create-ailk 0.2.0 → 0.4.0

package/templates/.claude/rules/architecture.md

@@ -28,10 +28,10 @@ other.
 - Need database access? Only `apps/api` and `apps/mcp` import
   `@working-theory/database`. `apps/web` never reads the database directly — it
   goes through the HTTP API.
-- Cross-cutting integrations (auth, payments, email, analytics) go
-  through their wrapper packages: `@working-theory/auth-client`,
-  `@working-theory/stripe-client`, `@working-theory/email`, `@working-theory/analytics`. Never
-  import `next-auth`, `stripe`, `resend`, etc. directly.
+- Cross-cutting integrations (auth, email, analytics) go through their
+  wrapper packages: `@working-theory/auth-client`, `@working-theory/email`,
+  `@working-theory/analytics`. Never import `next-auth`, `resend`, etc.
+  directly.
 
 ## What you can verify, what you can't
 
@@ -62,5 +62,5 @@ These never appear in source code:
   by being named on a ban-list. Live keys live in your deployment
   platform's secrets store, never in source files or `.env`.
 - Direct vendor SDK imports outside the wrapper packages
-  (`import 'stripe'` outside `@working-theory/stripe-client`, etc.).
+  (`import 'resend'` outside `@working-theory/email`, etc.).
 - Hardcoded production database URLs in committed files.

package/templates/.claude/skills/README.md

@@ -17,12 +17,13 @@ local project's issues.
 | -------------------- | ------------------------------------------------------ | ---------------------------------------------------- |
 | `suggest-site-pages` | Generic page-type suggestions by category              | coming soon — issue #361 (working-theory-labs/ai-launch-kit) |
 | `scaffold-page`      | Generate a page with the appropriate schema.org type   | coming soon — issue #362 (working-theory-labs/ai-launch-kit) |
-| `scaffold-commerce`  | Sell stuff: external store link or direct payments     | coming soon — issue #363 (working-theory-labs/ai-launch-kit) |
 | `scaffold-auth`      | Wire up an auth flow against `@working-theory/auth-client`       | coming soon — issue #364 (working-theory-labs/ai-launch-kit) |
 | `audit-site`         | Run `ailk audit` and explain the results               | coming soon — issue #365 (working-theory-labs/ai-launch-kit) |
 | `add-schema`         | Add Product / Service / FAQ schema to an existing page | coming soon — issue #366 (working-theory-labs/ai-launch-kit) |
 | `provision-config`   | Generate `vercel.json` and environment templates       | coming soon — issue #367 (working-theory-labs/ai-launch-kit) |
 
+`scaffold-commerce` is delivered with the commerce module (`--modules commerce`, licensed).
+
 ## How a skill ships
 
 When a skill is built upstream, this directory will contain a

package/templates/.env.example

@@ -98,11 +98,20 @@ CONTENT_BACKEND=mdx
 # default.
 # RESEND_AUDIENCE_ID=
 #
-# The public base URL this API is reachable at — used ONLY to build the
-# deliverable-delivery download link (#3961 D5):
-# `${AILK_PUBLIC_API_URL}/v1/deliverables/:grantId`. Unset means a relative
-# link (base ""), which is not usable from an email client — set this in any
-# deployment that uses the `deliverables` block.
+# The public base URL this API is reachable at, e.g. https://api.example.com
+# (no trailing slash). This is the API's OWN origin — distinct from
+# FRONTEND_URL (the site the browser loads) and from `_site.mdx`'s `baseUrl`
+# (the site's public web origin). A deployment typically serves the site from
+# example.com and this API from api.example.com, so neither of the other two
+# can stand in for it. Two consumers:
+#
+#   1. The deliverable-delivery download link (#3961 D5):
+#      `${AILK_PUBLIC_API_URL}/v1/deliverables/:grantId`. Unset means a
+#      relative link (base ""), which is not usable from an email client — set
+#      this in any deployment that uses the `deliverables` block.
+#   2. The OpenAPI `servers` block (#5306). Unset degrades to a single
+#      document-relative server (`/`), which an agent resolves against the
+#      origin it fetched the spec from — correct, just less explicit.
 # AILK_PUBLIC_API_URL=
 #
 # The apps/api origin @working-theory/api-client calls from
@@ -313,11 +322,14 @@ CONTENT_BACKEND=mdx
 # apps/api's origin as seen from apps/web's SERVER process — the api-client's
 # base URL (getApiBase(), packages/api-client/src/http.ts) for every flow
 # Server Action call (flows.get / submitStep / save / checkout). AILK_API_URL
-# wins; NEXT_PUBLIC_API_URL is the fallback; both unset resolves to
+# wins; NEXT_PUBLIC_AILK_API_URL (apps/web/.env.example) is the fallback, and
+# is also what getApiBase() resolves in the BROWSER, where only a
+# NEXT_PUBLIC_-prefixed name is inlined (#5397); NEXT_PUBLIC_API_URL is still
+# read after it as a DEPRECATED fallback for deployments that set it under the
+# old behaviour — do not set it in a new one. All unset resolves to
 # http://localhost:3001 (local dev only — off-localhost every save / checkout
-# call fails as `network`). Distinct from NEXT_PUBLIC_AILK_API_URL
-# (apps/web/.env.example), which BROWSER-side blocks post to directly. Set on
-# every apps/web deployment whose API is not on localhost.
+# call fails as `network`). Set AILK_API_URL on every apps/web deployment whose
+# API is not on localhost.
 # AILK_API_URL=http://localhost:3001
 #
 # NEXT_PUBLIC_ENABLED_LOCALES — do NOT set by hand. Baked at build time by

package/templates/CONVENTIONS.md

@@ -174,13 +174,12 @@ Vendor SDKs are imported only inside their `@working-theory/*` wrapper. The
 wrapper exports a typed, project-flavored interface; your code imports
 from the wrapper.
 
-| Vendor              | Wrapper package       | Where you use it             |
-| ------------------- | --------------------- | ---------------------------- |
-| Stripe              | `@working-theory/stripe-client` | `apps/api` checkout/webhooks |
-| NextAuth            | `@working-theory/auth-client`   | `apps/api`, `apps/web`       |
-| Resend / Nodemailer | `@working-theory/email`         | `apps/api`                   |
-| Analytics           | `@working-theory/analytics`     | `apps/web`, `apps/api`       |
-| Prisma              | `@working-theory/database`      | `apps/api`, `apps/mcp`       |
+| Vendor              | Wrapper package               | Where you use it       |
+| ------------------- | ----------------------------- | ---------------------- |
+| NextAuth            | `@working-theory/auth-client` | `apps/api`, `apps/web` |
+| Resend / Nodemailer | `@working-theory/email`       | `apps/api`             |
+| Analytics           | `@working-theory/analytics`   | `apps/web`, `apps/api` |
+| Prisma              | `@working-theory/database`    | `apps/api`, `apps/mcp` |
 
 The wrapper is where retries, signature verification, error mapping,
 and config defaults live. Don't reinvent them per consumer.

package/templates/apps/api/.env.example

@@ -58,6 +58,15 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # (#4288) lands as a second value here with no change to the section.
 # SCHEDULING_PROVIDER=cal
 
+# =============================================================================
+# Paid modules (D-44, #5368)
+# =============================================================================
+# Comma-separated allowlist of installed paid modules, e.g.
+# "multi-tenant,scheduling". Unset (the default) or "" means NO paid modules
+# — installed modules enable themselves explicitly. Recognized keys: docs,
+# multi-tenant, scheduling, content-write. Must match apps/mcp's value.
+# AILK_ENABLED_MODULES=
+
 # ── Project listings — site addressing (#5048 D2) ───────────────────────────
 # AILK_SITE_ID is this deployment's own site identifier. Unset means "default".
 # It is read SERVER-SIDE only; no request body carries a site identifier.

package/templates/apps/api/CLAUDE.md

@@ -8,6 +8,26 @@ Inherits root `CLAUDE.md`. This file adds API-specific rules.
 - Persistence: configurable adapter (default DB; file fallback so OSS works without DB config)
 - Email: operator-notification stub at OSS; routing pipeline at Pro (in `@working-theory/*`)
 
+## Deploy path
+
+**The supported deploy path is plain `tsc` output, traced and compiled by `@vercel/node`.** `vercel.json` sets `framework: null` and routes every request to `/api/index.ts`; `build:vercel` runs `prisma generate` and two package builds and does NOT compile `apps/api` — Vercel's own builder does, through `nodeFileTrace`. That tracer is what decides which files ship.
+
+**Bundling `apps/api` is NOT a supported deploy path** (#5334). This is a property of the analysers, not a policy:
+
+- Paid-module slices are loaded through an indirect dynamic `import()`, because a string literal at the call site would make `tsc` resolve a path the OSS strip removes (#5182).
+- esbuild bundles a dynamic `import()` **only** when its argument is a string literal at the call site — the same predicate `tsc` resolves on. So no expression shape satisfies both the strip and a bundler.
+- In a bundled build the specifier therefore survives verbatim and Node resolves it against the **bundle's output directory** rather than its source module's: `"./list.js"`, written in `src/routes/project-listings/index.ts`, becomes `dist/list.js` and does not exist. esbuild emits no warning. The throw lands inside `build()`, which is construction, so **every route 500s rather than one** — measured in production, nine hours of total API outage on a consuming site.
+
+If a dependency is forcing you toward a bundler (an extensionless relative import in a published `dist`, say), fix the dependency's packaging — don't bundle `apps/api`. If you bundle anyway, `loadSlice()` (`src/lib/slice-load.ts`) makes the failure say so at boot instead of failing mute; it does not make bundling work.
+
+Three gates hold this together. Run them from the repo root, with `apps/api/dist` built:
+
+```bash
+pnpm slice-reachability:check   # every slice specifier is reachable to @vercel/nft
+pnpm artifact-boots:check       # the traced artifact boots and answers /health 200
+pnpm bundled-build:check        # a bundled build fails, and says why
+```
+
 ## API ↔ MCP parity (hard rule)
 
 Every endpoint here has a 1:1 MCP tool in `apps/mcp`. When you add, change, or remove an endpoint, update the MCP tool in the same PR. CI enforces — broken parity fails the build.
@@ -17,8 +37,9 @@ Every endpoint here has a 1:1 MCP tool in `apps/mcp`. When you add, change, or r
 Routes are versioned under `/v1/*`:
 
 - `/v1/leads/{submit,subscribe,callback}` — lead capture, newsletter subscription, callback request
-- `/v1/flows/:slug` (GET), `/v1/flows/:slug/steps` (POST) — serve a flow config + submit a step's answers; server-side per-step partial-state persistence (#3956)
-- `/v1/flows/:slug/aggregate` (GET) — anonymous, site-scoped per-question response counts across all completed respondents for the results reveal (#4771): respondents are completed `FlowSession` rows (not `Lead` rows — a recommending-mode respondent has no Lead until the email moment), question metadata + the chart flag come from the `WaitlistExperiment` register, and only `resultsReveal`-flagged `single`/`multi` questions are returned (`src/services/flow-aggregate.ts`). No individual answer, email, name, session id, or score in the response; no auth. No MCP twin — recorded exception (an agent walking a flow already gets everything it needs from `submit_flow_step`'s own response; "how everyone else answered" changes none of it).
+- `/v1/flows/:slug` (GET), `/v1/flows/:slug/steps` (POST) — serve a flow config + submit a step's answers; server-side per-step partial-state persistence (#3956). Module: `signal-collectors` (D-48, #5366) — registers only when the module is enabled; MCP twins `get_flow`/`submit_flow_step` carry the same `module` tag (D7).
+- `/v1/flows/:slug/aggregate` (GET) — anonymous, site-scoped per-question response counts across all completed respondents for the results reveal (#4771): respondents are completed `FlowSession` rows (not `Lead` rows — a recommending-mode respondent has no Lead until the email moment), question metadata + the chart flag come from the `WaitlistExperiment` register, and only `resultsReveal`-flagged `single`/`multi` questions are returned (`src/services/flow-aggregate.ts`). No individual answer, email, name, session id, or score in the response; no auth. Module: `signal-collectors`. No MCP twin — recorded exception (an agent walking a flow already gets everything it needs from `submit_flow_step`'s own response; "how everyone else answered" changes none of it).
+- `/v1/deliverables/:grantId` (GET) — the capability-token download route for gated PDFs and reports, including client deliverables (#3961 D5); the token itself is the sole gate, no auth preHandler applies (`src/routes/deliverables/index.ts`). Module: `signal-collectors` (D-48, #5366). No MCP twin — identity-bound capability-link download (#3591 exception, the same shape as `/v1/waitlist-signups/me`).
 - `/v1/flows/:slug/save` (POST), `/v1/flows/:slug/checkout` (POST) — the recommender's email moment (#4841): `save` creates the FlowSession + Lead (+ the T+0 DeliverableGrant) for the permalink's answers; `checkout` does the same, records the `FlowCheckout` buyer row at a SERVER-recomputed `price()` (the body carries no amount — `flowCheckoutInputSchema` is strict), and opens a Stripe TEST-mode Checkout Session whose metadata carries the permalink + offer key (`src/routes/flows/recommender.ts`, `src/services/recommender-capture.ts`, `packages/stripe-client`'s `createQuotedCheckoutSession`). Anonymous, rate-limited; a non-`sk_test_` key is refused before any side effect. No MCP twin — recorded exception: an agent walking a flow has no email to give and no card to pay with; the anonymous MCP surface is identity-blind.
 - `/v1/content/{types,:type,:type/:slug}` — public content reads
 - `/v1/auth/tokens`, `/v1/user/{profile,data/:key}` — local auth + user data
@@ -28,9 +49,11 @@ Routes are versioned under `/v1/*`:
 - `/v1/schedule/availability` (GET), `/v1/schedule/event-meta` (GET), `/v1/schedule/book` (POST) — anonymous scheduling proxy behind the provider seam (`src/services/scheduling/`); Cal.com v2 today, a self-hosted engine later, same three calls. `event-meta` is the meta-only read (title · duration · description · price) so rendering an event's facts never fetches an availability window (#4633). `CAL_API_KEY` is read server-side only. MCP twins: `list_availability` / `get_event_meta` / `create_booking` (#4416, #4633)
 - `/v1/aeo/score` (POST), `/v1/aeo/score/example` (GET) — anonymous instant AEO score for a respondent-supplied URL, and the bundled pre-launch example, both fed by the SSRF-guarded crawler at `@working-theory/aeo/fetch` and the pure scorer at `@working-theory/aeo` (`src/services/aeo-score.ts`, #4666). No MCP twin — recorded exception, brief D7 (exposing an arbitrary-URL crawler to anonymous agents is a security-posture decision; `apps/mcp/src/tools/audit.ts` deliberately stays same-origin-locked instead).
 - `/v1/waitlist-experiments` (GET), `/v1/waitlist-experiments/:experimentId` (GET), `/v1/waitlist-experiments/:experimentId/signups` (GET), `/v1/waitlist-experiments/:experimentId/signups/:leadId` (GET) — the operator-dashboard read API for Parallel Waitlist Validation (#4665 D7, B0): tenant-scoped list + rollup, per-waitlist comparison, paginated signups, and a signup drill-down over A1's `WaitlistExperiment` / `WaitlistScore` / `Lead` rows (`src/services/waitlist-dashboard.ts`, #4671). Role floor `owner|admin` (signup PII); the platform-operator scope (`isSentinel(organizationId) && role === "owner"`, ALSO requiring `AILK_OPERATOR_EMAIL` to be set — fail-closed, PR #4687) sees every site, an ordinary owner/admin sees only its own `siteId`. No MCP twin — identity-bound tenant routes (#3591 exception, same shape as `/v1/billing/*`).
-- `/v1/waitlist-signups/me` (GET, `?experimentKey=<slug>`) — the respondent read (#4731): a signed-in, **email-verified** user's OWN newest signup for one experiment (`experimentKey`, `waitlistKey`, `completedAt`, `tier`, `score`, `aeoScore`, `answers.q3` — seven fields, nothing more; `src/services/waitlist-signups.ts` is the only read path). Registered in `authScope` only (auth, no tenant guard — a respondent has no workspace). Identity is `request.userId`; the email is the `User`'s, never a parameter; `emailVerified !== true` → 403 `email_unverified` before any `Lead` read; no match → 404 `signup_not_found`; every read scoped to `currentSiteId()`. No MCP twin — identity-bound (#3591 exception).
+- `/v1/waitlist-signups/me` (GET, `?experimentKey=<slug>`) — the respondent read (#4731): a signed-in, **email-verified** user's OWN newest signup for one experiment (`experimentKey`, `waitlistKey`, `completedAt`, `tier`, `score`, `aeoScore`, `answers.q3` — seven fields, nothing more; `src/services/waitlist-signups.ts` is the only read path). Registered in `authScope` only (auth, no tenant guard — a respondent has no workspace). Identity is `request.userId`; the email is the `User`'s, never a parameter; `emailVerified !== true` → 403 `email_unverified` before any `Lead` read; no match → 404 `signup_not_found`; every read scoped to `currentSiteId()`. Module: `signal-collectors` (D-48, #5366). No MCP twin — identity-bound (#3591 exception).
 - `/v1/flow-checkouts/me` (GET) — the respondent purchases read (#4984, FEAT-022 M2): a signed-in, **email-verified** user's OWN `FlowCheckout` rows, newest first, `[]` when none (`id`, `flowSlug`, `experimentKey`, `offerKey`, `status`, `amountMinor`, `currency`, `period`, `completedAt`, `createdAt` — ten fields, nothing more; `src/services/flow-checkouts.ts` is the only read path). Registered in `authScope` only, beside `/v1/waitlist-signups/me`. Identity is `request.userId`; rows are joined through the promotion link (`Lead.promotedUserId = userId`, `src/services/lead-promotion.ts`) — never by an email, and no query parameter is read; `emailVerified !== true` → 403 `email_unverified` before any `Lead` read; every read scoped to `currentSiteId()`. No MCP twin — identity-bound (#3591 exception).
-- `/v1/project-listings/me` (GET) — the FOUNDER'S OWN listings read (#5295): a signed-in user's own `ProjectListing` rows, newest first, `[]` when none. Registered in `authScope` only, beside `/v1/flow-checkouts/me` — a founder is not a workspace member, so the tenant guard's default-deny would answer 403 for their own submission. Identity is `request.userId`; rows are joined through the owner link (`ProjectListing.ownerUserId = userId`, stamped by `src/services/listing-promotion.ts`) — **never** by `founderEmail`, at any stage, and no query parameter is read. `founderEmail` is an unverified string typed into an anonymous form, so a read-time email match would hand one of two people sharing an address the other's submission. The row shape is `projectListingDraftSchema` (the founder-facing shape the anonymous draft read already uses — no `siteId`, `leadId`, `decidedBy`, `issueUrl`, or `experimentKey`). The route is ADDITIVE: `PROJECT_LISTING_ROLES` stays `owner|admin` and the tenant-scoped list/get/patch routes are unchanged. No MCP twin — identity-bound (#3591 exception).
+- `/v1/project-listings/me` (GET) — the FOUNDER'S OWN listings read (#5295): a signed-in user's own `ProjectListing` rows, newest first, `[]` when none. Registered in `authScope` only, beside `/v1/flow-checkouts/me` — a founder is not a workspace member, so the tenant guard's default-deny would answer 403 for their own submission. Identity is `request.userId`; rows are joined through the owner link (`ProjectListing.ownerUserId = userId`, stamped by `src/services/listing-promotion.ts`) — **never** by `founderEmail`, at any stage, and no query parameter is read. `founderEmail` is an unverified string typed into an anonymous form, so a read-time email match would hand one of two people sharing an address the other's submission. The row shape is `projectListingDraftSchema` (the founder-facing shape the anonymous draft read already uses — no `siteId`, `leadId`, `decidedBy`, `issueUrl`, or `experimentKey`). The route is ADDITIVE: `PROJECT_LISTING_ROLES` stays `owner|admin` and the tenant-scoped list/get/patch routes are unchanged. Module: `signal-collectors` (D-48, #5366) — not severable from the anonymous listing-application routes below (same static barrel, D4). No MCP twin — identity-bound (#3591 exception).
+- `/v1/project-listings/{start,submit}` (POST), `/v1/project-listings/:id` (PATCH, draft), `/v1/project-listings/public` (GET) — the anonymous founder's-application lifecycle (#4998, reshaped by #5036): draft start/patch/submit plus the public shelves read, identity-blind and rate-limited alongside the leads routes. Module: `signal-collectors`. No MCP twin — anonymous form-lifecycle routes, not agent-facing.
+- `/v1/slack/actions` (POST) — the project-listing operator decision (Slack Approve/Reject, #4999): verifies the Slack signature, applies the decision via `src/services/project-listing-decision.ts`. Module: `signal-collectors`. No MCP twin — a Slack-signed webhook, not agent-facing.
 
 The workspace site-config routes are **identity-bound tenant routes** (guarded by the tenant preHandler; the write scope is the caller's active workspace, never a body-supplied id). Like the sibling `/v1/workspaces/*` routes they have **no anonymous MCP twin** — the OSS MCP surface is identity-blind (`apps/mcp/CLAUDE.md`), so the "1:1 MCP tool" rule above does not apply to them; the tenant-scoped authed MCP surface is tracked in #3591. The `/v1/billing/*` and `/v1/waitlist-experiments/*` routes are the same shape — identity-bound tenant routes, admin/settings-facing rather than agent-facing, no MCP twin.
 
@@ -118,8 +141,13 @@ sweep's own DB constraint (never a caller-side lock).
 - Don't return 200 with `{ ok: false }`.
 - Don't read MDX directly — use `@working-theory/content-adapters`.
 - Don't put session state in `apps/api`. It's stateless.
+- Don't bundle `apps/api` (esbuild, rollup, webpack). Slice specifiers cannot survive it — see `## Deploy path`.
+
+Last updated: 2026-09-14 — doc-sync: signal-collectors module extraction (D-48, #5366) — added the `module: signal-collectors` note to the flows/waitlist-signups-me/project-listings-me endpoints, added the previously-undocumented `/v1/deliverables/:grantId`, `/v1/project-listings/{start,submit,:id,public}` and `/v1/slack/actions` rows — verified against `apps/api/src/server.ts` and each route's own header.
+
+Prior: 2026-09-12 — doc-sync: added the `## Deploy path` section and the matching `## What NOT to do` line (#5334), recording that bundling `apps/api` is not a supported deploy path and naming the three gates — verified against `apps/api/vercel.json`, `apps/api/src/lib/slice-load.ts` and `scripts/check-bundled-build-diagnoses.ts`.
 
-Last updated: 2026-09-12 — doc-sync: added `GET /v1/project-listings/me` (#5295), the auth-scoped founder read joined on the owner link, to Endpoint conventions — verified against `apps/api/src/routes/project-listings/me.ts` and `apps/api/src/server.ts`.
+Prior: 2026-09-12 — doc-sync: added `GET /v1/project-listings/me` (#5295), the auth-scoped founder read joined on the owner link, to Endpoint conventions — verified against `apps/api/src/routes/project-listings/me.ts` and `apps/api/src/server.ts`.
 
 Prior: 2026-09-07 — doc-sync: added `listing-csv:sweep` (#5001), the weekly founder-CSV sweep, to `## Scheduled sweeps (external cron)` — verified against `apps/api/src/bin/listing-csv-sweep.ts` and `apps/api/package.json`.
 

package/templates/apps/api/package.json

@@ -46,7 +46,6 @@
     "@working-theory/observability": "workspace:*",
     "@working-theory/schema": "workspace:*",
     "@working-theory/site-config": "workspace:*",
-    "@working-theory/stripe-client": "workspace:*",
     "@working-theory/validation": "workspace:*",
     "dotenv": "^17.4.2",
     "fastify": "^5.12.1",

package/templates/apps/api/src/__tests__/cors.test.ts

@@ -0,0 +1,195 @@
+/**
+ * @file cors.test.ts
+ * @description CORS preflight contract (#5397).
+ *
+ * The one test file that does NOT mock `@fastify/cors`. Its siblings
+ * (`server.test.ts`, `module-exclusion.test.ts`, `index.test.ts`) stub the
+ * plugin at the module boundary, which is why the defect this file pins was
+ * invisible to the whole suite: with the plugin mocked, the registration
+ * options are never read and no preflight is ever answered. The plugin needs
+ * no live infrastructure — it is a header writer — so the real one runs here.
+ *
+ * The defect: `@fastify/cors` defaults `methods` to `GET,HEAD,POST`
+ * (node_modules/@fastify/cors/index.js `defaultOptions`), and `server.ts`
+ * passed only `origin` + `credentials`. So the preflight for
+ * `PATCH /v1/project-listings/drafts/:id` answered
+ * `access-control-allow-methods: GET, HEAD, POST` and the browser refused the
+ * request — a split-origin site could create a listing draft but never save
+ * one. Observed against the salessmyth/samhenry deploy, 2026-09-13.
+ *
+ * Each case rebuilds the module graph (`jest.resetModules()`) because
+ * `config/index.ts` snapshots `FRONTEND_URL` and `NODE_ENV` at import time.
+ */
+
+// Mocked for the same reasons the sibling suites give: rate-limit wants a live
+// store, and @working-theory/email pulls an ESM-only transitive dep that
+// jest-resolve cannot load in CommonJS mode. `@fastify/cors` is deliberately
+// NOT mocked — it is the subject.
+jest.mock("@fastify/rate-limit", () => jest.fn().mockResolvedValue(undefined));
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+import { REGISTERED_ROUTES_DECORATOR } from "../openapi/spec";
+import type { RegisteredRoute } from "../openapi/surface-drift";
+
+const FRONTEND_URL = "https://site.example.com";
+const FOREIGN_ORIGIN = "https://attacker.example.net";
+
+// The route the defect was found on: ListingApplicationFlow's `patchDraft`
+// runs in the browser on every advance after step one.
+const DRAFT_PATCH_URL = "/v1/project-listings/drafts/listing_abc123";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+type App = any;
+
+const ENV_KEYS = ["FRONTEND_URL", "NODE_ENV"] as const;
+
+/**
+ * Build a server whose `config` was resolved from `env`. Restores the prior
+ * environment through `restoreEnv()` in `afterEach`.
+ */
+async function buildWith(env: {
+  FRONTEND_URL?: string;
+  NODE_ENV: string;
+}): Promise<App> {
+  for (const key of ENV_KEYS) {
+    const value = env[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  jest.resetModules();
+   
+  const { build } = require("../server") as typeof import("../server");
+  return build();
+}
+
+/** Issue a CORS preflight the way a browser would. */
+function preflight(
+  app: App,
+  origin: string,
+  method: string,
+  url = DRAFT_PATCH_URL,
+) {
+  return app.inject({
+    method: "OPTIONS",
+    url,
+    headers: {
+      origin,
+      "access-control-request-method": method,
+      "access-control-request-headers": "authorization,content-type",
+    },
+  });
+}
+
+/** `Access-Control-Allow-Methods` as an uppercased, trimmed set. */
+function allowedMethods(response: {
+  headers: Record<string, unknown>;
+}): string[] {
+  const header = response.headers["access-control-allow-methods"];
+  if (typeof header !== "string") return [];
+  return header.split(",").map((method) => method.trim().toUpperCase());
+}
+
+describe("CORS preflight (#5397)", () => {
+  const priorEnv = new Map<string, string | undefined>(
+    ENV_KEYS.map((key) => [key, process.env[key]]),
+  );
+  let app: App;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    for (const [key, value] of priorEnv) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+    jest.resetModules();
+  });
+
+  it("allows PATCH and the authorization header for the configured FRONTEND_URL origin", async () => {
+    // ARRANGE
+    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+
+    // ACT
+    const response = await preflight(app, FRONTEND_URL, "PATCH");
+
+    // ASSERT — the origin is allowed, with credentials, exactly as before.
+    expect(response.headers["access-control-allow-origin"]).toBe(FRONTEND_URL);
+    expect(response.headers["access-control-allow-credentials"]).toBe("true");
+    // ...and the method the browser asked about is in the answer. Without an
+    // explicit `methods` option this is `GET, HEAD, POST` and the browser
+    // refuses the PATCH.
+    expect(allowedMethods(response)).toEqual(
+      expect.arrayContaining(["GET", "HEAD", "POST", "PATCH"]),
+    );
+    // The bearer token ListingApplicationFlow sends must survive the preflight.
+    const allowHeaders = String(
+      response.headers["access-control-allow-headers"] ?? "",
+    ).toLowerCase();
+    expect(allowHeaders).toContain("authorization");
+    expect(allowHeaders).toContain("content-type");
+  });
+
+  it("refuses a preflight from an origin other than FRONTEND_URL in production", async () => {
+    // ARRANGE
+    app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+
+    // ACT
+    const response = await preflight(app, FOREIGN_ORIGIN, "PATCH");
+
+    // ASSERT — with a STRING `origin` option, @fastify/cors echoes the
+    // configured origin rather than the requester's
+    // (`getAccessControlAllowOriginHeader`), and the refusal is the browser's:
+    // it blocks any response whose allow-origin is not its own origin. So the
+    // contract to pin is that the foreign origin is never named back, and the
+    // wildcard never appears — `credentials: true` with `*` would let any site
+    // read credentialed responses (the security-review M1 posture server.ts
+    // already documents). Widening `methods` must not widen WHO may use them.
+    const allowOrigin = response.headers["access-control-allow-origin"];
+    expect(allowOrigin).not.toBe(FOREIGN_ORIGIN);
+    expect(allowOrigin).not.toBe("*");
+    expect(allowOrigin).toBe(FRONTEND_URL);
+  });
+
+  it("advertises every method the registered route table actually serves", async () => {
+    // ARRANGE — every paid module on, so the widest route surface is measured.
+    process.env.AILK_ENABLED_MODULES = "multi-tenant,scheduling,content-write";
+    try {
+      app = await buildWith({ FRONTEND_URL, NODE_ENV: "production" });
+      await app.ready();
+
+      // ACT
+      const response = await preflight(app, FRONTEND_URL, "GET", "/health");
+      const advertised = allowedMethods(response);
+      const registered = new Set(
+        (app[REGISTERED_ROUTES_DECORATOR] as RegisteredRoute[]).map((route) =>
+          route.method.toUpperCase(),
+        ),
+      );
+
+      // ASSERT — a route added in a method nobody added to the CORS list is
+      // unreachable from a browser on a split-origin deploy. This is the drift
+      // guard: add a DELETE route, and this fails until `methods` says DELETE.
+      // Reported as a set so a drift names every missing method at once.
+      const missing = [...registered].filter(
+        (method) => !advertised.includes(method),
+      );
+      expect(missing).toEqual([]);
+      // HEAD is never in the route table (Fastify synthesises it from GET, and
+      // server.ts's onRoute hook drops it), so assert it separately.
+      expect(advertised).toContain("HEAD");
+    } finally {
+      delete process.env.AILK_ENABLED_MODULES;
+    }
+  });
+});

package/templates/apps/api/src/__tests__/module-exclusion.test.ts

@@ -67,6 +67,43 @@ const MODULE_ROUTES: Record<string, { method: 'GET' | 'POST'; url: string }[]> =
     ],
     scheduling: [{ method: 'GET', url: '/v1/schedule/availability' }],
     'content-write': [{ method: 'POST', url: '/v1/content/BlogPosting' }],
+    // D-48 signal-collectors (#5366). Each route is chosen so a REGISTERED
+    // handler never itself answers 404 without seed data (an unregistered
+    // route is Fastify's own 404, so a route whose "not found" business
+    // outcome is also 404 — /v1/flows/:slug with a real slug,
+    // /v1/deliverables/:grantId, which is a deliberately uniform 404 by
+    // design — would be ambiguous evidence either way):
+    //   - /v1/flows/INVALID_SLUG fails flowSlugSchema's kebab-case regex ->
+    //     400, before any flow lookup (flowsScope gate)
+    //   - /v1/waitlist-signups/me is authScope-only (no tenant guard) -> 401
+    //     with no session (one of two authScope gates, D2)
+    //   - /v1/slack/actions with no signature -> 401/503, never 404
+    //     (webhooksScope gate)
+    // NOT any /v1/project-listings/* static path (D4's authScope gate, or
+    // the leadsScope gate's four anonymous routes): whenever this static
+    // route is unregistered, multi-tenant's tenant-scoped parametric
+    // /v1/project-listings/:id (registered whenever multi-tenant is enabled,
+    // which every case below does) matches the last path segment as an :id
+    // value and answers 401 (auth required) instead of Fastify's own 404 —
+    // a real routing precedence effect (server.ts's own comment on
+    // projectListingMeRoute), confirmed for both /me and /public, not a
+    // gating defect but ambiguous evidence for this test's shape.
+    'signal-collectors': [
+      { method: 'GET', url: '/v1/flows/INVALID_SLUG' },
+      { method: 'GET', url: '/v1/waitlist-signups/me' },
+      { method: 'POST', url: '/v1/slack/actions' },
+    ],
+    // D-47 commerce (#5364): checkout, the Stripe webhook receiver, the
+    // flow-checkouts read and the recommender's two email-moment routes —
+    // one representative route per registration site server.ts gates on
+    // isModuleEnabled("commerce").
+    commerce: [
+      { method: 'POST', url: '/v1/checkout/sessions' },
+      { method: 'POST', url: '/v1/webhooks/stripe' },
+      { method: 'GET', url: '/v1/flow-checkouts/me' },
+      { method: 'POST', url: '/v1/flows/x/checkout' },
+      { method: 'POST', url: '/v1/flows/x/save' },
+    ],
   };
 
 const ALL_MODULES = Object.keys(MODULE_ROUTES);
@@ -103,8 +140,8 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
     },
   );
 
-  it('with every module enabled (the default), every module route registers — no over-exclusion', async () => {
-    app = await build();
+  it('with every module explicitly enabled, every module route registers — no over-exclusion', async () => {
+    app = await withEnabledModules(ALL_MODULES.join(','), () => build());
     for (const routes of Object.values(MODULE_ROUTES)) {
       for (const { method, url } of routes) {
         const res = await app.inject({ method, url });
@@ -138,4 +175,25 @@ describe('Module exclusion — registration vanishes with the module (S1, #5088)
       }
     }
   });
+
+  // D-44 / #5368: an unset AILK_ENABLED_MODULES is now the same as an
+  // explicit empty string — no paid module registers by default.
+  it('with AILK_ENABLED_MODULES unset (the new default), every module route 404s', async () => {
+    delete process.env.AILK_ENABLED_MODULES;
+    app = await build();
+    const health = await app.inject({ method: 'GET', url: '/health' });
+    expect(health.statusCode).toBe(200);
+    const contentTypes = await app.inject({
+      method: 'GET',
+      url: '/v1/content/types',
+    });
+    expect(contentTypes.statusCode).not.toBe(404);
+
+    for (const routes of Object.values(MODULE_ROUTES)) {
+      for (const { method, url } of routes) {
+        const res = await app.inject({ method, url });
+        expect(res.statusCode).toBe(404);
+      }
+    }
+  });
 });