create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/services/project-listings.ts

@@ -1,4 +1,11 @@
 /**
+ * NOT marked `oss: false` (D-48/#5366 escalation — see
+ * `routes/project-listings/me.ts`'s header comment): imported by
+ * `routes/project-listings/{start,patch-draft,submit,public,me}.ts`, each of
+ * which ships unconditionally because `routes/project-listings/index.ts`'s
+ * multi-tenant literal `import()` forces it. Registration of the routes that
+ * call into this service stays gated (`isModuleEnabled("signal-collectors")`).
+ *
  * @file project-listings.ts
  * @description The founder's-application-row service (#4998, reshaped by
  * #5036) — writes, reads, and transitions `ProjectListing` (ADR 0009 D3
@@ -43,6 +50,7 @@ import {
   buildProjectListingDraftPatchSchema,
   buildProjectListingSubmitSchema,
   composeAddressLine,
+  composeFounderName,
   flowAddressValueSchema,
   publicSiteAnswers,
   PROJECT_LISTING_CONCURRENT_LIMIT,
@@ -230,7 +238,13 @@ const PROJECT_LISTING_SELECT = {
   siteAnswers: true,
   windowDays: true,
   founderName: true,
+  // #5407 — the name parts beside the composed display string, the phone, and
+  // the resume-link verification stamp.
+  founderFirstName: true,
+  founderLastName: true,
   founderEmail: true,
+  founderPhone: true,
+  emailVerifiedAt: true,
   founderCompany: true,
   headline: true,
   logoMarkUrl: true,
@@ -357,7 +371,13 @@ function toResponseRow(
     address: row.address,
     addressParts: addressPartsFromRow(row),
     founderName: row.founderName,
+    founderFirstName: row.founderFirstName,
+    founderLastName: row.founderLastName,
     founderEmail: row.founderEmail,
+    founderPhone: row.founderPhone,
+    // #5407 — the operator's verification filter at review. Null means "no
+    // opening of the resume link recorded", never "verification failed".
+    emailVerifiedAt: row.emailVerifiedAt ? row.emailVerifiedAt.toISOString() : null,
     founderCompany: row.founderCompany,
     questions: row.questions as unknown as ProjectListingQuestions | null,
     logoMarkUrl: row.logoMarkUrl,
@@ -489,6 +509,42 @@ function hashResumeToken(token: string): string {
   return createHash("sha256").update(token).digest("hex");
 }
 
+// ─── The email-verification nonce (#5407) ──────────────────────────────────
+
+/**
+ * Mint the nonce that PROVES the founder read mail sent to `founderEmail`.
+ *
+ * WHY A SECOND CREDENTIAL EXISTS AT ALL, since the obvious design is to reuse
+ * the resume token the emailed link already carries. That design cannot work:
+ * `start` returns the resume token in its own 201 body, to whoever posted the
+ * form. The emailed link is a SECOND COPY of a credential the applicant
+ * already holds, so keying verification on it would let two HTTP calls — open
+ * a draft under a stranger's address, take the token out of the response,
+ * present it back — forge the stamp with no mailbox involved. Found by this
+ * change's own security review, before it shipped.
+ *
+ * This nonce closes that because of where it does NOT go. It is minted here,
+ * digested into `emailVerifyNonceHash`, and returned to exactly one caller —
+ * `start`, which hands it to `sendListingResumeLink` and to nothing else. It
+ * is in no response body, no log line, and no browser that filled the form.
+ * The only way to hold it is to have read the email.
+ *
+ * Same 256 bits as the resume token, for the same reason.
+ */
+function mintVerifyNonce(): string {
+  return randomBytes(RESUME_TOKEN_BYTES).toString("base64url");
+}
+
+/**
+ * What `emailVerifyNonceHash` holds. The same plain sha-256 as
+ * `hashResumeToken`, for the same reason — the input is CSPRNG output, not a
+ * human-chosen secret — and kept as its own function rather than aliased so
+ * no call site has to read "resume token" while meaning the nonce.
+ */
+function hashVerifyNonce(nonce: string): string {
+  return createHash("sha256").update(nonce).digest("hex");
+}
+
 /**
  * Resolve the ONE draft a token grants access to (#5036 D1).
  *
@@ -532,6 +588,19 @@ export type StartProjectListingDraftResult =
       ok: true;
       id: string;
       resumeToken: string;
+      /**
+       * #5407 — the email-verification nonce, for the RESUME-EMAIL BUILDER
+       * and for nothing else.
+       *
+       * A sibling of the result rather than a field of anything the route
+       * hands to a response schema, deliberately (lesson 05): `start`'s 201
+       * body is `projectListingStartResponseSchema`, which is `.strict()` and
+       * carries `id` and `resumeToken` only. That route's request and
+       * response shapes are a declared hard floor and are unchanged — this
+       * value reaches `sendListingResumeLink` from the route's local
+       * variable and never touches the wire.
+       */
+      verifyNonce: string;
     }
   | { ok: false; error: { kind: "invalid_input"; message: string } };
 
@@ -557,7 +626,14 @@ export async function startProjectListingDraft(
   siteId: string,
   input: ProjectListingStartInput,
 ): Promise<StartProjectListingDraftResult> {
-  const { founderName, requestedWindowDays } = input;
+  const { requestedWindowDays } = input;
+  // #5407 — the NOT NULL display column. `composeFounderName` builds it from
+  // the PARTS wherever both are written (even beside a `founderName` the body
+  // also sent, so the stored line and the stored parts can never disagree),
+  // and stores a line sent on its own verbatim. ONE WAY ONLY: nothing here or
+  // anywhere else derives parts back out of a line. The schema has already
+  // refused a body carrying neither shape, so this always produces a string.
+  const founderName = composeFounderName(input);
   const founderEmail = normalizeFounderEmail(input.founderEmail);
 
   const listingConfig = await listingConfigFor(siteId);
@@ -590,6 +666,13 @@ export async function startProjectListingDraft(
   }
 
   const resumeToken = mintResumeToken();
+  // #5407 — minted on EVERY draft, whether or not the site sends the resume
+  // email. `start` cannot know: the send is decided asynchronously inside
+  // `sendListingResumeLink`, against the site's own config. A site running no
+  // resume email therefore stores a nonce nobody is ever handed, and nothing
+  // on that row can ever verify — which is the correct outcome rather than a
+  // gap, because no one has read anything at that address.
+  const verifyNonce = mintVerifyNonce();
   // #5275 — the row and its grant record land in ONE transaction: from here
   // on `consentAt` and the ConsentGrant row are stamped by the SAME
   // affirmative act, and a grant write that fails takes the row with it
@@ -606,10 +689,21 @@ export async function startProjectListingDraft(
       data: {
         siteId,
         founderName,
+        // #5407 — the parts as sent, beside the composed line. Absent where a
+        // caller sent only a display line, which is the shape every row
+        // written before #5407 carries; nothing here ever splits that line.
+        ...(input.founderFirstName !== undefined && {
+          founderFirstName: input.founderFirstName,
+        }),
+        ...(input.founderLastName !== undefined && {
+          founderLastName: input.founderLastName,
+        }),
         founderEmail,
+        ...(input.founderPhone !== undefined && { founderPhone: input.founderPhone }),
         status: "draft",
         consentAt: new Date(),
         resumeTokenHash: hashResumeToken(resumeToken),
+        emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
         windowDays,
       },
       select: { id: true },
@@ -623,7 +717,120 @@ export async function startProjectListingDraft(
     return created;
   });
 
-  return { ok: true, id: row.id, resumeToken };
+  return { ok: true, id: row.id, resumeToken, verifyNonce };
+}
+
+// ─── verify-email (POST, anonymous, nonce-gated) ───────────────────────────
+
+/**
+ * THE NONCE HAS NO EXPIRY, and shares the resume token's lifetime exactly: it
+ * lives until `submit` clears both digests, and an unsubmitted draft is never
+ * swept (`DRAFT_HOLDS_A_SLOT_DAYS` bounds the QUOTA a draft occupies, not the
+ * row). A resume email sitting in a mailbox for a year still verifies that
+ * draft a year later.
+ *
+ * That is acceptable rather than overlooked, and for one reason: the same
+ * message carries the resume token, so anyone who can read it can already
+ * resume and submit the draft outright. A TTL would have to cover both
+ * credentials to mean anything, and that is a change to #5048's resume
+ * contract rather than to this column.
+ *
+ * It is also NOT cleared on a successful stamp — the fallback read below
+ * needs it to answer a repeat call idempotently.
+ */
+export type VerifyProjectListingDraftEmailResult =
+  | { ok: true; value: { id: string; emailVerifiedAt: Date } }
+  | { ok: false; error: { kind: "not_found"; message: string } };
+
+/**
+ * Record that somebody who can read mail at `founderEmail` opened this
+ * draft's emailed link (#5407).
+ *
+ * THE PRECISION IN THAT SENTENCE IS DELIBERATE. It is evidence about the
+ * ADDRESS, not about the person driving the draft. Whoever posted `start`
+ * chose the address and holds the resume token, so an attacker can open a
+ * draft under a stranger's address and the platform will mail that stranger a
+ * link; if they click it, the attacker's draft is stamped. Binding the stamp
+ * to the application's CONTENT, or to `ownerUserId`, is what would close that,
+ * and neither is in this issue. What the stamp rules out is the case it was
+ * built for: a stamp obtained with no mailbox involved at all.
+ *
+ * WHAT IT PROVES, and why it takes TWO credentials. The caller must present
+ * both the draft's resume token and its verification NONCE, and only the
+ * second one carries the proof:
+ *
+ *   - the RESUME TOKEN says "you opened this draft". `start` returns it in
+ *     its own 201 body, so anyone who posted the form has it. On its own it
+ *     proves nothing about an address, and a design that stamped on it alone
+ *     would be forgeable in two HTTP calls — open a draft under a stranger's
+ *     address, take the token out of the response, present it back. That is
+ *     the design this one replaced, caught by its own security review.
+ *   - the NONCE says "you read mail sent to `founderEmail`". It is minted at
+ *     `start`, digested onto the row, and handed to nothing but
+ *     `sendListingResumeLink`. It is in no response body and no log line, and
+ *     the only place it exists outside this server is the `?verify=`
+ *     parameter of the link inside the email.
+ *
+ * The token stays in the guard anyway: it costs one term in a `where` and it
+ * means a nonce that somehow leaked alone still opens nothing.
+ *
+ * What it does NOT say is who the founder is. `ownerUserId` (#5295) is the
+ * column that carries an identity claim and still needs a signed-in user
+ * whose own address the auth system verified.
+ *
+ * WRITE-ONCE, BY COMPARE-AND-SWAP. `emailVerifiedAt: null` is in the `where`,
+ * so the stamp is the atomic transition and two concurrent openings of the
+ * same link produce one stamp between them rather than a last-writer-wins
+ * race. A repeat opening reads back the FIRST stamp, so the call is
+ * idempotent in its effect and in its answer. It is not indistinguishable —
+ * a repeat answers an older timestamp than "now" — and does not need to be:
+ * only a holder of both credentials can make the call at all, and they are
+ * the one person entitled to know when their own link was first opened.
+ *
+ * ONE ANSWER FOR EVERY FAILURE. A wrong token, a wrong nonce, a credential
+ * bound to a different listing, an unknown id and an already-submitted row
+ * are all `not_found` — exactly what `patch` and `submit` answer. The
+ * anonymous surface must not distinguish "exists but not yours" from "does
+ * not exist", and a verification route least of all: its whole input is a
+ * guessable-in-principle id and two secrets, so a distinguishable response
+ * would turn it into an oracle for which drafts exist and, worse, into a
+ * nonce-guessing feedback channel.
+ *
+ * Neither credential is ever logged, returned, or compared in application
+ * code — only their sha-256 digests reach the query.
+ */
+export async function verifyProjectListingDraftEmail(
+  id: string,
+  resumeToken: string,
+  verifyNonce: string,
+): Promise<VerifyProjectListingDraftEmailResult> {
+  const guard = {
+    id,
+    status: "draft",
+    resumeTokenHash: hashResumeToken(resumeToken),
+    emailVerifyNonceHash: hashVerifyNonce(verifyNonce),
+  };
+  const emailVerifiedAt = new Date();
+
+  const stamped = await prisma.projectListing.updateMany({
+    where: { ...guard, emailVerifiedAt: null },
+    data: { emailVerifiedAt },
+  });
+  if (stamped.count > 0) return { ok: true, value: { id, emailVerifiedAt } };
+
+  // Zero rows means one of two things, and they answer differently: the draft
+  // is already stamped (idempotent success, carrying the FIRST stamp), or the
+  // credentials do not open this draft (`not_found`). This read is what tells
+  // them apart, and it is gated by the same four terms the write was — so it
+  // cannot report a draft the caller's credentials do not open.
+  const row = await prisma.projectListing.findFirst({
+    where: guard,
+    select: { id: true, emailVerifiedAt: true },
+  });
+  if (row?.emailVerifiedAt) {
+    return { ok: true, value: { id: row.id, emailVerifiedAt: row.emailVerifiedAt } };
+  }
+  return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
 }
 
 // ─── patch (PATCH, anonymous, token-gated) ──────────────────────────────────
@@ -1010,7 +1217,15 @@ export async function submitProjectListingDraft(
     try {
       const updated = await prisma.projectListing.updateMany({
         where: { id, status: "draft" },
-        data: { status: "requested", slug: candidate, resumeTokenHash: null },
+        // #5407 — the verification nonce is cleared here too, for the reason
+        // the resume-token digest is: a credential that leaks after the draft
+        // stops being a draft is inert twice over.
+        data: {
+          status: "requested",
+          slug: candidate,
+          resumeTokenHash: null,
+          emailVerifyNonceHash: null,
+        },
       });
       return updated.count;
     } catch (err) {
@@ -1451,7 +1666,17 @@ export async function publicProjectListings(siteId: string): Promise<ProjectList
 
   const now = new Date();
   return [...top3, ...rest].map(({ row, waitlistCount }) => {
-    const { founderEmail: _founderEmail, ...publicRow } = toResponseRow(
+    // #5407 — `founderPhone` and `emailVerifiedAt` leave here with
+    // `founderEmail`. `projectListingPublicSchema` omits all three and
+    // `sendValidated` re-parses `.strict()`, so a key that stopped being
+    // dropped here would 500 the public read rather than quietly publishing a
+    // founder's phone number — which is the failure mode worth having.
+    const {
+      founderEmail: _founderEmail,
+      founderPhone: _founderPhone,
+      emailVerifiedAt: _emailVerifiedAt,
+      ...publicRow
+    } = toResponseRow(
       row,
       waitlistCount,
       now,

package/templates/apps/api/src/vercel-handler.ts

@@ -31,39 +31,70 @@ async function getBuildFunction(): Promise<typeof buildServer> {
 
 // Initialize build function
 const buildPromise = getBuildFunction();
-let serverInstance: FastifyServer | null = null;
 
 /**
- * Get or create the Fastify server instance
+ * The in-flight (or settled) build. Caching the PROMISE rather than the
+ * resolved instance is what makes this safe: a warm Vercel container serves
+ * concurrent invocations on one Node process, and the old check-then-set
+ * (`if (!serverInstance)` followed by two awaits before the assignment) let
+ * two requests arriving during a cold start both see null and both construct
+ * a complete Fastify server — every plugin registered, every route wired, the
+ * Prisma client initialised — with one of the two then discarded. Nothing
+ * failed; the only symptoms were cold-start latency and memory (#5332).
  */
-async function getServer() {
-  if (!serverInstance) {
-    logger.info('[Vercel Handler] Building server instance...');
-    const startTime = Date.now();
-
-    try {
-      const buildTimeout = new Promise<never>((_, reject) => {
-        setTimeout(() => reject(new Error('Server build timeout after 10s')), 10000);
-      });
+let serverPromise: Promise<FastifyServer> | null = null;
 
-      const build = await Promise.race([buildPromise, buildTimeout]);
-      logger.info('[Vercel Handler] Build function obtained, creating server...');
+async function buildServerInstance(): Promise<FastifyServer> {
+  logger.info('[Vercel Handler] Building server instance...');
+  const startTime = Date.now();
 
-      const initTimeout = new Promise<never>((_, reject) => {
-        setTimeout(() => reject(new Error('Server initialization timeout after 10s')), 10000);
-      });
+  try {
+    const buildTimeout = new Promise<never>((_, reject) => {
+      setTimeout(() => reject(new Error('Server build timeout after 10s')), 10000);
+    });
 
-      serverInstance = await Promise.race([build(), initTimeout]);
+    const build = await Promise.race([buildPromise, buildTimeout]);
+    logger.info('[Vercel Handler] Build function obtained, creating server...');
 
-      const buildTime = Date.now() - startTime;
-      logger.info({ buildTime }, '[Vercel Handler] Server built successfully');
-    } catch (error) {
-      const buildTime = Date.now() - startTime;
-      logger.error({ err: error, buildTime }, '[Vercel Handler] Failed to build server');
-      throw new Error(`Server build failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-    }
+    const initTimeout = new Promise<never>((_, reject) => {
+      setTimeout(() => reject(new Error('Server initialization timeout after 10s')), 10000);
+    });
+
+    const serverInstance = await Promise.race([build(), initTimeout]);
+
+    const buildTime = Date.now() - startTime;
+    logger.info({ buildTime }, '[Vercel Handler] Server built successfully');
+    return serverInstance;
+  } catch (error) {
+    const buildTime = Date.now() - startTime;
+    logger.error({ err: error, buildTime }, '[Vercel Handler] Failed to build server');
+    throw new Error(`Server build failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
   }
-  return serverInstance;
+}
+
+/**
+ * Get or create the Fastify server instance
+ */
+function getServer(): Promise<FastifyServer> {
+  if (serverPromise) {
+    return serverPromise;
+  }
+
+  const attempt = buildServerInstance();
+  serverPromise = attempt;
+  // Evict a FAILED build from the cache so the next invocation retries —
+  // a rejected promise left in place would serve every later request the
+  // same cold-start failure for the life of the container. The guard keeps
+  // this from clearing a newer attempt; `attempt` is returned as-is, so the
+  // rejection still reaches the caller (this handler only silences the
+  // unhandled-rejection warning on its own bookkeeping branch).
+  attempt.catch(() => {
+    if (serverPromise === attempt) {
+      serverPromise = null;
+    }
+  });
+
+  return attempt;
 }
 
 /**
@@ -156,9 +187,12 @@ export default async function handler(
     logger.error({ err: error }, '[Vercel Handler] Error handling request');
 
     if (!res.headersSent) {
+      // Generic body only (security review on #146): this catch sits above
+      // Fastify's error serializer, so error.message could carry hosts,
+      // paths, or driver detail. The logger.error above keeps the detail.
       res.status(500).json({
         error: 'Internal Server Error',
-        message: error instanceof Error ? error.message : String(error),
+        message: 'Something went wrong on our end.',
       });
     }
   }

package/templates/apps/mcp/.env.example

@@ -40,6 +40,14 @@ MCP_RATE_LIMIT_WRITE_PER_MIN=10
 # Example: https://app.yourdomain.com,https://other.yourdomain.com
 MCP_CORS_WRITE_ALLOWED_ORIGINS=
 
+# ── Paid modules (D-44, #5368) ──────────────────────────────────────────────────
+
+# Comma-separated allowlist of installed paid modules, e.g.
+# "multi-tenant,scheduling". Unset (the default) or "" means NO paid modules
+# — installed modules enable themselves explicitly. Recognized keys: docs,
+# multi-tenant, scheduling, content-write. Must match apps/api's value.
+# AILK_ENABLED_MODULES=
+
 # ── Abuse protection ───────────────────────────────────────────────────────────
 
 # Maximum number of capture_lead submissions per IP per day.

package/templates/apps/mcp/CLAUDE.md

@@ -25,8 +25,8 @@ Every tool maps 1:1 to an `apps/api` endpoint. When you change a tool, change th
 **Read (9):** `list_pages`, `read_content`, `search_content`, `get_site_info`, `get_business_hours`, `get_locations`, `get_offerings`, `get_pricing`, `get_faq`
 **Conversion-write (3):** `capture_lead`, `subscribe_newsletter`, `request_callback`
 **Maintenance (2):** `audit`, `scaffold`
-**Flow (2):** `get_flow`, `submit_flow_step`
-**Booking (3):** `list_availability`, `get_event_meta`, `create_booking`
+**Flow (2):** `get_flow`, `submit_flow_step` — module-gated (`module: "signal-collectors"`, D-48, #5366): identity-blind and free of any `requirePaidTier()` call like every tool in this list, but registered only when the signal-collectors module is present, the same shape Booking below already has
+**Booking (3):** `list_availability`, `get_event_meta`, `create_booking` — module-gated (`module: "scheduling"`)
 
 ### Why the catalog reports 23 and the server registers 22
 

package/templates/apps/mcp/__tests__/catalog-drift.test.ts

@@ -24,7 +24,28 @@ interface RegisteredTool {
   description?: string;
 }
 
+// The catalog includes module-gated tools (scheduling, content-write,
+// signal-collectors); an unset AILK_ENABLED_MODULES no longer registers them
+// by default (D-44, #5368), so this drift check enables every paid module
+// explicitly — it is comparing the full catalog, not what a default build
+// registers.
+const PAID_MODULES = "scheduling,content-write,signal-collectors";
+
 describe("MCP catalog ↔ server drift", () => {
+  const priorEnabledModules = process.env.AILK_ENABLED_MODULES;
+
+  beforeEach(() => {
+    process.env.AILK_ENABLED_MODULES = PAID_MODULES;
+  });
+
+  afterAll(() => {
+    if (priorEnabledModules === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = priorEnabledModules;
+    }
+  });
+
   it("registered tool names equal catalog tool names", () => {
     const server = createMcpServer();
     const registered = (

package/templates/apps/mcp/__tests__/config/modules.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `isModuleEnabled()` default-flip regression test (D-44, #5368).
+ *
+ * Mirrors `apps/api/src/config/__tests__/modules.test.ts` — apps/* may not
+ * import apps/*, so this reader (and its test) are duplicated rather than
+ * shared. Proves the mechanical claim #5368 exists to make true: an UNSET
+ * `AILK_ENABLED_MODULES` now gates every paid module OFF, the same as an
+ * explicit empty string — only an explicit allowlist turns modules on, and
+ * turns on exactly the modules it names.
+ *
+ * Reverting `enabledModules()`'s unset branch back to the `undefined`
+ * sentinel (S1, #5088's original shape) makes the "unset" cases below fail
+ * RED — see #5368 verification notes.
+ */
+
+import { isModuleEnabled } from "../../src/config/modules.js";
+
+const RECOGNIZED_MODULES = [
+  "docs",
+  "multi-tenant",
+  "scheduling",
+  "content-write",
+] as const;
+
+describe("isModuleEnabled", () => {
+  const originalEnv = process.env.AILK_ENABLED_MODULES;
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = originalEnv;
+    }
+  });
+
+  describe("AILK_ENABLED_MODULES unset", () => {
+    it.each(RECOGNIZED_MODULES)("returns false for %s", (moduleName) => {
+      delete process.env.AILK_ENABLED_MODULES;
+      expect(isModuleEnabled(moduleName)).toBe(false);
+    });
+  });
+
+  describe('AILK_ENABLED_MODULES=""', () => {
+    it.each(RECOGNIZED_MODULES)("returns false for %s", (moduleName) => {
+      process.env.AILK_ENABLED_MODULES = "";
+      expect(isModuleEnabled(moduleName)).toBe(false);
+    });
+  });
+
+  describe("AILK_ENABLED_MODULES as an explicit allowlist", () => {
+    it.each(RECOGNIZED_MODULES)(
+      "enables exactly the listed modules — %s on when named",
+      (moduleName) => {
+        process.env.AILK_ENABLED_MODULES = moduleName;
+        expect(isModuleEnabled(moduleName)).toBe(true);
+        for (const other of RECOGNIZED_MODULES) {
+          if (other === moduleName) continue;
+          expect(isModuleEnabled(other)).toBe(false);
+        }
+      },
+    );
+
+    it("enables every module named in a comma list, and no others", () => {
+      process.env.AILK_ENABLED_MODULES = "multi-tenant,scheduling";
+      expect(isModuleEnabled("multi-tenant")).toBe(true);
+      expect(isModuleEnabled("scheduling")).toBe(true);
+      expect(isModuleEnabled("docs")).toBe(false);
+      expect(isModuleEnabled("content-write")).toBe(false);
+    });
+
+    it("trims whitespace and drops empty entries, same as before the flip", () => {
+      process.env.AILK_ENABLED_MODULES = " multi-tenant , , scheduling ";
+      expect(isModuleEnabled("multi-tenant")).toBe(true);
+      expect(isModuleEnabled("scheduling")).toBe(true);
+      expect(isModuleEnabled("docs")).toBe(false);
+    });
+  });
+});

package/templates/apps/mcp/__tests__/module-exclusion.test.ts

@@ -18,7 +18,7 @@ import { getMcpToolRegistrations } from "@working-theory/metadata";
 
 import { createMcpServer, listRegisteredTools } from "../src/server.js";
 
-const PAID_MODULES = ["scheduling", "content-write"] as const;
+const PAID_MODULES = ["scheduling", "content-write", "signal-collectors"] as const;
 
 function withEnabledModules<T>(enabled: string, fn: () => T): T {
   const prior = process.env.AILK_ENABLED_MODULES;

package/templates/apps/mcp/src/config/modules.ts

@@ -1,26 +1,29 @@
 /**
  * Paid-module presence — the registration-grain signal used by `server.ts`
  * to decide whether a paid module's tools are wired into this build
- * (S1, #5088). Mirrors `apps/api/src/config/modules.ts` — apps/* may not
- * import apps/*, so this tiny reader is duplicated rather than shared.
+ * (S1, #5088; defaulted off by D-44, #5368). Mirrors
+ * `apps/api/src/config/modules.ts` — apps/* may not import apps/*, so this
+ * tiny reader is duplicated rather than shared.
  *
  * `AILK_ENABLED_MODULES` is a comma-separated allowlist (e.g.
- * `"multi-tenant,scheduling"`). Unset means "every module on" — today's
- * behavior, unchanged for every existing deployment; an explicit empty
- * string (`""`) means "no paid modules" (the OSS-strip build target).
+ * `"multi-tenant,scheduling"`). Unset means **no paid modules** — installed
+ * modules enable themselves explicitly; an explicit empty string (`""`)
+ * means the same (the OSS-strip build target); a list enables exactly the
+ * modules it names.
  *
- * Recognized module keys: `docs`, `multi-tenant`, `scheduling` (the
- * `ModuleName` vocabulary `packages/create-ailk/src/module-architecture.ts`
- * already models via `MODULE_SLICES`) plus `content-write` — the Pro
+ * Recognized module keys: `docs`, `multi-tenant`, `scheduling`,
+ * `signal-collectors` (the `ModuleName` vocabulary
+ * `packages/create-ailk/src/module-architecture.ts` already models via
+ * `MODULE_SLICES`) plus `content-write` — the Pro
  * content-write surface (`create_page`/`update_page`/`delete_page`).
  * `content-write` is intentionally NOT a `MODULE_SLICES` entry: it is not
  * (yet) a create-ailk `--modules` selector, so it stays a local flag here
  * rather than widening the create-ailk module vocabulary.
  */
 
-function enabledModules(): Set<string> | undefined {
+function enabledModules(): Set<string> {
   const raw = process.env.AILK_ENABLED_MODULES;
-  if (raw === undefined) return undefined; // undefined sentinel = "all enabled"
+  if (raw === undefined) return new Set(); // unset = no paid modules
   return new Set(
     raw
       .split(",")
@@ -31,7 +34,5 @@ function enabledModules(): Set<string> | undefined {
 
 /** Whether the named paid module's tools should register on this build/boot. */
 export function isModuleEnabled(moduleName: string): boolean {
-  const enabled = enabledModules();
-  if (enabled === undefined) return true;
-  return enabled.has(moduleName);
+  return enabledModules().has(moduleName);
 }

package/templates/apps/mcp/src/server.ts

@@ -20,7 +20,6 @@ import { ailkAudit } from "./tools/audit.js";
 import { ailkCaptureLead } from "./tools/capture_lead.js";
 import { ailkGetBusinessHours } from "./tools/get_business_hours.js";
 import { ailkGetFaq } from "./tools/get_faq.js";
-import { ailkGetFlow } from "./tools/get_flow.js";
 import { ailkGetLocations } from "./tools/get_locations.js";
 import { ailkGetOfferings } from "./tools/get_offerings.js";
 import { ailkGetPricing } from "./tools/get_pricing.js";
@@ -31,7 +30,6 @@ import { ailkReadContent } from "./tools/read_content.js";
 import { ailkRequestCallback } from "./tools/request_callback.js";
 import { ailkScaffold } from "./tools/scaffold.js";
 import { ailkSearchContent } from "./tools/search_content.js";
-import { ailkSubmitFlowStep } from "./tools/submit_flow_step.js";
 import { ailkSubscribeNewsletter } from "./tools/subscribe_newsletter.js";
 
 /**
@@ -65,8 +63,6 @@ const HANDLERS: Record<string, (input: unknown) => Promise<unknown>> = {
   subscribe_newsletter: (input) => ailkSubscribeNewsletter(input as never),
   request_callback: (input) => ailkRequestCallback(input as never),
   scaffold: (input) => ailkScaffold(input as never),
-  get_flow: (input) => ailkGetFlow(input as never),
-  submit_flow_step: (input) => ailkSubmitFlowStep(input as never),
 };
 
 type ToolHandler = (input: unknown) => Promise<unknown>;
@@ -119,6 +115,14 @@ const MODULE_TOOL_ENTRIES: Record<
   create_page: { specifier: "./tools/create_page.js", exportName: "ailkCreatePage" },
   update_page: { specifier: "./tools/update_page.js", exportName: "ailkUpdatePage" },
   delete_page: { specifier: "./tools/delete_page.js", exportName: "ailkDeletePage" },
+  // D-48 signal-collectors — the flow engine's MCP twins of GET
+  // /v1/flows/:slug and POST /v1/flows/:slug/steps. Anonymous, identity-blind;
+  // free-anonymous status is now module-gated rather than unconditional.
+  get_flow: { specifier: "./tools/get_flow.js", exportName: "ailkGetFlow" },
+  submit_flow_step: {
+    specifier: "./tools/submit_flow_step.js",
+    exportName: "ailkSubmitFlowStep",
+  },
 };
 
 /**