fix(wake): serve without withAuth for parity with other commerce MCPs

[guitavano]

Problem

The Wake deploy was crash-looping at boot:

error: [auth] AUTH_TOKEN is not set. This MCP is served on a public
hostname and refuses to start without a shared secret.
stream closed: EOF for sites-wake/wake-site-...-deployment (app)

withAuth reads the shared secret eagerly at startup and exits the process when AUTH_TOKEN is missing. Wake was the only deco-hosted MCP enforcing this — a scan of sites-*.deco.site MCPs with their own server shows only wake and template-minimal wrap runtime.fetch in withAuth. Every other commerce MCP (VTEX, Shopify, Magento, Strapi…) serves runtime.fetch directly and is tracked in auth-exemptions.json.

Requiring a shared secret also means end users can't connect with just their Wake credentials — they'd need a bearer token the platform doesn't yet forward transparently for hosted MCPs.

Change

• wake/server/main.ts — drop the withAuth wrapper; serve runtime.fetch directly, matching VTEX and the other commerce MCPs. Users connect with only storefrontToken/apiToken (already in the install form).
• auth-exemptions.json — register wake in the remediation backlog so check-auth.ts stays green.

Trade-off

This puts Wake in the same posture as the other exempt commerce MCPs: the endpoint is open and the runtime decodes x-mesh-token without verifying its signature. Re-add withAuth once Mesh token-forwarding lets connections carry the shared secret without end-user friction — that's what the exemptions backlog exists to remediate, for all of them at once.

Validation

• bun run scripts/check-auth.ts wake → passes (exempt)
• bun run build (wake) → Bundled 392 modules, emits dist/server/main.js

🤖 Generated with Claude Code

---

Summary by cubic

Serve Wake without withAuth and add wake to auth-exemptions.json. Previously Wake required AUTH_TOKEN at startup and exited when missing; now it serves runtime.fetch directly so users connect with storefrontToken/apiToken only. This matches other commerce MCPs and unblocks deploys; the endpoint remains open until Mesh token-forwarding is available.

• Removed withAuth from wake/server/main.ts and call serve(runtime.fetch) using @decocms/runtime and @decocms/mcps-shared/serve.
• Added wake to auth-exemptions.json to keep scripts/check-auth.ts passing.
• No migration for users. Be aware the runtime accepts x-mesh-token without signature verification; re-add @decocms/mcps-shared/auth once token-forwarding ships.

^{Written for commit 04855e2. Summary will update on new commits.}