create-ailk 0.21.0 → 0.23.0

package/templates/database/__tests__/in-page-magnets-migration.test.ts

@@ -0,0 +1,161 @@
+/**
+ * @file in-page-magnets-migration.test.ts
+ *
+ * DB-free: migrations/20261022120000_in_page_magnets writes two configs as
+ * JSONB literals, because SQL cannot import TS (#8847 spec
+ * docs/specs/8847-the-in-page-form-shape-spec.md D5; AC-3, AC-5). This test
+ * holds each literal to its one TS source so they can never drift, as
+ * `member-contract-migration.test.ts` does for the request-quote backfill:
+ *
+ *   - `newsletter backfill` inserts `newsletterFlowConfig` into every
+ *     workspace, insert-only on `(site_id, slug)`;
+ *   - `contact-form upgrade` replaces a stored Contact form with
+ *     `contactFormFlowConfig` ONLY where its config equals #8661's shipped
+ *     default as JSONB, so an owner's edit (or a wizard-built Contact form) is
+ *     never touched, and it sets nothing but `config` and `updated_at`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  CONTACT_FORM_FLOW_SLUG,
+  contactFormFlowConfig,
+  flowConfigSchema,
+  NEWSLETTER_FLOW_SLUG,
+  NEWSLETTER_FLOW_TITLE,
+  NEWSLETTER_LANDING_PAGE,
+  newsletterFlowConfig,
+  STANDARD_MAGNET_COMPLETIONS,
+} from "@working-theory/validation";
+
+const MIGRATION_SQL = readFileSync(
+  join(__dirname, "..", "migrations", "20261022120000_in_page_magnets", "migration.sql"),
+  "utf8",
+);
+
+/**
+ * #8661's shipped default Contact form — `contactFormFlowConfig` as it stood
+ * at commit e34e7468^ (`git show e34e7468^:packages/validation/src/schemas/flow.ts`),
+ * the only shape the #8661 seed ever wrote. Written out here, not imported:
+ * the constant has moved on, and this is the value the upgrade's guard must
+ * match exactly.
+ */
+const CONTACT_FORM_8661_DEFAULT = {
+  slug: "contact",
+  defaultLocale: "en",
+  steps: [
+    {
+      key: "contact",
+      type: "field",
+      copy: { title: { en: "Contact form" }, cta: { en: "Send message" } },
+      fields: [
+        { name: "name", inputType: "text", required: true, mapsTo: "name", copy: { label: { en: "Name" } } },
+        { name: "email", inputType: "email", required: true, mapsTo: "email", copy: { label: { en: "Email" } } },
+        {
+          name: "subject",
+          inputType: "select",
+          required: false,
+          options: [
+            { value: "General question", label: { en: "General question" } },
+            { value: "Working together", label: { en: "Working together" } },
+            { value: "Support", label: { en: "Support" } },
+            { value: "Press and partnerships", label: { en: "Press and partnerships" } },
+            { value: "Other", label: { en: "Other" } },
+          ],
+          copy: { label: { en: "Subject" }, placeholder: { en: "Choose a subject" } },
+        },
+        { name: "message", inputType: "textarea", required: false, copy: { label: { en: "Message" } } },
+        {
+          name: "terms",
+          inputType: "consent",
+          required: true,
+          purposes: ["service_terms"],
+          copy: {
+            label: {
+              en: "I accept the [Terms](terms), [Privacy Policy](privacy), and [Working Agreement](working_agreement).",
+            },
+          },
+        },
+      ],
+    },
+  ],
+};
+
+/** The text between `-- BEGIN <name>` and `-- END <name>`. */
+function block(name: string): string {
+  const match = new RegExp(`-- BEGIN ${name}\\n([\\s\\S]*?)-- END ${name}`).exec(MIGRATION_SQL);
+  if (!match?.[1]) throw new Error(`${name} markers not found`);
+  return match[1];
+}
+
+/** A SQL string literal's body, `''` unescaped, parsed as JSON. */
+const parseLiteral = (body: string): unknown => JSON.parse(body.replace(/''/g, "'"));
+
+/** The block with every string literal blanked, so only SQL structure is left. */
+const withoutLiterals = (sql: string): string => sql.replace(/'(?:[^']|'')*'/g, "''");
+
+describe("the newsletter backfill (#8847 D5, AC-5)", () => {
+  const sql = block("newsletter backfill");
+
+  it("carries exactly one JSONB config literal, and it deep-equals newsletterFlowConfig", () => {
+    const literals = [...sql.matchAll(/'(\{[\s\S]*?\})'::jsonb/g)];
+    expect(literals).toHaveLength(1);
+    const parsed = parseLiteral(literals[0]![1]!);
+    expect(parsed).toEqual(newsletterFlowConfig);
+    expect(flowConfigSchema.safeParse(parsed).success).toBe(true);
+  });
+
+  it("writes the constants' slug, title and landing page, kind newsletter, live, the lead completion, into every workspace", () => {
+    expect(sql).toContain(
+      `INSERT INTO "flow_definitions" ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "completion", "landing_page", "updated_at")`,
+    );
+    expect(sql).toContain(`SELECT w."id", w."id", '${NEWSLETTER_FLOW_SLUG}',`);
+    expect(STANDARD_MAGNET_COMPLETIONS[NEWSLETTER_FLOW_SLUG]).toBe("lead");
+    expect(sql).toContain(
+      `'newsletter', '${NEWSLETTER_FLOW_TITLE}', 'live', false, 'lead', '${NEWSLETTER_LANDING_PAGE}', CURRENT_TIMESTAMP`,
+    );
+    expect(sql).toContain(`FROM "workspaces" w`);
+  });
+
+  it("ends ON CONFLICT (\"site_id\", \"slug\") DO NOTHING, so an existing row is never overwritten", () => {
+    expect(sql.trimEnd().endsWith(`ON CONFLICT ("site_id", "slug") DO NOTHING;`)).toBe(true);
+    expect(sql).not.toMatch(/DO UPDATE/i);
+  });
+});
+
+describe("the contact-form upgrade (#8847 D5, C5, AC-3)", () => {
+  const sql = block("contact-form upgrade");
+  const statements = withoutLiterals(sql).split(";").filter((s) => s.trim().length > 0);
+
+  it("is one UPDATE of flow_definitions", () => {
+    expect(statements).toHaveLength(1);
+    expect(statements[0]!.trim()).toMatch(/^UPDATE "flow_definitions" SET /);
+  });
+
+  it("its SET literal deep-equals contactFormFlowConfig", () => {
+    const set = /SET "config" = '(\{[\s\S]*?\})'::jsonb/.exec(sql);
+    expect(set?.[1]).toBeDefined();
+    const parsed = parseLiteral(set![1]!);
+    expect(parsed).toEqual(contactFormFlowConfig);
+    expect(flowConfigSchema.safeParse(parsed).success).toBe(true);
+  });
+
+  it("its WHERE names the contact slug and compares config with = against a ::jsonb literal equal to #8661's default", () => {
+    const where = new RegExp(
+      `WHERE "slug" = '${CONTACT_FORM_FLOW_SLUG}' AND "config" = '(\\{[\\s\\S]*?\\})'::jsonb;`,
+    ).exec(sql);
+    expect(where?.[1]).toBeDefined();
+    expect(parseLiteral(where![1]!)).toEqual(CONTACT_FORM_8661_DEFAULT);
+    // The guard is a different value from what it writes, so a re-run matches nothing.
+    expect(CONTACT_FORM_8661_DEFAULT).not.toEqual(contactFormFlowConfig);
+    expect(flowConfigSchema.safeParse(CONTACT_FORM_8661_DEFAULT).success).toBe(true);
+  });
+
+  it("sets no column besides config and updated_at", () => {
+    const setClause = /SET ([\s\S]*?)\s+WHERE /.exec(withoutLiterals(sql))?.[1];
+    expect(setClause).toBeDefined();
+    const columns = [...setClause!.matchAll(/"([a-z_]+)"\s*=/g)].map((m) => m[1]);
+    expect(columns).toEqual(["config", "updated_at"]);
+    expect(setClause).toContain(`"updated_at" = CURRENT_TIMESTAMP`);
+  });
+});

package/templates/database/__tests__/offerings-checkout-session.db.test.ts

@@ -0,0 +1,270 @@
+/**
+ * @file offerings-checkout-session.db.test.ts
+ *
+ * LIVE-DATABASE proof of the Offerings Checkout session record's table (#8930,
+ * spec docs/specs/8930-the-offerings-checkout-session-record-spec.md D1, D2,
+ * AC-1, AC-2, AC-3; contract A11). Requires DATABASE_URL pointing at a Postgres
+ * with the migrations applied — SKIPS when DATABASE_URL is unset (the repo
+ * convention; the `apps/api Route Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so no
+ * row outlives the suite. Each refusal runs in its own savepoint and names the
+ * constraint Postgres reports, so a refusal for the wrong reason fails.
+ */
+import { idRegex } from "@working-theory/ids";
+import { parseLookupKey } from "@working-theory/validation";
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const TABLE = "offerings_checkout_sessions";
+const ORG = "org_01920000-8930-7000-8000-0000000000a1";
+const WS = "wksp_01920000-8930-7000-8000-0000000000b1";
+
+/** The one valid row every refusal changes a single column of. */
+const VALID: Record<string, unknown> = {
+  session_id: "cs_test_a1",
+  workspace_id: WS,
+  organization_id: ORG,
+  price_id: "price_1Abc",
+  lookup_key: "growth_monthly",
+  mode: "test",
+};
+
+/** The eight CHECKs D2 names, and nothing else. */
+const CHECKS = [
+  "offerings_checkout_sessions_id_format",
+  "offerings_checkout_sessions_session_id_format",
+  "offerings_checkout_sessions_workspace_id_format",
+  "offerings_checkout_sessions_organization_id_format",
+  "offerings_checkout_sessions_price_id_format",
+  "offerings_checkout_sessions_lookup_key_format",
+  "offerings_checkout_sessions_mode_domain",
+  "offerings_checkout_sessions_session_mode_agree",
+];
+
+describeDb(
+  "the Offerings Checkout session record (#8930 D1, D2, live DB)",
+  () => {
+    let db: Client;
+
+    beforeAll(async () => {
+      db = new Client({ connectionString: process.env.DATABASE_URL });
+      await db.connect();
+      await db.query("BEGIN");
+    });
+
+    afterAll(async () => {
+      await db.query("ROLLBACK");
+      await db.end();
+    });
+
+    /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+    const violation = async (
+      run: () => Promise<unknown>,
+    ): Promise<string | null> => {
+      await db.query("SAVEPOINT attempt");
+      try {
+        await run();
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        return null;
+      } catch (err) {
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        return (err as { constraint?: string }).constraint ?? String(err);
+      }
+    };
+
+    /** Insert one record: the valid row with `cols` over it. */
+    const insert = (cols: Record<string, unknown> = {}) => {
+      const all = { ...VALID, ...cols };
+      const names = Object.keys(all);
+      return db.query(
+        `INSERT INTO "${TABLE}" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+        names.map((n) => all[n]),
+      );
+    };
+
+    describe("AC-1 — exactly the record's columns", () => {
+      it("has the eight columns, each NOT NULL", async () => {
+        const { rows } = await db.query(
+          `SELECT column_name, is_nullable FROM information_schema.columns
+         WHERE table_schema = current_schema() AND table_name = $1 ORDER BY column_name`,
+          [TABLE],
+        );
+        expect(rows.map((r) => r.column_name)).toEqual([
+          "created_at",
+          "id",
+          "lookup_key",
+          "mode",
+          "organization_id",
+          "price_id",
+          "session_id",
+          "workspace_id",
+        ]);
+        expect(rows.filter((r) => r.is_nullable !== "NO")).toEqual([]);
+      });
+
+      it("carries exactly D2's eight CHECKs", async () => {
+        const { rows } = await db.query(
+          `SELECT conname FROM pg_constraint
+         WHERE conrelid = $1::regclass AND contype = 'c' ORDER BY conname`,
+          [TABLE],
+        );
+        expect(rows.map((r) => r.conname)).toEqual([...CHECKS].sort());
+      });
+
+      it("has one non-primary index: the unique session id key", async () => {
+        const { rows } = await db.query(
+          `SELECT i.relname AS name, x.indisunique AS unique FROM pg_index x
+         JOIN pg_class i ON i.oid = x.indexrelid
+         WHERE x.indrelid = $1::regclass AND NOT x.indisprimary`,
+          [TABLE],
+        );
+        expect(rows).toEqual([
+          { name: "offerings_checkout_sessions_session_id_key", unique: true },
+        ]);
+      });
+    });
+
+    describe("AC-2 — Postgres refuses each malformed row by the named constraint", () => {
+      it("accepts the valid row and mints a prefixed id", async () => {
+        await db.query("SAVEPOINT ok");
+        const { rows } = await insert();
+        expect(rows[0].id).toMatch(idRegex("offeringsCheckoutSession"));
+        await db.query("ROLLBACK TO SAVEPOINT ok");
+      });
+
+      it("accepts a live record of a live session", async () => {
+        expect(
+          await violation(() =>
+            insert({ session_id: "cs_live_a1", mode: "live" }),
+          ),
+        ).toBeNull();
+      });
+
+      it.each([
+        [
+          "a charge id",
+          { session_id: "ch_test_a1" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a session id with no body",
+          { session_id: "cs_test_" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a session id with a dash",
+          { session_id: "cs_test_a-1" },
+          "offerings_checkout_sessions_session_id_format",
+        ],
+        [
+          "a workspace id of another shape",
+          { workspace_id: "ws_1" },
+          "offerings_checkout_sessions_workspace_id_format",
+        ],
+        [
+          "an organization id of another shape",
+          { organization_id: "org_1" },
+          "offerings_checkout_sessions_organization_id_format",
+        ],
+        [
+          "an empty Price id",
+          { price_id: "" },
+          "offerings_checkout_sessions_price_id_format",
+        ],
+        [
+          "a Price id with a space",
+          { price_id: "price 1" },
+          "offerings_checkout_sessions_price_id_format",
+        ],
+        [
+          "an uppercase lookup key",
+          { lookup_key: "Growth_Monthly" },
+          "offerings_checkout_sessions_lookup_key_format",
+        ],
+        [
+          "a 41-character plan inside the column width",
+          { lookup_key: `${"a".repeat(41)}_once` },
+          "offerings_checkout_sessions_lookup_key_format",
+        ],
+        [
+          "a mode of prod",
+          { mode: "prod" },
+          "offerings_checkout_sessions_mode_domain",
+        ],
+        [
+          "a live record of a test session",
+          { mode: "live" },
+          "offerings_checkout_sessions_session_mode_agree",
+        ],
+        [
+          "a test record of a live session",
+          { session_id: "cs_live_a1" },
+          "offerings_checkout_sessions_session_mode_agree",
+        ],
+        [
+          "an id of another shape",
+          { id: "ocsess_1" },
+          "offerings_checkout_sessions_id_format",
+        ],
+      ])("refuses %s", async (_label, cols, constraint) => {
+        expect(await violation(() => insert(cols))).toBe(constraint);
+      });
+
+      it("refuses a second record of one session", async () => {
+        expect(
+          await violation(async () => {
+            await insert();
+            await insert({ price_id: "price_2Def" });
+          }),
+        ).toBe("offerings_checkout_sessions_session_id_key");
+      });
+    });
+
+    describe("AC-3 — the lookup-key CHECK accepts exactly what parseLookupKey accepts", () => {
+      const CORPUS = [
+        // Contract §3.7's worked examples.
+        "growth_monthly",
+        "growth_yearly",
+        "basic_once",
+        "samhenry-coaching_monthly",
+        "growth_quarterly",
+        "growth_pro_monthly",
+        "Growth_Monthly",
+        "wendi_retainer",
+        // The anchors, the plan's first character, and its length bound.
+        "-growth_monthly",
+        "growth-_once",
+        "growth_monthly ",
+        "growth_monthly\n",
+        "_monthly",
+        `${"a".repeat(40)}_yearly`,
+        `${"a".repeat(41)}_monthly`,
+        // 46 characters: inside VARCHAR(48), so only the CHECK can refuse it.
+        `${"a".repeat(41)}_once`,
+      ];
+
+      it("the corpus holds keys each side accepts and keys each side refuses", () => {
+        const accepted = CORPUS.filter((key) => parseLookupKey(key) !== null);
+        expect(accepted).toEqual([
+          "growth_monthly",
+          "growth_yearly",
+          "basic_once",
+          "samhenry-coaching_monthly",
+          "growth-_once",
+          `${"a".repeat(40)}_yearly`,
+        ]);
+      });
+
+      it.each(CORPUS.map((key) => [JSON.stringify(key), key]))(
+        "inserts %s if and only if the parser accepts it",
+        async (_label, key) => {
+          const refused = await violation(() => insert({ lookup_key: key }));
+          expect(refused === null).toBe(parseLookupKey(key) !== null);
+        },
+      );
+    });
+  },
+);

package/templates/database/__tests__/offerings-migration.test.ts

@@ -0,0 +1,197 @@
+/**
+ * @file offerings-migration.test.ts
+ *
+ * DB-free proof of the offerings_data_model migration's shape (#8876, spec
+ * docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2, AC-1).
+ * Reads the migration's own text and the config schema: it creates exactly
+ * the three tables, with every column the models `@map` to, the three
+ * `_id_format` CHECKs, the three reference-column format CHECKs and every
+ * integrity CHECK D1 names — and touches no other table. The live-database
+ * half is `offerings.db.test.ts`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261020120000_offerings_data_model",
+  "migration.sql",
+);
+const SCHEMA = join(__dirname, "..", "config", "schema.prisma");
+
+const TABLES: Record<string, { model: string; columns: string[] }> = {
+  stripe_connections: {
+    model: "StripeConnection",
+    columns: [
+      "id",
+      "organization_id",
+      "mode",
+      "key_last4",
+      "credential_ciphertext",
+      "webhook_token",
+      "webhook_secret_ciphertext",
+      "live_at",
+      "created_at",
+      "updated_at",
+    ],
+  },
+  organization_offerings: {
+    model: "OrganizationOfferings",
+    columns: ["id", "organization_id", "enabled_product_ids", "created_at", "updated_at"],
+  },
+  workspace_offerings: {
+    model: "WorkspaceOfferings",
+    columns: [
+      "id",
+      "workspace_id",
+      "shown_product_ids",
+      "recommended_plan_product_id",
+      "recommended_addon_product_id",
+      "snapshot",
+      "snapshot_at",
+      "created_at",
+      "updated_at",
+    ],
+  },
+};
+
+/**
+ * Columns a later migration adds, after each table's own: #9070's
+ * `shown_price_ids` (offerings-shown-price-ids-migration.test.ts).
+ */
+const LATER_COLUMNS: Record<string, string[]> = {
+  workspace_offerings: ["shown_price_ids"],
+};
+
+const CHECKS = [
+  "stripe_connections_id_format",
+  "stripe_connections_organization_id_format",
+  "organization_offerings_id_format",
+  "organization_offerings_organization_id_format",
+  "workspace_offerings_id_format",
+  "workspace_offerings_workspace_id_format",
+  "stripe_connections_mode_domain",
+  "stripe_connections_live_at_pair",
+  "stripe_connections_key_last4_shape",
+  "stripe_connections_webhook_token_shape",
+  "stripe_connections_credential_envelope",
+  "stripe_connections_webhook_secret_envelope",
+  "organization_offerings_enabled_product_ids_bound",
+  "workspace_offerings_shown_product_ids_bound",
+  "workspace_offerings_recommended_plan_shown",
+  "workspace_offerings_recommended_addon_shown",
+  "workspace_offerings_snapshot_pair",
+];
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+/** One model's body from the config schema. */
+function modelBody(model: string): string {
+  const match = new RegExp(`^model ${model} \\{\\n([\\s\\S]*?)^\\}`, "m").exec(
+    readFileSync(SCHEMA, "utf8"),
+  );
+  if (!match) throw new Error(`model ${model} not found`);
+  return match[1]!;
+}
+
+/** The column each field of a model maps to: its `@map`, else its own name. */
+function mappedColumns(model: string): string[] {
+  return modelBody(model)
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => /^[a-zA-Z]\w*\s/.test(line))
+    .map((line) => /@map\("([^"]+)"\)/.exec(line)?.[1] ?? line.split(/\s+/)[0]!);
+}
+
+describe("the offerings_data_model migration (#8876 D2, AC-1)", () => {
+  it("creates exactly the three tables, each column the model maps to", () => {
+    const creates = statements().filter((s) => s.startsWith("CREATE TABLE "));
+    expect(creates.map((s) => /^CREATE TABLE "([a-z_]+)"/.exec(s)?.[1])).toEqual(
+      Object.keys(TABLES),
+    );
+    for (const [table, { model, columns }] of Object.entries(TABLES)) {
+      const create = creates.find((s) => s.startsWith(`CREATE TABLE "${table}"`))!;
+      const created = [...create.matchAll(/(?:\( |, )"([a-z0-9_]+)" [A-Z]/g)].map((m) => m[1]);
+      expect(created).toEqual(columns);
+      // #9070 D1 — a later migration adds one column to workspace_offerings.
+      const later = LATER_COLUMNS[table] ?? [];
+      expect(mappedColumns(model).filter((c) => !later.includes(c))).toEqual(columns);
+      expect(mappedColumns(model)).toEqual(expect.arrayContaining(later));
+      expect(modelBody(model)).toContain(`@@map("${table}")`);
+    }
+  });
+
+  it("holds one unique index per key and on the webhook token", () => {
+    const indexes = statements()
+      .map((s) => /^CREATE UNIQUE INDEX "([a-z0-9_]+)"/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(indexes).toEqual([
+      "stripe_connections_organization_id_key",
+      "stripe_connections_webhook_token_key",
+      "organization_offerings_organization_id_key",
+      "workspace_offerings_workspace_id_key",
+    ]);
+  });
+
+  it("adds every named CHECK, each once", () => {
+    const added = statements()
+      .map((s) => /^ALTER TABLE "[a-z_]+" ADD CONSTRAINT "([a-z0-9_]+)" CHECK /.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(added).toEqual(CHECKS);
+  });
+
+  it("pins each CHECK's rule", () => {
+    const sql = statements().join("\n");
+    const rule = (name: string) =>
+      new RegExp(`ADD CONSTRAINT "${name}" CHECK (.*)`).exec(sql)?.[1];
+    expect(rule("stripe_connections_mode_domain")).toBe(`("mode" IN ('test', 'live'))`);
+    expect(rule("stripe_connections_live_at_pair")).toBe(
+      `(("mode" = 'live') = ("live_at" IS NOT NULL))`,
+    );
+    expect(rule("stripe_connections_webhook_token_shape")).toBe(
+      `("webhook_token" ~ '^[A-Za-z0-9_-]{43}$')`,
+    );
+    const envelope = `'^v1\\.[A-Za-z0-9_-]{16}\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]+$'`;
+    const keyPrefix = `'(rk|sk|pk)_(test|live)_|whsec_'`;
+    expect(rule("stripe_connections_credential_envelope")).toBe(
+      `("credential_ciphertext" ~ ${envelope} AND "credential_ciphertext" !~ ${keyPrefix})`,
+    );
+    expect(rule("stripe_connections_webhook_secret_envelope")).toBe(
+      `("webhook_secret_ciphertext" IS NULL OR ("webhook_secret_ciphertext" ~ ${envelope} AND "webhook_secret_ciphertext" !~ ${keyPrefix}))`,
+    );
+    for (const [name, column] of [
+      ["organization_offerings_enabled_product_ids_bound", "enabled_product_ids"],
+      ["workspace_offerings_shown_product_ids_bound", "shown_product_ids"],
+    ]) {
+      expect(rule(name!)).toBe(
+        `("${column}" IS NOT NULL AND cardinality("${column}") <= 100 AND array_position("${column}", NULL) IS NULL)`,
+      );
+    }
+    expect(rule("workspace_offerings_snapshot_pair")).toBe(
+      `(("snapshot" IS NULL) = ("snapshot_at" IS NULL))`,
+    );
+  });
+
+  it("touches no other table: no UPDATE, INSERT, DELETE, DROP, or ALTER of another table", () => {
+    const own = new Set(Object.keys(TABLES));
+    for (const s of statements()) {
+      expect(s).not.toMatch(/^(UPDATE|INSERT|DELETE|DROP|TRUNCATE)\b/);
+      const altered = /^ALTER TABLE "([a-z_]+)"/.exec(s)?.[1];
+      if (altered) expect(own.has(altered)).toBe(true);
+      const created = /^CREATE (?:UNIQUE )?INDEX "[a-z0-9_]+" ON "([a-z_]+)"/.exec(s)?.[1];
+      if (created) expect(own.has(created)).toBe(true);
+    }
+  });
+});