create-ailk 0.2.0 → 0.3.0

package/templates/apps/api/src/__tests__/cors.test.ts

@@ -0,0 +1,195 @@
+/**
+ * @file cors.test.ts
+ * @description CORS preflight contract (#5397).
+ *
+ * The one test file that does NOT mock `@fastify/cors`. Its siblings
+ * (`server.test.ts`, `module-exclusion.test.ts`, `index.test.ts`) stub the
+ * plugin at the module boundary, which is why the defect this file pins was
+ * invisible to the whole suite: with the plugin mocked, the registration
+ * options are never read and no preflight is ever answered. The plugin needs
+ * no live infrastructure — it is a header writer — so the real one runs here.
+ *
+ * The defect: `@fastify/cors` defaults `methods` to `GET,HEAD,POST`
+ * (node_modules/@fastify/cors/index.js `defaultOptions`), and `server.ts`
+ * passed only `origin` + `credentials`. So the preflight for
+ * `PATCH /v1/project-listings/drafts/:id` answered
+ * `access-control-allow-methods: GET, HEAD, POST` and the browser refused the
+ * request — a split-origin site could create a listing draft but never save
+ * one. Observed against the salessmyth/samhenry deploy, 2026-09-13.
+ *
+ * Each case rebuilds the module graph (`jest.resetModules()`) because
+ * `config/index.ts` snapshots `FRONTEND_URL` and `NODE_ENV` at import time.
+ */
+
+// Mocked for the same reasons the sibling suites give: rate-limit wants a live
+// store, and @working-theory/email pulls an ESM-only transitive dep that
+// jest-resolve cannot load in CommonJS mode. `@fastify/cors` is deliberately
+// NOT mocked — it is the subject.
+jest.mock("@fastify/rate-limit", () => jest.fn().mockResolvedValue(undefined));
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+import { REGISTERED_ROUTES_DECORATOR } from "../openapi/spec";
+import type { RegisteredRoute } from "../openapi/surface-drift";
+
+const FRONTEND_URL = "https://site.example.com";
+const FOREIGN_ORIGIN = "https://attacker.example.net";
+
+// The route the defect was found on: ListingApplicationFlow's `patchDraft`
+// runs in the browser on every advance after step one.
+const DRAFT_PATCH_URL = "/v1/project-listings/drafts/listing_abc123";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+type App = any;
+
+const ENV_KEYS = ["FRONTEND_URL", "NODE_ENV"] as const;
+
+/**
+ * Build a server whose `config` was resolved from `env`. Restores the prior
+ * environment through `restoreEnv()` in `afterEach`.
+ */
+async function buildWith(env: {
+  FRONTEND_URL?: string;
+  NODE_ENV: string;
+}): Promise<App> {
+  for (const key of ENV_KEYS) {
+    const value = env[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  jest.resetModules();
+   
+  const { build } = require("../server") as typeof import("../server");
+  return build();
+}
+
+/** Issue a CORS preflight the way a browser would. */
+function preflight(
+  app: App,
+  origin: string,
+  method: string,
+  url = DRAFT_PATCH_URL,
+) {
+  return app.inject({
+    method: "OPTIONS",
+    url,
+    headers: {
+      origin,
+      "access-control-request-method": method,
+      "access-control-request-headers": "authorization,content-type",
+    },
+  });
+}
+
+/** `Access-Control-Allow-Methods` as an uppercased, trimmed set. */
+function allowedMethods(response: {
+  headers: Record<string, unknown>;
+}): string[] {
+  const header = response.headers["access-control-allow-methods"];
+  if (typeof header !== "string") return [];
+  return header.split(",").map((method) => method.trim().toUpperCase());
+}
+
+describe("CORS preflight (#5397)", () => {
+  const priorEnv = new Map<string, string | undefined>(
+    ENV_KEYS.map((key) => [key, process.env[key]]),
+  );
+  let app: App;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    for (const [key, value] of priorEnv) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+    jest.resetModules();
+  });
+
+  it("allows PATCH and the authorization header for the configured FRONTEND_URL origin", async () => {
+    // ARRANGE
+    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+
+    // ACT
+    const response = await preflight(app, FRONTEND_URL, "PATCH");
+
+    // ASSERT — the origin is allowed, with credentials, exactly as before.
+    expect(response.headers["access-control-allow-origin"]).toBe(FRONTEND_URL);
+    expect(response.headers["access-control-allow-credentials"]).toBe("true");
+    // ...and the method the browser asked about is in the answer. Without an
+    // explicit `methods` option this is `GET, HEAD, POST` and the browser
+    // refuses the PATCH.
+    expect(allowedMethods(response)).toEqual(
+      expect.arrayContaining(["GET", "HEAD", "POST", "PATCH"]),
+    );
+    // The bearer token ListingApplicationFlow sends must survive the preflight.
+    const allowHeaders = String(
+      response.headers["access-control-allow-headers"] ?? "",
+    ).toLowerCase();
+    expect(allowHeaders).toContain("authorization");
+    expect(allowHeaders).toContain("content-type");
+  });
+
+  it("refuses a preflight from an origin other than FRONTEND_URL in production", async () => {
+    // ARRANGE
+    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+
+    // ACT
+    const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
+
+    // ASSERT — with a STRING `origin` option, @fastify/cors echoes the
+    // configured origin rather than the requester's
+    // (`getAccessControlAllowOriginHeader`), and the refusal is the browser's:
+    // it blocks any response whose allow-origin is not its own origin. So the
+    // contract to pin is that the foreign origin is never named back, and the
+    // wildcard never appears — `credentials: true` with `*` would let any site
+    // read credentialed responses (the security-review M1 posture server.ts
+    // already documents). Widening `methods` must not widen WHO may use them.
+    const allowOrigin = response.headers["access-control-allow-origin"];
+    expect(allowOrigin).not.toBe(FOREIGN_ORIGIN);
+    expect(allowOrigin).not.toBe("*");
+    expect(allowOrigin).toBe(FRONTEND_URL);
+  });
+
+  it("advertises every method the registered route table actually serves", async () => {
+    // ARRANGE — every paid module on, so the widest route surface is measured.
+    process.env.AILK_ENABLED_MODULES = "multi-tenant,scheduling,content-write";
+    try {
+      app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+      await app.ready();
+
+      // ACT
+      const response = await preflight(app, FRONTEND_URL, "GET", "/health");
+      const advertised = allowedMethods(response);
+      const registered = new Set(
+        (app[REGISTERED_ROUTES_DECORATOR] as RegisteredRoute[]).map((route) =>
+          route.method.toUpperCase(),
+        ),
+      );
+
+      // ASSERT — a route added in a method nobody added to the CORS list is
+      // unreachable from a browser on a split-origin deploy. This is the drift
+      // guard: add a DELETE route, and this fails until `methods` says DELETE.
+      // Reported as a set so a drift names every missing method at once.
+      const missing = [...registered].filter(
+        (method) => !advertised.includes(method),
+      );
+      expect(missing).toEqual([]);
+      // HEAD is never in the route table (Fastify synthesises it from GET, and
+      // server.ts's onRoute hook drops it), so assert it separately.
+      expect(advertised).toContain("HEAD");
+    } finally {
+      delete process.env.AILK_ENABLED_MODULES;
+    }
+  });
+});

package/templates/apps/api/src/__tests__/module-exclusion.test.ts

@@ -67,6 +67,43 @@ const MODULE_ROUTES: Record<string, { method: 'GET' | 'POST'; url: string }[]> =
     ],
     scheduling: [{ method: 'GET', url: '/v1/schedule/availability' }],
     'content-write': [{ method: 'POST', url: '/v1/content/BlogPosting' }],
+    // D-48 signal-collectors (#5366). Each route is chosen so a REGISTERED
+    // handler never itself answers 404 without seed data (an unregistered
+    // route is Fastify's own 404, so a route whose "not found" business
+    // outcome is also 404 — /v1/flows/:slug with a real slug,
+    // /v1/deliverables/:grantId, which is a deliberately uniform 404 by
+    // design — would be ambiguous evidence either way):
+    //   - /v1/flows/INVALID_SLUG fails flowSlugSchema's kebab-case regex ->
+    //     400, before any flow lookup (flowsScope gate)
+    //   - /v1/waitlist-signups/me is authScope-only (no tenant guard) -> 401
+    //     with no session (one of two authScope gates, D2)
+    //   - /v1/slack/actions with no signature -> 401/503, never 404
+    //     (webhooksScope gate)
+    // NOT any /v1/project-listings/* static path (D4's authScope gate, or
+    // the leadsScope gate's four anonymous routes): whenever this static
+    // route is unregistered, multi-tenant's tenant-scoped parametric
+    // /v1/project-listings/:id (registered whenever multi-tenant is enabled,
+    // which every case below does) matches the last path segment as an :id
+    // value and answers 401 (auth required) instead of Fastify's own 404 —
+    // a real routing precedence effect (server.ts's own comment on
+    // projectListingMeRoute), confirmed for both /me and /public, not a
+    // gating defect but ambiguous evidence for this test's shape.
+    'signal-collectors': [
+      { method: 'GET', url: '/v1/flows/INVALID_SLUG' },
+      { method: 'GET', url: '/v1/waitlist-signups/me' },
+      { method: 'POST', url: '/v1/slack/actions' },
+    ],
+    // D-47 commerce (#5364): checkout, the Stripe webhook receiver, the
+    // flow-checkouts read and the recommender's two email-moment routes —
+    // one representative route per registration site server.ts gates on
+    // isModuleEnabled("commerce").
+    commerce: [
+      { method: 'POST', url: '/v1/checkout/sessions' },
+      { method: 'POST', url: '/v1/webhooks/stripe' },
+      { method: 'GET', url: '/v1/flow-checkouts/me' },
+      { method: 'POST', url: '/v1/flows/x/checkout' },
+      { method: 'POST', url: '/v1/flows/x/save' },
+    ],
   };
 
 const ALL_MODULES = Object.keys(MODULE_ROUTES);
@@ -103,8 +140,8 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
     },
   );
 
-  it('with every module enabled (the default), every module route registers — no over-exclusion', async () => {
-    app = await build();
+  it('with every module explicitly enabled, every module route registers — no over-exclusion', async () => {
+    app = await withEnabledModules(ALL_MODULES.join(','), () => build());
     for (const routes of Object.values(MODULE_ROUTES)) {
       for (const { method, url } of routes) {
         const res = await app.inject({ method, url });
@@ -138,4 +175,25 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
       }
     }
   });
+
+  // D-44 / #5368: an unset AILK_ENABLED_MODULES is now the same as an
+  // explicit empty string — no paid module registers by default.
+  it('with AILK_ENABLED_MODULES unset (the new default), every module route 404s', async () => {
+    delete process.env.AILK_ENABLED_MODULES;
+    app = await build();
+    const health = await app.inject({ method: 'GET', url: '/health' });
+    expect(health.statusCode).toBe(200);
+    const contentTypes = await app.inject({
+      method: 'GET',
+      url: '/v1/content/types',
+    });
+    expect(contentTypes.statusCode).not.toBe(404);
+
+    for (const routes of Object.values(MODULE_ROUTES)) {
+      for (const { method, url } of routes) {
+        const res = await app.inject({ method, url });
+        expect(res.statusCode).toBe(404);
+      }
+    }
+  });
 });

package/templates/apps/api/src/__tests__/vercel-handler.test.ts

@@ -32,6 +32,10 @@
 import type { VercelRequest, VercelResponse } from '@vercel/node';
 import Fastify from 'fastify';
 
+jest.mock('@working-theory/observability', () => ({
+  logger: { info: jest.fn(), error: jest.fn(), warn: jest.fn() },
+}));
+
 // ── Typed request/response stubs ────────────────────────────────────────────
 //
 // Minimal stubs that satisfy only the VercelRequest/VercelResponse surface
@@ -209,3 +213,158 @@ describe('vercel-handler — response side: binary round-trip (#5168)', () => {
     expect(Buffer.compare(res._sent as Buffer, rawPayload)).toBe(0);
   });
 });
+
+// ── #5332: one build() per process ──────────────────────────────────────────
+//
+// getServer() used to cache the RESOLVED instance and test it before two
+// awaits, so two invocations overlapping a cold start on one warm container
+// both saw null and both built a complete Fastify server. The fix caches the
+// in-flight promise instead. These tests drive getServer() through the default
+// handler — the handler's exported shape is byte-synced into consuming sites,
+// so getServer() stays module-private rather than being exported for the test.
+
+const COLD_START_REQUEST: MockVercelRequest = {
+  method: 'GET',
+  url: '/health',
+  headers: {},
+  body: undefined,
+  query: {},
+};
+
+function sentMessage(_res: MockRes): string {
+  // Re-required, not imported: jest.resetModules() gives each test a fresh
+  // mock instance, and the handler under test holds that fresh one.
+  const { logger } = require('@working-theory/observability') as {
+    logger: { error: jest.Mock };
+  };
+  const calls = logger.error.mock.calls.filter(
+    ([, msg]) => msg === '[Vercel Handler] Error handling request',
+  );
+  const last = calls[calls.length - 1];
+  return last ? String((last[0] as { err?: Error }).err?.message ?? '') : '';
+}
+
+describe('vercel-handler — one build per process (#5332)', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('builds one server for two invocations that overlap a cold start', async () => {
+    // One shared deferred for both calls, so whichever build() calls happen
+    // all settle together — the assertion is on the CALL COUNT, and a test
+    // that hung when the second call won the cache would obscure it.
+    let resolveServer!: (instance: unknown) => void;
+    const serverReady = new Promise<unknown>((resolve) => {
+      resolveServer = resolve;
+    });
+    const inject = jest.fn().mockResolvedValue({
+      statusCode: 200,
+      headers: {},
+      body: 'ok',
+      rawPayload: Buffer.from('ok'),
+    });
+    const build = jest.fn(() => serverReady);
+    jest.doMock('../server', () => ({ build }));
+    const handler = loadHandler();
+
+    const resA = makeRes();
+    const resB = makeRes();
+    // Both started before either resolves: neither has a server yet.
+    const a = handler(asRequest(COLD_START_REQUEST), asResponse(resA));
+    const b = handler(asRequest(COLD_START_REQUEST), asResponse(resB));
+
+    // Drain the microtask queue so both calls have reached getServer() and
+    // awaited build() before the build is allowed to finish.
+    for (let i = 0; i < 10; i += 1) {
+      await new Promise((resolve) => setImmediate(resolve));
+    }
+
+    resolveServer({ inject });
+    await Promise.all([a, b]);
+
+    expect(build).toHaveBeenCalledTimes(1);
+    expect(resA._status).toBe(200);
+    expect(resB._status).toBe(200);
+  });
+
+  it('retries the build on the next invocation after a failed cold start', async () => {
+    const inject = jest.fn().mockResolvedValue({
+      statusCode: 200,
+      headers: {},
+      body: 'ok',
+      rawPayload: Buffer.from('ok'),
+    });
+    const build = jest
+      .fn()
+      .mockRejectedValueOnce(new Error('prisma connect refused'))
+      .mockResolvedValue({ inject });
+    jest.doMock('../server', () => ({ build }));
+    const handler = loadHandler();
+
+    const failed = makeRes();
+    await handler(asRequest(COLD_START_REQUEST), asResponse(failed));
+    expect(failed._status).toBe(500);
+    expect(sentMessage(failed)).toBe('Server build failed: prisma connect refused');
+
+    // A rejected promise left in the cache would serve this request the same
+    // failure forever without calling build() again.
+    const retried = makeRes();
+    await handler(asRequest(COLD_START_REQUEST), asResponse(retried));
+
+    expect(build).toHaveBeenCalledTimes(2);
+    expect(retried._status).toBe(200);
+  });
+
+  it('does not leak an absolute filesystem path in the 500 body (#5351)', async () => {
+    const leakyPath = '/home/deploy/apps/api/dist/list.js';
+    const build = jest.fn().mockRejectedValue(
+      new Error(`ERR_MODULE_NOT_FOUND file://${leakyPath}`)
+    );
+    jest.doMock('../server', () => ({ build }));
+    const handler = loadHandler();
+
+    const res = makeRes();
+    await handler(asRequest(COLD_START_REQUEST), asResponse(res));
+
+    expect(res._status).toBe(500);
+    expect(JSON.stringify(res._sent)).not.toContain(leakyPath);
+  });
+
+  it('still fires the build timeout with its original message', async () => {
+    jest.useFakeTimers();
+    // A module object carrying its own `then` is assimilated when the
+    // handler's `await import('./server.js')` resolves with it, so the
+    // dynamic import never settles — the production condition the 10s build
+    // timeout guards. `__esModule` keeps ts-jest's __importStar from copying
+    // the object and dropping `then`.
+    jest.doMock('../server', () => ({ __esModule: true, then: () => {} }));
+    const handler = loadHandler();
+
+    const res = makeRes();
+    const pending = handler(asRequest(COLD_START_REQUEST), asResponse(res));
+    await jest.advanceTimersByTimeAsync(10_000);
+    await pending;
+
+    expect(res._status).toBe(500);
+    expect(sentMessage(res)).toBe('Server build failed: Server build timeout after 10s');
+  });
+
+  it('still fires the init timeout with its original message', async () => {
+    jest.useFakeTimers();
+    const build = jest.fn(() => new Promise(() => {}));
+    jest.doMock('../server', () => ({ build }));
+    const handler = loadHandler();
+
+    const res = makeRes();
+    const pending = handler(asRequest(COLD_START_REQUEST), asResponse(res));
+    await jest.advanceTimersByTimeAsync(10_000);
+    await pending;
+
+    expect(res._status).toBe(500);
+    expect(sentMessage(res)).toBe('Server build failed: Server initialization timeout after 10s');
+  });
+});

package/templates/apps/api/src/config/__tests__/modules.test.ts

@@ -0,0 +1,76 @@
+/**
+ * `isModuleEnabled()` default-flip regression test (D-44, #5368).
+ *
+ * Proves the mechanical claim #5368 exists to make true: an UNSET
+ * `AILK_ENABLED_MODULES` now gates every paid module OFF, the same as an
+ * explicit empty string — only an explicit allowlist turns modules on, and
+ * turns on exactly the modules it names.
+ *
+ * Reverting `enabledModules()`'s unset branch back to the `undefined`
+ * sentinel (S1, #5088's original shape) makes the "unset" cases below fail
+ * RED — see #5368 verification notes.
+ */
+
+import { isModuleEnabled } from '../modules';
+
+const RECOGNIZED_MODULES = [
+  'docs',
+  'multi-tenant',
+  'scheduling',
+  'content-write',
+] as const;
+
+describe('isModuleEnabled', () => {
+  const originalEnv = process.env.AILK_ENABLED_MODULES;
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = originalEnv;
+    }
+  });
+
+  describe('AILK_ENABLED_MODULES unset', () => {
+    it.each(RECOGNIZED_MODULES)('returns false for %s', (moduleName) => {
+      delete process.env.AILK_ENABLED_MODULES;
+      expect(isModuleEnabled(moduleName)).toBe(false);
+    });
+  });
+
+  describe('AILK_ENABLED_MODULES=""', () => {
+    it.each(RECOGNIZED_MODULES)('returns false for %s', (moduleName) => {
+      process.env.AILK_ENABLED_MODULES = '';
+      expect(isModuleEnabled(moduleName)).toBe(false);
+    });
+  });
+
+  describe('AILK_ENABLED_MODULES as an explicit allowlist', () => {
+    it.each(RECOGNIZED_MODULES)(
+      'enables exactly the listed modules — %s on when named',
+      (moduleName) => {
+        process.env.AILK_ENABLED_MODULES = moduleName;
+        expect(isModuleEnabled(moduleName)).toBe(true);
+        for (const other of RECOGNIZED_MODULES) {
+          if (other === moduleName) continue;
+          expect(isModuleEnabled(other)).toBe(false);
+        }
+      },
+    );
+
+    it('enables every module named in a comma list, and no others', () => {
+      process.env.AILK_ENABLED_MODULES = 'multi-tenant,scheduling';
+      expect(isModuleEnabled('multi-tenant')).toBe(true);
+      expect(isModuleEnabled('scheduling')).toBe(true);
+      expect(isModuleEnabled('docs')).toBe(false);
+      expect(isModuleEnabled('content-write')).toBe(false);
+    });
+
+    it('trims whitespace and drops empty entries, same as before the flip', () => {
+      process.env.AILK_ENABLED_MODULES = ' multi-tenant , , scheduling ';
+      expect(isModuleEnabled('multi-tenant')).toBe(true);
+      expect(isModuleEnabled('scheduling')).toBe(true);
+      expect(isModuleEnabled('docs')).toBe(false);
+    });
+  });
+});

package/templates/apps/api/src/config/index.ts

@@ -39,6 +39,21 @@ export interface Config {
   // row's issueUrl stays null for a later retry via the PATCH route.
   AILK_GITHUB_REPO?: string;
   AILK_GITHUB_TOKEN?: string;
+
+  // The public origin this API is reachable at, e.g. https://api.example.com.
+  // Already consumed by the deliverable download link (#3961 D5); the OpenAPI
+  // `servers` block reads it too (#5306), since the spec is byte-synced into
+  // every consuming site and cannot name a host as a literal.
+  //
+  // This is the API's OWN origin, distinct from FRONTEND_URL (the site the
+  // browser loads) and from `_site.mdx`'s `baseUrl` (the site's public web
+  // origin). A deployment typically serves the site from example.com and this
+  // API from api.example.com, so neither of the other two can stand in.
+  //
+  // Optional: unset degrades the `servers` block to a document-relative
+  // origin, which stays correct for any agent that fetched the spec from this
+  // API. See resolveServers() in src/openapi/spec.ts.
+  AILK_PUBLIC_API_URL?: string;
 }
 
 function validateConfig(): Config {
@@ -85,6 +100,10 @@ function validateConfig(): Config {
     ...(process.env.AILK_GITHUB_TOKEN !== undefined && {
       AILK_GITHUB_TOKEN: process.env.AILK_GITHUB_TOKEN,
     }),
+
+    ...(process.env.AILK_PUBLIC_API_URL !== undefined && {
+      AILK_PUBLIC_API_URL: process.env.AILK_PUBLIC_API_URL,
+    }),
   };
 }
 

package/templates/apps/api/src/config/modules.ts

@@ -1,18 +1,18 @@
 /**
  * Paid-module presence — the registration-grain signal used by `server.ts`
  * to decide whether a paid module's routes (and their imports) are wired
- * into this build (S1, #5088).
+ * into this build (S1, #5088; defaulted off by D-44, #5368).
  *
  * `AILK_ENABLED_MODULES` is a comma-separated allowlist (e.g.
- * `"multi-tenant,scheduling"`). Unset means "every module on" — today's
- * behavior, unchanged for every existing deployment; an explicit empty
- * string (`""`) means "no paid modules" (the OSS-strip build target). This
- * mirrors `shouldMountTestAuth()`'s fail-open-by-default / explicit-opt-in
- * shape elsewhere in this file's sibling config.
+ * `"multi-tenant,scheduling"`). Unset means **no paid modules** — installed
+ * modules enable themselves explicitly; an explicit empty string (`""`)
+ * means the same (the OSS-strip build target); a list enables exactly the
+ * modules it names.
  *
- * Recognized module keys: `docs`, `multi-tenant`, `scheduling` (the
- * `ModuleName` vocabulary `packages/create-ailk/src/module-architecture.ts`
- * already models via `MODULE_SLICES`) plus `content-write` — the Pro
+ * Recognized module keys: `docs`, `multi-tenant`, `scheduling`,
+ * `signal-collectors`, `commerce` (the `ModuleName` vocabulary
+ * `packages/create-ailk/src/module-architecture.ts` already models via
+ * `MODULE_SLICES`) plus `content-write` — the Pro
  * content-write surface (`create`/`update`/`delete` under
  * `apps/api/src/routes/content/`). `content-write` is intentionally NOT a
  * `MODULE_SLICES` entry: it is not (yet) a `create-ailk --modules`
@@ -24,9 +24,9 @@
  * create-ailk's module types (outside its package allowlist anyway).
  */
 
-function enabledModules(): Set<string> | undefined {
+function enabledModules(): Set<string> {
   const raw = process.env.AILK_ENABLED_MODULES;
-  if (raw === undefined) return undefined; // undefined sentinel = "all enabled"
+  if (raw === undefined) return new Set(); // unset = no paid modules
   return new Set(
     raw
       .split(',')
@@ -37,7 +37,5 @@ function enabledModules(): Set<string> | undefined {
 
 /** Whether the named paid module's routes should register on this build/boot. */
 export function isModuleEnabled(moduleName: string): boolean {
-  const enabled = enabledModules();
-  if (enabled === undefined) return true;
-  return enabled.has(moduleName);
+  return enabledModules().has(moduleName);
 }

package/templates/apps/api/src/lib/__mocks__/prisma.ts

@@ -194,6 +194,9 @@ export const prisma = {
     findMany: jest.fn(),
     update: jest.fn(),
     updateMany: jest.fn(),
+    // `count` — the resume email's per-recipient send cap (#5406): how many
+    // drafts this address has started on this site inside the rolling window.
+    count: jest.fn(),
   },
   // ── Inbox namespace (WaitlistExperiment — #4661 D5) ──────────────────────
   // `upsert` — the ONLY write path into waitlist_experiments