create-ailk 0.24.0 → 0.26.0

package/templates/apps/mcp/src/abuse/index.ts

@@ -1,349 +0,0 @@
-/**
- * Abuse rule orchestrator for MCP write tools.
- *
- * Runs all in-process heuristics for the anonymous write tools:
- * capture_lead, subscribe_newsletter, request_callback, start_purchase
- * (#5971), and — since #8071 — create_booking and submit_flow_step.
- *
- * Rules applied (in order):
- *   1. User-Agent deny list (applies to all write tools)
- *   2. Honeypot field check (applies to all write tools)
- *   3. Email format validation (capture_lead, subscribe_newsletter, and
- *      create_booking's attendee.email)
- *   4. Per-IP daily cap (capture_lead, start_purchase, create_booking and
- *      submit_flow_step, each on its OWN tracker — sharing one would let one
- *      tool's calls consume another's budget, a silent cross-tool denial of
- *      service)
- *
- * The paid layer (lead-routing.ts) extends with real abuse-protection
- * services. OSS gets basic heuristics that stop obvious bots.
- */
-
-import type { FastifyRequest } from "fastify";
-
-import { DailyCapTracker } from "./daily-cap.js";
-import { isValidEmail } from "./email-validator.js";
-import { isHoneypotTripped } from "./honeypot.js";
-import { buildDenyList, isUserAgentBlocked } from "./user-agent-deny.js";
-
-/**
- * Tools that require email format validation on their input, each mapped to
- * the paths the email may sit at, read in order — the first string wins: top
- * level for the lead tools, then `payload.email`, since the route lifts the
- * address from there when the top level has none (#7171, #7172: `email` is
- * optional at the top level of both bodies, so an agent could otherwise nest
- * a malformed one past this check); `attendee.email` for create_booking
- * (#8071 D3). submit_flow_step has no fixed email field — its `values` is a
- * free record the hub's flow engine validates.
- */
-const EMAIL_VALIDATED_TOOLS = new Map<string, readonly (readonly string[])[]>([
-  ["capture_lead", [["email"], ["payload", "email"]]],
-  ["subscribe_newsletter", [["email"], ["payload", "email"]]],
-  ["create_booking", [["attendee", "email"]]],
-]);
-
-/**
- * The value at `path` in `input`, or undefined when any step is not a plain
- * object — a `null`, string or array `attendee` reads as a missing email, so a
- * malformed body can never throw out of the guard (#8071 SEC-13).
- */
-function valueAt(input: unknown, path: readonly string[]): unknown {
-  let value = input;
-  for (const key of path) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-      return undefined;
-    }
-    value = (value as Record<string, unknown>)[key];
-  }
-  return value;
-}
-
-/** The per-tool daily-cap budgets, keyed by MCP tool name. */
-type DailyCapKey =
-  | "captureLead"
-  | "startPurchase"
-  | "createBooking"
-  | "submitFlowStep";
-
-/**
- * The typed reason codes an {@link AbuseResult} refusal can carry.
- *
- * The code — not the prose in `reason` — is the contract between this module
- * and its callers. `http-transport.ts` maps each code to an HTTP status
- * (`ABUSE_REFUSAL_STATUS`), so a reworded refusal reason can never move a
- * refusal between statuses, and a NEW code fails to compile until the
- * transport declares a status for it (#5994).
- */
-export const AbuseReasonCode = {
-  /** The caller's User-Agent is on the deny list. */
-  BLOCKED_USER_AGENT: "blocked_user_agent",
-  /** The submitted input filled a honeypot field. */
-  HONEYPOT_FILLED: "honeypot_filled",
-  /** The submitted input carried a malformed email address. */
-  INVALID_EMAIL: "invalid_email",
-  /** The caller's IP has spent this tool's per-IP daily budget. */
-  DAILY_CAP_REACHED: "daily_cap_reached",
-} as const;
-
-export type AbuseReasonCode =
-  (typeof AbuseReasonCode)[keyof typeof AbuseReasonCode];
-
-/**
- * Tools that apply a per-IP daily cap, each mapped to the tracker that budgets
- * it and the refusal reason it answers with. One tracker per entry — never
- * shared across tools, since a shared budget would let one tool's calls
- * consume another's allowance (purchase attempts the lead budget, flow steps
- * the lead budget they could otherwise mint Leads past).
- *
- * The reason strings here are prose for the caller and nothing more: every
- * entry refuses with {@link AbuseReasonCode.DAILY_CAP_REACHED}, and that code
- * is what decides the HTTP status. Reword either one freely.
- */
-const DAILY_CAPPED_TOOLS = new Map<
-  string,
-  { tracker: DailyCapKey; reason: string }
->([
-  [
-    "capture_lead",
-    {
-      tracker: "captureLead",
-      reason: "daily capture_lead cap reached for this IP",
-    },
-  ],
-  [
-    "start_purchase",
-    {
-      tracker: "startPurchase",
-      reason: "daily cap reached for start_purchase from this IP",
-    },
-  ],
-  [
-    "create_booking",
-    {
-      tracker: "createBooking",
-      reason: "daily cap reached for create_booking from this IP",
-    },
-  ],
-  [
-    "submit_flow_step",
-    {
-      tracker: "submitFlowStep",
-      reason: "daily cap reached for submit_flow_step from this IP",
-    },
-  ],
-]);
-
-export interface AbuseConfig {
-  /** Per-IP daily cap for capture_lead. Default 50. */
-  captureLeadDailyCapPerIp: number;
-  /**
-   * Per-IP daily cap for start_purchase (#5971). Default 20 — lower than
-   * capture_lead's, because each call creates a real Stripe Checkout Session.
-   * Optional so existing callers that construct an AbuseConfig without it
-   * keep compiling; omitted falls back to the default.
-   */
-  startPurchaseDailyCapPerIp?: number;
-  /**
-   * Per-IP daily cap for create_booking (#8071). Default 20, as for
-   * start_purchase: each call creates a real calendar event and emails the
-   * attendee an invite. Optional; omitted falls back to the default.
-   */
-  createBookingDailyCapPerIp?: number;
-  /**
-   * Per-IP daily cap for submit_flow_step (#8071). Default 50, equal to
-   * capture_lead's and no higher: a one-step flow creates a Lead in one call.
-   * Optional; omitted falls back to the default.
-   */
-  submitFlowStepDailyCapPerIp?: number;
-  /** Comma-separated extra UA substrings to block. */
-  blockedUserAgents: string;
-}
-
-/** Default per-IP daily cap for start_purchase when none is configured. */
-export const DEFAULT_START_PURCHASE_DAILY_CAP = 20;
-
-/** Default per-IP daily cap for capture_lead when none is configured. */
-export const DEFAULT_CAPTURE_LEAD_DAILY_CAP = 50;
-
-/** Default per-IP daily cap for create_booking when none is configured. */
-export const DEFAULT_CREATE_BOOKING_DAILY_CAP = 20;
-
-/** Default per-IP daily cap for submit_flow_step when none is configured. */
-export const DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP = 50;
-
-/**
- * Reads a positive-integer env var, falling back to `fallback` for anything
- * that is not one.
- *
- * `parseInt(process.env[X] ?? "20", 10)` is NOT enough, and the gap is a
- * silent fail-OPEN on a security threshold (#5971 security review round 2):
- * `?? "20"` fires only when the var is UNSET, so a var that is present but
- * BLANK — the shape `.env.example` itself teaches for three neighbouring
- * vars — reaches `parseInt("")` and yields `NaN`. `NaN` then survives every
- * downstream `??` guard (nullish coalescing catches null/undefined, not NaN),
- * and `count >= NaN` is always false, so the cap silently stops refusing
- * anything. A misconfigured deployment looks identical to a correct one at
- * rest, which is exactly why this needs a guard rather than a convention.
- */
-export function readPositiveIntEnv(name: string, fallback: number): number {
-  const parsed = Number.parseInt(process.env[name] ?? "", 10);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
-}
-
-/** Coerces a configured cap to a usable one, defaulting anything non-finite
- * or non-positive. The in-process twin of {@link readPositiveIntEnv}, for a
- * cap that arrives through {@link AbuseConfig} rather than the environment. */
-function usableCap(value: number | undefined, fallback: number): number {
-  return typeof value === "number" && Number.isFinite(value) && value > 0
-    ? value
-    : fallback;
-}
-
-/** A refusal: always carries both the typed code and its caller-facing prose. */
-export interface AbuseRefusal {
-  allowed: false;
-  /** What kind of refusal this is — the machine-readable half. */
-  code: AbuseReasonCode;
-  /** Caller-facing prose. Free to reword; nothing keys control flow on it. */
-  reason: string;
-}
-
-/** The verdict of {@link AbuseGuard.validate}. */
-export type AbuseResult = { allowed: true } | AbuseRefusal;
-
-export class AbuseGuard {
-  private readonly denyList: RegExp[];
-  private readonly caps: Record<DailyCapKey, DailyCapTracker>;
-
-  constructor(config: AbuseConfig) {
-    this.denyList = buildDenyList(config.blockedUserAgents);
-    this.caps = {
-      captureLead: new DailyCapTracker(
-        usableCap(
-          config.captureLeadDailyCapPerIp,
-          DEFAULT_CAPTURE_LEAD_DAILY_CAP,
-        ),
-      ),
-      startPurchase: new DailyCapTracker(
-        usableCap(
-          config.startPurchaseDailyCapPerIp,
-          DEFAULT_START_PURCHASE_DAILY_CAP,
-        ),
-      ),
-      createBooking: new DailyCapTracker(
-        usableCap(
-          config.createBookingDailyCapPerIp,
-          DEFAULT_CREATE_BOOKING_DAILY_CAP,
-        ),
-      ),
-      submitFlowStep: new DailyCapTracker(
-        usableCap(
-          config.submitFlowStepDailyCapPerIp,
-          DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
-        ),
-      ),
-    };
-  }
-
-  /**
-   * Validates all abuse rules for the given tool call.
-   *
-   * @param toolName - MCP tool name (e.g. "capture_lead")
-   * @param input    - Parsed tool arguments object
-   * @param request  - Fastify request (for IP + UA extraction)
-   */
-  validate(
-    toolName: string,
-    input: unknown,
-    request: FastifyRequest,
-  ): AbuseResult {
-    const ua = request.headers["user-agent"];
-    const ip = request.ip;
-
-    // Rule 1: User-Agent deny list
-    if (isUserAgentBlocked(ua, this.denyList)) {
-      return {
-        allowed: false,
-        code: AbuseReasonCode.BLOCKED_USER_AGENT,
-        reason: "blocked user agent",
-      };
-    }
-
-    // Rule 2: Honeypot
-    if (isHoneypotTripped(input)) {
-      return {
-        allowed: false,
-        code: AbuseReasonCode.HONEYPOT_FILLED,
-        reason: "honeypot field filled",
-      };
-    }
-
-    // Rule 3: Email format validation, at the tool's own email paths — the
-    // first path holding a string is the address the route will read. A
-    // missing or non-string email passes — the handler's Zod schema is the
-    // authority on required fields.
-    const emailPaths = EMAIL_VALIDATED_TOOLS.get(toolName);
-    if (emailPaths !== undefined) {
-      const email = emailPaths
-        .map((path) => valueAt(input, path))
-        .find((value) => typeof value === "string");
-      if (typeof email === "string" && !isValidEmail(email)) {
-        return {
-          allowed: false,
-          code: AbuseReasonCode.INVALID_EMAIL,
-          reason: "invalid email format",
-        };
-      }
-    }
-
-    // Rule 4: Per-IP daily cap, on the tool's OWN tracker and with the
-    // tool's OWN refusal prose — one shared code, see DAILY_CAPPED_TOOLS.
-    const cap = DAILY_CAPPED_TOOLS.get(toolName);
-    if (cap !== undefined && !this.caps[cap.tracker].isAllowed(ip)) {
-      return {
-        allowed: false,
-        code: AbuseReasonCode.DAILY_CAP_REACHED,
-        reason: cap.reason,
-      };
-    }
-
-    return { allowed: true };
-  }
-}
-
-/**
- * The abuse configuration, read from the environment. The one reader of the
- * MCP_ABUSE_* variables: both entries reach it through
- * `httpTransportConfigFromEnv()` (`src/boot.ts`), and
- * {@link createAbuseGuardFromEnv} wraps it, so a new cap is added here once.
- *
- * Every cap goes through {@link readPositiveIntEnv}: a blank, zero or
- * non-numeric value yields its default, never an unlimited cap.
- */
-export function abuseConfigFromEnv(): Required<AbuseConfig> {
-  return {
-    captureLeadDailyCapPerIp: readPositiveIntEnv(
-      "MCP_ABUSE_CAPTURE_LEAD_DAILY_CAP",
-      DEFAULT_CAPTURE_LEAD_DAILY_CAP,
-    ),
-    startPurchaseDailyCapPerIp: readPositiveIntEnv(
-      "MCP_ABUSE_START_PURCHASE_DAILY_CAP",
-      DEFAULT_START_PURCHASE_DAILY_CAP,
-    ),
-    createBookingDailyCapPerIp: readPositiveIntEnv(
-      "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
-      DEFAULT_CREATE_BOOKING_DAILY_CAP,
-    ),
-    submitFlowStepDailyCapPerIp: readPositiveIntEnv(
-      "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
-      DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
-    ),
-    // A literal read, so create-ailk's declared-env scan finds it (#7874).
-    blockedUserAgents: process.env["MCP_ABUSE_BLOCKED_USER_AGENTS"] ?? "",
-  };
-}
-
-/** An AbuseGuard built from {@link abuseConfigFromEnv}. */
-export function createAbuseGuardFromEnv(): AbuseGuard {
-  return new AbuseGuard(abuseConfigFromEnv());
-}

package/templates/apps/mcp/src/abuse/user-agent-deny.ts

@@ -1,58 +0,0 @@
-/**
- * User-Agent deny list for abuse rules.
- *
- * Built-in list blocks well-known script-runner and scraper UAs.
- * Additional patterns can be provided via MCP_ABUSE_BLOCKED_USER_AGENTS
- * (comma-separated substrings; case-insensitive prefix/infix match).
- */
-
-/**
- * Built-in patterns for well-known bot/script user agents.
- * Each is a case-insensitive regex that matches a substring of the UA string.
- */
-const BUILTIN_PATTERNS: RegExp[] = [
-  /python-requests/i,
-  /curl\//i,
-  /wget\//i,
-  /scrapy/i,
-  /go-http-client/i,
-  /libwww-perl/i,
-  /java\//i,
-  /httpx/i,
-  /aiohttp/i,
-  /node-fetch/i,
-  /axios/i,
-];
-
-/**
- * Build the full deny list by merging built-in patterns with any
- * comma-separated substrings from `extraPatterns` (e.g., from env).
- */
-export function buildDenyList(extraPatterns?: string): RegExp[] {
-  const list = [...BUILTIN_PATTERNS];
-
-  if (extraPatterns) {
-    for (const raw of extraPatterns.split(",")) {
-      const trimmed = raw.trim();
-      if (trimmed.length > 0) {
-        // Escape special regex chars so literal substrings match correctly
-        const escaped = trimmed.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-        list.push(new RegExp(escaped, "i"));
-      }
-    }
-  }
-
-  return list;
-}
-
-/**
- * Returns true if the user agent string matches any pattern in the deny list,
- * or if the UA is missing/empty (headless script behaviour).
- */
-export function isUserAgentBlocked(
-  ua: string | null | undefined,
-  denyList: RegExp[],
-): boolean {
-  if (!ua || ua.trim().length === 0) return true;
-  return denyList.some((pattern) => pattern.test(ua));
-}

package/templates/apps/mcp/src/boot.ts

@@ -1,167 +0,0 @@
-/**
- * The boot sequence and the HTTP env→config reader both entrypoints share
- * (#8070 D1, D2).
- *
- * `src/index.ts` (stdio, or HTTP on `MCP_HTTP_PORT`) and `src/app.ts` (the
- * Vercel entry) each call {@link bootMcp} before they build a transport, and
- * read the HTTP configuration through {@link httpTransportConfigFromEnv} and
- * {@link readStatelessEnv}. One copy of each, so the two entries cannot drift.
- *
- * Nothing here loads Fastify: the HTTP transport's config type is imported as
- * a type only, so the stdio entry still never loads the HTTP stack.
- */
-
-import { abuseConfigFromEnv, readPositiveIntEnv } from "./abuse/index.js";
-import type { HttpTransportConfig } from "./http-transport.js";
-import {
-  initMcpCommerceClaim,
-  startMcpClaimRefresh,
-} from "./lib/commerce-claim.js";
-import {
-  initPublicWorkspace,
-  registerLicenseKeyStore,
-} from "./lib/topology.generated.js";
-
-/**
- * Runs the boot sequence, in order: the workspace resolution, the licence-key
- * store, the commerce claim, the claim re-read loop and the one-release
- * licence warning. Each step that can fail is guarded so one failure never
- * takes the other tools down.
- */
-export async function bootMcp(): Promise<void> {
-  // Resolves the MCP server's own workspace ONCE, before any transport is
-  // built — a no-op unless CONTENT_ADAPTER=database (#5876 spec D4/D6).
-  // This is the one `await` that covers every transport:
-  // `getMcpContentAdapter()` (content-adapter.ts) stays synchronous and reads
-  // the memoised result.
-  //
-  // A REJECTION here (a transient DB error — unreachable at boot, a migration
-  // in progress, a bad DATABASE_URL) is caught rather than left to crash the
-  // process: every OTHER tool (lead capture, scheduling, …) has nothing to do
-  // with the content adapter and must keep serving. The module's un-resolved
-  // `{ kind: "not-required" }` state is left in place on a caught failure —
-  // the SAME fail-closed shape an ambiguous workspace count already produces
-  // (D5) — so content tools serve their empty/not-found shape rather than the
-  // whole server going dark over one adapter's connectivity.
-  try {
-    await initPublicWorkspace();
-  } catch (err) {
-    console.error(
-      "[mcp] initPublicWorkspace() failed — content tools will serve their " +
-        "fail-closed empty shape under CONTENT_ADAPTER=database until this " +
-        "resolves; every other tool is unaffected:",
-      err,
-    );
-  }
-
-  // Registers the renewed licence key's durable home (#6677 DD-6) BEFORE the
-  // commerce claim below memoises the licence: with a database, the key a
-  // sibling app renewed lives in one SiteSetting row, and the claim must read
-  // it. Never throws; without DATABASE_URL the file store stays in place.
-  await registerLicenseKeyStore();
-
-  // Resolves the deployment's `commerce` add-on claim at boot, before any
-  // transport is built — the sibling of the workspace resolution above and
-  // the same #5876 idiom (#5971 spec D2). Without this await the memoised
-  // claim is never resolved and `start_purchase` is invisible on a KEYED
-  // site too. The same single licence read now also resolves the licence
-  // features the deployment holds, which gate the five `feature`-tagged
-  // tools (#7136). The re-read loop below runs every `MCP_CLAIM_REFRESH_MS`
-  // thereafter (#7156), so the server's origin agrees with the manifest
-  // route's origin response within that bound; the route answers
-  // `cache-control: public, max-age=86400`, so a downstream cache may serve
-  // an older manifest for up to 24 hours.
-  //
-  // A REJECTION is caught for the same reason: a licence read that fails
-  // must not take the other 19 tools down. `initMcpCommerceClaim()` already
-  // resolves to the fail-closed "unclaimed" internally, so this catch is
-  // belt-and-braces for anything thrown outside its own try.
-  try {
-    await initMcpCommerceClaim();
-  } catch (err) {
-    console.error(
-      "[mcp] initMcpCommerceClaim() failed — start_purchase stays unregistered " +
-        "(fail-closed) until this resolves; every other tool is unaffected:",
-      err,
-    );
-  }
-
-  // Starts the bounded re-read (#7156 spec D1), after the boot read resolves
-  // so the first re-read never races it. Never throws; the timer is unref'd.
-  startMcpClaimRefresh();
-
-  // The one-release warning cycle (#7136): once per process, whichever
-  // transport follows, one stderr line per tool served without its licence
-  // feature. After the claim resolves, or it would warn for every tool.
-  //
-  // A throw here must not stop the server (#7156 spec D2, L1) — only the call
-  // is guarded, not the import: if `./server.js` fails to load, every
-  // transport loads it again and the server could not start anyway.
-  const { reportUnlicensedProTools } = await import("./server.js");
-  try {
-    reportUnlicensedProTools();
-  } catch (err) {
-    console.error(
-      "[mcp] reportUnlicensedProTools() failed — the licence boot warning was " +
-        "not written; every tool is served as registered:",
-      err,
-    );
-  }
-}
-
-/**
- * Whether the HTTP transport runs stateless, from `MCP_HTTP_STATELESS`
- * (#8070 D1). Trimmed and case-insensitive: `true`/`1` → on, `false`/`0` →
- * off, unset or empty → `defaultValue`. Anything else throws, so a typo fails
- * the boot rather than silently picking a mode.
- *
- * Each entry passes its own default: `src/index.ts` passes `false` (today's
- * stateful server, unchanged); the Vercel entry passes `true`, because a
- * stateful transport keeps its sessions in one instance's memory and cannot
- * work across the instances a serverless host runs.
- */
-export function readStatelessEnv(defaultValue: boolean): boolean {
-  // A literal read, so create-ailk's declared-env scan finds it (#7874).
-  const raw = process.env["MCP_HTTP_STATELESS"];
-  const value = (raw ?? "").trim().toLowerCase();
-  if (value === "") return defaultValue;
-  if (value === "true" || value === "1") return true;
-  if (value === "false" || value === "0") return false;
-  throw new Error(
-    `MCP_HTTP_STATELESS must be one of true, false, 1 or 0 (got "${raw}")`,
-  );
-}
-
-/**
- * The HTTP transport's configuration, read from the environment as
- * `src/index.ts` has always read it — with one change: the two per-minute
- * rates go through {@link readPositiveIntEnv}, as the daily caps already do,
- * so a blank or non-numeric value falls back to its default instead of
- * yielding `NaN` and silently disabling the limit (#8070 S8070-06).
- *
- * Every variable is optional; the defaults are shown in
- * `apps/mcp/.env.example`. Stateless mode is not read here: each entry reads
- * it through {@link readStatelessEnv} with its own default.
- */
-export function httpTransportConfigFromEnv(): HttpTransportConfig & {
-  port: number;
-} {
-  const port = parseInt(process.env["MCP_HTTP_PORT"] ?? "8080", 10);
-  const path = process.env["MCP_HTTP_PATH"] ?? "/mcp";
-  const readPerMin = readPositiveIntEnv("MCP_RATE_LIMIT_READ_PER_MIN", 60);
-  const writePerMin = readPositiveIntEnv("MCP_RATE_LIMIT_WRITE_PER_MIN", 10);
-  const writeOriginsRaw = process.env["MCP_CORS_WRITE_ALLOWED_ORIGINS"] ?? "";
-  const writeAllowedOrigins = writeOriginsRaw
-    ? writeOriginsRaw.split(",").map((o) => o.trim())
-    : [];
-  return {
-    port,
-    path,
-    rateLimits: { readPerMin, writePerMin },
-    cors: { writeAllowedOrigins },
-    // The MCP_ABUSE_* variables have one reader, shared with
-    // createAbuseGuardFromEnv (#8071); every cap falls back to its default
-    // on a blank or non-numeric value, never to unlimited (#5971).
-    abuse: abuseConfigFromEnv(),
-  };
-}

package/templates/apps/mcp/src/config/modules.ts

@@ -1,43 +0,0 @@
-/**
- * Paid-module presence — the registration-grain signal used by `server.ts`
- * to decide whether a paid module's tools are wired into this build
- * (S1, #5088; defaulted off by D-44, #5368). Mirrors
- * `apps/api/src/config/modules.ts` — apps/* may not import apps/*, so this
- * tiny reader is duplicated rather than shared.
- *
- * `AILK_ENABLED_MODULES` is a comma-separated allowlist (e.g.
- * `"multi-tenant,scheduling"`). Unset means **no paid modules** — installed
- * modules enable themselves explicitly; an explicit empty string (`""`)
- * means the same (the OSS-strip build target); a list enables exactly the
- * modules it names.
- *
- * Recognized module keys: `docs`, `multi-tenant`, `scheduling`,
- * `signal-collectors` (the `ModuleName` vocabulary
- * `packages/create-ailk/src/module-architecture.ts` already models via
- * `MODULE_SLICES`) plus `content-write` — the Pro content-write surface,
- * which owns NO MCP tool since #5853: `create_page`/`update_page`/`delete_page`
- * were retired by deletion along with their untenanted HTTP twins, and their
- * replacement is identity-bound, which the identity-blind MCP surface cannot
- * carry (D7, D15; the authed MCP surface is #3591). The flag is read here only
- * because this reader is shared with `apps/api`, where it still gates the
- * tenant-guarded editor routes. `content-write` is intentionally NOT a
- * `MODULE_SLICES` entry: it is not (yet) a create-ailk `--modules` selector,
- * so it stays a local flag here rather than widening the create-ailk module
- * vocabulary.
- */
-
-function enabledModules(): Set<string> {
-  const raw = process.env.AILK_ENABLED_MODULES;
-  if (raw === undefined) return new Set(); // unset = no paid modules
-  return new Set(
-    raw
-      .split(",")
-      .map((m) => m.trim())
-      .filter(Boolean),
-  );
-}
-
-/** Whether the named paid module's tools should register on this build/boot. */
-export function isModuleEnabled(moduleName: string): boolean {
-  return enabledModules().has(moduleName);
-}