create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/config/index.ts

@@ -1,596 +0,0 @@
-/**
- * AI Launch Kit API Configuration
- *
- * Local-only backend (auth + sessions). External-platform forwarding has been
- * removed; AILK-native routes will be added in subsequent issues.
- */
-import { logger } from '@working-theory/observability';
-import * as dotenv from 'dotenv';
-
-import { isModuleEnabled } from './modules.js';
-
-dotenv.config();
-
-export interface Config {
-  // Server
-  NODE_ENV: 'development' | 'production' | 'test';
-  PORT: number;
-  FRONTEND_URL: string;
-
-  // The browser origins this API trusts (#7395) — the one list CORS, the
-  // cookie-forwarded write check (middleware/auth.ts) and the checkout
-  // redirect lock (routes/checkout/sessions.ts) all read. Resolved once, at
-  // startup, by resolveTrustedOrigins() below from FRONTEND_URL's origin plus
-  // the opt-in AILK_TRUSTED_ORIGINS (a comma-separated list of exact origins,
-  // for a hub that serves its Admin app and spoke sites). Frozen; no request
-  // input can add to it, and no entry can be `*` or a wildcard host.
-  TRUSTED_ORIGINS: readonly string[];
-  AILK_TRUSTED_ORIGINS?: string;
-
-  // Local Database (for auth: User, Session, ApiToken, etc.). Required in
-  // production; unset elsewhere starts the API database-less (#6482).
-  DATABASE_URL?: string;
-
-  // Stripe — consumed by apps/api/src/lib/stripe.ts via @working-theory/stripe-client wrapper
-  STRIPE_SECRET_KEY?: string;
-  STRIPE_WEBHOOK_SECRET?: string;
-
-  // Slack — the project-listings approve/reject workflow (#4999). Consumed
-  // by services/slack-notify.ts (bot token + channel) and
-  // routes/slack/actions.ts (signing secret, for X-Slack-Signature
-  // verification). All three optional; absent means "Slack off" — a create
-  // still succeeds, it just skips the notification.
-  AILK_SLACK_BOT_TOKEN?: string;
-  AILK_SLACK_SIGNING_SECRET?: string;
-  AILK_SLACK_CHANNEL_ID?: string;
-
-  // GitHub issue filing — the approve-time build-issue workflow (#5000).
-  // Consumed by services/project-listing-issue.ts: AILK_GITHUB_REPO is the
-  // site's own `owner/name` (never this repo); AILK_GITHUB_TOKEN is a
-  // fine-grained token scoped to `issues:write` on that one repo. Both
-  // optional; absent means "filing off" — approve still succeeds, and the
-  // row's issueUrl stays null for a later retry via the PATCH route.
-  AILK_GITHUB_REPO?: string;
-  AILK_GITHUB_TOKEN?: string;
-
-  // The public origin this API is reachable at, e.g. https://api.example.com.
-  // Already consumed by the deliverable download link (#3961 D5); the OpenAPI
-  // `servers` block reads it too (#5306), since the spec is byte-synced into
-  // every consuming site and cannot name a host as a literal.
-  //
-  // This is the API's OWN origin, distinct from FRONTEND_URL (the site the
-  // browser loads) and from `_site.mdx`'s `baseUrl` (the site's public web
-  // origin). A deployment typically serves the site from example.com and this
-  // API from api.example.com, so neither of the other two can stand in.
-  //
-  // Optional: unset degrades the `servers` block to a document-relative
-  // origin, which stays correct for any agent that fetched the spec from this
-  // API. See resolveServers() in src/openapi/spec.ts.
-  AILK_PUBLIC_API_URL?: string;
-
-  // Request-and-confirm (#5970) — the callback → confirm → Payment Link path.
-  // All five optional and all read through services/request-confirm.ts, never
-  // from here directly; they are declared so the env contract is complete and
-  // one place lists them.
-  //
-  // AILK_REQUEST_CONFIRM_ENABLED is the switch: "true" turns the path on,
-  // anything else (including absent, the default) leaves the callback route
-  // behaving byte-for-byte as it did before the feature existed. TO and FROM
-  // fall back to the AILK_LEAD_NOTIFICATION_* pair; the link's base is the
-  // existing AILK_PUBLIC_API_URL above, since the confirm route is on this
-  // API. None of the five is a secret, so project.yaml's required_secrets
-  // gains nothing.
-  AILK_REQUEST_CONFIRM_ENABLED?: string;
-  AILK_REQUEST_CONFIRM_TO?: string;
-  AILK_REQUEST_CONFIRM_FROM?: string;
-  AILK_REQUEST_CONFIRM_CURRENCY?: string;
-  AILK_REQUEST_CONFIRM_MAX_MINOR?: string;
-
-  // Publish revalidation (#5851) — the signed webhook services/revalidation.ts
-  // POSTs at the site's /api/revalidate on publish/unpublish.
-  // CONTENT_REVALIDATE_SECRET is the HMAC-SHA256 signing key. Both optional;
-  // either absent means "revalidation off" — the service is a logged no-op and
-  // the publish that called it still completes.
-  CONTENT_REVALIDATE_URL?: string;
-  CONTENT_REVALIDATE_SECRET?: string;
-
-  // Scheduling webhook receiver (#6085, brief H7) — the HMAC-SHA256 key
-  // routes/webhooks/calcom.ts verifies POST /v1/webhooks/calcom's
-  // x-cal-signature-256 header against (§ D2, § D14). Read the same way
-  // STRIPE_WEBHOOK_SECRET is above — through `config`, never `process.env`
-  // at the call site. Unset makes the receiver answer 503 and accept
-  // nothing (§ D2 row 1) — the same fail-closed posture STRIPE_WEBHOOK_SECRET
-  // unset already has.
-  CAL_WEBHOOK_SECRET?: string;
-
-  // Per-workspace scheduling connections (#7533 D2) — the AES-256-GCM key
-  // services/scheduling/connections.ts encrypts each connection's provider
-  // credential and webhook secret under. Canonical standard base64 of exactly
-  // 32 random bytes (`openssl rand -base64 32`), checked at startup by
-  // resolveSchedulingCredentialKey() below; a refused value stops the API.
-  // Optional: unset (or empty) means connections cannot be written, and the
-  // env-configured CAL_API_KEY path works exactly as before. Held decoded,
-  // never as the raw string, and never logged.
-  SCHEDULING_CREDENTIAL_KEY?: Buffer;
-  // An Organization's Stripe connection (#8907 D3, contract C3, C10) — the
-  // AES-256-GCM key services/offerings/connection.ts encrypts each
-  // connection's restricted key and webhook secret under, and the key it
-  // replaced during a rotation. The SCHEDULING_CREDENTIAL_KEY shape rule,
-  // checked at startup by resolveStripeConnectionKeys() below; a refused
-  // value stops the API. Optional: unset (or empty) means a connection can be
-  // read and removed but not written. Held decoded, never logged.
-  STRIPE_CONNECTION_KEY?: Buffer;
-  STRIPE_CONNECTION_KEY_PREVIOUS?: Buffer;
-  // What a hub does with a request to a spoke-aware public surface (meeting
-  // types, the three lead writes, booking, availability, event meta, the
-  // public content reads) that carries no `x-ailk-spoke-key` (#7532 D7,
-  // #7633 D2). `"auto"` (unset, the default) refuses it once the spoke
-  // registry holds a row, and keeps the keyless answer on a deployment with
-  // no spoke; `"on"` always refuses it; `"off"` never does — an emergency
-  // opt-out, warned at boot. A mode, never a boolean: every value is a truthy
-  // string, so no reader may test it by truthiness. Parsed by
-  // parseHubRequireSpokeKey() below; read by services/public-site-resolver.ts.
-  AILK_HUB_REQUIRE_SPOKE_KEY: HubSpokeKeyMode;
-  // Whether a registered spoke key may write flow definitions into its own
-  // workspace through `PUT /v1/flows/:slug/definition` (#7876 D3). Off unless
-  // the hub's operator turns it on; warned at boot when on. Parsed by
-  // parseSpokeFlowSeed() below; read by routes/flows/index.ts.
-  AILK_SPOKE_FLOW_SEED: boolean;
-}
-
-/** `AILK_HUB_REQUIRE_SPOKE_KEY`'s three states (#7633 D2). */
-export type HubSpokeKeyMode = 'auto' | 'on' | 'off';
-
-/** Why an AILK_TRUSTED_ORIGINS entry was refused (#7395 D2). */
-export type TrustedOriginRefusal =
-  | 'wildcard'
-  | 'unparseable'
-  | 'scheme'
-  | 'not-canonical'
-  | 'trailing-dot';
-
-/** The zero-config development origin (`apps/web`'s `pnpm dev`). */
-const DEV_FRONTEND_ORIGIN = 'http://localhost:3000';
-
-/** `FRONTEND_URL`'s origin, or null when it is unusable as one (#7395 D2). */
-function primaryOrigin(raw: string): string | null {
-  // A comma means a list was put in the wrong variable:
-  // new URL('https://a.example,https://b.example').origin is 'https://a.example,https'.
-  if (raw.includes('*') || raw.includes(',')) return null;
-  let parsed: URL;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return null;
-  // WHATWG decodes a percent-encoded host: `https://%2A.example.com` has origin
-  // `https://*.example.com`, which the raw-string check above cannot see.
-  if (parsed.origin.includes('*')) return null;
-  return parsed.origin;
-}
-
-/** Why one AILK_TRUSTED_ORIGINS entry is refused, or null when it is an exact origin. */
-function refuseExtra(entry: string, nodeEnv: Config['NODE_ENV']): TrustedOriginRefusal | null {
-  // WHATWG parses `https://*.example.com` and keeps it as its own origin, so
-  // the wildcard is refused by name, before the parse (spec § 1.3).
-  if (entry.includes('*')) return 'wildcard';
-  let parsed: URL;
-  try {
-    parsed = new URL(entry);
-  } catch {
-    return 'unparseable';
-  }
-  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && nodeEnv !== 'production')) {
-    return 'scheme';
-  }
-  // Written exactly as a browser serialises an Origin header: lower-case
-  // punycode host, no default port, path, trailing slash or userinfo.
-  if (entry !== parsed.origin) return 'not-canonical';
-  // `https://a.example.` is a different origin from `https://a.example`.
-  if (parsed.hostname.endsWith('.')) return 'trailing-dot';
-  return null;
-}
-
-/**
- * The trusted browser-origin allowlist (#7395 D2). Pure; `validateConfig()`
- * calls it once.
- *
- * - `FRONTEND_URL` is normalised to its origin, as the checkout lock always
- *   did; unset outside production it is the dev default. Unset in production,
- *   or unusable (unparseable, not http(s), or containing `*` or `,`), it
- *   contributes nothing, and `primaryUnusable` reports the latter.
- * - `AILK_TRUSTED_ORIGINS` entries must already be exact origins, https-only in
- *   production. A refused entry is reported by 1-based position and reason —
- *   never its text, which may carry userinfo or a misplaced secret.
- *
- * The result is de-duplicated in first-seen order and frozen.
- */
-export function resolveTrustedOrigins(env: {
-  FRONTEND_URL?: string | undefined;
-  AILK_TRUSTED_ORIGINS?: string | undefined;
-  NODE_ENV: Config['NODE_ENV'];
-}): {
-  origins: readonly string[];
-  refused: { position: number; reason: TrustedOriginRefusal }[];
-  primaryUnusable: boolean;
-} {
-  const origins: string[] = [];
-  const refused: { position: number; reason: TrustedOriginRefusal }[] = [];
-  let primaryUnusable = false;
-
-  if (env.FRONTEND_URL) {
-    const primary = primaryOrigin(env.FRONTEND_URL);
-    if (primary === null) primaryUnusable = true;
-    else origins.push(primary);
-  } else if (env.NODE_ENV !== 'production') {
-    origins.push(DEV_FRONTEND_ORIGIN);
-  }
-
-  (env.AILK_TRUSTED_ORIGINS ?? '').split(',').forEach((piece, index) => {
-    const entry = piece.trim();
-    if (!entry) return;
-    const reason = refuseExtra(entry, env.NODE_ENV);
-    if (reason !== null) refused.push({ position: index + 1, reason });
-    else origins.push(entry);
-  });
-
-  return { origins: Object.freeze([...new Set(origins)]), refused, primaryUnusable };
-}
-
-/** Why a SCHEDULING_CREDENTIAL_KEY value was refused (#7533 D2). */
-export type SchedulingCredentialKeyRefusal = 'not-canonical-base64' | 'length';
-
-/**
- * The scheduling-connection key (#7533 D2, SEC-7533-6). Pure;
- * `validateConfig()` calls it once.
- *
- * Accepts only CANONICAL standard base64 — `Buffer.from(v, 'base64')
- * .toString('base64') === v` — of exactly 32 bytes. Base64 decoding silently
- * skips characters outside its alphabet, so without the round-trip a
- * base64url value, or a passphrase that happens to decode to 32 bytes, would
- * be taken as a key. `''` and unset are both `unset`. A refusal carries the
- * reason kind only, never any part of the value.
- */
-export function resolveSchedulingCredentialKey(
-  raw: string | undefined,
-):
-  | { kind: 'unset' }
-  | { kind: 'ok'; key: Buffer }
-  | { kind: 'refused'; reason: SchedulingCredentialKeyRefusal } {
-  if (raw === undefined || raw === '') return { kind: 'unset' };
-  const key = Buffer.from(raw, 'base64');
-  if (key.toString('base64') !== raw) {
-    return { kind: 'refused', reason: 'not-canonical-base64' };
-  }
-  if (key.length !== 32) return { kind: 'refused', reason: 'length' };
-  return { kind: 'ok', key };
-}
-
-/** The two variables an Organization's Stripe connection key is read from (#8907 D3). */
-export type StripeConnectionKeyVariable =
-  | 'STRIPE_CONNECTION_KEY'
-  | 'STRIPE_CONNECTION_KEY_PREVIOUS';
-
-/** Why a Stripe connection key was refused (#8907 D3). */
-export type StripeConnectionKeyRefusal =
-  | SchedulingCredentialKeyRefusal
-  | 'previous_without_current'
-  | 'previous_equals_current'
-  | 'shared_with_scheduling';
-
-/**
- * The Stripe connection keys (#8907 D3, contract C3, C10). Pure;
- * `validateConfig()` calls it once.
- *
- * Each raw value is read with `resolveSchedulingCredentialKey`, the one shape
- * rule. A previous key needs a current one, may not equal it, and neither may
- * equal the scheduling key (`Buffer.equals`), so one key never guards both
- * calendars and money. A refusal names the variable and the reason kind only,
- * never any part of a value.
- */
-export function resolveStripeConnectionKeys(input: {
-  current: string | undefined;
-  previous: string | undefined;
-  scheduling: Buffer | undefined;
-}):
-  | { kind: 'ok'; current?: Buffer; previous?: Buffer }
-  | {
-      kind: 'refused';
-      variable: StripeConnectionKeyVariable;
-      reason: StripeConnectionKeyRefusal;
-    } {
-  const current = resolveSchedulingCredentialKey(input.current);
-  if (current.kind === 'refused') {
-    return { kind: 'refused', variable: 'STRIPE_CONNECTION_KEY', reason: current.reason };
-  }
-  const previous = resolveSchedulingCredentialKey(input.previous);
-  if (previous.kind === 'refused') {
-    return { kind: 'refused', variable: 'STRIPE_CONNECTION_KEY_PREVIOUS', reason: previous.reason };
-  }
-  const currentKey = current.kind === 'ok' ? current.key : undefined;
-  const previousKey = previous.kind === 'ok' ? previous.key : undefined;
-  if (previousKey && !currentKey) {
-    return {
-      kind: 'refused',
-      variable: 'STRIPE_CONNECTION_KEY_PREVIOUS',
-      reason: 'previous_without_current',
-    };
-  }
-  if (previousKey && currentKey?.equals(previousKey)) {
-    return {
-      kind: 'refused',
-      variable: 'STRIPE_CONNECTION_KEY_PREVIOUS',
-      reason: 'previous_equals_current',
-    };
-  }
-  if (input.scheduling) {
-    if (currentKey?.equals(input.scheduling)) {
-      return { kind: 'refused', variable: 'STRIPE_CONNECTION_KEY', reason: 'shared_with_scheduling' };
-    }
-    if (previousKey?.equals(input.scheduling)) {
-      return {
-        kind: 'refused',
-        variable: 'STRIPE_CONNECTION_KEY_PREVIOUS',
-        reason: 'shared_with_scheduling',
-      };
-    }
-  }
-  return {
-    kind: 'ok',
-    ...(currentKey && { current: currentKey }),
-    ...(previousKey && { previous: previousKey }),
-  };
-}
-
-/**
- * `AILK_HUB_REQUIRE_SPOKE_KEY` (#7532 D7, #7633 D2): unset, empty or blank →
- * `"auto"`; `true`/`1` → `"on"`; `false`/`0` → `"off"` — case-insensitive,
- * after trimming. `null` for any other value, which `validateConfig()`
- * refuses at boot.
- */
-export function parseHubRequireSpokeKey(raw: string | undefined): HubSpokeKeyMode | null {
-  const value = (raw ?? '').trim().toLowerCase();
-  if (value === '') return 'auto';
-  if (value === 'true' || value === '1') return 'on';
-  if (value === 'false' || value === '0') return 'off';
-  return null;
-}
-
-/**
- * `AILK_SPOKE_FLOW_SEED` (#7876 D3): unset, empty or blank → `false`;
- * `true`/`1` → `true`; `false`/`0` → `false` — case-insensitive, after
- * trimming. `null` for any other value, which `validateConfig()` refuses at
- * boot.
- */
-export function parseSpokeFlowSeed(raw: string | undefined): boolean | null {
-  const value = (raw ?? '').trim().toLowerCase();
-  if (value === '' || value === 'false' || value === '0') return false;
-  if (value === 'true' || value === '1') return true;
-  return null;
-}
-
-/** Enabled modules whose state lives in the database (see validateConfig). */
-const DATABASE_MODULES = [
-  'commerce',
-  'content-write',
-  'multi-tenant',
-  'scheduling',
-  'signal-collectors',
-  'workspace',
-] as const;
-
-function validateConfig(): Config {
-  const nodeEnv = (process.env.NODE_ENV || 'development') as Config['NODE_ENV'];
-
-  // No database is a supported shape in every environment, production
-  // included (#6730 operator decision (a)): a Free site delivers leads by
-  // email and needs no Postgres. Start database-less and let the auth
-  // preHandler answer 503 database_not_configured (#6482) — it reads
-  // DATABASE_URL per request, whatever NODE_ENV says, so no authenticated
-  // route runs without a database.
-  //
-  // Except a production build whose ENABLED modules keep their state in the
-  // database. There a missing DATABASE_URL is a broken deploy, not a Free
-  // site: e.g. a commerce site's licence lives in the database-backed store,
-  // so booting without it would read the site as unlicensed and ack-and-drop
-  // every signed Stripe event (#6730 security review, M1). Those builds keep
-  // the loud startup failure.
-  if (!process.env.DATABASE_URL) {
-    const needsDatabase = DATABASE_MODULES.filter((m) => isModuleEnabled(m));
-    if (nodeEnv === 'production' && needsDatabase.length > 0) {
-      logger.error(
-        { modules: needsDatabase },
-        '❌ DATABASE_URL is required in production when these modules are enabled',
-      );
-      process.exit(1);
-    }
-    logger.warn(
-      { nodeEnv },
-      '⚠️ DATABASE_URL not set — starting database-less; authenticated routes answer 503 database_not_configured',
-    );
-  }
-
-  // #7395 D3 — a refused AILK_TRUSTED_ORIGINS entry stops the API in every
-  // environment: the variable is opt-in, and an entry dropped silently would
-  // resurface as the very 401 it was added to fix. Position and reason only,
-  // never the entry's text. console.error too, because pino-pretty's worker
-  // transport can drop the last line written before exit.
-  const trusted = resolveTrustedOrigins({
-    FRONTEND_URL: process.env.FRONTEND_URL,
-    AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
-    NODE_ENV: nodeEnv,
-  });
-  if (trusted.refused.length > 0) {
-    const message =
-      '❌ AILK_TRUSTED_ORIGINS has entries that are not exact http(s) origins (https only in production; no `*`, path, trailing slash or userinfo)';
-    logger.error({ refused: trusted.refused }, message);
-    console.error(message, JSON.stringify({ refused: trusted.refused }));
-    process.exit(1);
-  }
-  // #7395 D5 — a set-but-unusable FRONTEND_URL predates this list, so it is
-  // logged rather than fatal. The value is never echoed.
-  if (trusted.primaryUnusable) {
-    logger.error(
-      "FRONTEND_URL is set but is not an absolute http(s) URL without '*' or ',' — it is not a trusted origin",
-    );
-  }
-
-  // #7533 D2 — a set-but-refused SCHEDULING_CREDENTIAL_KEY stops the API in
-  // every environment, as a refused AILK_TRUSTED_ORIGINS entry does: a key
-  // taken in some other shape would encrypt every connection under a value
-  // the operator did not mean. The reason kind only, never the value.
-  const schedulingKey = resolveSchedulingCredentialKey(process.env.SCHEDULING_CREDENTIAL_KEY);
-  if (schedulingKey.kind === 'refused') {
-    const message =
-      '❌ SCHEDULING_CREDENTIAL_KEY must be canonical standard base64 of exactly 32 bytes (openssl rand -base64 32)';
-    logger.error({ reason: schedulingKey.reason }, message);
-    console.error(message, JSON.stringify({ reason: schedulingKey.reason }));
-    process.exit(1);
-  }
-
-  // #8907 D3 — a set-but-refused Stripe connection key stops the API in every
-  // environment, for the scheduling key's reason; so does a key shared with
-  // the scheduling key or a previous key that could never be rotated away.
-  // The variable and the reason kind only, never a value.
-  const stripeConnectionKeys = resolveStripeConnectionKeys({
-    current: process.env.STRIPE_CONNECTION_KEY,
-    previous: process.env.STRIPE_CONNECTION_KEY_PREVIOUS,
-    scheduling: schedulingKey.kind === 'ok' ? schedulingKey.key : undefined,
-  });
-  if (stripeConnectionKeys.kind === 'refused') {
-    const { variable, reason } = stripeConnectionKeys;
-    const message =
-      '❌ STRIPE_CONNECTION_KEY and STRIPE_CONNECTION_KEY_PREVIOUS must each be canonical standard base64 of exactly 32 bytes (openssl rand -base64 32), distinct from each other and from SCHEDULING_CREDENTIAL_KEY, and a previous key needs a current one';
-    logger.error({ variable, reason }, message);
-    console.error(message, JSON.stringify({ variable, reason }));
-    process.exit(1);
-  }
-
-  // #7532 D7, #7633 D2 — the hub's spoke-key mode. An unparseable value stops
-  // the API: a typo read as "off" would silently leave the hub open to
-  // header-less callers. The message names the variable, never its value.
-  // "on" with no DATABASE_URL stops it too: with no registry to look a key up
-  // in it would refuse every call. "auto" and "off" boot without a database.
-  const hubRequireSpokeKey = parseHubRequireSpokeKey(process.env.AILK_HUB_REQUIRE_SPOKE_KEY);
-  if (hubRequireSpokeKey === null) {
-    const message =
-      '❌ AILK_HUB_REQUIRE_SPOKE_KEY must be true, 1, false, 0 or unset';
-    logger.error(message);
-    console.error(message);
-    process.exit(1);
-  }
-  if (hubRequireSpokeKey === 'on' && !process.env.DATABASE_URL) {
-    const message =
-      '❌ AILK_HUB_REQUIRE_SPOKE_KEY is on but DATABASE_URL is not set — the spoke registry lives in the database';
-    logger.error(message);
-    console.error(message);
-    process.exit(1);
-  }
-  // The emergency opt-out is never silent: it reopens keyless access on every
-  // spoke-aware surface of a hub (#7633 D2, D6).
-  if (hubRequireSpokeKey === 'off') {
-    logger.warn(
-      'AILK_HUB_REQUIRE_SPOKE_KEY=false — a public request with no spoke key is accepted even when spokes are registered',
-    );
-  }
-
-  // Flow seeding is a write a spoke key could not do before (#7876 D3): a
-  // typo must never read as either state, and turning it on is never silent.
-  // The message names the variable, never its value.
-  const spokeFlowSeed = parseSpokeFlowSeed(process.env.AILK_SPOKE_FLOW_SEED);
-  if (spokeFlowSeed === null) {
-    const message = '❌ AILK_SPOKE_FLOW_SEED must be true, 1, false, 0 or unset';
-    logger.error(message);
-    console.error(message);
-    process.exit(1);
-  }
-  if (spokeFlowSeed) {
-    logger.warn(
-      "AILK_SPOKE_FLOW_SEED=true — a registered spoke key may write its own workspace's flow definitions",
-    );
-  }
-
-  return {
-    NODE_ENV: nodeEnv,
-    PORT: parseInt(process.env.PORT || '3002', 10),
-    FRONTEND_URL: process.env.FRONTEND_URL || 'http://localhost:3000',
-    TRUSTED_ORIGINS: trusted.origins,
-    ...(process.env.AILK_TRUSTED_ORIGINS !== undefined && {
-      AILK_TRUSTED_ORIGINS: process.env.AILK_TRUSTED_ORIGINS,
-    }),
-
-    ...(process.env.DATABASE_URL !== undefined && {
-      DATABASE_URL: process.env.DATABASE_URL,
-    }),
-
-    ...(process.env.STRIPE_SECRET_KEY !== undefined && {
-      STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY,
-    }),
-    ...(process.env.STRIPE_WEBHOOK_SECRET !== undefined && {
-      STRIPE_WEBHOOK_SECRET: process.env.STRIPE_WEBHOOK_SECRET,
-    }),
-
-    ...(process.env.AILK_SLACK_BOT_TOKEN !== undefined && {
-      AILK_SLACK_BOT_TOKEN: process.env.AILK_SLACK_BOT_TOKEN,
-    }),
-    ...(process.env.AILK_SLACK_SIGNING_SECRET !== undefined && {
-      AILK_SLACK_SIGNING_SECRET: process.env.AILK_SLACK_SIGNING_SECRET,
-    }),
-    ...(process.env.AILK_SLACK_CHANNEL_ID !== undefined && {
-      AILK_SLACK_CHANNEL_ID: process.env.AILK_SLACK_CHANNEL_ID,
-    }),
-
-    ...(process.env.AILK_GITHUB_REPO !== undefined && {
-      AILK_GITHUB_REPO: process.env.AILK_GITHUB_REPO,
-    }),
-    ...(process.env.AILK_GITHUB_TOKEN !== undefined && {
-      AILK_GITHUB_TOKEN: process.env.AILK_GITHUB_TOKEN,
-    }),
-
-    ...(process.env.AILK_PUBLIC_API_URL !== undefined && {
-      AILK_PUBLIC_API_URL: process.env.AILK_PUBLIC_API_URL,
-    }),
-
-    ...(process.env.AILK_REQUEST_CONFIRM_ENABLED !== undefined && {
-      AILK_REQUEST_CONFIRM_ENABLED: process.env.AILK_REQUEST_CONFIRM_ENABLED,
-    }),
-    ...(process.env.AILK_REQUEST_CONFIRM_TO !== undefined && {
-      AILK_REQUEST_CONFIRM_TO: process.env.AILK_REQUEST_CONFIRM_TO,
-    }),
-    ...(process.env.AILK_REQUEST_CONFIRM_FROM !== undefined && {
-      AILK_REQUEST_CONFIRM_FROM: process.env.AILK_REQUEST_CONFIRM_FROM,
-    }),
-    ...(process.env.AILK_REQUEST_CONFIRM_CURRENCY !== undefined && {
-      AILK_REQUEST_CONFIRM_CURRENCY: process.env.AILK_REQUEST_CONFIRM_CURRENCY,
-    }),
-    ...(process.env.AILK_REQUEST_CONFIRM_MAX_MINOR !== undefined && {
-      AILK_REQUEST_CONFIRM_MAX_MINOR: process.env.AILK_REQUEST_CONFIRM_MAX_MINOR,
-    }),
-
-    ...(process.env.CONTENT_REVALIDATE_URL !== undefined && {
-      CONTENT_REVALIDATE_URL: process.env.CONTENT_REVALIDATE_URL,
-    }),
-    ...(process.env.CONTENT_REVALIDATE_SECRET !== undefined && {
-      CONTENT_REVALIDATE_SECRET: process.env.CONTENT_REVALIDATE_SECRET,
-    }),
-
-    ...(process.env.CAL_WEBHOOK_SECRET !== undefined && {
-      CAL_WEBHOOK_SECRET: process.env.CAL_WEBHOOK_SECRET,
-    }),
-
-    ...(schedulingKey.kind === 'ok' && {
-      SCHEDULING_CREDENTIAL_KEY: schedulingKey.key,
-    }),
-    ...(stripeConnectionKeys.current && {
-      STRIPE_CONNECTION_KEY: stripeConnectionKeys.current,
-    }),
-    ...(stripeConnectionKeys.previous && {
-      STRIPE_CONNECTION_KEY_PREVIOUS: stripeConnectionKeys.previous,
-    }),
-    AILK_HUB_REQUIRE_SPOKE_KEY: hubRequireSpokeKey,
-    AILK_SPOKE_FLOW_SEED: spokeFlowSeed,
-  };
-}
-
-export const config = validateConfig();

package/templates/apps/api/src/config/modules.ts

@@ -1,83 +0,0 @@
-/**
- * Paid-module presence — the registration-grain signal used by `server.ts`
- * to decide whether a paid module's routes (and their imports) are wired
- * into this build (S1, #5088; defaulted off by D-44, #5368).
- *
- * `AILK_ENABLED_MODULES` is a comma-separated allowlist (e.g.
- * `"multi-tenant,scheduling"`). Unset means **no paid modules** — installed
- * modules enable themselves explicitly; an explicit empty string (`""`)
- * means the same (the OSS-strip build target); a list enables exactly the
- * modules it names.
- *
- * Recognized module keys: `docs`, `multi-tenant`, `workspace`, `scheduling`,
- * `signal-collectors`, `commerce` (the `ModuleName` vocabulary
- * `packages/create-ailk/src/module-architecture.ts` already models via
- * `MODULE_SLICES`) plus `content-write` — the Pro content-write surface,
- * which since #5853 means the tenant-guarded editor routes in
- * `apps/api/src/routes/workspaces/content.ts` (the untenanted
- * `create`/`update`/`delete` under `apps/api/src/routes/content/` that it used
- * to name were retired by deletion). The flag's NAME, registration grain and
- * default-off semantics are unchanged (D8) — only its documented meaning
- * widened. `content-write` is intentionally NOT a
- * `MODULE_SLICES` entry: it is not (yet) a `create-ailk --modules`
- * selector — a customer never opts into it at scaffold time, it is a
- * license-tier line drawn inside the single `apps/api` app — so it stays a
- * local registration flag here rather than widening the create-ailk module
- * vocabulary. This function does not validate its input against that list;
- * it is a thin string-set reader so `apps/api` has no reason to import
- * create-ailk's module types (outside its package allowlist anyway).
- */
-
-function enabledModules(): Set<string> {
-  const raw = process.env.AILK_ENABLED_MODULES;
-  if (raw === undefined) return new Set(); // unset = no paid modules
-  return new Set(
-    raw
-      .split(',')
-      .map((m) => m.trim())
-      .filter(Boolean),
-  );
-}
-
-/** Whether the named paid module's routes should register on this build/boot. */
-export function isModuleEnabled(moduleName: string): boolean {
-  return enabledModules().has(moduleName);
-}
-
-/**
- * The recognized optional-module keys, sorted — the vocabulary the root index
- * may report (#7501). Filtering to this list is what keeps the anonymous
- * `GET /` from echoing whatever text an operator typed into
- * `AILK_ENABLED_MODULES`. `docs` is deliberately absent: no apps/api route
- * registers under it, so reporting it would break "modules this process
- * registered routes for".
- */
-export const OPTIONAL_MODULES = [
-  "commerce",
-  "content-write",
-  "multi-tenant",
-  "scheduling",
-  "signal-collectors",
-  "workspace",
-] as const;
-
-/**
- * The optional modules whose routes this process registers, sorted. Called
- * once at build time by `server.ts`, so the answer matches what registered
- * even if the env changes afterwards.
- *
- * `content-write` counts only alongside a tenancy module (`workspace` or
- * `multi-tenant`) — the exact predicate `server.ts` registers the editor's
- * content routes under. That gate stays a literal there (the
- * slice-registration lint reads `isModuleEnabled("X")` guards by text), so the
- * predicate is repeated here and `root-modules.test.ts` asserts they agree.
- */
-export function servedModules(): string[] {
-  return OPTIONAL_MODULES.filter((name) => {
-    if (!isModuleEnabled(name)) return false;
-    if (name === "content-write") {
-      return isModuleEnabled("workspace") || isModuleEnabled("multi-tenant");
-    }
-    return true;
-  });
-}