create-ailk 0.22.0 → 0.24.0

package/templates/database/__tests__/offerings.db.test.ts

@@ -0,0 +1,303 @@
+/**
+ * @file offerings.db.test.ts
+ *
+ * LIVE-DATABASE proof of the three Offerings tables' constraints (#8876, spec
+ * docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2, AC-1).
+ * Requires DATABASE_URL pointing at a Postgres with the migrations applied —
+ * SKIPS when DATABASE_URL is unset (the repo convention; the `apps/api Route
+ * Tests (Postgres)` workflow exercises it).
+ *
+ * Uses the `pg` driver directly, in ONE transaction that is rolled back, so no
+ * row outlives the suite. Each refusal runs in its own savepoint and names the
+ * constraint Postgres reports, so a refusal for the wrong reason fails.
+ */
+import { Client } from "pg";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+const ORG = "org_01920000-8876-7000-8000-0000000000a1";
+const ORG_2 = "org_01920000-8876-7000-8000-0000000000a2";
+const WS = "wksp_01920000-8876-7000-8000-0000000000b1";
+const WS_2 = "wksp_01920000-8876-7000-8000-0000000000b2";
+/** The fixture's placeholder: the envelope shape, decrypting under no key. */
+const PLACEHOLDER = "v1.Zml4dHVyZWl2ODg3.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA";
+/** The placeholder's `v1.<iv>.<tag>` head, to wrap a cleartext value in. */
+const ENVELOPE_HEAD = PLACEHOLDER.split(".").slice(0, 3).join(".");
+const TOKEN = "A".repeat(43);
+const TOKEN_2 = "B".repeat(43);
+
+describeDb("the Offerings tables (#8876 D1, D2, AC-1, live DB)", () => {
+  let db: Client;
+
+  beforeAll(async () => {
+    db = new Client({ connectionString: process.env.DATABASE_URL });
+    await db.connect();
+    await db.query("BEGIN");
+  });
+
+  afterAll(async () => {
+    await db.query("ROLLBACK");
+    await db.end();
+  });
+
+  /** Run `run` inside a savepoint; resolve to the violated constraint's name, or null. */
+  const violation = async (run: () => Promise<unknown>): Promise<string | null> => {
+    await db.query("SAVEPOINT attempt");
+    try {
+      await run();
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return null;
+    } catch (err) {
+      await db.query("ROLLBACK TO SAVEPOINT attempt");
+      return (err as { constraint?: string }).constraint ?? String(err);
+    }
+  };
+
+  /** Insert one row of `table` from `cols` (plus `updated_at`). */
+  const insert = (table: string, cols: Record<string, unknown>) => {
+    const all: Record<string, unknown> = { updated_at: new Date(), ...cols };
+    const names = Object.keys(all);
+    return db.query(
+      `INSERT INTO "${table}" (${names.map((n) => `"${n}"`).join(", ")})
+       VALUES (${names.map((_, i) => `$${i + 1}`).join(", ")}) RETURNING "id"`,
+      names.map((n) => all[n]),
+    );
+  };
+
+  const connection = (cols: Record<string, unknown> = {}) =>
+    insert("stripe_connections", {
+      organization_id: ORG,
+      mode: "test",
+      key_last4: "4242",
+      credential_ciphertext: PLACEHOLDER,
+      webhook_token: TOKEN,
+      ...cols,
+    });
+
+  const workspaceOfferings = (cols: Record<string, unknown> = {}) =>
+    insert("workspace_offerings", { workspace_id: WS, ...cols });
+
+  describe("stripe_connections", () => {
+    it("accepts the fixture's envelope-shaped placeholder and mints a prefixed id", async () => {
+      await db.query("SAVEPOINT ok");
+      const { rows } = await connection({ webhook_secret_ciphertext: PLACEHOLDER });
+      expect(rows[0].id).toMatch(/^stripecon_[0-9a-f]{8}-[0-9a-f]{4}-7/);
+      await db.query("ROLLBACK TO SAVEPOINT ok");
+    });
+
+    it("accepts a live row with its go-live time", async () => {
+      expect(await violation(() => connection({ mode: "live", live_at: new Date() }))).toBeNull();
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ webhook_token: TOKEN_2 });
+        }),
+      ).toBe("stripe_connections_organization_id_key");
+    });
+
+    it("refuses a second row with one webhook token", async () => {
+      expect(
+        await violation(async () => {
+          await connection();
+          await connection({ organization_id: ORG_2 });
+        }),
+      ).toBe("stripe_connections_webhook_token_key");
+    });
+
+    it.each([
+      ["a mode of prod", { mode: "prod" }, "stripe_connections_mode_domain"],
+      ["a live row with no live_at", { mode: "live" }, "stripe_connections_live_at_pair"],
+      ["a test row with a live_at", { live_at: new Date() }, "stripe_connections_live_at_pair"],
+      ["a token of 42 characters", { webhook_token: "A".repeat(42) }, "stripe_connections_webhook_token_shape"],
+      ["a token with a dot", { webhook_token: `${"A".repeat(42)}.` }, "stripe_connections_webhook_token_shape"],
+      ["a last4 of three characters", { key_last4: "424" }, "stripe_connections_key_last4_shape"],
+      ["a last4 with a symbol", { key_last4: "42_2" }, "stripe_connections_key_last4_shape"],
+      [
+        "a credential stored in clear",
+        { credential_ciphertext: `rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a live credential stored in clear",
+        { credential_ciphertext: `sk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret stored in clear",
+        { webhook_secret_ciphertext: `whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      [
+        "a live key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_${"live"}_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a test key wrapped in the envelope's dots",
+        { credential_ciphertext: `${ENVELOPE_HEAD}.rk_test_${"a1B2".repeat(24)}` },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "an IV that is not 12 bytes",
+        { credential_ciphertext: "v1.Zml4dHVyZQ.Zml4dHVyZS10YWctODg3Ng.Y2lwaGVydGV4dA" },
+        "stripe_connections_credential_envelope",
+      ],
+      [
+        "a webhook secret wrapped in the envelope's dots",
+        { webhook_secret_ciphertext: `${ENVELOPE_HEAD}.whsec_${"a1B2".repeat(8)}` },
+        "stripe_connections_webhook_secret_envelope",
+      ],
+      ["a malformed organization_id", { organization_id: "org_1" }, "stripe_connections_organization_id_format"],
+      [
+        "a workspace id as organization_id",
+        { organization_id: WS },
+        "stripe_connections_organization_id_format",
+      ],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => connection(cols))).toBe(constraint);
+    });
+  });
+
+  describe("organization_offerings", () => {
+    const orgOfferings = (cols: Record<string, unknown> = {}) =>
+      insert("organization_offerings", { organization_id: ORG, ...cols });
+
+    it("defaults to the empty set and accepts 100 ids", async () => {
+      expect(await violation(() => orgOfferings())).toBeNull();
+      const hundred = Array.from({ length: 100 }, (_, i) => `prod_${i}`);
+      expect(await violation(() => orgOfferings({ enabled_product_ids: hundred }))).toBeNull();
+    });
+
+    it.each([
+      [
+        "more than 100 ids",
+        { enabled_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a NULL set", { enabled_product_ids: null }, "organization_offerings_enabled_product_ids_bound"],
+      [
+        "a NULL element",
+        { enabled_product_ids: ["prod_a", null] },
+        "organization_offerings_enabled_product_ids_bound",
+      ],
+      ["a malformed organization_id", { organization_id: "org_x" }, "organization_offerings_organization_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => orgOfferings(cols))).toBe(constraint);
+    });
+
+    it("refuses a second row for one Organization", async () => {
+      expect(
+        await violation(async () => {
+          await orgOfferings();
+          await orgOfferings();
+        }),
+      ).toBe("organization_offerings_organization_id_key");
+    });
+  });
+
+  describe("workspace_offerings", () => {
+    it("accepts a shown set with Recommended and a snapshot with its time", async () => {
+      expect(
+        await violation(() =>
+          workspaceOfferings({
+            shown_product_ids: ["prod_growth", "prod_seo"],
+            recommended_plan_product_id: "prod_growth",
+            recommended_addon_product_id: "prod_seo",
+            snapshot: JSON.stringify({ v: 1, offerings: [] }),
+            snapshot_at: new Date(),
+          }),
+        ),
+      ).toBeNull();
+    });
+
+    it.each([
+      [
+        "a Recommended plan not in the shown set",
+        { shown_product_ids: ["prod_seo"], recommended_plan_product_id: "prod_growth" },
+        "workspace_offerings_recommended_plan_shown",
+      ],
+      [
+        "a Recommended add-on not in the shown set",
+        { shown_product_ids: ["prod_growth"], recommended_addon_product_id: "prod_seo" },
+        "workspace_offerings_recommended_addon_shown",
+      ],
+      [
+        "more than 100 ids",
+        { shown_product_ids: Array.from({ length: 101 }, (_, i) => `prod_${i}`) },
+        "workspace_offerings_shown_product_ids_bound",
+      ],
+      ["a NULL element", { shown_product_ids: [null] }, "workspace_offerings_shown_product_ids_bound"],
+      [
+        "a snapshot without snapshot_at",
+        { snapshot: JSON.stringify({ v: 1, offerings: [] }) },
+        "workspace_offerings_snapshot_pair",
+      ],
+      ["a snapshot_at without a snapshot", { snapshot_at: new Date() }, "workspace_offerings_snapshot_pair"],
+      ["a malformed workspace_id", { workspace_id: "wksp_1" }, "workspace_offerings_workspace_id_format"],
+    ])("refuses %s", async (_label, cols, constraint) => {
+      expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+    });
+
+    describe("shown_price_ids (#9070 D1, AC-6)", () => {
+      it("reads the empty set for a row inserted without it", async () => {
+        await db.query("SAVEPOINT attempt");
+        const { rows } = await db.query(
+          `INSERT INTO "workspace_offerings" ("workspace_id", "shown_product_ids", "updated_at")
+           VALUES ($1, $2, now()) RETURNING "shown_price_ids"`,
+          [WS, ["prod_growth"]],
+        );
+        await db.query("ROLLBACK TO SAVEPOINT attempt");
+        expect(rows[0].shown_price_ids).toEqual([]);
+      });
+
+      it("accepts 300 Price ids beside one Product", async () => {
+        expect(
+          await violation(() =>
+            workspaceOfferings({
+              shown_product_ids: ["prod_growth"],
+              shown_price_ids: Array.from({ length: 300 }, (_, i) => `price_${i}`),
+            }),
+          ),
+        ).toBeNull();
+      });
+
+      it.each([
+        [
+          "301 Price ids",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: Array.from({ length: 301 }, (_, i) => `price_${i}`) },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a NULL Price id",
+          { shown_product_ids: ["prod_growth"], shown_price_ids: [null] },
+          "workspace_offerings_shown_price_ids_bound",
+        ],
+        [
+          "a Price id with no shown Product",
+          { shown_product_ids: [], shown_price_ids: ["price_growth_yearly"] },
+          "workspace_offerings_shown_prices_need_products",
+        ],
+      ])("refuses %s", async (_label, cols, constraint) => {
+        expect(await violation(() => workspaceOfferings(cols))).toBe(constraint);
+      });
+    });
+
+    it("refuses a second row for one workspace and accepts another workspace's", async () => {
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings();
+        }),
+      ).toBe("workspace_offerings_workspace_id_key");
+      expect(
+        await violation(async () => {
+          await workspaceOfferings();
+          await workspaceOfferings({ workspace_id: WS_2 });
+        }),
+      ).toBeNull();
+    });
+  });
+});

package/templates/database/__tests__/seed.test.ts

@@ -15,10 +15,14 @@ import {
   contactFormFlowConfig,
   JOB_APPLICATION_FLOW_SLUG,
   jobApplicationFlowConfig,
+  NEWSLETTER_FLOW_SLUG,
+  newsletterFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
   STANDARD_MAGNET_COMPLETIONS,
+  TRIAL_FLOW_SLUG,
+  trialFlowConfig,
 } from "@working-theory/validation";
 
 import {
@@ -112,7 +116,7 @@ describe("provisionDefaultWorkspace — the request-quote magnet (#8168 D8, C4,
 
     await provisionDefaultWorkspace(prisma);
 
-    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(3);
+    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(5);
     expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(1, {
       where: {
         siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: REQUEST_QUOTE_FLOW_SLUG },
@@ -208,3 +212,61 @@ describe("provisionDefaultWorkspace — the Job application magnet (#8746 D3, AC
     });
   });
 });
+
+describe("provisionDefaultWorkspace — the newsletter magnet (#8847 D4, AC-5)", () => {
+  it("upserts the default workspace's live newsletter, insert-if-absent", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(4, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: NEWSLETTER_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "newsletter",
+        config: newsletterFlowConfig,
+        kind: "newsletter",
+        title: "Newsletter",
+        status: "live",
+        customersEnabled: false,
+        completion: STANDARD_MAGNET_COMPLETIONS[NEWSLETTER_FLOW_SLUG],
+        landingPage: "/newsletter",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});
+
+describe("provisionDefaultWorkspace — the trial magnet (#9287 D11, #9301 AC-1)", () => {
+  it("upserts the default workspace's live trial magnet, insert-if-absent, as the fifth magnet", async () => {
+    const { prisma, flowDefinitionUpsert } = makeStubPrisma(0);
+
+    await provisionDefaultWorkspace(prisma);
+
+    expect(flowDefinitionUpsert).toHaveBeenCalledTimes(5);
+    expect(flowDefinitionUpsert).toHaveBeenNthCalledWith(5, {
+      where: {
+        siteId_slug: { siteId: DEFAULT_WORKSPACE_ID, slug: TRIAL_FLOW_SLUG },
+      },
+      create: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        workspaceId: DEFAULT_WORKSPACE_ID,
+        slug: "trial",
+        config: trialFlowConfig,
+        kind: "diagnostic",
+        title: "Free trial",
+        status: "live",
+        customersEnabled: false,
+        // No account invite: the licence key's email is the invitation.
+        completion: "lead",
+        landingPage: "/trial",
+      },
+      // Empty: a re-run never overwrites the owner's edits.
+      update: {},
+    });
+  });
+});

package/templates/database/__tests__/trial-magnet-migration.test.ts

@@ -0,0 +1,186 @@
+/**
+ * @file trial-magnet-migration.test.ts
+ *
+ * DB-free: migrations/20261025120000_trial_magnet writes the trial magnet's
+ * config as a JSONB literal, because SQL cannot import TS (#9287 spec
+ * docs/specs/9287-operator-started-trials-spec.md D11; #9301 AC-1). This test
+ * holds the literal to its one TS source so they can never drift, as
+ * `in-page-magnets-migration.test.ts` does for the newsletter backfill:
+ * `trial backfill` inserts `trialFlowConfig` into every workspace,
+ * insert-only on `(site_id, slug)`, so an owner's own row at `trial` is never
+ * updated.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  flowConfigSchema,
+  TRIAL_FLOW_LANDING_PAGE,
+  TRIAL_FLOW_SLUG,
+  TRIAL_FLOW_TITLE,
+  trialFlowConfig,
+} from "@working-theory/validation";
+
+const MIGRATION_SQL = readFileSync(
+  join(
+    __dirname,
+    "..",
+    "migrations",
+    "20261025120000_trial_magnet",
+    "migration.sql",
+  ),
+  "utf8",
+);
+
+const PROOF_MIGRATION_SQL = readFileSync(
+  join(
+    __dirname,
+    "..",
+    "migrations",
+    "20261026120000_trial_magnet_proof_line",
+    "migration.sql",
+  ),
+  "utf8",
+);
+
+/**
+ * #9301's shipped trial magnet — `trialFlowConfig` as #9301 wrote it, before
+ * #9302 added the landing's proof line. Written out here, not imported: the
+ * constant has moved on, and this is the value the backfill wrote and the
+ * #9302 upgrade's guard must match exactly (the in-page-magnets precedent).
+ */
+const TRIAL_9301_DEFAULT = {
+  slug: "trial",
+  defaultLocale: "en",
+  steps: [
+    {
+      key: "about",
+      type: "field",
+      copy: { title: { en: "Free trial" }, cta: { en: "Request my trial" } },
+      fields: [
+        { name: "first_name", inputType: "text", required: true, mapsTo: "givenName", copy: { label: { en: "First name" } } },
+        { name: "last_name", inputType: "text", required: true, mapsTo: "familyName", copy: { label: { en: "Last name" } } },
+        { name: "email", inputType: "email", required: true, mapsTo: "email", copy: { label: { en: "Work email" } } },
+        {
+          name: "terms",
+          inputType: "consent",
+          required: true,
+          purposes: ["service_terms"],
+          copy: { label: { en: "I accept the [Terms](terms) and [Privacy Policy](privacy)." } },
+        },
+      ],
+    },
+  ],
+  ending: {
+    default: {
+      kind: "screen",
+      headline: { en: "Thanks, {name}." },
+      body: { en: "We have your request and will be in touch about your trial." },
+    },
+  },
+  landing: {
+    title: { en: "Free trial" },
+    description: { en: "Try it free for 14 days. No card needed." },
+    cta: { en: "Request a free trial" },
+  },
+};
+
+/** The text between `-- BEGIN <name>` and `-- END <name>`. */
+function block(name: string, source: string = MIGRATION_SQL): string {
+  const match = new RegExp(
+    `-- BEGIN ${name}\\n([\\s\\S]*?)-- END ${name}`,
+  ).exec(source);
+  if (!match?.[1]) throw new Error(`${name} markers not found`);
+  return match[1];
+}
+
+/** A SQL string literal's body, `''` unescaped, parsed as JSON. */
+const parseLiteral = (body: string): unknown =>
+  JSON.parse(body.replace(/''/g, "'"));
+
+/** The SQL with every string literal blanked, so only its structure is left. */
+const withoutLiterals = (sql: string): string =>
+  sql.replace(/'(?:[^']|'')*'/g, "''");
+
+describe("the trial backfill (#9287 D11, #9301 AC-1)", () => {
+  const sql = block("trial backfill");
+
+  it("carries exactly one JSONB config literal, and it deep-equals #9301's shipped default", () => {
+    const literals = [...sql.matchAll(/'(\{[\s\S]*?\})'::jsonb/g)];
+    expect(literals).toHaveLength(1);
+    const parsed = parseLiteral(literals[0]![1]!);
+    expect(parsed).toEqual(TRIAL_9301_DEFAULT);
+    expect(flowConfigSchema.safeParse(parsed).success).toBe(true);
+  });
+
+  it("#9301's default is trialFlowConfig minus the proof line #9302 added", () => {
+    const { meta, ...landing } = trialFlowConfig.landing!;
+    expect(meta).toEqual({ en: "A person on our team reviews every request." });
+    expect({ ...trialFlowConfig, landing }).toEqual(TRIAL_9301_DEFAULT);
+  });
+
+  it("writes the constants' slug, title and landing page, kind diagnostic, live, the lead completion, into every workspace", () => {
+    expect(sql).toContain(
+      `INSERT INTO "flow_definitions" ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "completion", "landing_page", "updated_at")`,
+    );
+    expect(sql).toContain(`SELECT w."id", w."id", '${TRIAL_FLOW_SLUG}',`);
+    expect(sql).toContain(
+      `'diagnostic', '${TRIAL_FLOW_TITLE}', 'live', false, 'lead', '${TRIAL_FLOW_LANDING_PAGE}', CURRENT_TIMESTAMP`,
+    );
+    expect(sql).toContain(`FROM "workspaces" w`);
+  });
+
+  it('ends ON CONFLICT ("site_id", "slug") DO NOTHING, so an existing row is never overwritten', () => {
+    expect(
+      sql.trimEnd().endsWith(`ON CONFLICT ("site_id", "slug") DO NOTHING;`),
+    ).toBe(true);
+    expect(sql).not.toMatch(/DO UPDATE/i);
+  });
+
+  it("the whole migration is that one INSERT — no UPDATE or DELETE anywhere", () => {
+    const statements = withoutLiterals(MIGRATION_SQL.replace(/^--.*$/gm, ""))
+      .split(";")
+      .filter((s) => s.trim().length > 0);
+    expect(statements).toHaveLength(1);
+    expect(statements[0]!.trim()).toMatch(/^INSERT INTO "flow_definitions" /);
+    expect(withoutLiterals(MIGRATION_SQL.replace(/^--.*$/gm, ""))).not.toMatch(
+      /\b(UPDATE|DELETE)\b/i,
+    );
+  });
+});
+
+describe("the trial proof-line upgrade (#9302)", () => {
+  const sql = block("trial proof-line upgrade", PROOF_MIGRATION_SQL);
+  const statements = withoutLiterals(sql).split(";").filter((s) => s.trim().length > 0);
+
+  it("is one UPDATE of flow_definitions, and the whole migration is only that", () => {
+    expect(statements).toHaveLength(1);
+    expect(statements[0]!.trim()).toMatch(/^UPDATE "flow_definitions" SET /);
+    const all = withoutLiterals(PROOF_MIGRATION_SQL.replace(/^--.*$/gm, ""))
+      .split(";")
+      .filter((s) => s.trim().length > 0);
+    expect(all).toHaveLength(1);
+    expect(withoutLiterals(PROOF_MIGRATION_SQL.replace(/^--.*$/gm, ""))).not.toMatch(
+      /\b(INSERT|DELETE)\b/i,
+    );
+  });
+
+  it("its SET literal deep-equals trialFlowConfig, and it sets only config and updated_at", () => {
+    const set = /SET "config" = '(\{[\s\S]*?\})'::jsonb/.exec(sql);
+    expect(set?.[1]).toEqual(expect.any(String));
+    const parsed = parseLiteral(set![1]!);
+    expect(parsed).toEqual(trialFlowConfig);
+    expect(flowConfigSchema.safeParse(parsed).success).toBe(true);
+    expect(withoutLiterals(sql)).toMatch(
+      /SET "config" = ''::jsonb, "updated_at" = CURRENT_TIMESTAMP\s+WHERE /,
+    );
+  });
+
+  it("its WHERE names the trial slug and matches only #9301's exact default, so an owner's edit is never touched", () => {
+    expect(withoutLiterals(sql)).toMatch(/WHERE "slug" = '' AND "config" = ''::jsonb;\s*$/);
+    expect(sql).toContain(`WHERE "slug" = '${TRIAL_FLOW_SLUG}' AND "config" = '`);
+    const guard = /AND "config" = '(\{[\s\S]*?\})'::jsonb;/.exec(sql);
+    expect(guard?.[1]).toEqual(expect.any(String));
+    expect(parseLiteral(guard![1]!)).toEqual(TRIAL_9301_DEFAULT);
+  });
+});

package/templates/database/auth/schema.prisma

@@ -55,6 +55,10 @@ model Organization {
   tier              String   @default("free")             // "free" | "pro" | "pro_plus" | "enterprise"
   hasCarePlan       Boolean  @default(false) @map("has_care_plan")
   seatCount         Int      @default(1) @map("seat_count")
+  // #9067 D13 — the one plan Checkout this Organization has open, recorded by
+  // POST /v1/billing/plan-checkout. The webhook binds billingCustomerId only
+  // for this session, into an empty column, and clears it. Server-side only.
+  planCheckoutSessionId String? @unique @map("plan_checkout_session_id")
 
   // Usage-billing balance counters — the Company-counter live on-demand
   // credit model (FEAT-047 P1.S2, #3710 — capture D6, NOT a CreditUsagePeriod

package/templates/database/config/schema.prisma

@@ -175,6 +175,97 @@ model SchedulingConnection {
   @@map("scheduling_connections")
 }
 
+/// StripeConnection — an Organization's own Stripe account, by a restricted
+/// key (#8876 D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// C1). One row per Organization on the SchedulingConnection shape: a plain
+/// `organizationId @unique` scalar, no relation, no foreign key (ADR 0009
+/// invariant 1). In hub-and-spoke every workspace reads its Organization's
+/// one row; a single-tenant site's sentinel Organization holds its own — no
+/// workspace-scoped key column exists anywhere. The key and the webhook
+/// secret are `v1.<iv>.<tag>.<ct>` ciphertext (contract C2), written only by
+/// apps/api's services/offerings/connection.ts; the migration's envelope
+/// CHECKs refuse a value stored in clear. Every reader sees `mode` and
+/// `keyLast4` only. `webhookToken` is a 256-bit routing id, not an
+/// authenticator. Keep every `@map` in lockstep with the migration's column
+/// names (see WorkspaceMeetings).
+model StripeConnection {
+  id                      String    @id @default(dbgenerated("('stripecon_'::text || (uuidv7())::text)")) @db.Text
+  organizationId          String    @unique @map("organization_id")
+  mode                    String    @db.VarChar(8)
+  keyLast4                String    @map("key_last4") @db.VarChar(4)
+  credentialCiphertext    String    @map("credential_ciphertext") @db.Text
+  webhookToken            String    @unique @map("webhook_token") @db.VarChar(64)
+  webhookSecretCiphertext String?   @map("webhook_secret_ciphertext") @db.Text
+  liveAt                  DateTime? @map("live_at") @db.Timestamptz
+  createdAt               DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt               DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("stripe_connections")
+}
+
+/// OrganizationOfferings — the Stripe Products an Organization has switched
+/// on for its sites (#8876 D1, C2): the org-enabled set. Its own row, not a
+/// column on the connection, because disconnecting deletes the connection and
+/// keeps this set (contract C8). One row per Organization; no row is the
+/// empty set.
+model OrganizationOfferings {
+  id                String   @id @default(dbgenerated("('orgoffer_'::text || (uuidv7())::text)")) @db.Text
+  organizationId    String   @unique @map("organization_id")
+  enabledProductIds String[] @default([]) @map("enabled_product_ids")
+  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt         DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("organization_offerings")
+}
+
+/// WorkspaceOfferings — what one workspace shows of its Organization's
+/// enabled Products (#8876 D1): the shown set, Recommended per group, and the
+/// last-good Stripe snapshot anonymous readers serve (contract T7). One row
+/// per workspace, the WorkspaceMeetings shape. The two Recommended columns
+/// must name a shown product (a CHECK), and `snapshot` and `snapshotAt` are
+/// set together (a CHECK). `snapshot` is `offeringsSnapshotSchema`-shaped,
+/// validated on read and write, never trusted. `shownPriceIds` (#9070 D1) is
+/// the shown set at Price grain; empty means every Price of each shown
+/// Product, the grain of a row saved before #9070.
+model WorkspaceOfferings {
+  id                        String    @id @default(dbgenerated("('wsoffer_'::text || (uuidv7())::text)")) @db.Text
+  workspaceId               String    @unique @map("workspace_id")
+  shownProductIds           String[]  @default([]) @map("shown_product_ids")
+  shownPriceIds             String[]  @default([]) @map("shown_price_ids")
+  recommendedPlanProductId  String?   @map("recommended_plan_product_id")
+  recommendedAddonProductId String?   @map("recommended_addon_product_id")
+  snapshot                  Json?
+  snapshotAt                DateTime? @map("snapshot_at") @db.Timestamptz
+  createdAt                 DateTime  @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt                 DateTime  @updatedAt @map("updated_at") @db.Timestamptz
+
+  @@map("workspace_offerings")
+}
+
+/// OfferingsCheckoutSession — the Offerings Checkout session record (#8930
+/// D1; contract docs/specs/8879-the-offerings-security-contract-key-spec.md
+/// A11, W5, A13). One row per Checkout Session the hub created, written
+/// before the checkout route answers, so the per-Organization webhook and the
+/// session read act only on a session this hub recorded — never on metadata
+/// alone. Exactly A11's six columns beside the id and createdAt; no
+/// updatedAt, because no path updates a record. Plain scalar keys, no
+/// relation, no foreign key (ADR 0009 invariant 1); the migration's CHECKs
+/// bound every column. Written and read only by apps/api's
+/// services/offerings/checkout-session-record.ts. Keep every `@map` in
+/// lockstep with the migration's column names (see WorkspaceMeetings).
+model OfferingsCheckoutSession {
+  id             String   @id @default(dbgenerated("('ocsess_'::text || (uuidv7())::text)")) @db.Text
+  sessionId      String   @unique @map("session_id") @db.Text
+  workspaceId    String   @map("workspace_id")
+  organizationId String   @map("organization_id")
+  priceId        String   @map("price_id") @db.VarChar(255)
+  lookupKey      String   @map("lookup_key") @db.VarChar(48)
+  mode           String   @db.VarChar(8)
+  createdAt      DateTime @default(now()) @map("created_at") @db.Timestamptz
+
+  @@map("offerings_checkout_sessions")
+}
+
 /// SiteListingConfig — per-SITE project-listings config blob (#5033).
 ///
 /// The fourth site-config model, and the one keyed on `siteId` rather than