create-ailk 0.22.0 → 0.23.0

package/templates/database/__tests__/offerings.db.test.ts

@@ -0,0 +1,303 @@
+/**
+ * @file offerings.db.test.ts
+ *
+ * LIVE-DATABASE proof of the three Offerings tables' constraints (#8876, spec
+ * docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2, AC-1).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied —
+ * SKIPS when DATABASE_URL is unset (the repo convention; the `apps/api Route
+ * Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so no
+ * row outlives the suite. Each refusal runs in its own savepoint and names the
+ * constraint Postgres reports, so a refusal for the wrong reason fails.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const ORG = "org_01920000-8876-7000-8000-0000000000a1";
+const ORG_2 = "org_01920000-8876-7000-8000-0000000000a2";
+const WS = "wksp_01920000-8876-7000-8000-0000000000b1";
+const WS_2 = "wksp_01920000-8876-7000-8000-0000000000b2";
+/** The fixture's placeholder: the envelope shape, decrypting under no key. */
+const PLACEHOLDER = "v1.Zml4dHVyZWl2ODg3.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA";
+/** The placeholder's `v1.<iv>.<tag>` head, to wrap a cleartext value in. */
+const ENVELOPE_HEAD = PLACEHOLDER.split(".").slice(0, 3).join(".");
+const TOKEN = "A".repeat(43);
+const TOKEN_2 = "B".repeat(43);
+
+describeDb("the Offerings tables (#8876 D1, D2, AC-1, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    await db.query("BEGIN");
+  });
+
+  afterAll(async () => {
+    await db.query("ROLLBACK");
+    await db.end();
+  });
+
+  /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+  const violation = async (run: () => Promise<unknown>): Promise<string | null> => {
+    await db.query("SAVEPOINT attempt");
+    try {
+      await run();
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return null;
+    } catch (err) {
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return (err as { constraint?: string }).constraint ?? String(err);
+    }
+  };
+
+  /** Insert one row of `table` from `cols` (plus `updated_at`). */
+  const insert = (table: string, cols: Record<string, unknown>) => {
+    const all: Record<string, unknown> = { updated_at: new Date(), ...cols };
+    const names = Object.keys(all);
+    return db.query(
+      `INSERT INTO "${table}" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+      names.map((n) => all[n]),
+    );
+  };
+
+  const connection = (cols: Record<string, unknown> = {}) =>
+    insert("stripe_connections", {
+      organization_id: ORG,
+      mode: "test",
+      key_last4: "4242",
+      credential_ciphertext: PLACEHOLDER,
+      webhook_token: TOKEN,
+      ...cols,
+    });
+
+  const workspaceOfferings = (cols: Record<string, unknown> = {}) =>
+    insert("workspace_offerings", { workspace_id: WS, ...cols });
+
+  describe("stripe_connections", () => {
+    it("accepts the fixture's envelope-shaped placeholder and mints a prefixed id", async () => {
+      await db.query("SAVEPOINT ok");
+      const { rows } = await connection({ webhook_secret_ciphertext: PLACEHOLDER });
+      expect(rows[0].id).toMatch(/^stripecon_[0-9a-f]{8}-[0-9a-f]{4}-7/);
+      await db.query("ROLLBACK TO SAVEPOINT ok");
+    });
+
+    it("accepts a live row with its go-live time", async () => {
+      expect(await violation(() => connection({ mode: "live", live_at: new Date() }))).toBeNull();
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ webhook_token: TOKEN_2 });
+        }),
+      ).toBe("stripe_connections_organization_id_key");
+    });
+
+    it("refuses a second row with one webhook token", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ organization_id: ORG_2 });
+        }),
+      ).toBe("stripe_connections_webhook_token_key");
+    });
+
+    it.each([
+      ["a mode of prod", { mode: "prod" }, "stripe_connections_mode_domain"],
+      ["a live row with no live_at", { mode: "live" }, "stripe_connections_live_at_pair"],
+      ["a test row with a live_at", { live_at: new Date() }, "stripe_connections_live_at_pair"],
+      ["a token of 42 characters", { webhook_token: "A".repeat(42) }, "stripe_connections_webhook_token_shape"],
+      ["a token with a dot", { webhook_token: `${"A".repeat(42)}.` }, "stripe_connections_webhook_token_shape"],
+      ["a last4 of three characters", { key_last4: "424" }, "stripe_connections_key_last4_shape"],
+      ["a last4 with a symbol", { key_last4: "42_2" }, "stripe_connections_key_last4_shape"],
+      [
+        "a credential stored in clear",
+        { credential_ciphertext: `rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a live credential stored in clear",
+        { credential_ciphertext: `sk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret stored in clear",
+        { webhook_secret_ciphertext: `whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      [
+        "a live key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a test key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "an IV that is not 12 bytes",
+        { credential_ciphertext: "v1.Zml4dHVyZQ.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA" },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret wrapped in the envelope's dots",
+        { webhook_secret_ciphertext: `${ENVELOPE_HEAD}.whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      ["a malformed organization_id", { organization_id: "org_1" }, "stripe_connections_organization_id_format"],
+      [
+        "a workspace id as organization_id",
+        { organization_id: WS },
+        "stripe_connections_organization_id_format",
+      ],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => connection(cols))).toBe(constraint);
+    });
+  });
+
+  describe("organization_offerings", () => {
+    const orgOfferings = (cols: Record<string, unknown> = {}) =>
+      insert("organization_offerings", { organization_id: ORG, ...cols });
+
+    it("defaults to the empty set and accepts 100 ids", async () => {
+      expect(await violation(() => orgOfferings())).toBeNull();
+      const hundred = Array.from({ length: 100 }, (_, i) => `prod_${i}`);
+      expect(await violation(() => orgOfferings({ enabled_product_ids: hundred }))).toBeNull();
+    });
+
+    it.each([
+      [
+        "more than 100 ids",
+        { enabled_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a NULL set", { enabled_product_ids: null }, "organization_offerings_enabled_product_ids_bound"],
+      [
+        "a NULL element",
+        { enabled_product_ids: ["prod_a", null] },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a malformed organization_id", { organization_id: "org_x" }, "organization_offerings_organization_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => orgOfferings(cols))).toBe(constraint);
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await orgOfferings();
+          await orgOfferings();
+        }),
+      ).toBe("organization_offerings_organization_id_key");
+    });
+  });
+
+  describe("workspace_offerings", () => {
+    it("accepts a shown set with Recommended and a snapshot with its time", async () => {
+      expect(
+        await violation(() =>
+          workspaceOfferings({
+            shown_product_ids: ["prod_growth", "prod_seo"],
+            recommended_plan_product_id: "prod_growth",
+            recommended_addon_product_id: "prod_seo",
+            snapshot: JSON.stringify({ v: 1, offerings: [] }),
+            snapshot_at: new Date(),
+          }),
+        ),
+      ).toBeNull();
+    });
+
+    it.each([
+      [
+        "a Recommended plan not in the shown set",
+        { shown_product_ids: ["prod_seo"], recommended_plan_product_id: "prod_growth" },
+        "workspace_offerings_recommended_plan_shown",
+      ],
+      [
+        "a Recommended add-on not in the shown set",
+        { shown_product_ids: ["prod_growth"], recommended_addon_product_id: "prod_seo" },
+        "workspace_offerings_recommended_addon_shown",
+      ],
+      [
+        "more than 100 ids",
+        { shown_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "workspace_offerings_shown_product_ids_bound",
+      ],
+      ["a NULL element", { shown_product_ids: [null] }, "workspace_offerings_shown_product_ids_bound"],
+      [
+        "a snapshot without snapshot_at",
+        { snapshot: JSON.stringify({ v: 1, offerings: [] }) },
+        "workspace_offerings_snapshot_pair",
+      ],
+      ["a snapshot_at without a snapshot", { snapshot_at: new Date() }, "workspace_offerings_snapshot_pair"],
+      ["a malformed workspace_id", { workspace_id: "wksp_1" }, "workspace_offerings_workspace_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+    });
+
+    describe("shown_price_ids (#9070 D1, AC-6)", () => {
+      it("reads the empty set for a row inserted without it", async () => {
+        await db.query("SAVEPOINT attempt");
+        const { rows } = await db.query(
+          `INSERT INTO "workspace_offerings" ("workspace_id", "shown_product_ids", "updated_at")
+           VALUES ($1, $2, now()) RETURNING "shown_price_ids"`,
+          [WS, ["prod_growth"]],
+        );
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        expect(rows[0].shown_price_ids).toEqual([]);
+      });
+
+      it("accepts 300 Price ids beside one Product", async () => {
+        expect(
+          await violation(() =>
+            workspaceOfferings({
+              shown_product_ids: ["prod_growth"],
+              shown_price_ids: Array.from({ length: 300 }, (_, i) => `price_${i}`),
+            }),
+          ),
+        ).toBeNull();
+      });
+
+      it.each([
+        [
+          "301 Price ids",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: Array.from({ length: 301 }, (_, i) => `price_${i}`) },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a NULL Price id",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: [null] },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a Price id with no shown Product",
+          { shown_product_ids: [], shown_price_ids: ["price_growth_yearly"] },
+          "workspace_offerings_shown_prices_need_products",
+        ],
+      ])("refuses %s", async (_label, cols, constraint) => {
+        expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+      });
+    });
+
+    it("refuses a second row for one workspace and accepts another workspace's", async () => {
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings();
+        }),
+      ).toBe("workspace_offerings_workspace_id_key");
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings({ workspace_id: WS_2 });
+        }),
+      ).toBeNull();
+    });
+  });
+});

package/templates/database/__tests__/seed.test.ts

@@ -15,6 +15,8 @@ import {
   contactFormFlowConfig,
   JOB_APPLICATION_FLOW_SLUG,
   jobApplicationFlowConfig,
+  NEWSLETTER_FLOW_SLUG,
+  newsletterFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
@@ -112,7 +114,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
 
     await provisionDefaultWorkspace(prisma);
 
-    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(3);
+    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(4);
     expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(1, {
       where: {
         siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: REQUEST_QUOTE_FLOW_SLUG },
@@ -208,3 +210,31 @@ describe("provisionDefaultWorkspace — the Job application magnet (#8746 D3, AC
     });
   });
 });
+
+describe("provisionDefaultWorkspace — the newsletter magnet (#8847 D4, AC-5)", () => {
+  it("upserts the default workspace's live newsletter, insert-if-absent", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(4, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: NEWSLETTER_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "newsletter",
+        config: newsletterFlowConfig,
+        kind: "newsletter",
+        title: "Newsletter",
+        status: "live",
+        customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[NEWSLETTER_FLOW_SLUG],
+        landingPage: "/newsletter",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});

package/templates/database/auth/schema.prisma

@@ -55,6 +55,10 @@ model Organization {
   tier              String   @default("free")             // "free" | "pro" | "pro_plus" | "enterprise"
   hasCarePlan       Boolean  @default(false) @map("has_care_plan")
   seatCount         Int      @default(1) @map("seat_count")
+  // #9067 D13 — the one plan Checkout this Organization has open, recorded by
+  // POST /v1/billing/plan-checkout. The webhook binds billingCustomerId only
+  // for this session, into an empty column, and clears it. Server-side only.
+  planCheckoutSessionId String? @unique @map("plan_checkout_session_id")
 
   // Usage-billing balance counters — the Company-counter live on-demand
   // credit model (FEAT-047 P1.S2, #3710 — capture D6, NOT a CreditUsagePeriod

package/templates/database/config/schema.prisma

@@ -175,6 +175,97 @@ model SchedulingConnection {
   @@map("scheduling_connections")
 }
 
+/// StripeConnection — an Organization's own Stripe account, by a restricted
+/// key (#8876 D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// C1). One row per Organization on the SchedulingConnection shape: a plain
+/// `organizationId @unique` scalar, no relation, no foreign key (ADR 0009
+/// invariant 1). In hub-and-spoke every workspace reads its Organization's
+/// one row; a single-tenant site's sentinel Organization holds its own — no
+/// workspace-scoped key column exists anywhere. The key and the webhook
+/// secret are `v1.<iv>.<tag>.<ct>` ciphertext (contract C2), written only by
+/// apps/api's services/offerings/connection.ts; the migration's envelope
+/// CHECKs refuse a value stored in clear. Every reader sees `mode` and
+/// `keyLast4` only. `webhookToken` is a 256-bit routing id, not an
+/// authenticator. Keep every `@map` in lockstep with the migration's column
+/// names (see WorkspaceMeetings).
+model StripeConnection {
+  id                      String    @id @default(dbgenerated("('stripecon_'::text || (uuidv7())::text)")) @db.Text
+  organizationId          String    @unique @map("organization_id")
+  mode                    String    @db.VarChar(8)
+  keyLast4                String    @map("key_last4") @db.VarChar(4)
+  credentialCiphertext    String    @map("credential_ciphertext") @db.Text
+  webhookToken            String    @unique @map("webhook_token") @db.VarChar(64)
+  webhookSecretCiphertext String?   @map("webhook_secret_ciphertext") @db.Text
+  liveAt                  DateTime? @map("live_at") @db.Timestamptz
+  createdAt               DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("stripe_connections")
+}
+
+/// OrganizationOfferings — the Stripe Products an Organization has switched
+/// on for its sites (#8876 D1, C2): the org-enabled set. Its own row, not a
+/// column on the connection, because disconnecting deletes the connection and
+/// keeps this set (contract C8). One row per Organization; no row is the
+/// empty set.
+model OrganizationOfferings {
+  id                String   @id @default(dbgenerated("('orgoffer_'::text || (uuidv7())::text)")) @db.Text
+  organizationId    String   @unique @map("organization_id")
+  enabledProductIds String[] @default([]) @map("enabled_product_ids")
+  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt         DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("organization_offerings")
+}
+
+/// WorkspaceOfferings — what one workspace shows of its Organization's
+/// enabled Products (#8876 D1): the shown set, Recommended per group, and the
+/// last-good Stripe snapshot anonymous readers serve (contract T7). One row
+/// per workspace, the WorkspaceMeetings shape. The two Recommended columns
+/// must name a shown product (a CHECK), and `snapshot` and `snapshotAt` are
+/// set together (a CHECK). `snapshot` is `offeringsSnapshotSchema`-shaped,
+/// validated on read and write, never trusted. `shownPriceIds` (#9070 D1) is
+/// the shown set at Price grain; empty means every Price of each shown
+/// Product, the grain of a row saved before #9070.
+model WorkspaceOfferings {
+  id                        String    @id @default(dbgenerated("('wsoffer_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId               String    @unique @map("workspace_id")
+  shownProductIds           String[]  @default([]) @map("shown_product_ids")
+  shownPriceIds             String[]  @default([]) @map("shown_price_ids")
+  recommendedPlanProductId  String?   @map("recommended_plan_product_id")
+  recommendedAddonProductId String?   @map("recommended_addon_product_id")
+  snapshot                  Json?
+  snapshotAt                DateTime? @map("snapshot_at") @db.Timestamptz
+  createdAt                 DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt                 DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("workspace_offerings")
+}
+
+/// OfferingsCheckoutSession — the Offerings Checkout session record (#8930
+/// D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// A11, W5, A13). One row per Checkout Session the hub created, written
+/// before the checkout route answers, so the per-Organization webhook and the
+/// session read act only on a session this hub recorded — never on metadata
+/// alone. Exactly A11's six columns beside the id and createdAt; no
+/// updatedAt, because no path updates a record. Plain scalar keys, no
+/// relation, no foreign key (ADR 0009 invariant 1); the migration's CHECKs
+/// bound every column. Written and read only by apps/api's
+/// services/offerings/checkout-session-record.ts. Keep every `@map` in
+/// lockstep with the migration's column names (see WorkspaceMeetings).
+model OfferingsCheckoutSession {
+  id             String   @id @default(dbgenerated("('ocsess_'::text || (uuidv7())::text)")) @db.Text
+  sessionId      String   @unique @map("session_id") @db.Text
+  workspaceId    String   @map("workspace_id")
+  organizationId String   @map("organization_id")
+  priceId        String   @map("price_id") @db.VarChar(255)
+  lookupKey      String   @map("lookup_key") @db.VarChar(48)
+  mode           String   @db.VarChar(8)
+  createdAt      DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@map("offerings_checkout_sessions")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than

package/templates/database/migrations/20261020120000_offerings_data_model/migration.sql

@@ -0,0 +1,146 @@
+-- #8876 — the Offerings data model (spec
+-- docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2; contract
+-- docs/specs/8879-the-offerings-security-contract-key-spec.md C1):
+--
+--   stripe_connections (config) — an Organization's own Stripe account by a
+--     restricted key: the mode, the key's last four, the key and webhook
+--     secret as AES-256-GCM ciphertext written only by apps/api's
+--     services/offerings/connection.ts, and a per-connection webhook token.
+--   organization_offerings (config) — the Products an Organization has
+--     switched on (the org-enabled set). Kept when a connection is deleted.
+--   workspace_offerings (config) — the Products one workspace shows, its
+--     Recommended plan and add-on, and the last-good Stripe snapshot.
+--
+-- Three new tables in the house style of 20261003130000_scheduling_connection
+-- (CreateTable + CreateIndex as `prisma migrate diff` emits them, then the
+-- ADR-0031 rule-3 id-format completion, in ONE migration since the tables are
+-- new), plus a format CHECK on each reference column (the
+-- workspace_piece_stages style) and the integrity CHECKs spec D1 names. Plain
+-- scalar keys, no foreign key (ADR 0009 invariant 1).
+--
+-- The two ciphertext envelope CHECKs are the `v1.<iv>.<tag>.<ciphertext>`
+-- base64url shape the cipher writes — a 12-byte IV (16 characters) and a
+-- 16-byte tag (22) — and refuse a Stripe key or signing-secret prefix
+-- anywhere in the value, so a writer bug that stored a key or a secret in
+-- clear, bare or wrapped in the envelope's dots, is refused here
+-- (SEC-8876-3, SEC-PR8955-2).
+--
+-- No backfill, no constraint relaxed, no existing table touched.
+--
+-- Rollback: DROP TABLE "stripe_connections", "organization_offerings",
+-- "workspace_offerings". Every stored connection and selection is lost and
+-- every site returns to its page content.
+
+-- CreateTable
+CREATE TABLE "stripe_connections" (
+    "id" TEXT NOT NULL DEFAULT ('stripecon_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "mode" VARCHAR(8) NOT NULL,
+    "key_last4" VARCHAR(4) NOT NULL,
+    "credential_ciphertext" TEXT NOT NULL,
+    "webhook_token" VARCHAR(64) NOT NULL,
+    "webhook_secret_ciphertext" TEXT,
+    "live_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "stripe_connections_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "organization_offerings" (
+    "id" TEXT NOT NULL DEFAULT ('orgoffer_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "enabled_product_ids" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "organization_offerings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_offerings" (
+    "id" TEXT NOT NULL DEFAULT ('wsoffer_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "shown_product_ids" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "recommended_plan_product_id" TEXT,
+    "recommended_addon_product_id" TEXT,
+    "snapshot" JSONB,
+    "snapshot_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "workspace_offerings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "stripe_connections_organization_id_key" ON "stripe_connections"("organization_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "stripe_connections_webhook_token_key" ON "stripe_connections"("webhook_token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "organization_offerings_organization_id_key" ON "organization_offerings"("organization_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_offerings_workspace_id_key" ON "workspace_offerings"("workspace_id");
+
+-- ADR-0031 rule 3 — stripe_connections: stripecon_, organization_offerings:
+-- orgoffer_, workspace_offerings: wsoffer_ (registered in
+-- packages/ids/src/registry.ts ENTITY_PREFIX; this migration's path is added
+-- to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "stripe_connections" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "stripe_connections" ALTER COLUMN "id" SET DEFAULT ('stripecon_'::text || (uuidv7())::text);
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_id_format" CHECK ("id" ~ '^stripecon_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "organization_offerings" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "organization_offerings" ALTER COLUMN "id" SET DEFAULT ('orgoffer_'::text || (uuidv7())::text);
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_id_format" CHECK ("id" ~ '^orgoffer_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "workspace_offerings" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "workspace_offerings" ALTER COLUMN "id" SET DEFAULT ('wsoffer_'::text || (uuidv7())::text);
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_id_format" CHECK ("id" ~ '^wsoffer_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- A connection is in test or live mode, and only a live one has a go-live
+-- time (a replace that returns a row to test clears it, contract C9).
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_mode_domain"
+  CHECK ("mode" IN ('test', 'live'));
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_live_at_pair"
+  CHECK (("mode" = 'live') = ("live_at" IS NOT NULL));
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_key_last4_shape"
+  CHECK ("key_last4" ~ '^[A-Za-z0-9]{4}$');
+-- 32 random bytes, base64url.
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_webhook_token_shape"
+  CHECK ("webhook_token" ~ '^[A-Za-z0-9_-]{43}$');
+-- Ciphertext only: never a key or a signing secret in clear.
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_credential_envelope"
+  CHECK ("credential_ciphertext" ~ '^v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]+$'
+    AND "credential_ciphertext" !~ '(rk|sk|pk)_(test|live)_|whsec_');
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_webhook_secret_envelope"
+  CHECK ("webhook_secret_ciphertext" IS NULL
+    OR ("webhook_secret_ciphertext" ~ '^v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]+$'
+      AND "webhook_secret_ciphertext" !~ '(rk|sk|pk)_(test|live)_|whsec_'));
+
+-- Each id set is never NULL, holds no NULL element, and has at most 100 ids.
+-- Duplicates and the id shape are refused by the writers' schema parse.
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_enabled_product_ids_bound"
+  CHECK ("enabled_product_ids" IS NOT NULL
+    AND cardinality("enabled_product_ids") <= 100
+    AND array_position("enabled_product_ids", NULL) IS NULL);
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_shown_product_ids_bound"
+  CHECK ("shown_product_ids" IS NOT NULL
+    AND cardinality("shown_product_ids") <= 100
+    AND array_position("shown_product_ids", NULL) IS NULL);
+
+-- A Recommended product is one the workspace shows.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_recommended_plan_shown"
+  CHECK ("recommended_plan_product_id" IS NULL
+    OR "recommended_plan_product_id" = ANY ("shown_product_ids"));
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_recommended_addon_shown"
+  CHECK ("recommended_addon_product_id" IS NULL
+    OR "recommended_addon_product_id" = ANY ("shown_product_ids"));
+
+-- The snapshot and its time are set together.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_snapshot_pair"
+  CHECK (("snapshot" IS NULL) = ("snapshot_at" IS NULL));