create-ailk 0.21.0 → 0.23.0

package/templates/database/__tests__/offerings-shown-price-ids-migration.test.ts

@@ -0,0 +1,86 @@
+/**
+ * @file offerings-shown-price-ids-migration.test.ts
+ *
+ * DB-free proof of the offerings_shown_price_ids migration's shape (#9070,
+ * spec docs/specs/9070-the-workspace-offerings-page-becomes-spec.md D1,
+ * AC-6). Reads the migration's own text and the config schema: it adds
+ * exactly one column to workspace_offerings, NOT NULL with the empty-array
+ * default, and exactly two CHECKs, each added NOT VALID then VALIDATEd — and
+ * creates, drops and updates nothing else, so no existing row is rewritten.
+ * The live-database half is `offerings.db.test.ts`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const MIGRATION = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20261023120000_offerings_shown_price_ids",
+  "migration.sql",
+);
+const SCHEMA = join(__dirname, "..", "config", "schema.prisma");
+
+const CHECKS = [
+  "workspace_offerings_shown_price_ids_bound",
+  "workspace_offerings_shown_prices_need_products",
+];
+
+/** The migration's statements, comments stripped, whitespace collapsed. */
+function statements(): string[] {
+  const text = readFileSync(MIGRATION, "utf8")
+    .split("\n")
+    .filter((line) => !line.trimStart().startsWith("--"))
+    .join("\n");
+  return text
+    .split(";")
+    .map((s) => s.replace(/\s+/g, " ").trim())
+    .filter((s) => s.length > 0);
+}
+
+describe("the offerings_shown_price_ids migration (#9070 D1, AC-6)", () => {
+  it("adds exactly one column, NOT NULL with the empty-array default", () => {
+    const adds = statements().filter((s) => / ADD COLUMN /.test(s));
+    expect(adds).toEqual([
+      `ALTER TABLE "workspace_offerings" ADD COLUMN "shown_price_ids" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[]`,
+    ]);
+  });
+
+  it("adds exactly the two CHECKs, each NOT VALID then VALIDATEd", () => {
+    const added = statements()
+      .map((s) => /^ALTER TABLE "workspace_offerings" ADD CONSTRAINT "([a-z0-9_]+)" CHECK .* NOT VALID$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(added).toEqual(CHECKS);
+    const validated = statements()
+      .map((s) => /^ALTER TABLE "workspace_offerings" VALIDATE CONSTRAINT "([a-z0-9_]+)"$/.exec(s)?.[1])
+      .filter((name): name is string => name !== undefined);
+    expect(validated).toEqual(CHECKS);
+    expect(statements()).toHaveLength(1 + 2 * CHECKS.length);
+  });
+
+  it("pins each CHECK's rule", () => {
+    const sql = statements().join("\n");
+    const rule = (name: string) =>
+      new RegExp(`ADD CONSTRAINT "${name}" CHECK (.*) NOT VALID`).exec(sql)?.[1];
+    expect(rule("workspace_offerings_shown_price_ids_bound")).toBe(
+      `(cardinality("shown_price_ids") <= 300 AND array_position("shown_price_ids", NULL) IS NULL)`,
+    );
+    expect(rule("workspace_offerings_shown_prices_need_products")).toBe(
+      `(cardinality("shown_price_ids") = 0 OR cardinality("shown_product_ids") > 0)`,
+    );
+  });
+
+  it("creates, drops and updates nothing, and alters no other table", () => {
+    for (const s of statements()) {
+      expect(s).not.toMatch(/^(UPDATE|INSERT|DELETE|DROP|TRUNCATE|CREATE)\b/);
+      expect(s).toMatch(/^ALTER TABLE "workspace_offerings" /);
+      expect(s).not.toMatch(/ DROP /);
+    }
+  });
+
+  it("the model maps the column with the empty-list default", () => {
+    expect(readFileSync(SCHEMA, "utf8")).toMatch(
+      /^ {2}shownPriceIds +String\[\] +@default\(\[\]\) @map\("shown_price_ids"\)$/m,
+    );
+  });
+});

package/templates/database/__tests__/offerings.db.test.ts

@@ -0,0 +1,303 @@
+/**
+ * @file offerings.db.test.ts
+ *
+ * LIVE-DATABASE proof of the three Offerings tables' constraints (#8876, spec
+ * docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2, AC-1).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied —
+ * SKIPS when DATABASE_URL is unset (the repo convention; the `apps/api Route
+ * Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so no
+ * row outlives the suite. Each refusal runs in its own savepoint and names the
+ * constraint Postgres reports, so a refusal for the wrong reason fails.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const ORG = "org_01920000-8876-7000-8000-0000000000a1";
+const ORG_2 = "org_01920000-8876-7000-8000-0000000000a2";
+const WS = "wksp_01920000-8876-7000-8000-0000000000b1";
+const WS_2 = "wksp_01920000-8876-7000-8000-0000000000b2";
+/** The fixture's placeholder: the envelope shape, decrypting under no key. */
+const PLACEHOLDER = "v1.Zml4dHVyZWl2ODg3.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA";
+/** The placeholder's `v1.<iv>.<tag>` head, to wrap a cleartext value in. */
+const ENVELOPE_HEAD = PLACEHOLDER.split(".").slice(0, 3).join(".");
+const TOKEN = "A".repeat(43);
+const TOKEN_2 = "B".repeat(43);
+
+describeDb("the Offerings tables (#8876 D1, D2, AC-1, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    await db.query("BEGIN");
+  });
+
+  afterAll(async () => {
+    await db.query("ROLLBACK");
+    await db.end();
+  });
+
+  /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+  const violation = async (run: () => Promise<unknown>): Promise<string | null> => {
+    await db.query("SAVEPOINT attempt");
+    try {
+      await run();
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return null;
+    } catch (err) {
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return (err as { constraint?: string }).constraint ?? String(err);
+    }
+  };
+
+  /** Insert one row of `table` from `cols` (plus `updated_at`). */
+  const insert = (table: string, cols: Record<string, unknown>) => {
+    const all: Record<string, unknown> = { updated_at: new Date(), ...cols };
+    const names = Object.keys(all);
+    return db.query(
+      `INSERT INTO "${table}" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+      names.map((n) => all[n]),
+    );
+  };
+
+  const connection = (cols: Record<string, unknown> = {}) =>
+    insert("stripe_connections", {
+      organization_id: ORG,
+      mode: "test",
+      key_last4: "4242",
+      credential_ciphertext: PLACEHOLDER,
+      webhook_token: TOKEN,
+      ...cols,
+    });
+
+  const workspaceOfferings = (cols: Record<string, unknown> = {}) =>
+    insert("workspace_offerings", { workspace_id: WS, ...cols });
+
+  describe("stripe_connections", () => {
+    it("accepts the fixture's envelope-shaped placeholder and mints a prefixed id", async () => {
+      await db.query("SAVEPOINT ok");
+      const { rows } = await connection({ webhook_secret_ciphertext: PLACEHOLDER });
+      expect(rows[0].id).toMatch(/^stripecon_[0-9a-f]{8}-[0-9a-f]{4}-7/);
+      await db.query("ROLLBACK TO SAVEPOINT ok");
+    });
+
+    it("accepts a live row with its go-live time", async () => {
+      expect(await violation(() => connection({ mode: "live", live_at: new Date() }))).toBeNull();
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ webhook_token: TOKEN_2 });
+        }),
+      ).toBe("stripe_connections_organization_id_key");
+    });
+
+    it("refuses a second row with one webhook token", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ organization_id: ORG_2 });
+        }),
+      ).toBe("stripe_connections_webhook_token_key");
+    });
+
+    it.each([
+      ["a mode of prod", { mode: "prod" }, "stripe_connections_mode_domain"],
+      ["a live row with no live_at", { mode: "live" }, "stripe_connections_live_at_pair"],
+      ["a test row with a live_at", { live_at: new Date() }, "stripe_connections_live_at_pair"],
+      ["a token of 42 characters", { webhook_token: "A".repeat(42) }, "stripe_connections_webhook_token_shape"],
+      ["a token with a dot", { webhook_token: `${"A".repeat(42)}.` }, "stripe_connections_webhook_token_shape"],
+      ["a last4 of three characters", { key_last4: "424" }, "stripe_connections_key_last4_shape"],
+      ["a last4 with a symbol", { key_last4: "42_2" }, "stripe_connections_key_last4_shape"],
+      [
+        "a credential stored in clear",
+        { credential_ciphertext: `rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a live credential stored in clear",
+        { credential_ciphertext: `sk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret stored in clear",
+        { webhook_secret_ciphertext: `whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      [
+        "a live key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a test key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "an IV that is not 12 bytes",
+        { credential_ciphertext: "v1.Zml4dHVyZQ.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA" },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret wrapped in the envelope's dots",
+        { webhook_secret_ciphertext: `${ENVELOPE_HEAD}.whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      ["a malformed organization_id", { organization_id: "org_1" }, "stripe_connections_organization_id_format"],
+      [
+        "a workspace id as organization_id",
+        { organization_id: WS },
+        "stripe_connections_organization_id_format",
+      ],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => connection(cols))).toBe(constraint);
+    });
+  });
+
+  describe("organization_offerings", () => {
+    const orgOfferings = (cols: Record<string, unknown> = {}) =>
+      insert("organization_offerings", { organization_id: ORG, ...cols });
+
+    it("defaults to the empty set and accepts 100 ids", async () => {
+      expect(await violation(() => orgOfferings())).toBeNull();
+      const hundred = Array.from({ length: 100 }, (_, i) => `prod_${i}`);
+      expect(await violation(() => orgOfferings({ enabled_product_ids: hundred }))).toBeNull();
+    });
+
+    it.each([
+      [
+        "more than 100 ids",
+        { enabled_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a NULL set", { enabled_product_ids: null }, "organization_offerings_enabled_product_ids_bound"],
+      [
+        "a NULL element",
+        { enabled_product_ids: ["prod_a", null] },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a malformed organization_id", { organization_id: "org_x" }, "organization_offerings_organization_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => orgOfferings(cols))).toBe(constraint);
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await orgOfferings();
+          await orgOfferings();
+        }),
+      ).toBe("organization_offerings_organization_id_key");
+    });
+  });
+
+  describe("workspace_offerings", () => {
+    it("accepts a shown set with Recommended and a snapshot with its time", async () => {
+      expect(
+        await violation(() =>
+          workspaceOfferings({
+            shown_product_ids: ["prod_growth", "prod_seo"],
+            recommended_plan_product_id: "prod_growth",
+            recommended_addon_product_id: "prod_seo",
+            snapshot: JSON.stringify({ v: 1, offerings: [] }),
+            snapshot_at: new Date(),
+          }),
+        ),
+      ).toBeNull();
+    });
+
+    it.each([
+      [
+        "a Recommended plan not in the shown set",
+        { shown_product_ids: ["prod_seo"], recommended_plan_product_id: "prod_growth" },
+        "workspace_offerings_recommended_plan_shown",
+      ],
+      [
+        "a Recommended add-on not in the shown set",
+        { shown_product_ids: ["prod_growth"], recommended_addon_product_id: "prod_seo" },
+        "workspace_offerings_recommended_addon_shown",
+      ],
+      [
+        "more than 100 ids",
+        { shown_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "workspace_offerings_shown_product_ids_bound",
+      ],
+      ["a NULL element", { shown_product_ids: [null] }, "workspace_offerings_shown_product_ids_bound"],
+      [
+        "a snapshot without snapshot_at",
+        { snapshot: JSON.stringify({ v: 1, offerings: [] }) },
+        "workspace_offerings_snapshot_pair",
+      ],
+      ["a snapshot_at without a snapshot", { snapshot_at: new Date() }, "workspace_offerings_snapshot_pair"],
+      ["a malformed workspace_id", { workspace_id: "wksp_1" }, "workspace_offerings_workspace_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+    });
+
+    describe("shown_price_ids (#9070 D1, AC-6)", () => {
+      it("reads the empty set for a row inserted without it", async () => {
+        await db.query("SAVEPOINT attempt");
+        const { rows } = await db.query(
+          `INSERT INTO "workspace_offerings" ("workspace_id", "shown_product_ids", "updated_at")
+           VALUES ($1, $2, now()) RETURNING "shown_price_ids"`,
+          [WS, ["prod_growth"]],
+        );
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        expect(rows[0].shown_price_ids).toEqual([]);
+      });
+
+      it("accepts 300 Price ids beside one Product", async () => {
+        expect(
+          await violation(() =>
+            workspaceOfferings({
+              shown_product_ids: ["prod_growth"],
+              shown_price_ids: Array.from({ length: 300 }, (_, i) => `price_${i}`),
+            }),
+          ),
+        ).toBeNull();
+      });
+
+      it.each([
+        [
+          "301 Price ids",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: Array.from({ length: 301 }, (_, i) => `price_${i}`) },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a NULL Price id",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: [null] },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a Price id with no shown Product",
+          { shown_product_ids: [], shown_price_ids: ["price_growth_yearly"] },
+          "workspace_offerings_shown_prices_need_products",
+        ],
+      ])("refuses %s", async (_label, cols, constraint) => {
+        expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+      });
+    });
+
+    it("refuses a second row for one workspace and accepts another workspace's", async () => {
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings();
+        }),
+      ).toBe("workspace_offerings_workspace_id_key");
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings({ workspace_id: WS_2 });
+        }),
+      ).toBeNull();
+    });
+  });
+});

package/templates/database/__tests__/seed.test.ts

@@ -13,9 +13,14 @@
 import {
   CONTACT_FORM_FLOW_SLUG,
   contactFormFlowConfig,
+  JOB_APPLICATION_FLOW_SLUG,
+  jobApplicationFlowConfig,
+  NEWSLETTER_FLOW_SLUG,
+  newsletterFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
+  STANDARD_MAGNET_COMPLETIONS,
 } from "@working-theory/validation";
 
 import {
@@ -109,7 +114,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
 
     await provisionDefaultWorkspace(prisma);
 
-    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(2);
+    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(4);
     expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(1, {
       where: {
         siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: REQUEST_QUOTE_FLOW_SLUG },
@@ -123,6 +128,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
         title: REQUEST_QUOTE_FLOW_TITLE,
         status: "draft",
         customersEnabled: true,
+        completion: STANDARD_MAGNET_COMPLETIONS[REQUEST_QUOTE_FLOW_SLUG],
       },
       // Empty: an existing (site_id, slug) row is never overwritten (D8, C6).
       update: {},
@@ -160,6 +166,7 @@ describe("provisionDefaultWorkspace — the Contact form magnet (#8661 D3, AC-1)
         title: "Contact form",
         status: "live",
         customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[CONTACT_FORM_FLOW_SLUG],
         landingPage: "/contact",
       },
       // Empty: a re-run never overwrites the owner's edits.
@@ -175,3 +182,59 @@ describe("provisionDefaultWorkspace — the Contact form magnet (#8661 D3, AC-1)
     expect(flowDefinitionUpsert).not.toHaveBeenCalled();
   });
 });
+
+describe("provisionDefaultWorkspace — the Job application magnet (#8746 D3, AC-2)", () => {
+  it("upserts the default workspace's live Job application, insert-if-absent", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(3, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: JOB_APPLICATION_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "job-application",
+        config: jobApplicationFlowConfig,
+        kind: "diagnostic",
+        title: "Job application",
+        status: "live",
+        customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[JOB_APPLICATION_FLOW_SLUG],
+        landingPage: "/careers",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});
+
+describe("provisionDefaultWorkspace — the newsletter magnet (#8847 D4, AC-5)", () => {
+  it("upserts the default workspace's live newsletter, insert-if-absent", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(4, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: NEWSLETTER_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "newsletter",
+        config: newsletterFlowConfig,
+        kind: "newsletter",
+        title: "Newsletter",
+        status: "live",
+        customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[NEWSLETTER_FLOW_SLUG],
+        landingPage: "/newsletter",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});

package/templates/database/auth/schema.prisma

@@ -55,6 +55,10 @@ model Organization {
   tier              String   @default("free")             // "free" | "pro" | "pro_plus" | "enterprise"
   hasCarePlan       Boolean  @default(false) @map("has_care_plan")
   seatCount         Int      @default(1) @map("seat_count")
+  // #9067 D13 — the one plan Checkout this Organization has open, recorded by
+  // POST /v1/billing/plan-checkout. The webhook binds billingCustomerId only
+  // for this session, into an empty column, and clears it. Server-side only.
+  planCheckoutSessionId String? @unique @map("plan_checkout_session_id")
 
   // Usage-billing balance counters — the Company-counter live on-demand
   // credit model (FEAT-047 P1.S2, #3710 — capture D6, NOT a CreditUsagePeriod

package/templates/database/config/schema.prisma

@@ -175,6 +175,97 @@ model SchedulingConnection {
   @@map("scheduling_connections")
 }
 
+/// StripeConnection — an Organization's own Stripe account, by a restricted
+/// key (#8876 D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// C1). One row per Organization on the SchedulingConnection shape: a plain
+/// `organizationId @unique` scalar, no relation, no foreign key (ADR 0009
+/// invariant 1). In hub-and-spoke every workspace reads its Organization's
+/// one row; a single-tenant site's sentinel Organization holds its own — no
+/// workspace-scoped key column exists anywhere. The key and the webhook
+/// secret are `v1.<iv>.<tag>.<ct>` ciphertext (contract C2), written only by
+/// apps/api's services/offerings/connection.ts; the migration's envelope
+/// CHECKs refuse a value stored in clear. Every reader sees `mode` and
+/// `keyLast4` only. `webhookToken` is a 256-bit routing id, not an
+/// authenticator. Keep every `@map` in lockstep with the migration's column
+/// names (see WorkspaceMeetings).
+model StripeConnection {
+  id                      String    @id @default(dbgenerated("('stripecon_'::text || (uuidv7())::text)")) @db.Text
+  organizationId          String    @unique @map("organization_id")
+  mode                    String    @db.VarChar(8)
+  keyLast4                String    @map("key_last4") @db.VarChar(4)
+  credentialCiphertext    String    @map("credential_ciphertext") @db.Text
+  webhookToken            String    @unique @map("webhook_token") @db.VarChar(64)
+  webhookSecretCiphertext String?   @map("webhook_secret_ciphertext") @db.Text
+  liveAt                  DateTime? @map("live_at") @db.Timestamptz
+  createdAt               DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("stripe_connections")
+}
+
+/// OrganizationOfferings — the Stripe Products an Organization has switched
+/// on for its sites (#8876 D1, C2): the org-enabled set. Its own row, not a
+/// column on the connection, because disconnecting deletes the connection and
+/// keeps this set (contract C8). One row per Organization; no row is the
+/// empty set.
+model OrganizationOfferings {
+  id                String   @id @default(dbgenerated("('orgoffer_'::text || (uuidv7())::text)")) @db.Text
+  organizationId    String   @unique @map("organization_id")
+  enabledProductIds String[] @default([]) @map("enabled_product_ids")
+  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt         DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("organization_offerings")
+}
+
+/// WorkspaceOfferings — what one workspace shows of its Organization's
+/// enabled Products (#8876 D1): the shown set, Recommended per group, and the
+/// last-good Stripe snapshot anonymous readers serve (contract T7). One row
+/// per workspace, the WorkspaceMeetings shape. The two Recommended columns
+/// must name a shown product (a CHECK), and `snapshot` and `snapshotAt` are
+/// set together (a CHECK). `snapshot` is `offeringsSnapshotSchema`-shaped,
+/// validated on read and write, never trusted. `shownPriceIds` (#9070 D1) is
+/// the shown set at Price grain; empty means every Price of each shown
+/// Product, the grain of a row saved before #9070.
+model WorkspaceOfferings {
+  id                        String    @id @default(dbgenerated("('wsoffer_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId               String    @unique @map("workspace_id")
+  shownProductIds           String[]  @default([]) @map("shown_product_ids")
+  shownPriceIds             String[]  @default([]) @map("shown_price_ids")
+  recommendedPlanProductId  String?   @map("recommended_plan_product_id")
+  recommendedAddonProductId String?   @map("recommended_addon_product_id")
+  snapshot                  Json?
+  snapshotAt                DateTime? @map("snapshot_at") @db.Timestamptz
+  createdAt                 DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt                 DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("workspace_offerings")
+}
+
+/// OfferingsCheckoutSession — the Offerings Checkout session record (#8930
+/// D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// A11, W5, A13). One row per Checkout Session the hub created, written
+/// before the checkout route answers, so the per-Organization webhook and the
+/// session read act only on a session this hub recorded — never on metadata
+/// alone. Exactly A11's six columns beside the id and createdAt; no
+/// updatedAt, because no path updates a record. Plain scalar keys, no
+/// relation, no foreign key (ADR 0009 invariant 1); the migration's CHECKs
+/// bound every column. Written and read only by apps/api's
+/// services/offerings/checkout-session-record.ts. Keep every `@map` in
+/// lockstep with the migration's column names (see WorkspaceMeetings).
+model OfferingsCheckoutSession {
+  id             String   @id @default(dbgenerated("('ocsess_'::text || (uuidv7())::text)")) @db.Text
+  sessionId      String   @unique @map("session_id") @db.Text
+  workspaceId    String   @map("workspace_id")
+  organizationId String   @map("organization_id")
+  priceId        String   @map("price_id") @db.VarChar(255)
+  lookupKey      String   @map("lookup_key") @db.VarChar(48)
+  mode           String   @db.VarChar(8)
+  createdAt      DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@map("offerings_checkout_sessions")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than

package/templates/database/inbox/schema.prisma

@@ -473,6 +473,18 @@ model FlowDefinition {
   /// `request-quote` magnet is `draft` (never served anonymously) with
   /// `customersEnabled = true`.
   customersEnabled Boolean @default(false) @map("customers_enabled")
+  /// #8757 D1/D2 — what happens after someone submits the magnet: `lead`
+  /// (the thank-you only), `invite` (an account link with the email
+  /// prefilled) or `checkout` (continue to `checkoutOffering`). A column, on
+  /// the `customersEnabled` footing: no seed or config names it. Closed by
+  /// the `flow_definitions_completion_domain` CHECK; the standard defaults are
+  /// the migration's backfill by slug (`STANDARD_MAGNET_COMPLETIONS`).
+  completion String @default("lead") @db.VarChar(16)
+  /// #8757 D1/D2 — the offering key a `checkout` magnet continues to; NULL
+  /// exactly when `completion` is not `checkout`
+  /// (`flow_definitions_checkout_offering_pair`), in the spoke checkout slug
+  /// format (`flow_definitions_checkout_offering_format`).
+  checkoutOffering String? @map("checkout_offering") @db.VarChar(40)
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
 
@@ -1283,8 +1295,11 @@ model ProjectListing {
 /// would prove nothing once that row is edited, and `statementHash` groups
 /// identical wordings. `locale` is the locale the statement was actually
 /// served in, not the one requested. `purposeId` is the site-config registry
-/// id — the join key across surfaces. Written only by
-/// apps/api/src/services/consent.ts.
+/// id — the join key across surfaces. Two writers: apps/api/src/services/consent.ts
+/// (every source), and the web sign-up hook apps/web/lib/sign-up-agreements.ts
+/// (#8765 D4), which writes only `sign_up` rows (subject `user`) of a user it
+/// creates in the same Better Auth transaction, from evidence the API built
+/// with consent.ts's own functions.
 model ConsentGrant {
   id            String   @id @default(dbgenerated("('cnsnt_'::text || (uuidv7())::text)")) @db.Text
   siteId        String   @map("site_id")