create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/__tests__/server.test.ts

@@ -0,0 +1,471 @@
+/**
+ * @file server.test.ts
+ * @description Unit tests for server.ts - Server setup
+ *
+ * Uses the real build() function with real route plugins. All internal modules
+ * run real; external boundaries (CORS, rate-limit) are mocked at the plugin
+ * boundary since they would require live network/Redis in production.
+ */
+
+import { build, requestLogSerializer } from "../server";
+
+// External service boundaries — mocked because they require live infrastructure
+// or have ESM-only transitive deps that Jest's CJS preset cannot resolve:
+//   @fastify/cors, @fastify/rate-limit — Fastify plugins that would require
+//     live network infrastructure (CORS policy sync, Redis store) in unit tests.
+//   @working-theory/email — transitive dep on @react-email/components which is ESM-only
+//     and cannot be resolved by jest-resolve in CommonJS mode.
+jest.mock("@fastify/cors", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@fastify/rate-limit", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+describe("Server", () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+  let app: any;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+    }
+  });
+
+  describe("build function", () => {
+    it("should build Fastify server instance", async () => {
+      // ACT
+      app = await build();
+
+      // ASSERT
+      expect(app).toBeDefined();
+      expect(typeof app.inject).toBe("function");
+    });
+
+    it("should register health check route returning static OK without external calls", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/health",
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.status).toBe("healthy");
+      expect(body.timestamp).toBeDefined();
+      // No external dependencies in the health check anymore
+      expect(body.platform).toBeUndefined();
+    });
+
+    it("should register root endpoint", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.name).toBe("AI Launch Kit API");
+      expect(body.endpoints).toBeDefined();
+    });
+
+    it("should register CORS", async () => {
+      // ACT
+      app = await build();
+
+      // ASSERT - CORS should be registered (no error thrown)
+      expect(app).toBeDefined();
+    });
+
+    it("should register all route plugins", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT & ASSERT - Test that routes are registered by checking they don't 404
+      const healthResponse = await app.inject({
+        method: "GET",
+        url: "/health",
+      });
+      expect(healthResponse.statusCode).toBe(200);
+
+      const rootResponse = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+      expect(rootResponse.statusCode).toBe(200);
+    });
+
+    it("should include all endpoints in root response", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+
+      // ASSERT
+      const body = JSON.parse(response.body);
+      expect(body.endpoints).toHaveProperty("health");
+      expect(body.endpoints).toHaveProperty("tokens");
+      expect(body.endpoints).toHaveProperty("profile");
+    });
+
+    it("startup throws when LEAD_CAPTURE_FILE points at a missing directory", async () => {
+      // ARRANGE — set LEAD_CAPTURE_FILE to a path whose parent dir doesn't exist
+      // so the real validateLeadCaptureDir() throws (AC8). Restore after test.
+      const prior = process.env.LEAD_CAPTURE_FILE;
+      process.env.LEAD_CAPTURE_FILE = "/nonexistent-ailk-test-dir/leads.jsonl";
+
+      try {
+        // ACT & ASSERT
+        await expect(build()).rejects.toThrow(/LEAD_CAPTURE_FILE/);
+      } finally {
+        if (prior === undefined) {
+          delete process.env.LEAD_CAPTURE_FILE;
+        } else {
+          process.env.LEAD_CAPTURE_FILE = prior;
+        }
+      }
+    });
+  });
+});
+
+// ── Bootstrap test: raw-body parser scope encapsulation (AC 13) ──────────────
+//
+// Proves that registering the webhooks plugin (with its raw-body parser scoped
+// to application/json) does NOT leak that parser to other routes. The global
+// Fastify JSON parser must remain active for all non-webhook routes.
+
+import Fastify from "fastify";
+import { webhooksRoutes } from "../routes/webhooks/index.js";
+
+describe("Parser scope — webhooks raw-body parser does not leak", () => {
+  it("other routes still receive parsed JSON objects after webhooks plugin registers", async () => {
+    // Build a minimal server that mirrors the encapsulation pattern in server.ts:
+    //   1. Register a JSON route that echoes the parsed body.
+    //   2. Register the webhooks plugin inside an encapsulated scope with a
+    //      raw-body (buffer) parser.
+    // If the raw-body parser leaks out of the webhooks scope, the echo route
+    // would receive a Buffer instead of a parsed object.
+
+    const server = Fastify({ logger: false });
+
+    // A simple JSON echo route — simulates any existing JSON-parsed route
+    server.post("/api/echo", async (req) => ({ received: req.body }));
+
+    // Mirror of server.ts registration pattern
+    await server.register(async (webhooksScope) => {
+      webhooksScope.addContentTypeParser(
+        "application/json",
+        { parseAs: "buffer" },
+        (_req, body, done) => {
+          done(null, body);
+        },
+      );
+      await webhooksScope.register(webhooksRoutes);
+    });
+
+    await server.ready();
+
+    try {
+      const response = await server.inject({
+        method: "POST",
+        url: "/api/echo",
+        payload: { hello: "world" },
+        headers: { "content-type": "application/json" },
+      });
+
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      // Must be a plain object, not a stringified Buffer
+      expect(body.received).toEqual({ hello: "world" });
+      expect(Buffer.isBuffer(body.received)).toBe(false);
+    } finally {
+      await server.close();
+    }
+  });
+
+  describe("per-scope rate-limit defaults (#5111, DEF-004)", () => {
+    // Real end-to-end behavior against the real in-house rate-limit
+    // middleware (NOT mocked — this repo's convention is to mock only real
+    // external boundaries, never an internal module, see the file header).
+    // aeoScope's `/v1/aeo/score/example` needs no DB/network (a bundled
+    // example, `loadExampleScore()`); flowsScope's `/v1/flows/:slug` with a
+    // schema-invalid slug returns 400 before any DB access — both let the
+    // onRequest rate-limit hook be the only thing under test, regardless of
+    // the eventual handler status.
+    it("caps aeoScope at the strict pre-#4730 default (10/min) — the 11th request 429s", async () => {
+      app = await build();
+      const ip = "198.51.100.11";
+
+      for (let i = 0; i < 10; i++) {
+        const res = await app.inject({
+          method: "GET",
+          url: "/v1/aeo/score/example",
+          headers: { "x-forwarded-for": ip },
+        });
+        expect(res.statusCode).not.toBe(429);
+      }
+
+      const eleventh = await app.inject({
+        method: "GET",
+        url: "/v1/aeo/score/example",
+        headers: { "x-forwarded-for": ip },
+      });
+      expect(eleventh.statusCode).toBe(429);
+    });
+
+    it("leaves flowsScope above the strict default — 11 requests never 429", async () => {
+      // #5366 (D-48): /v1/flows/:slug only registers when signal-collectors
+      // is enabled.
+      const prior = process.env.AILK_ENABLED_MODULES;
+      process.env.AILK_ENABLED_MODULES = "signal-collectors";
+      try {
+        app = await build();
+        const ip = "198.51.100.12";
+
+        for (let i = 0; i < 11; i++) {
+          const res = await app.inject({
+            method: "GET",
+            url: "/v1/flows/not-a-real-slug!!!",
+            headers: { "x-forwarded-for": ip },
+          });
+          // Schema-invalid slug → 400, well before any rate limit or DB call.
+          expect(res.statusCode).toBe(400);
+        }
+      } finally {
+        if (prior === undefined) {
+          delete process.env.AILK_ENABLED_MODULES;
+        } else {
+          process.env.AILK_ENABLED_MODULES = prior;
+        }
+      }
+    });
+  });
+});
+
+// ── #5970 — the request log must never carry a query string ────────────────
+//
+// The security review's High finding: a bare `logger: true` gives pino's stock
+// `req` serializer, which logs `req.raw.url` VERBATIM — so every open of
+// `/v1/requests/:id/confirm?token=…` wrote a live seven-day credential into
+// the log drain, from a hook that fires before any route-level code can
+// intervene. The four fixes for that finding shipped with no assertion between
+// them, which is precisely how this class of bug comes back: a future refactor
+// restores `request.url` and nothing turns red.
+//
+// Asserted both ways — the serializer's own output, and a real captured line,
+// so neither the function nor its WIRING can regress unnoticed.
+describe("#5970 — the request log carries no query string", () => {
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("drops the query string but keeps the path and its route parameters", () => {
+    expect(
+      requestLogSerializer(
+        asRequest("/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN"),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/requests/callbk_1/confirm",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves a URL with no query exactly as it is", () => {
+    expect(requestLogSerializer(asRequest("/health")).url).toBe("/health");
+  });
+
+  it("is actually wired into the instance — a captured line carries no token", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/requests/:id/confirm", async () => ({ ok: true }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: "/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN",
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/v1/requests/callbk_1/confirm");
+      expect(captured).not.toContain("SUPERSECRETTOKEN");
+      expect(captured).not.toContain("token=");
+    } finally {
+      await fastify.close();
+    }
+  });
+});
+
+// #6084 D14/AC-9 — `GET /v1/checkout/sessions/:id` puts its credential in
+// the PATH, which the #5970 query-string strip above does not cover. A
+// `cs_…`-shaped PATH SEGMENT is truncated to its first 8 characters plus
+// `…`; the rule is segment-scoped so it cannot corrupt an unrelated URL.
+describe("#6084 D14 — a cs_… path segment is truncated to 8 characters", () => {
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("truncates a cs_… session id segment to its first 8 characters plus an ellipsis", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(
+          "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
+        ),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/checkout/sessions/cs_test_…",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves an unrelated path byte-identical to today (no cs_ segment present)", () => {
+    expect(requestLogSerializer(asRequest("/v1/checkout/sessions")).url).toBe(
+      "/v1/checkout/sessions",
+    );
+  });
+
+  it("does not truncate a segment that merely CONTAINS cs_ mid-string, only one that IS cs_…-shaped", () => {
+    expect(
+      requestLogSerializer(asRequest("/v1/content/discs_catalog")).url,
+    ).toBe("/v1/content/discs_catalog");
+  });
+
+  it("is actually wired into the instance — a captured line carries no full session id", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/checkout/sessions/:id", async () => ({ ok: true }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/v1/checkout/sessions/cs_test_…");
+      expect(captured).not.toContain(
+        "cs_test_a1B2c3D4e5F6g7H8i9J0",
+      );
+    } finally {
+      await fastify.close();
+    }
+  });
+});
+
+// #6216 D11/§ 9 A-3 — the SAME rule's second arm: a `lead_…`-shaped PATH
+// SEGMENT (every item read / PATCH under `/v1/workspaces/:id/messages/:leadId`)
+// is truncated to 8 characters plus `…`, exactly like the `cs_` case above.
+// The `cs_…` behaviour must stay byte-identical (asserted in the SAME test).
+describe("#6216 D11 — a lead_… path segment is truncated to 8 characters, cs_ unchanged", () => {
+  const LEAD_ID = "lead_01928374-65ba-7cde-89ab-0123456789ab";
+
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("truncates a lead_… id segment to its first 8 characters plus an ellipsis", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(`/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/lead_019…",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves the list path (no :leadId segment) byte-identical to today", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(
+          "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
+        ),
+      ).url,
+    ).toBe(
+      "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
+    );
+  });
+
+  it("the cs_… behaviour is byte-identical after adding the lead_ arm", () => {
+    expect(
+      requestLogSerializer(
+        asRequest("/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0"),
+      ).url,
+    ).toBe("/v1/checkout/sessions/cs_test_…");
+  });
+
+  it("is actually wired into the instance — a captured line carries no full lead id", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/workspaces/:workspaceId/messages/:leadId", async () => ({
+      ok: true,
+    }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: `/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`,
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/messages/lead_019…");
+      expect(captured).not.toContain(LEAD_ID);
+    } finally {
+      await fastify.close();
+    }
+  });
+});

package/templates/apps/api/src/__tests__/vercel-handler.test.ts

@@ -368,3 +368,48 @@ describe('vercel-handler — one build per process (#5332)', () => {
     expect(sentMessage(res)).toBe('Server build failed: Server initialization timeout after 10s');
   });
 });
+
+// #6019 AC-2 — the PATHNAME, never the raw target (#5970 security review
+// round 2, H1): this is the first log line the production entry point emits,
+// ahead of Fastify's own query-stripped one, so a route parameter's
+// credential in the query string (`/v1/requests/:id/confirm?token=…`) must
+// never reach it.
+describe('vercel-handler — the request log carries no query string (#5970)', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('logs the pathname, not the raw target, on request start', async () => {
+    const inject = jest.fn().mockResolvedValue({
+      statusCode: 200,
+      headers: {},
+      body: 'ok',
+      rawPayload: Buffer.from('ok'),
+    });
+    jest.doMock('../server', () => ({ build: jest.fn().mockResolvedValue({ inject }) }));
+    const handler = loadHandler();
+
+    const req: MockVercelRequest = {
+      method: 'GET',
+      url: '/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN',
+      headers: {},
+      body: undefined,
+      query: { token: 'SUPERSECRETTOKEN' },
+    };
+    const res = makeRes();
+
+    await handler(asRequest(req), asResponse(res));
+
+    const { logger } = require('@working-theory/observability') as {
+      logger: { info: jest.Mock };
+    };
+    const startCall = logger.info.mock.calls.find(
+      ([, msg]) => msg === '[Vercel Handler] Starting request',
+    );
+    expect(startCall?.[0]).toEqual({
+      method: 'GET',
+      pathname: '/v1/requests/callbk_1/confirm',
+    });
+    expect(JSON.stringify(logger.info.mock.calls)).not.toContain('SUPERSECRETTOKEN');
+  });
+});

package/templates/apps/api/src/__tests__/workspace-module-registration.test.ts

@@ -70,6 +70,8 @@ const MULTI_TENANT_ONLY_ROUTES = [
   { method: 'GET' as const, url: '/v1/workspaces' },
   { method: 'GET' as const, url: '/v1/billing' },
   { method: 'GET' as const, url: '/v1/waitlist-experiments' },
+  { method: 'POST' as const, url: `/v1/workspaces/${WS}/activate` },
+  { method: 'GET' as const, url: `/v1/workspaces/${WS}/sessions` },
 ];
 
 async function withEnabledModules<T>(

package/templates/apps/api/src/config/index.ts

@@ -54,6 +54,41 @@ export interface Config {
   // origin, which stays correct for any agent that fetched the spec from this
   // API. See resolveServers() in src/openapi/spec.ts.
   AILK_PUBLIC_API_URL?: string;
+
+  // Request-and-confirm (#5970) — the callback → confirm → Payment Link path.
+  // All five optional and all read through services/request-confirm.ts, never
+  // from here directly; they are declared so the env contract is complete and
+  // one place lists them.
+  //
+  // AILK_REQUEST_CONFIRM_ENABLED is the switch: "true" turns the path on,
+  // anything else (including absent, the default) leaves the callback route
+  // behaving byte-for-byte as it did before the feature existed. TO and FROM
+  // fall back to the AILK_LEAD_NOTIFICATION_* pair; the link's base is the
+  // existing AILK_PUBLIC_API_URL above, since the confirm route is on this
+  // API. None of the five is a secret, so project.yaml's required_secrets
+  // gains nothing.
+  AILK_REQUEST_CONFIRM_ENABLED?: string;
+  AILK_REQUEST_CONFIRM_TO?: string;
+  AILK_REQUEST_CONFIRM_FROM?: string;
+  AILK_REQUEST_CONFIRM_CURRENCY?: string;
+  AILK_REQUEST_CONFIRM_MAX_MINOR?: string;
+
+  // Publish revalidation (#5851) — the signed webhook services/revalidation.ts
+  // POSTs at the site's /api/revalidate on publish/unpublish.
+  // CONTENT_REVALIDATE_SECRET is the HMAC-SHA256 signing key. Both optional;
+  // either absent means "revalidation off" — the service is a logged no-op and
+  // the publish that called it still completes.
+  CONTENT_REVALIDATE_URL?: string;
+  CONTENT_REVALIDATE_SECRET?: string;
+
+  // Scheduling webhook receiver (#6085, brief H7) — the HMAC-SHA256 key
+  // routes/webhooks/calcom.ts verifies POST /v1/webhooks/calcom's
+  // x-cal-signature-256 header against (§ D2, § D14). Read the same way
+  // STRIPE_WEBHOOK_SECRET is above — through `config`, never `process.env`
+  // at the call site. Unset makes the receiver answer 503 and accept
+  // nothing (§ D2 row 1) — the same fail-closed posture STRIPE_WEBHOOK_SECRET
+  // unset already has.
+  CAL_WEBHOOK_SECRET?: string;
 }
 
 function validateConfig(): Config {
@@ -104,6 +139,33 @@ function validateConfig(): Config {
     ...(process.env.AILK_PUBLIC_API_URL !== undefined && {
       AILK_PUBLIC_API_URL: process.env.AILK_PUBLIC_API_URL,
     }),
+
+    ...(process.env.AILK_REQUEST_CONFIRM_ENABLED !== undefined && {
+      AILK_REQUEST_CONFIRM_ENABLED: process.env.AILK_REQUEST_CONFIRM_ENABLED,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_TO !== undefined && {
+      AILK_REQUEST_CONFIRM_TO: process.env.AILK_REQUEST_CONFIRM_TO,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_FROM !== undefined && {
+      AILK_REQUEST_CONFIRM_FROM: process.env.AILK_REQUEST_CONFIRM_FROM,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_CURRENCY !== undefined && {
+      AILK_REQUEST_CONFIRM_CURRENCY: process.env.AILK_REQUEST_CONFIRM_CURRENCY,
+    }),
+    ...(process.env.AILK_REQUEST_CONFIRM_MAX_MINOR !== undefined && {
+      AILK_REQUEST_CONFIRM_MAX_MINOR: process.env.AILK_REQUEST_CONFIRM_MAX_MINOR,
+    }),
+
+    ...(process.env.CONTENT_REVALIDATE_URL !== undefined && {
+      CONTENT_REVALIDATE_URL: process.env.CONTENT_REVALIDATE_URL,
+    }),
+    ...(process.env.CONTENT_REVALIDATE_SECRET !== undefined && {
+      CONTENT_REVALIDATE_SECRET: process.env.CONTENT_REVALIDATE_SECRET,
+    }),
+
+    ...(process.env.CAL_WEBHOOK_SECRET !== undefined && {
+      CAL_WEBHOOK_SECRET: process.env.CAL_WEBHOOK_SECRET,
+    }),
   };
 }
 

package/templates/apps/api/src/config/modules.ts

@@ -12,9 +12,13 @@
  * Recognized module keys: `docs`, `multi-tenant`, `workspace`, `scheduling`,
  * `signal-collectors`, `commerce` (the `ModuleName` vocabulary
  * `packages/create-ailk/src/module-architecture.ts` already models via
- * `MODULE_SLICES`) plus `content-write` — the Pro
- * content-write surface (`create`/`update`/`delete` under
- * `apps/api/src/routes/content/`). `content-write` is intentionally NOT a
+ * `MODULE_SLICES`) plus `content-write` — the Pro content-write surface,
+ * which since #5853 means the tenant-guarded editor routes in
+ * `apps/api/src/routes/workspaces/content.ts` (the untenanted
+ * `create`/`update`/`delete` under `apps/api/src/routes/content/` that it used
+ * to name were retired by deletion). The flag's NAME, registration grain and
+ * default-off semantics are unchanged (D8) — only its documented meaning
+ * widened. `content-write` is intentionally NOT a
  * `MODULE_SLICES` entry: it is not (yet) a `create-ailk --modules`
  * selector — a customer never opts into it at scaffold time, it is a
  * license-tier line drawn inside the single `apps/api` app — so it stays a