feat(training-agent): wire accounts.upsert on all v6 tenants — billing gates flow through per-tenant routes

[bokelley]

Summary

Tier-3 follow-up to #3851 (BILLING_NOT_SUPPORTED + BILLING_NOT_PERMITTED_FOR_AGENT gates). Closes the gap that left sync_accounts exposed only on the deprecated legacy /mcp route — gates now fire on every per-tenant route at /api/training-agent/<tenant>/mcp (sales / signals / governance / creative / creative-builder / brand).

Unblocked by SDK 6.7.0's accounts.upsert(refs, ctx) ctx-forwarding (originally filed at adcontextprotocol/adcp-client#1310, shipped as Phase 1 of #1269).

What landed

1. Shared helper (v6-account-helpers.ts) — single syncAccountsUpsert const that delegates to the existing v5 handleSyncAccounts. Capability + per-buyer-agent gate semantics are identical on v6 and legacy paths.

2. All six v6 tenant platforms wire the helper — accounts.upsert: syncAccountsUpsert on each platform's AccountStore. Framework auto-registers sync_accounts as a tool on every per-tenant route now that upsert is defined.

3. Tenant router auth bridge (tenants/router.ts) — bridges res.locals.trainingPrincipal (set by the conductor's bearer-auth middleware, upstream of the framework) onto req.auth.{token, clientId, scopes} so the SDK framework surfaces it as ctx.authInfo.clientId to platform handlers. Without this bridge the framework runs without auth context — the conductor's auth middleware doesn't otherwise propagate into the framework's MCP transport. Shape mirrors serve.js attachAuthInfo verbatim (token: '', scopes: []).

4. Integration test (tenants/sync-accounts-gates.test.ts) — boots the real tenant router, sends real HTTP, asserts:

   • Per-agent gate fires on /sales/mcp with the clamped error.details shape (rejected + suggested billing only).
   • Autonomous recovery via suggested_billing succeeds.
   • Agent-billable bearer accepts all three values.
   • Uniform-response rule for unrecognized principals holds.
   • it.each smoke over all six v6 tenant routes confirms the gate fires symmetrically.

Reviewed by

code-reviewer. Three SHOULD FIX findings addressed before opening:

• Multi-tenant test coverage (originally only /sales/mcp; now covers all six via it.each).
• SSE/JSON parser disambiguation (Accept header pinned to JSON-only; SSE branch removed).
• Stale "spike" comment in v6-platform.ts updated to reflect the canonical ctx.authInfo.clientId path.

Plus two cheap NICE TO HAVE: token: '' on the auth bridge to match serve.js verbatim; a doc note on the refs as unknown[] cast assuming v5/v6 AccountReference wire compatibility.

Verified end-to-end

• npx vitest run server/src/training-agent/tenants/sync-accounts-gates.test.ts → 10/10 pass (4 base + 6 per-tenant smoke).
• npx vitest run server/tests/unit/account-handlers.test.ts → 22/22 pass (feat(training-agent): implement BILLING_NOT_SUPPORTED + BILLING_NOT_PERMITTED_FOR_AGENT gates #3851 regression).
• Full server suite → 3133 passed, 42 skipped, 0 failed.
• tsc --noEmit → clean.

Phase 2 migration path

When BuyerAgentRegistry framework-level enforcement lands (Phase 2 of adcp-client #1269), commercial-relationships.ts becomes a BuyerAgentRegistry.bearerOnly adapter, the framework reads ctx.agent.billing_capabilities directly, and syncAccountsUpsert's gate-replay-via-handleSyncAccounts goes away. Tracked alongside adcp-client#1310 follow-ups.

🤖 Generated with Claude Code