#269)

## Summary

Two related changes to give the monorepo a test quality baseline:

1. **Smoke tests for \`@readied/commands\`** (was 0 tests, now **13**) —
Covers all wrapping (bold/italic/strike/code) including unwrap behavior,
all line-prefix commands (headings, lists, checkbox, quote), and
block-insertion commands. Coverage: **78% lines** on \`commands.ts\`.

2. **v8 coverage wired into all 12 vitest configs** —
\`vitest.shared.ts\` exports a shared coverage block; each
\`vitest.config.ts\` spreads it. No thresholds enforced yet — baseline
measurement only.

## How the commands test works without a DOM

The package's commands take a \`CodeMirror.EditorView\` and call
\`view.dispatch\` / \`view.focus\`. A real view needs a DOM. Instead of
pulling in \`happy-dom\`, the tests fake a view backed by
\`EditorState.update()\`:

\`\`\`ts
function fakeView(initialDoc: string, selection: { from, to }) {
  let state = EditorState.create({ doc, selection: ... });
  const dispatch = vi.fn(spec => { state = state.update(spec).state; });
return { view: { get state(){return state;}, dispatch, focus: vi.fn() },
doc: () => state.doc.toString() };
}
\`\`\`

This is enough surface area for every exported command. No DOM, no
environment changes.

## Coverage setup

| File | Purpose |
|---|---|
| \`vitest.shared.ts\` | exports \`sharedCoverage\` — v8 provider,
text+lcov reporters, src/\*\* in, tests/dist/index out |
| 12× \`vitest.config.ts\` | imports \`sharedCoverage\`, applies under
\`test.coverage\` |
| \`package.json\` | adds \`@vitest/coverage-v8\` devDep +
\`test:coverage\` script |
| \`.gitignore\` | adds \`coverage/\` |

To run locally: \`pnpm test:coverage\`. CI integration (artifact upload
+ codecov) is a follow-up.

## Audit correction

The audit flagged 5 packages as having no tests: \`ai-assistant\`,
\`commands\`, \`licensing\`, \`mcp-server\`, \`product-config\`. On
inspection, only **commands** actually had no tests:

- \`ai-assistant\`: has \`src/aiCommandTypes.test.ts\`
- \`licensing\`: has 3 tests in \`__tests__/\`
- \`mcp-server\`: has \`src/__tests__/fts5-triggers.test.ts\` (from PR
#264)
- \`product-config\`: has \`__tests__/facade.test.ts\`

So this PR fills the one real gap and adds coverage infrastructure so
future gaps become visible.

## Test plan

- [x] \`pnpm test\` — 17/17 packages, all green.
- [x] \`pnpm -r typecheck\` — green.
- [x] \`pnpm --filter @readied/commands exec vitest run --coverage\` —
13/13 tests, 78% lines.
- [ ] \`pnpm test:coverage\` per package as needed locally.

## Stack context

**PR-D** in the audit stack. Stacked on top of #268 (PR-H) → #267 (PR-C)
→ #266 (PR-A) → #265 (PR-B). Retargets to \`develop\` automatically as
predecessors merge.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…270)

## Summary

Two changes in \`packages/mcp-server/src/index.ts\`:

### 1. \`server.tool()\` → \`server.registerTool()\` (MCP SDK 1.29)

All 7 call sites migrated:

| Tool | |
|---|---|
| \`readied_list_notes\` | ✅ |
| \`readied_read_note\` | ✅ |
| \`readied_create_note\` | ✅ |
| \`readied_update_note\` | ✅ |
| \`readied_search_notes\` | ✅ |
| \`readied_list_notebooks\` | ✅ |
| \`readied_trash_note\` | ✅ |

The old \`tool()\` overload is deprecated in
\`@modelcontextprotocol/sdk\` (TS6387 in the IDE). \`registerTool\`
takes a config object \`{description?, inputSchema?, outputSchema?,
annotations?, _meta?}\` instead of positional args, so future evolution
(output schemas, annotations) is additive without breaking changes.

### 2. \`readied_read_note\`: FTS5 title search, LIKE as fallback

The previous title search did \`title LIKE '%' || ? || '%'\` which:
- can't use any index (wildcard-prefix LIKE),
- has no relevance ranking.

New flow: build the FTS5 query via the existing \`prepareFtsQuery()\`
(same path as \`readied_search_notes\`), bm25-rank, take the top hit. If
FTS returns nothing (index rebuild in progress, freshly restored DB,
etc.), fall back to the parameterized LIKE on the live table so the tool
still works in degraded states.

\`\`\`ts
const ftsQuery = prepareFtsQuery(title);
note = queryOne(db,
  \`SELECT n.id, n.title, n.content, n.notebook_id
     FROM notes_fts JOIN notes n ON n.id = notes_fts.id
     WHERE notes_fts MATCH ? AND n.is_deleted = 0
     ORDER BY bm25(notes_fts) LIMIT 1\`,
  [ftsQuery]
);
if (!note) {
  // FTS index might not have caught up — fall back
note = queryOne(db, \`SELECT ... WHERE title LIKE '%' || ? || '%' ...\`,
[title]);
}
\`\`\`

## Test plan

- [x] \`pnpm --filter @readied/mcp-server build\` — clean.
- [x] \`pnpm --filter @readied/mcp-server test\` — 5/5 (the FTS5 trigger
test from #264 still passes).
- [ ] Manual: \`node packages/mcp-server/dist/index.js\` against a
Readied DB, then via Claude Code exercise each of the 7 tools.

## Stack context

**PR-J** in the audit stack. Stacked on top of #269 (PR-D) → #268 (PR-H)
→ #267 (PR-C) → #266 (PR-A) → #265 (PR-B). Retargets to \`develop\`
automatically as predecessors merge.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

## Summary

Promotes `develop` to `main` for **v0.15.0**. Originally opened
2026-04-24; now refreshed with the 19-PR tech-debt audit shipped via
#285 plus the accumulated dependabot bumps reconciled.

`semantic-release` will pick the version bump. Expected: **minor
(v0.14.x → v0.15.0)** because of multiple \`feat:\` commits.

## What ships (audit highlights, from #285)

### Runtime fixes (user-facing)
- **Editor no longer crashes on table-containing notes** (#266) —
\`Decoration.replace\` over multi-line ranges moved from a ViewPlugin to
a StateField, plus an EditorView.exceptionSink so any future plugin
error no longer tears down the EditorView.
- **AI keys survive sleep/wake** (#275) — \`aiKeyStorage\` stopped
silently deleting the encrypted store when the keychain was temporarily
locked after macOS sleep.
- **Backup restore is now safe** (#271) — restored DBs go through
\`PRAGMA integrity_check\` before being swapped in; corrupt backups roll
back to the safety copy.
- **MCP server runs without electron-builder rebuilds** (#264 → #270) —
migrated from native \`better-sqlite3\` to built-in \`node:sqlite\`
(Node 22.5+), updated to the new \`registerTool\` MCP SDK API.

### Security
- **Typed IPC boundary** (#272 + #273 + #274) — 130+ IPC channels now
validated with Zod tuples at the main↔renderer boundary. Garbage in
fails fast with \`IpcValidationError\` instead of corrupting downstream
code.
- **Ed25519 license verification scaffolding** (#276 + #281 + #284) —
\`signSubscriptionPayload\` / \`verifySubscriptionSignature\` helpers
ship in \`@readied/licensing\`, wired into
\`FileLicenseStorage.readSubscriptionData\` with lenient fallthrough
during migration. Real public key embedded (\`d04901…\`). Server-side
\`LICENSE_SIGNING_PRIVATE_KEY\` already set in Cloudflare staging +
production.

### Developer experience
- **Husky → Lefthook** (#267) plus lint-staged that now runs ESLint, not
just Prettier.
- **\`knip\` added** (#267) + 12 unused files deleted (#279) + 6 unused
deps dropped (#280).
- **Playwright Electron E2E scaffold** (#277) with smoke + notes-IPC
specs and a Linux+xvfb CI job (\`continue-on-error: true\` while it
stabilises).
- **Vitest coverage baseline** (#269) — 12 packages share a coverage
config; smoke tests added for \`@readied/commands\`.

### Refactor (no behavior change)
- **Zustand selectors migration** (#268) — 3 components stopped
destructuring entire stores.
- **God-file extractions**:
- \`main/index.ts\` 1065 → 950 lines (#278) — \`FileLicenseStorage\`,
\`windowState\` extracted to services
- \`SQLiteNoteRepository.ts\` 1121 → 1038 lines (#282) — pure helpers
extracted to \`noteMapping.ts\`
- \`MarkdownEditor.tsx\` 737 → 612 lines (#283) — theme +
markdownHighlighting extracted to \`editorTheme.ts\`

## Deploys triggered

| Workflow | Trigger | What happens |
|---|---|---|
| \`deploy-api.yml\` | Auto on \`push\` to main affecting
\`packages/api/**\` | Tests + deploys \`@readied/api\` to Cloudflare
Workers (\`readied-api-production\`). This stack only touched
\`wrangler.toml\` + \`.dev.vars\` docs, no production code change. |
| \`release.yml\` | Manual \`workflow_dispatch\` post-merge |
\`semantic-release\` analyses conventional commits, bumps version,
creates GitHub Release draft + tag |
| \`build.yml\` | Auto on tag push from release.yml | mac / windows /
linux parallel builds, artefacts attached to the GitHub Release |

## Pre-merge verification (local, this branch)

- ✅ \`pnpm -r typecheck\` — green across 18 workspace projects
- ✅ \`pnpm test\` — 17/17 packages
- ✅ Merge resolved: take develop versions for 19 conflicted
package.jsons (develop has equal or newer deps than main's dependabot
bumps)

## Post-merge action items (operator)

1. **Deploy API to staging first** (smoke test):
   \`\`\`
   gh workflow run deploy-api.yml -f environment=staging
   \`\`\`
2. Confirm staging API responds correctly (subscription endpoint with
new \`LICENSE_SIGNING_PRIVATE_KEY\` secret already set in CF).
3. Merge this PR → auto-deploys API to production.
4. Trigger Release workflow: GitHub → Actions → Release → "Run workflow"
→ main.
5. Watch Build workflow for mac/win/linux completion.
6. Confirm the release un-drafts itself.

## Known risks / follow-ups

- **Pre-existing Vercel preview failure for \`apps/web\`** — marketing
site, scheduled to be extracted to its own repo (P3 in the roadmap).
- **\`SUBSCRIPTION_PUBLIC_KEY\` is dev-grade** — generated in a Claude
session. Before the licensing server emits envelopes for real paid
users, rotate the keypair from a trusted machine and ship a follow-up
release.
- **Branch protection should require CodeRabbit completion before
automerge** — added to the roadmap as a process item; this very PR was
BLOCKED correctly because of that policy gap being closed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>