create-ailk 0.22.0 → 0.24.0

package/templates/database/migrations/20261020120000_offerings_data_model/migration.sql

@@ -0,0 +1,146 @@
+-- #8876 — the Offerings data model (spec
+-- docs/specs/8876-the-offerings-data-model-typed-spec.md D1, D2; contract
+-- docs/specs/8879-the-offerings-security-contract-key-spec.md C1):
+--
+--   stripe_connections (config) — an Organization's own Stripe account by a
+--     restricted key: the mode, the key's last four, the key and webhook
+--     secret as AES-256-GCM ciphertext written only by apps/api's
+--     services/offerings/connection.ts, and a per-connection webhook token.
+--   organization_offerings (config) — the Products an Organization has
+--     switched on (the org-enabled set). Kept when a connection is deleted.
+--   workspace_offerings (config) — the Products one workspace shows, its
+--     Recommended plan and add-on, and the last-good Stripe snapshot.
+--
+-- Three new tables in the house style of 20261003130000_scheduling_connection
+-- (CreateTable + CreateIndex as `prisma migrate diff` emits them, then the
+-- ADR-0031 rule-3 id-format completion, in ONE migration since the tables are
+-- new), plus a format CHECK on each reference column (the
+-- workspace_piece_stages style) and the integrity CHECKs spec D1 names. Plain
+-- scalar keys, no foreign key (ADR 0009 invariant 1).
+--
+-- The two ciphertext envelope CHECKs are the `v1.<iv>.<tag>.<ciphertext>`
+-- base64url shape the cipher writes — a 12-byte IV (16 characters) and a
+-- 16-byte tag (22) — and refuse a Stripe key or signing-secret prefix
+-- anywhere in the value, so a writer bug that stored a key or a secret in
+-- clear, bare or wrapped in the envelope's dots, is refused here
+-- (SEC-8876-3, SEC-PR8955-2).
+--
+-- No backfill, no constraint relaxed, no existing table touched.
+--
+-- Rollback: DROP TABLE "stripe_connections", "organization_offerings",
+-- "workspace_offerings". Every stored connection and selection is lost and
+-- every site returns to its page content.
+
+-- CreateTable
+CREATE TABLE "stripe_connections" (
+    "id" TEXT NOT NULL DEFAULT ('stripecon_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "mode" VARCHAR(8) NOT NULL,
+    "key_last4" VARCHAR(4) NOT NULL,
+    "credential_ciphertext" TEXT NOT NULL,
+    "webhook_token" VARCHAR(64) NOT NULL,
+    "webhook_secret_ciphertext" TEXT,
+    "live_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "stripe_connections_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "organization_offerings" (
+    "id" TEXT NOT NULL DEFAULT ('orgoffer_'::text || (uuidv7())::text),
+    "organization_id" TEXT NOT NULL,
+    "enabled_product_ids" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "organization_offerings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_offerings" (
+    "id" TEXT NOT NULL DEFAULT ('wsoffer_'::text || (uuidv7())::text),
+    "workspace_id" TEXT NOT NULL,
+    "shown_product_ids" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "recommended_plan_product_id" TEXT,
+    "recommended_addon_product_id" TEXT,
+    "snapshot" JSONB,
+    "snapshot_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "workspace_offerings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "stripe_connections_organization_id_key" ON "stripe_connections"("organization_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "stripe_connections_webhook_token_key" ON "stripe_connections"("webhook_token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "organization_offerings_organization_id_key" ON "organization_offerings"("organization_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_offerings_workspace_id_key" ON "workspace_offerings"("workspace_id");
+
+-- ADR-0031 rule 3 — stripe_connections: stripecon_, organization_offerings:
+-- orgoffer_, workspace_offerings: wsoffer_ (registered in
+-- packages/ids/src/registry.ts ENTITY_PREFIX; this migration's path is added
+-- to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "stripe_connections" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "stripe_connections" ALTER COLUMN "id" SET DEFAULT ('stripecon_'::text || (uuidv7())::text);
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_id_format" CHECK ("id" ~ '^stripecon_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "organization_offerings" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "organization_offerings" ALTER COLUMN "id" SET DEFAULT ('orgoffer_'::text || (uuidv7())::text);
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_id_format" CHECK ("id" ~ '^orgoffer_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_organization_id_format" CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "workspace_offerings" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "workspace_offerings" ALTER COLUMN "id" SET DEFAULT ('wsoffer_'::text || (uuidv7())::text);
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_id_format" CHECK ("id" ~ '^wsoffer_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_workspace_id_format" CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- A connection is in test or live mode, and only a live one has a go-live
+-- time (a replace that returns a row to test clears it, contract C9).
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_mode_domain"
+  CHECK ("mode" IN ('test', 'live'));
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_live_at_pair"
+  CHECK (("mode" = 'live') = ("live_at" IS NOT NULL));
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_key_last4_shape"
+  CHECK ("key_last4" ~ '^[A-Za-z0-9]{4}$');
+-- 32 random bytes, base64url.
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_webhook_token_shape"
+  CHECK ("webhook_token" ~ '^[A-Za-z0-9_-]{43}$');
+-- Ciphertext only: never a key or a signing secret in clear.
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_credential_envelope"
+  CHECK ("credential_ciphertext" ~ '^v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]+$'
+    AND "credential_ciphertext" !~ '(rk|sk|pk)_(test|live)_|whsec_');
+ALTER TABLE "stripe_connections" ADD CONSTRAINT "stripe_connections_webhook_secret_envelope"
+  CHECK ("webhook_secret_ciphertext" IS NULL
+    OR ("webhook_secret_ciphertext" ~ '^v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]+$'
+      AND "webhook_secret_ciphertext" !~ '(rk|sk|pk)_(test|live)_|whsec_'));
+
+-- Each id set is never NULL, holds no NULL element, and has at most 100 ids.
+-- Duplicates and the id shape are refused by the writers' schema parse.
+ALTER TABLE "organization_offerings" ADD CONSTRAINT "organization_offerings_enabled_product_ids_bound"
+  CHECK ("enabled_product_ids" IS NOT NULL
+    AND cardinality("enabled_product_ids") <= 100
+    AND array_position("enabled_product_ids", NULL) IS NULL);
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_shown_product_ids_bound"
+  CHECK ("shown_product_ids" IS NOT NULL
+    AND cardinality("shown_product_ids") <= 100
+    AND array_position("shown_product_ids", NULL) IS NULL);
+
+-- A Recommended product is one the workspace shows.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_recommended_plan_shown"
+  CHECK ("recommended_plan_product_id" IS NULL
+    OR "recommended_plan_product_id" = ANY ("shown_product_ids"));
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_recommended_addon_shown"
+  CHECK ("recommended_addon_product_id" IS NULL
+    OR "recommended_addon_product_id" = ANY ("shown_product_ids"));
+
+-- The snapshot and its time are set together.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_snapshot_pair"
+  CHECK (("snapshot" IS NULL) = ("snapshot_at" IS NULL));

package/templates/database/migrations/20261021120000_offerings_checkout_session/migration.sql

@@ -0,0 +1,77 @@
+-- #8930 — the Offerings Checkout session record (spec
+-- docs/specs/8930-the-offerings-checkout-session-record-spec.md D1, D2;
+-- contract docs/specs/8879-the-offerings-security-contract-key-spec.md A11,
+-- W5, A13):
+--
+--   offerings_checkout_sessions (config) — one row per Checkout Session the
+--     hub created: its id, the workspace and Organization it was created for,
+--     the Price and lookup key it sells, and the key's mode. Written once by
+--     apps/api's services/offerings/checkout-session-record.ts before the
+--     checkout route answers; the per-Organization webhook fulfils, and the
+--     session read answers, only a session recorded here.
+--
+-- One new table in the house style of 20261003130000_scheduling_connection
+-- (CreateTable + CreateIndex as `prisma migrate diff` emits them, then the
+-- ADR-0031 rule-3 id-format completion), plus a CHECK on every column. Plain
+-- scalar keys, no foreign key (ADR 0009 invariant 1). The table is new, so no
+-- CHECK needs NOT VALID.
+--
+-- One new table, no backfill, no existing table touched.
+--
+-- Rollout: deploy the migration before the API code that writes the record,
+-- so the checkout route never runs on a database without the table.
+--
+-- Rollback: DROP TABLE "offerings_checkout_sessions". While the table is
+-- absent every read rejects, so the webhook answers non-2xx and Stripe keeps
+-- retrying. Re-creating it empty loses every earlier record: each such session
+-- then reads as unrecorded and a purchase completed after that is never
+-- fulfilled. So roll back only before the checkout route that writes it is
+-- live, and never re-create the table without its old rows unless the seller
+-- is told.
+
+-- CreateTable
+CREATE TABLE "offerings_checkout_sessions" (
+    "id" TEXT NOT NULL DEFAULT ('ocsess_'::text || (uuidv7())::text),
+    "session_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "organization_id" TEXT NOT NULL,
+    "price_id" VARCHAR(255) NOT NULL,
+    "lookup_key" VARCHAR(48) NOT NULL,
+    "mode" VARCHAR(8) NOT NULL,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "offerings_checkout_sessions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "offerings_checkout_sessions_session_id_key" ON "offerings_checkout_sessions"("session_id");
+
+-- ADR-0031 rule 3 — offerings_checkout_sessions: ocsess_ (registered in
+-- packages/ids/src/registry.ts ENTITY_PREFIX; this migration's path is added
+-- to migration-sync.test.ts's PK_CHECK_MIGRATIONS).
+ALTER TABLE "offerings_checkout_sessions" ALTER COLUMN "id" TYPE text COLLATE "C";
+ALTER TABLE "offerings_checkout_sessions" ALTER COLUMN "id" SET DEFAULT ('ocsess_'::text || (uuidv7())::text);
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_id_format" CHECK ("id" ~ '^ocsess_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+
+-- A Checkout Session id: the pieces_checkout_session_format body.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_session_id_format"
+  CHECK ("session_id" ~ '^cs_(test|live)_[A-Za-z0-9]{1,250}$');
+-- The workspace the session was created for.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_workspace_id_format"
+  CHECK ("workspace_id" ~ '^wksp_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+-- That workspace's own Organization.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_organization_id_format"
+  CHECK ("organization_id" ~ '^org_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$');
+-- A Stripe id: the one bound #8876 D4 puts on every Stripe id.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_price_id_format"
+  CHECK ("price_id" ~ '^[A-Za-z0-9_-]{1,255}$');
+-- The contract §3.7 whole-key grammar, <plan>_<period>. A backstop, never a
+-- parser: the store calls parseLookupKey, and the db test proves the two agree.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_lookup_key_format"
+  CHECK ("lookup_key" ~ '^[a-z0-9][a-z0-9-]{0,39}_(monthly|yearly|once)$');
+-- The key's mode.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_mode_domain"
+  CHECK ("mode" IN ('test', 'live'));
+-- A test key makes a cs_test_ session and a live key a cs_live_ one.
+ALTER TABLE "offerings_checkout_sessions" ADD CONSTRAINT "offerings_checkout_sessions_session_mode_agree"
+  CHECK (("mode" = 'live') = ("session_id" ~ '^cs_live_'));

package/templates/database/migrations/20261022120000_in_page_magnets/migration.sql

@@ -0,0 +1,45 @@
+-- #8847 — the in-page form shape (spec
+-- docs/specs/8847-the-in-page-form-shape-spec.md D5, C5).
+--
+-- Two marked blocks, each re-runnable and each held to its TypeScript
+-- constant by database/__tests__/in-page-magnets-migration.test.ts, on the
+-- request-quote backfill's footing (20261012120000_member_contract):
+--
+--   newsletter backfill   — every existing workspace gets the standard
+--                           newsletter magnet (`newsletterFlowConfig`,
+--                           `live`, landing page /newsletter, completion
+--                           `lead`). Insert-only on `(site_id, slug)`: a row
+--                           already at `newsletter` (an owner's own
+--                           wizard-built newsletter included) is never
+--                           changed. A workspace created after this runs is
+--                           seeded by `POST /v1/workspaces`, and the
+--                           seed-presets CLI covers one created between this
+--                           migration and the route code's deploy.
+--
+--   contact-form upgrade  — a stored Contact form whose config is EXACTLY
+--                           #8661's shipped default moves to the new default
+--                           (`contactFormFlowConfig`). `config` is jsonb, so
+--                           `=` compares values, not key order or whitespace:
+--                           a row an owner edited in any way, or a
+--                           wizard-built Contact form, is not equal and is
+--                           left as is. Only `config` and `updated_at` are
+--                           written — never title, status, landing page or
+--                           completion. A re-run matches nothing.
+--
+-- Rollback: DELETE FROM "flow_definitions" WHERE "slug" = 'newsletter' AND
+-- "config" = <the backfill literal>::jsonb; and the upgrade's UPDATE with its
+-- two literals swapped.
+
+-- BEGIN newsletter backfill
+INSERT INTO "flow_definitions" ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "completion", "landing_page", "updated_at")
+SELECT w."id", w."id", 'newsletter',
+  '{"slug":"newsletter","defaultLocale":"en","steps":[{"key":"subscribe","type":"field","copy":{"title":{"en":"Get the newsletter"},"body":{"en":"One email when there is something new."},"cta":{"en":"Subscribe"}},"fields":[{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Email"},"placeholder":{"en":"you@example.com"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["newsletter"],"copy":{"label":{"en":"I accept the [Terms](terms) and [Privacy Policy](privacy)."},"help":{"en":"No spam. Unsubscribe any time."}}}]}],"ending":{"default":{"kind":"screen","headline":{"en":"Check your inbox"},"body":{"en":"Your welcome email is on its way."}}},"completionEmail":{"subject":{"en":"You''re subscribed"},"body":{"en":"Thanks for subscribing. You''ll get one email when there is something new."}},"unsubscribe":{"title":{"en":"Unsubscribe"},"body":{"en":"Stop getting the newsletter by email?"},"cta":{"en":"Unsubscribe"},"done":{"headline":{"en":"You''re unsubscribed."},"body":{"en":"You won''t get the newsletter any more."}}}}'::jsonb,
+  'newsletter', 'Newsletter', 'live', false, 'lead', '/newsletter', CURRENT_TIMESTAMP
+FROM "workspaces" w
+ON CONFLICT ("site_id", "slug") DO NOTHING;
+-- END newsletter backfill
+
+-- BEGIN contact-form upgrade
+UPDATE "flow_definitions" SET "config" = '{"slug":"contact","defaultLocale":"en","steps":[{"key":"contact","type":"field","copy":{"title":{"en":"Get in touch"},"body":{"en":"I reply within one business day."},"cta":{"en":"Send message"}},"fields":[{"name":"name","inputType":"text","required":true,"mapsTo":"name","copy":{"label":{"en":"Name"}}},{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Email"}}},{"name":"subject","inputType":"select","required":false,"options":[{"value":"General question","label":{"en":"General question"}},{"value":"Working together","label":{"en":"Working together"}},{"value":"Support","label":{"en":"Support"}},{"value":"Press and partnerships","label":{"en":"Press and partnerships"}},{"value":"Other","label":{"en":"Other"}}],"copy":{"label":{"en":"Subject"},"placeholder":{"en":"Choose a subject"}}},{"name":"message","inputType":"textarea","required":false,"copy":{"label":{"en":"Message"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["service_terms"],"copy":{"label":{"en":"I accept the [Terms](terms) and [Privacy Policy](privacy)."}}}]}],"ending":{"default":{"kind":"screen","headline":{"en":"Message sent."},"body":{"en":"Thanks for getting in touch. I reply within one business day."}}}}'::jsonb, "updated_at" = CURRENT_TIMESTAMP
+WHERE "slug" = 'contact' AND "config" = '{"slug":"contact","defaultLocale":"en","steps":[{"key":"contact","type":"field","copy":{"title":{"en":"Contact form"},"cta":{"en":"Send message"}},"fields":[{"name":"name","inputType":"text","required":true,"mapsTo":"name","copy":{"label":{"en":"Name"}}},{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Email"}}},{"name":"subject","inputType":"select","required":false,"options":[{"value":"General question","label":{"en":"General question"}},{"value":"Working together","label":{"en":"Working together"}},{"value":"Support","label":{"en":"Support"}},{"value":"Press and partnerships","label":{"en":"Press and partnerships"}},{"value":"Other","label":{"en":"Other"}}],"copy":{"label":{"en":"Subject"},"placeholder":{"en":"Choose a subject"}}},{"name":"message","inputType":"textarea","required":false,"copy":{"label":{"en":"Message"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["service_terms"],"copy":{"label":{"en":"I accept the [Terms](terms), [Privacy Policy](privacy), and [Working Agreement](working_agreement)."}}}]}]}'::jsonb;
+-- END contact-form upgrade

package/templates/database/migrations/20261023120000_offerings_shown_price_ids/migration.sql

@@ -0,0 +1,47 @@
+-- #9070 — the workspace shown set becomes per Stripe Price (spec
+-- docs/specs/9070-the-workspace-offerings-page-becomes-spec.md D1, AC-6).
+--
+--   workspace_offerings.shown_price_ids (config) — the Stripe Price ids one
+--                    workspace shows on its pricing page. Written only by
+--                    apps/api's services/offerings/store.ts
+--                    (writeWorkspaceSelection, the PUT
+--                    /v1/workspaces/:workspaceId/offerings route), beside
+--                    shown_product_ids, which every write sets to the Products
+--                    with at least one shown Price. Read through
+--                    shownPriceIdsFor (services/offerings/index.ts) by
+--                    /pricing, the agent pricing tools, the plan picker and
+--                    checkout.
+--
+-- An EMPTY array means "every Price of each shown Product" — the grain every
+-- row had before this migration — so every existing row reads `{}` from the
+-- constant default and shows exactly what it showed before. Postgres stores
+-- the default in the catalog and rewrites no row for it. The store's parse
+-- refuses a new write of Products without Prices, so a row saved after this
+-- migration always carries its Price ids. Each CHECK is added NOT VALID and
+-- then VALIDATEd; every existing row passes both (an empty array).
+--
+-- The migration timestamp follows 20261022120000_in_page_magnets, which took
+-- the spec's named slot first (spec §5.3).
+--
+-- Rollout: deploy this migration BEFORE the API code that reads and writes the
+-- column, and the API before the Admin.
+--
+-- Rollback: roll the API back, then
+--   UPDATE "workspace_offerings" SET "shown_price_ids" = '{}';
+-- so every row reads at the Product grain again and the old route's saves
+-- pass workspace_offerings_shown_prices_need_products, and tell each owner who
+-- saved per Price that every Price of their shown Products is on sale again.
+-- Never drop the column while a per-Price row exists without that notice.
+
+-- AlterTable
+ALTER TABLE "workspace_offerings" ADD COLUMN "shown_price_ids" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[];
+
+-- At most 100 Products × three periods, and no NULL element.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_shown_price_ids_bound"
+  CHECK (cardinality("shown_price_ids") <= 300 AND array_position("shown_price_ids", NULL) IS NULL) NOT VALID;
+ALTER TABLE "workspace_offerings" VALIDATE CONSTRAINT "workspace_offerings_shown_price_ids_bound";
+
+-- A shown Price needs a shown Product.
+ALTER TABLE "workspace_offerings" ADD CONSTRAINT "workspace_offerings_shown_prices_need_products"
+  CHECK (cardinality("shown_price_ids") = 0 OR cardinality("shown_product_ids") > 0) NOT VALID;
+ALTER TABLE "workspace_offerings" VALIDATE CONSTRAINT "workspace_offerings_shown_prices_need_products";

package/templates/database/migrations/20261024120000_organization_plan_checkout_session/migration.sql

@@ -0,0 +1,16 @@
+-- #9067 D13 — the Organization binds only the plan Checkout it recorded (spec
+-- docs/specs/9067-the-billing-tab-s-plan-spec.md D13, SEC-9067-1 to -3).
+--
+-- `plan_checkout_session_id` is the one plan Checkout this Organization has
+-- open, written by POST /v1/billing/plan-checkout through a compare-and-set
+-- and cleared by the Stripe webhook when it binds that session's customer.
+-- Nullable, no default and no backfill: every existing row reads "no open
+-- plan session". Unique, so one session id can name at most one
+-- Organization.
+--
+-- Rollback: DROP INDEX "organizations_plan_checkout_session_id_key";
+-- ALTER TABLE "organizations" DROP COLUMN "plan_checkout_session_id";
+
+ALTER TABLE "organizations" ADD COLUMN "plan_checkout_session_id" TEXT;
+
+CREATE UNIQUE INDEX "organizations_plan_checkout_session_id_key" ON "organizations"("plan_checkout_session_id");

package/templates/database/migrations/20261025120000_trial_magnet/migration.sql

@@ -0,0 +1,28 @@
+-- #9301 — the standard trial magnet (spec
+-- docs/specs/9287-operator-started-trials-spec.md D11, C1).
+--
+-- One marked block, re-runnable and held to its TypeScript constant by
+-- database/__tests__/trial-magnet-migration.test.ts, on the newsletter
+-- backfill's footing (20261022120000_in_page_magnets):
+--
+--   trial backfill   — every existing workspace gets the standard trial
+--                      magnet (`trialFlowConfig`, `diagnostic`, `live`,
+--                      landing page /trial, completion `lead`). Insert-only
+--                      on `(site_id, slug)`: a row already at `trial` (an
+--                      owner's own magnet included) is never changed. A
+--                      workspace created after this runs is seeded by
+--                      `POST /v1/workspaces`, and the seed-presets CLI covers
+--                      one created between this migration and the route
+--                      code's deploy.
+--
+-- Rollback: DELETE FROM "flow_definitions" WHERE "slug" = 'trial' AND
+-- "config" = <the backfill literal>::jsonb;
+
+-- BEGIN trial backfill
+INSERT INTO "flow_definitions" ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "completion", "landing_page", "updated_at")
+SELECT w."id", w."id", 'trial',
+  '{"slug":"trial","defaultLocale":"en","steps":[{"key":"about","type":"field","copy":{"title":{"en":"Free trial"},"cta":{"en":"Request my trial"}},"fields":[{"name":"first_name","inputType":"text","required":true,"mapsTo":"givenName","copy":{"label":{"en":"First name"}}},{"name":"last_name","inputType":"text","required":true,"mapsTo":"familyName","copy":{"label":{"en":"Last name"}}},{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Work email"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["service_terms"],"copy":{"label":{"en":"I accept the [Terms](terms) and [Privacy Policy](privacy)."}}}]}],"ending":{"default":{"kind":"screen","headline":{"en":"Thanks, {name}."},"body":{"en":"We have your request and will be in touch about your trial."}}},"landing":{"title":{"en":"Free trial"},"description":{"en":"Try it free for 14 days. No card needed."},"cta":{"en":"Request a free trial"}}}'::jsonb,
+  'diagnostic', 'Free trial', 'live', false, 'lead', '/trial', CURRENT_TIMESTAMP
+FROM "workspaces" w
+ON CONFLICT ("site_id", "slug") DO NOTHING;
+-- END trial backfill

package/templates/database/migrations/20261026120000_trial_magnet_proof_line/migration.sql

@@ -0,0 +1,23 @@
+-- #9302 — the trial magnet's landing gains its proof line (spec
+-- docs/specs/9287-operator-started-trials-spec.md C2; operator decision on
+-- #9302, option (a)).
+--
+-- One marked block, held to its TypeScript constant by
+-- database/__tests__/trial-magnet-migration.test.ts, on the contact-form
+-- upgrade's footing (20261022120000_in_page_magnets):
+--
+--   trial proof-line upgrade — a trial magnet whose config is still exactly
+--                              #9301's shipped default (the backfill literal
+--                              in 20261025120000_trial_magnet) becomes
+--                              `trialFlowConfig`, which adds
+--                              `landing.meta`. An owner's edited trial magnet
+--                              is never touched. Sets nothing but `config`
+--                              and `updated_at`.
+--
+-- Rollback: UPDATE "flow_definitions" SET "config" = <the WHERE literal>::jsonb
+-- WHERE "slug" = 'trial' AND "config" = <the SET literal>::jsonb;
+
+-- BEGIN trial proof-line upgrade
+UPDATE "flow_definitions" SET "config" = '{"slug":"trial","defaultLocale":"en","steps":[{"key":"about","type":"field","copy":{"title":{"en":"Free trial"},"cta":{"en":"Request my trial"}},"fields":[{"name":"first_name","inputType":"text","required":true,"mapsTo":"givenName","copy":{"label":{"en":"First name"}}},{"name":"last_name","inputType":"text","required":true,"mapsTo":"familyName","copy":{"label":{"en":"Last name"}}},{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Work email"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["service_terms"],"copy":{"label":{"en":"I accept the [Terms](terms) and [Privacy Policy](privacy)."}}}]}],"ending":{"default":{"kind":"screen","headline":{"en":"Thanks, {name}."},"body":{"en":"We have your request and will be in touch about your trial."}}},"landing":{"title":{"en":"Free trial"},"description":{"en":"Try it free for 14 days. No card needed."},"meta":{"en":"A person on our team reviews every request."},"cta":{"en":"Request a free trial"}}}'::jsonb, "updated_at" = CURRENT_TIMESTAMP
+WHERE "slug" = 'trial' AND "config" = '{"slug":"trial","defaultLocale":"en","steps":[{"key":"about","type":"field","copy":{"title":{"en":"Free trial"},"cta":{"en":"Request my trial"}},"fields":[{"name":"first_name","inputType":"text","required":true,"mapsTo":"givenName","copy":{"label":{"en":"First name"}}},{"name":"last_name","inputType":"text","required":true,"mapsTo":"familyName","copy":{"label":{"en":"Last name"}}},{"name":"email","inputType":"email","required":true,"mapsTo":"email","copy":{"label":{"en":"Work email"}}},{"name":"terms","inputType":"consent","required":true,"purposes":["service_terms"],"copy":{"label":{"en":"I accept the [Terms](terms) and [Privacy Policy](privacy)."}}}]}],"ending":{"default":{"kind":"screen","headline":{"en":"Thanks, {name}."},"body":{"en":"We have your request and will be in touch about your trial."}}},"landing":{"title":{"en":"Free trial"},"description":{"en":"Try it free for 14 days. No card needed."},"cta":{"en":"Request a free trial"}}}'::jsonb;
+-- END trial proof-line upgrade

package/templates/database/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@working-theory/database",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package/templates/database/seed.ts

@@ -34,9 +34,17 @@ import {
   JOB_APPLICATION_FLOW_TITLE,
   JOB_APPLICATION_LANDING_PAGE,
   jobApplicationFlowConfig,
+  NEWSLETTER_FLOW_SLUG,
+  NEWSLETTER_FLOW_TITLE,
+  NEWSLETTER_LANDING_PAGE,
+  newsletterFlowConfig,
   REQUEST_QUOTE_FLOW_SLUG,
   REQUEST_QUOTE_FLOW_TITLE,
   requestQuoteFlowConfig,
+  TRIAL_FLOW_LANDING_PAGE,
+  TRIAL_FLOW_SLUG,
+  TRIAL_FLOW_TITLE,
+  trialFlowConfig,
 } from "@working-theory/validation";
 
 import type { PrismaClient } from "./generated/client/client.js";
@@ -84,8 +92,9 @@ export type DefaultWorkspacePrismaClient = Pick<
  * `update`, so an existing `(site_id, slug)` row is never overwritten.
  *
  * #8661 D3 — and its live Contact form magnet, the same way, and (#8746 D3)
- * its live Job application magnet. An existing deployment (a workspace
- * already present) gets its rows from the seed-presets CLI instead.
+ * its live Job application magnet, and (#8847 D4) its live newsletter magnet.
+ * An existing deployment (a workspace already present) gets its rows from the
+ * seed-presets CLI instead.
  *
  * #8759 — each names its #8757 D2 completion: the migration's backfill ran
  * before this seed and found no rows, so the seed writes the value itself.
@@ -189,6 +198,52 @@ export async function provisionDefaultWorkspace(
     update: {},
   });
 
+  // #8847 D4 — the standard newsletter magnet, the same way.
+  await prisma.flowDefinition.upsert({
+    where: {
+      siteId_slug: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        slug: NEWSLETTER_FLOW_SLUG,
+      },
+    },
+    create: {
+      siteId: DEFAULT_WORKSPACE_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      slug: NEWSLETTER_FLOW_SLUG,
+      config: newsletterFlowConfig,
+      kind: "newsletter",
+      title: NEWSLETTER_FLOW_TITLE,
+      status: "live",
+      customersEnabled: false,
+      completion: "lead",
+      landingPage: NEWSLETTER_LANDING_PAGE,
+    },
+    update: {},
+  });
+
+  // #9287 D11 — the standard trial magnet, the same way.
+  await prisma.flowDefinition.upsert({
+    where: {
+      siteId_slug: {
+        siteId: DEFAULT_WORKSPACE_ID,
+        slug: TRIAL_FLOW_SLUG,
+      },
+    },
+    create: {
+      siteId: DEFAULT_WORKSPACE_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      slug: TRIAL_FLOW_SLUG,
+      config: trialFlowConfig,
+      kind: "diagnostic",
+      title: TRIAL_FLOW_TITLE,
+      status: "live",
+      customersEnabled: false,
+      completion: "lead",
+      landingPage: TRIAL_FLOW_LANDING_PAGE,
+    },
+    update: {},
+  });
+
   return { created: true };
 }