create-ailk 0.23.0 → 0.24.0

package/templates/apps/api/src/services/__tests__/project-listings.fence.test.ts

@@ -35,7 +35,7 @@ jest.mock("@working-theory/license", () => ({
 jest.mock("../../lib/prisma.js", () => ({
   prisma: {
     projectListing: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
+    waitlistScore: { groupBy: jest.fn() },
   },
 }));
 
@@ -102,25 +102,25 @@ function listingRow(id: string, experimentKey: string | null): Record<string, un
 
 beforeEach(() => {
   jest.clearAllMocks();
-  (prisma.waitlistScore.count as jest.Mock).mockResolvedValue(3);
+  (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([]);
 });
 
 describe("attachWaitlistCounts — the fenced count filters on workspaceId beside siteId (#6258 AC-6)", () => {
-  it("prisma.waitlistScore.count's where carries workspaceId === the resolved scope id, by value", async () => {
+  it("prisma.waitlistScore.groupBy's where carries workspaceId === the resolved scope id, by value", async () => {
     (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
       listingRow("plst_a", EXPERIMENT_A),
     ]);
 
     await listProjectListings(SITE);
 
-    expect((prisma.waitlistScore.count as jest.Mock).mock.calls[0]![0]!.where).toEqual({
+    expect((prisma.waitlistScore.groupBy as jest.Mock).mock.calls[0]![0]!.where).toEqual({
       siteId: SITE,
       workspaceId: SITE,
-      experimentKey: EXPERIMENT_A,
+      experimentKey: { in: [EXPERIMENT_A] },
     });
   });
 
-  it("every DISTINCT experimentKey gets the same two scope terms — one count per key, no more", async () => {
+  it("every DISTINCT experimentKey sits under the same two scope terms — one grouped read, no more (#9243)", async () => {
     (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([
       listingRow("plst_a", EXPERIMENT_A),
       listingRow("plst_b", EXPERIMENT_B),
@@ -129,17 +129,14 @@ describe("attachWaitlistCounts — the fenced count filters on workspaceId besid
 
     await listProjectListings(SITE);
 
-    expect(prisma.waitlistScore.count).toHaveBeenCalledTimes(2);
-    const wheres = (prisma.waitlistScore.count as jest.Mock).mock.calls.map(
-      (call) => call[0]!.where as Record<string, unknown>,
-    );
-    for (const where of wheres) {
-      expect(where.siteId).toBe(SITE);
-      expect(where.workspaceId).toBe(SITE);
-    }
-    expect(wheres.map((w) => w.experimentKey).sort()).toEqual(
-      [EXPERIMENT_A, EXPERIMENT_B].sort(),
-    );
+    expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
+    const where = (prisma.waitlistScore.groupBy as jest.Mock).mock.calls[0]![0]!.where as Record<
+      string,
+      unknown
+    >;
+    expect(where.siteId).toBe(SITE);
+    expect(where.workspaceId).toBe(SITE);
+    expect(where.experimentKey).toEqual({ in: [EXPERIMENT_A, EXPERIMENT_B] });
   });
 
   it("no listing carries an experimentKey → no fenced read is issued at all", async () => {
@@ -149,6 +146,6 @@ describe("attachWaitlistCounts — the fenced count filters on workspaceId besid
 
     await listProjectListings(SITE);
 
-    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
+    expect(prisma.waitlistScore.groupBy).not.toHaveBeenCalled();
   });
 });

package/templates/apps/api/src/services/abandon-email.ts

@@ -134,6 +134,16 @@ function buildResumeLink(
   return `${resumeUrl}?fs=${sessionId}`;
 }
 
+// ─── Candidate paging (#9249) ───────────────────────────────────────────────────
+
+/**
+ * How many candidates one run reads per flow definition. A flow with more
+ * past-delay sessions than this processes one page and leaves the rest —
+ * still `abandonEmailStatus: null` — for the next run. Same page as
+ * `STANDARD_SEED_PAGE` (lib/tenant-db.ts), this app's other background page.
+ */
+export const ABANDON_CANDIDATE_PAGE_SIZE = 500;
+
 // ─── The sweep ──────────────────────────────────────────────────────────────────
 
 /**
@@ -197,19 +207,21 @@ async function sweepAllDefinitions(
         email: true,
         locale: true,
       },
+      // #9249 — oldest-updated first, so the page is deterministic (the same
+      // reason flow-aggregate.ts orders its capped read).
+      orderBy: { updatedAt: "asc" },
+      take: ABANDON_CANDIDATE_PAGE_SIZE,
     })) as AbandonCandidateRow[];
 
     summary.scanned += candidates.length;
 
+    const darkIds: string[] = [];
+
     for (const session of candidates) {
       summary.selected += 1;
 
       if (policy.mode === "dark") {
-        await prisma.flowSession.update({
-          where: { id: session.id },
-          data: { abandonEmailStatus: "dark", abandonEmailAt: now },
-        });
-        summary.dark += 1;
+        darkIds.push(session.id);
         logOutcome(session, policy.mode, "dark");
         continue;
       }
@@ -265,6 +277,17 @@ async function sweepAllDefinitions(
         logOutcome(session, policy.mode, "failed");
       }
     }
+
+    // #9249 — one stamp for the whole dark-mode page, not one per row. The
+    // `abandonEmailStatus: null` guard is the candidate read's own term, so a
+    // row an overlapping run stamped meanwhile keeps what that run wrote.
+    if (darkIds.length > 0) {
+      await prisma.flowSession.updateMany({
+        where: { id: { in: darkIds }, abandonEmailStatus: null },
+        data: { abandonEmailStatus: "dark", abandonEmailAt: now },
+      });
+      summary.dark += darkIds.length;
+    }
   }
 }
 

package/templates/apps/api/src/services/deliverable-fulfillment.ts

@@ -84,12 +84,6 @@ export type FulfillDeliverableInput = {
   locale: string;
 };
 
-type DeliverableAssetRow = {
-  id: string;
-  siteId: string;
-  key: string;
-};
-
 // Derived from the schema type (not hand-rolled) so it never drifts from
 // `deliverableAssetMapEntrySchema`'s actual Zod-inferred optional shape.
 type DeliverableEntry = NonNullable<
@@ -479,7 +473,8 @@ export async function fulfillDeliverable(
       // one row; `workspaceId` is what makes the tenant the QUERY's statement.
       const asset = (await prisma.deliverableAsset.findUnique({
         where: { siteId_key: { siteId, key: entry.assetKey }, workspaceId: siteId },
-      })) as DeliverableAssetRow | null;
+        select: { id: true },
+      })) as { id: string } | null;
 
       if (!asset) {
         logOutcome(logCtx, "asset_missing");

package/templates/apps/api/src/services/offerings/__tests__/catalog.test.ts

@@ -10,6 +10,7 @@ import { join } from "node:path";
 import { offeringsSnapshotProductSchema } from "@working-theory/validation";
 
 import {
+  isOfferingsPlanProduct,
   isOfferingsProduct,
   normalizeCatalog,
   type CatalogPrice,
@@ -286,6 +287,58 @@ describe("normalizeCatalog (#8876 D5, AC-5)", () => {
     });
   });
 
+  describe("the hub's own plans (#9338 AC-3)", () => {
+    const pro = product("prod_pro", { name: "AI Launch Kit Pro", metadata: { ailk_group: "plan", ailk_order: "10" } });
+    const proPlus = product("prod_pro_plus", {
+      name: "AI Launch Kit Pro Plus",
+      metadata: { ailk_group: "plan", ailk_order: "20" },
+    });
+    const yearly = { recurring: { interval: "year", interval_count: 1, usage_type: "licensed" } };
+
+    it("lists the re-keyed hub catalog as two plans with nothing held", () => {
+      const { offerings, held } = normalizeCatalog({
+        products: [pro, proPlus],
+        prices: [
+          price("price_pro_m", "prod_pro", { lookup_key: "ailk-pro_monthly" }),
+          price("price_pro_y", "prod_pro", { lookup_key: "ailk-pro_yearly", ...yearly }),
+          price("price_pp_m", "prod_pro_plus", { lookup_key: "ailk-pro-plus_monthly" }),
+        ],
+      });
+      expect(held).toEqual([]);
+      expect(offerings.map((o) => [o.productId, o.ailkGroup, o.prices.map((p) => p.lookupKey)])).toEqual([
+        ["prod_pro", "plan", ["ailk-pro_monthly", "ailk-pro_yearly"]],
+        ["prod_pro_plus", "plan", ["ailk-pro-plus_monthly"]],
+      ]);
+    });
+
+    it("holds today's Pro Plus (no group, key ailk-pro-plus) group_invalid", () => {
+      const today = product("prod_pro_plus", { name: "AI Launch Kit Pro Plus", metadata: {} });
+      expect(one(today, [price("price_pp", "prod_pro_plus", { lookup_key: "ailk-pro-plus", ...yearly })]).held).toEqual([
+        { productId: "prod_pro_plus", name: "AI Launch Kit Pro Plus", reason: "group_invalid" },
+      ]);
+    });
+
+    it("holds Pro Plus marked but still keyed ailk-pro-plus needs_lookup_key", () => {
+      expect(one(proPlus, [price("price_pp", "prod_pro_plus", { lookup_key: "ailk-pro-plus", ...yearly })]).held).toEqual([
+        { productId: "prod_pro_plus", name: "AI Launch Kit Pro Plus", reason: "needs_lookup_key" },
+      ]);
+    });
+
+    it("holds a yearly Price keyed _monthly needs_lookup_key", () => {
+      expect(
+        one(proPlus, [price("price_pp", "prod_pro_plus", { lookup_key: "ailk-pro-plus_monthly", ...yearly })]).held,
+      ).toEqual([{ productId: "prod_pro_plus", name: "AI Launch Kit Pro Plus", reason: "needs_lookup_key" }]);
+    });
+
+    it("isOfferingsPlanProduct is true for ailk_group plan only", () => {
+      expect(isOfferingsPlanProduct(product("prod_a", { metadata: { ailk_group: "plan" } }))).toBe(true);
+      expect(isOfferingsPlanProduct(product("prod_a", { metadata: { ailk_group: "addon" } }))).toBe(false);
+      expect(isOfferingsPlanProduct(product("prod_a", { metadata: { ailk_group: "Plan" } }))).toBe(false);
+      expect(isOfferingsPlanProduct(product("prod_a", { metadata: {} }))).toBe(false);
+      expect(isOfferingsPlanProduct(product("prod_a", { metadata: null }))).toBe(false);
+    });
+  });
+
   it("splits a lookup key only through parseLookupKey (AC-9)", () => {
     const source = readFileSync(join(__dirname, "..", "catalog.ts"), "utf8");
     expect(source).toContain("parseLookupKey(");

package/templates/apps/api/src/services/offerings/__tests__/connection.test.ts

@@ -48,6 +48,9 @@ jest.mock("node:crypto", () => {
 });
 
 const mockStripeClientForConnection = jest.fn();
+// `getStripeClient()` caches its client for the process, so a case that needs a
+// refusal swaps it (#9285); every other case calls through to the real one.
+const mockGetStripeClient = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- lib/stripe.ts is the Stripe HTTP boundary; the real wrapper runs unless a case swaps in a fake client
 jest.mock("../../../lib/stripe.js", () => {
   const actual = jest.requireActual<typeof import("../../../lib/stripe.js")>("../../../lib/stripe.js");
@@ -55,6 +58,7 @@ jest.mock("../../../lib/stripe.js", () => {
     ...actual,
     stripeClientForConnection: (...args: Parameters<typeof actual.stripeClientForConnection>) =>
       mockStripeClientForConnection(...args),
+    getStripeClient: () => mockGetStripeClient(),
   };
 });
 
@@ -67,8 +71,11 @@ import {
   encryptStripeConnectionValue,
   findStripeConnectionByWebhookToken,
   formatRekeyReport,
+  getEnvironmentStripeSource,
+  getOfferingsConnectionState,
   getStripeConnectionSummary,
   goLiveStripeConnection,
+  organizationOwnsEnvironmentStripeKey,
   PROBE_TIMEOUT_MS,
   probeStripeKey,
   putStripeConnectionKey,
@@ -866,3 +873,103 @@ describe("stripeClientForOrganization (#8907 D12, AC-13)", () => {
     expect(lib).toContain("productionBuild: isProductionBuild()");
   });
 });
+
+// ─── #9285 AC-8, AC-9 — the environment key's owner ─────────────────────────
+
+describe("the environment Stripe key and the Organization that owns it (#9285 AC-8, AC-9)", () => {
+  const saved = {
+    key: process.env["STRIPE_SECRET_KEY"],
+    modules: process.env["AILK_ENABLED_MODULES"],
+    owner: process.env["STRIPE_ENV_ORGANIZATION_ID"],
+  };
+  const restore = (name: string, value: string | undefined) => {
+    if (value === undefined) delete process.env[name];
+    else process.env[name] = value;
+  };
+
+  beforeEach(() => {
+    db.__db.stripeConnection = [];
+    mockGetStripeClient.mockReset().mockImplementation(() => actualStripe.getStripeClient());
+    process.env["STRIPE_SECRET_KEY"] = testKey();
+    process.env["AILK_ENABLED_MODULES"] = "multi-tenant";
+    delete process.env["STRIPE_ENV_ORGANIZATION_ID"];
+  });
+  afterAll(() => {
+    restore("STRIPE_SECRET_KEY", saved.key);
+    restore("AILK_ENABLED_MODULES", saved.modules);
+    restore("STRIPE_ENV_ORGANIZATION_ID", saved.owner);
+  });
+
+  it("with the multi-tenant module, only the Organization STRIPE_ENV_ORGANIZATION_ID names owns it", () => {
+    // Unset: nobody owns it (fail closed).
+    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
+    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(false);
+    // Blank or whitespace: nobody.
+    for (const blank of ["", "   "]) {
+      process.env["STRIPE_ENV_ORGANIZATION_ID"] = blank;
+      expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
+    }
+    // Naming no Organization: nobody.
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = "org_unknown";
+    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(false);
+    // Naming one: that one alone.
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
+    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(true);
+    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(false);
+  });
+
+  it("without the multi-tenant module, the single Organization owns it and the variable is not read", () => {
+    process.env["AILK_ENABLED_MODULES"] = "";
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = "org_unknown";
+    expect(organizationOwnsEnvironmentStripeKey(ORG_A)).toBe(true);
+    delete process.env["AILK_ENABLED_MODULES"];
+    expect(organizationOwnsEnvironmentStripeKey(ORG_B)).toBe(true);
+  });
+
+  it("reports the source and the Offerings state to the owner alone, and never a key class it cannot sell through", async () => {
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
+    expect(getEnvironmentStripeSource(ORG_A)).toEqual({ source: "environment", mode: "test" });
+    expect(await getOfferingsConnectionState(ORG_A)).toBe("environment");
+    expect(getEnvironmentStripeSource(ORG_B)).toBeNull();
+    expect(await getOfferingsConnectionState(ORG_B)).toBeNull();
+    // No usable key class: no source, even for the owner.
+    process.env["STRIPE_SECRET_KEY"] = ["pk", "test", "a".repeat(24)].join("_");
+    expect(getEnvironmentStripeSource(ORG_A)).toBeNull();
+    expect(await getOfferingsConnectionState(ORG_A)).toBeNull();
+  });
+
+  it("lets a stored connection win over the environment state", async () => {
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
+    const now = new Date();
+    rows().push({
+      id: "stripecon_a",
+      organizationId: ORG_A,
+      mode: "test",
+      liveAt: null,
+      keyLast4: "aaaa",
+      webhookToken: "A".repeat(43),
+      webhookSecretCiphertext: null,
+      credentialCiphertext: encryptStripeConnectionValue(testKey(), ORG_A, "credential", KEY_A),
+      createdAt: now,
+      updatedAt: now,
+    });
+    expect(await getOfferingsConnectionState(ORG_A)).toMatchObject({ mode: "test", last4: "aaaa" });
+  });
+
+  it("sells an Organization with no stored row through the environment client, and no other", async () => {
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
+    const owned = await stripeClientForOrganization(ORG_A);
+    expect(owned).toMatchObject({ kind: "ok", mode: "test" });
+    expect(await stripeClientForOrganization(ORG_B)).toEqual({ kind: "none" });
+    // The per-key factory is never used for the environment key.
+    expect(mockStripeClientForConnection).not.toHaveBeenCalled();
+  });
+
+  it("answers unusable when the owner's key is one the process refuses", async () => {
+    process.env["STRIPE_ENV_ORGANIZATION_ID"] = ORG_A;
+    mockGetStripeClient.mockImplementationOnce(() => {
+      throw new Error("refused");
+    });
+    expect(await stripeClientForOrganization(ORG_A)).toEqual({ kind: "unusable" });
+  });
+});

package/templates/apps/api/src/services/offerings/__tests__/org-products.test.ts

@@ -189,6 +189,10 @@ function corruptConnection(): void {
 const noValidate = { validate: () => undefined };
 
 beforeEach(async () => {
+  // With the multi-tenant module and no STRIPE_ENV_ORGANIZATION_ID nobody owns the
+  // environment key (#9285 AC-8), so "no connection" stays no connection here.
+  process.env.AILK_ENABLED_MODULES = "multi-tenant";
+  delete process.env.STRIPE_ENV_ORGANIZATION_ID;
   for (const key of Object.keys(db.__db)) delete db.__db[key];
   jest.clearAllMocks();
   resetOfferingsRefreshStateForTests();

package/templates/apps/api/src/services/offerings/__tests__/readers.test.ts

@@ -135,6 +135,10 @@ const rejecting = () =>
   });
 
 beforeEach(async () => {
+  // With the multi-tenant module and no STRIPE_ENV_ORGANIZATION_ID nobody owns the
+  // environment key (#9285 AC-8), so "no connection" stays no connection here.
+  process.env.AILK_ENABLED_MODULES = "multi-tenant";
+  delete process.env.STRIPE_ENV_ORGANIZATION_ID;
   for (const key of Object.keys(db.__db)) delete db.__db[key];
   mockLog.mockClear();
   db.workspaceOfferings.findUnique.mockClear();

package/templates/apps/api/src/services/offerings/catalog.ts

@@ -117,6 +117,16 @@ export function isOfferingsProduct(product: CatalogProduct): boolean {
     && product.metadata.ailk_group.length > 0;
 }
 
+/**
+ * An Offerings `plan` Product: `metadata.ailk_group` exactly `"plan"` — the
+ * normalizer's own group read, the stricter sibling of `isOfferingsProduct`.
+ * The Billing tab's plan checkout sells only a Price whose Product passes
+ * this (#9338 DD4), so an unmarked hub plan never sells from it.
+ */
+export function isOfferingsPlanProduct(product: CatalogProduct): boolean {
+  return groupOf(product) === "plan";
+}
+
 function metadataOf(product: CatalogProduct): Record<string, unknown> {
   return isRecord(product.metadata) ? product.metadata : {};
 }

package/templates/apps/api/src/services/offerings/checkout-authorization.ts

@@ -13,17 +13,21 @@
  * key: that key sells the deployment's own products, not a spoke's (#9126).
  *
  * THE SALE. `startOfferingsCheckout` parses the lookup key by the one grammar
- * before any read (A3), authorizes it at click time against org-enabled ∩
+ * before any read (A3), refuses the hub's own plan keys at any period
+ * (#9338 DD5), authorizes it at click time against org-enabled ∩
  * workspace-shown from the rows — never the snapshot (A4), and for a
  * workspace saved per Price only a shown Price (#9070 D5) — resolves it live
  * with the connection's own client, sells the authorized Price id in an
  * anonymous hosted session stamped `{ site, ailk_offering }` by the server
  * (A6, A7), and records the session before it answers; a failed record
  * expires the session (A11). Every miss is one `unknown`; every failure one
- * `unavailable`; there is never a snapshot or env-key fallback (A5).
+ * `unavailable`; there is never a snapshot fallback (A5), and this path never
+ * sells on the environment key: an Organization that owns it checks out on the
+ * env path until it has a stored connection (#9296, #8936).
  *
  * THE READ. `readOfferingsCheckoutSession` reads a recorded session with its
- * record's own connection, never the env key or a caller value (A13).
+ * record's own connection, never a caller value (A13). Only a stored connection
+ * records a session (#9296), so this read never runs on the environment key.
  *
  * LOGGING (D11, T6). Only `workspaceId` or `organizationId`, an 8-character
  * session-id prefix, a fixed `reason`, and an error's class name. Never a
@@ -33,6 +37,7 @@
 import { logger } from "@working-theory/observability";
 import {
   OFFERINGS_NAME_MAX,
+  isPlanPurchaseKey,
   lookupKeyPeriodSchema,
   parseLookupKey,
 } from "@working-theory/validation";
@@ -55,7 +60,7 @@ import {
   recordCheckoutSession,
 } from "./checkout-session-record.js";
 import {
-  getStripeConnectionSummary,
+  getOfferingsConnectionState,
   stripeClientForOrganization,
 } from "./connection.js";
 import { organizationIdOfWorkspace } from "./store.js";
@@ -106,10 +111,17 @@ export async function resolveOfferingsCheckoutPath(
       : { kind: "env" };
   const organizationId = await organizationIdOfWorkspace(workspaceId);
   if (organizationId === null) return noConnection;
-  const summary = await getStripeConnectionSummary(organizationId);
+  const summary = await getOfferingsConnectionState(organizationId);
   if (summary === null) return noConnection;
   // Never the rows, which read a corrupt connection as an empty set (404).
   if (summary === "unreadable") return { kind: "unavailable" };
+  // An Organization on the environment key never takes the Offerings path
+  // (#9296): that path stamps `ailk_offering`, which the legacy webhook acks
+  // `offerings_path` without recording and the per-Organization receiver takes
+  // only for a stored connection's token, so a sale on the environment key
+  // would be charged and never fulfilled. Its checkout stays on the env path
+  // until environment-key fulfilment exists (#8936 stores the connection).
+  if (summary === "environment") return noConnection;
   return { kind: "offerings", workspaceId, organizationId };
 }
 
@@ -168,6 +180,12 @@ export async function startOfferingsCheckout(
   const parsed = parseLookupKey(productCode);
   if (parsed === null) return unknown();
 
+  // 1b. Never a hub plan (#9338 DD5): AILK's own Pro / Pro Plus, at any
+  // period, for every Organization. A sale here would stamp `ailk_offering`,
+  // which no billing path mints a licence for — the buyer would be charged
+  // with no key. Same 404, same log reason, before any read.
+  if (isPlanPurchaseKey(productCode)) return unknown();
+
   // 2. The connection's own client (K6) — before the rows, so a key that
   // cannot be used answers 502 whatever the rows hold.
   let connection: Awaited<ReturnType<typeof stripeClientForOrganization>>;

package/templates/apps/api/src/services/offerings/connection.ts

@@ -49,9 +49,11 @@ import {
 import { z } from "zod";
 
 import { config } from "../../config/index.js";
+import { isModuleEnabled } from "../../config/modules.js";
 import { prisma } from "../../lib/prisma.js";
 import {
   classifyStripeKey,
+  getStripeClient,
   isProductionBuild,
   stripeClientForConnection,
   type StripeConnectionMode,
@@ -365,6 +367,65 @@ const viewSchema = z
   .refine((view) => (view.mode === "live") === (view.liveAt !== null), { path: ["liveAt"] });
 export type StripeConnectionView = z.infer<typeof viewSchema>;
 
+/**
+ * The read-only source the GET answers when the Organization has NO stored
+ * connection but OWNS the Stripe key in this API process's environment
+ * (#9285 AC-3, AC-8): the deployment's own `STRIPE_SECRET_KEY`. It names the
+ * mode the key's class implies and nothing else — never the key, its last
+ * four or a webhook path — and a publishable or unrecognised value is no
+ * source at all. A stored connection always wins; the caller decides that,
+ * not this function.
+ */
+export type StripeEnvironmentSource = { source: "environment"; mode: StripeConnectionMode };
+
+/** The mode the process's own Stripe key implies, or `null` for no usable class. */
+function environmentKeyMode(): StripeConnectionMode | null {
+  switch (classifyStripeKey(process.env["STRIPE_SECRET_KEY"])) {
+    case "restricted-test":
+    case "secret-test":
+      return "test";
+    case "restricted-live":
+    case "secret-live":
+      return "live";
+    default:
+      return null;
+  }
+}
+
+/**
+ * Whether this Organization owns the environment key (#9285 AC-8). Without
+ * the multi-tenant module a deployment has one Organization, and it owns the
+ * key. With it, only the Organization named by `STRIPE_ENV_ORGANIZATION_ID`
+ * does; unset, blank or naming no Organization, nobody does (fail closed), so
+ * one tenant's Offerings can never sell through another's account.
+ */
+export function organizationOwnsEnvironmentStripeKey(organizationId: string): boolean {
+  if (!isModuleEnabled("multi-tenant")) return true;
+  const owner = process.env["STRIPE_ENV_ORGANIZATION_ID"]?.trim();
+  return owner !== undefined && owner !== "" && owner === organizationId;
+}
+
+/** The environment source for this Organization, or `null` when it has none to see. */
+export function getEnvironmentStripeSource(organizationId: string): StripeEnvironmentSource | null {
+  if (!organizationOwnsEnvironmentStripeKey(organizationId)) return null;
+  const mode = environmentKeyMode();
+  return mode === null ? null : { source: "environment", mode };
+}
+
+/**
+ * The connection state Offerings sells on (#9285 AC-9): the stored summary
+ * first, else `"environment"` for an Organization that owns the environment
+ * key, else `null`. `"unreadable"` stays a corrupt stored row. The one
+ * "is this Organization connected" read every Offerings path shares.
+ */
+export async function getOfferingsConnectionState(
+  organizationId: string,
+): Promise<StripeConnectionSummary | "unreadable" | "environment" | null> {
+  const stored = await getStripeConnectionSummary(organizationId);
+  if (stored !== null) return stored;
+  return getEnvironmentStripeSource(organizationId) === null ? null : "environment";
+}
+
 /** What a write answers (D7): no `last4`, no `webhookPath` (SEC-8907-10). */
 export type StripeConnectionSaved = {
   mode: StripeConnectionMode;
@@ -837,13 +898,32 @@ export type StripeConnectionClient =
   | { kind: "unusable" }
   | { kind: "ok"; client: ConnectionClient; mode: StripeConnectionMode };
 
+/**
+ * The environment key's client for the Organization that owns it (#9285
+ * AC-9), through `getStripeClient()` — the allow-list the env checkout path
+ * already meets (a test key, or the restricted live key the process admitted
+ * at boot). A key it refuses is `unusable`, not `none`: the Organization owns
+ * a key it cannot sell through.
+ */
+function environmentClientFor(organizationId: string): StripeConnectionClient {
+  const source = getEnvironmentStripeSource(organizationId);
+  if (source === null) return { kind: "none" };
+  try {
+    return { kind: "ok", client: getStripeClient(), mode: source.mode };
+  } catch {
+    return { kind: "unusable" };
+  }
+}
+
 /**
  * A client built from the Organization's own key, in its own mode — what
  * #8054's catalog source and #8861's checkout call. A live row on a
  * non-production build is `unusable` before any decrypt (D3); so is a key
  * that does not decrypt and one the factory refuses for the row's mode.
- * Nothing is cached beyond the call (C8), and there is never a fallback to
- * the deployment's env key.
+ * Nothing is cached beyond the call (C8). With no stored row, an
+ * Organization that owns the deployment's environment key (#9285 AC-8) is sold
+ * through it, by the same chokepoint the env checkout path uses; no other
+ * Organization ever falls back to it.
  */
 export async function stripeClientForOrganization(
   organizationId: string,
@@ -854,7 +934,7 @@ export async function stripeClientForOrganization(
       select: { credentialCiphertext: true, mode: true, liveAt: true },
     }),
   );
-  if (row === null) return { kind: "none" };
+  if (row === null) return environmentClientFor(organizationId);
   if (!isMode(row.mode)) {
     logUnreadableRow(organizationId);
     return { kind: "unusable" };

package/templates/apps/api/src/services/offerings/index.ts

@@ -59,7 +59,7 @@ import {
   type NormalizedCatalog,
   type OfferingsCatalogSource,
 } from "./catalog.js";
-import { getStripeConnectionSummary } from "./connection.js";
+import { getOfferingsConnectionState } from "./connection.js";
 import {
   OfferingsShapeError,
   organizationIdOfWorkspace,
@@ -81,7 +81,7 @@ export {
   type OfferingsCatalog,
   type OfferingsCatalogSource,
 } from "./catalog.js";
-export { getStripeConnectionSummary } from "./connection.js";
+export { getOfferingsConnectionState, getStripeConnectionSummary } from "./connection.js";
 export { OfferingsShapeError } from "./store.js";
 
 /** The snapshot is served for at most 24 hours from `snapshotAt` (C5). */
@@ -268,7 +268,7 @@ export async function getOrgEnabledProducts(
   sourceFor: OfferingsSourceFor,
   { now = new Date() }: { now?: Date } = {},
 ): Promise<OrgEnabledProducts | null> {
-  const connection = await getStripeConnectionSummary(organizationId);
+  const connection = await getOfferingsConnectionState(organizationId);
   if (connection === null) return null;
   const productIds = await readEnabledProductIds(organizationId);
   if (connection === "unreadable") {
@@ -352,7 +352,7 @@ export async function listOrgProducts(
   sourceFor: OfferingsSourceFor,
   { now = new Date() }: { now?: Date } = {},
 ): Promise<OrgProductList> {
-  const connection = await getStripeConnectionSummary(organizationId);
+  const connection = await getOfferingsConnectionState(organizationId);
   if (connection === null) return { connection: "none" };
   if (connection === "unreadable") return { connection: "unreadable" };
   const enabled = await readEnabledProductIds(organizationId);
@@ -378,7 +378,7 @@ export async function setOrgEnabledProducts(
     validate,
   }: { now?: Date; validate: (list: ConnectedOrgProductList) => void },
 ): Promise<SetOrgEnabledResult> {
-  const connection = await getStripeConnectionSummary(organizationId);
+  const connection = await getOfferingsConnectionState(organizationId);
   if (connection === null) return { kind: "not_connected" };
   if (connection === "unreadable") return { kind: "connection_unreadable" };
   const catalog = await catalogOrSourceError(organizationId, sourceFor, now);
@@ -443,7 +443,7 @@ async function resolveWorkspace(
 ): Promise<{ missing: "no_connection" | "no_selection" } | ResolvedWorkspace> {
   const organizationId = await organizationIdOfWorkspace(workspaceId);
   if (organizationId === null) return { missing: "no_selection" };
-  const connection = await getStripeConnectionSummary(organizationId);
+  const connection = await getOfferingsConnectionState(organizationId);
   if (connection === null) return { missing: "no_connection" };
   // An unreadable connection serves nothing, with or without a selection
   // row, and never reads as unconnected (SEC-PR8955-R2-1).