create-ailk 0.4.0 → 0.6.0

package/templates/database/__tests__/fixtures/appointment-create-probe.ts

@@ -0,0 +1,79 @@
+/**
+ * @file appointment-create-probe.ts
+ *
+ * LIVE-CLIENT probe for `appointment.db.test.ts` (#6162). Runs `prisma.
+ * appointment.create()` for real, against a real (migrated) Postgres,
+ * through the REAL generated client — the exact runtime path that surfaced
+ * the bug this test guards ("column noShow does not exist" once
+ * `Appointment.noShow` lost its `@map("no_show")`).
+ *
+ * WHY A SEPARATE SCRIPT, RUN VIA `tsx` AS A SUBPROCESS, RATHER THAN IMPORTED
+ * DIRECTLY BY THE JEST TEST. `database/generated/client/client.ts` is
+ * generator-emitted, uses `import.meta.url`, and this package's `jest.
+ * config.cjs` transforms every test file through `ts-jest` targeting
+ * CommonJS — which cannot load an ESM-only module (see `prefixed-ids.db.
+ * test.ts`'s header for the same constraint). `tsx` runs this file as real
+ * ESM/TS with no such restriction, exactly as `seed-test.ts` already does
+ * for the same client (`pnpm --filter @working-theory/database db:seed:
+ * test`). The jest test spawns this script and asserts on its JSON stdout.
+ *
+ * Reads DATABASE_URL from the environment (the caller's `spawnSync` inherits
+ * `process.env`; `dotenv/config` covers a bare local run against `database/
+ * .env`). Creates one Appointment row with `noShow: true`, prints it as JSON,
+ * deletes it, and exits 0. On any Prisma error (e.g. the pre-fix "column
+ * noShow does not exist"), prints the error and exits 1 — the RED signal
+ * `appointment.db.test.ts` asserts against.
+ */
+import "dotenv/config";
+
+import { PrismaPg } from "@prisma/adapter-pg";
+
+import { PrismaClient } from "../../generated/client/client.js";
+
+const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL });
+const prisma = new PrismaClient({ adapter });
+
+// A fresh providerBookingUid per run — the unique key is
+// (siteId, provider, providerBookingUid), and this probe's site never
+// appears in any real fixture, so collision across concurrent runs would
+// only ever come from two probes racing within the same millisecond.
+//
+// #6374 — the id SHAPE is now load-bearing, where before any string did.
+// `appointments` joined the tenancy fence, so the row must satisfy
+// `appointments_workspace_id_format` (a well-formed `wksp_`+UUIDv7) AND
+// `appointments_workspace_site_agree` (workspace_id = site_id). This probe
+// still names a site that appears in no real fixture — the last group is a
+// literal marker, not a real workspace — but it must now be SHAPED like one.
+// Nothing here depends on the workspace existing: the fence is a CHECK, never
+// a foreign key (ADR-0009 invariant #1).
+const SITE_ID = "wksp_00000000-0000-7000-8000-00000000f1f1";
+const PROVIDER_BOOKING_UID = `probe-${Date.now()}-${process.pid}`;
+
+async function main(): Promise<void> {
+  const row = await prisma.appointment.create({
+    data: {
+      siteId: SITE_ID,
+      // #6374 — equal to `siteId` by construction, which is exactly what
+      // `appointments_workspace_site_agree` enforces at the database.
+      workspaceId: SITE_ID,
+      providerBookingUid: PROVIDER_BOOKING_UID,
+      startTime: new Date("2026-09-20T10:00:00.000Z"),
+      endTime: new Date("2026-09-20T10:15:00.000Z"),
+      attendeeName: "Appointment Probe",
+      attendeeEmail: "appointment-probe@example.invalid",
+      status: "confirmed",
+      noShow: true,
+      noShowEventAt: new Date("2026-09-20T10:20:00.000Z"),
+      lifecycleEventAt: new Date("2026-09-18T00:00:00.000Z"),
+    },
+  });
+  process.stdout.write(JSON.stringify(row));
+  await prisma.appointment.delete({ where: { id: row.id } });
+  await prisma.$disconnect();
+}
+
+main().catch(async (err: unknown) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  await prisma.$disconnect();
+  process.exitCode = 1;
+});

package/templates/database/__tests__/fixtures/project-listing-consent-probe.ts

@@ -0,0 +1,100 @@
+/**
+ * @file project-listing-consent-probe.ts
+ *
+ * LIVE-CLIENT probe for `project-listing-consent-at.db.test.ts` (#6171). Runs
+ * `prisma.projectListing.create()` / `.findUniqueOrThrow()` for real, against a
+ * real (migrated) Postgres, through the REAL generated client — spawned via
+ * `tsx` as a subprocess for the same reason `appointment-create-probe.ts`
+ * documents: `database/generated/client/client.ts` is generator-emitted,
+ * uses `import.meta.url`, and this package's `jest.config.cjs` transforms
+ * test files through `ts-jest` targeting CommonJS, which cannot load an
+ * ESM-only module.
+ *
+ * The bug this guards: `ProjectListing.consentAt` carried no
+ * `@db.Timestamptz(3)` — Prisma defaults an unannotated `DateTime` on
+ * Postgres to `TIMESTAMP(3)` (no time zone) — while the migration that added
+ * the column (`20260909180000_listing_draft_and_fields`) created it as the
+ * genuinely tz-aware `TIMESTAMPTZ`. This probe connects with the Postgres
+ * session clock pinned to a non-UTC, half-hour-offset zone
+ * (`Asia/Kolkata`, UTC+5:30) specifically because a naive wall-clock
+ * misinterpretation would shift the read-back instant by a non-round amount
+ * impossible to mistake for a coincidence, and writes a `consentAt` instant
+ * chosen to fall on a different Kolkata calendar DATE than its UTC date
+ * (18:30 UTC == 00:00 +5:30 the next day) so a date-only slip is equally
+ * visible.
+ *
+ * Reads DATABASE_URL from the environment. Creates one ProjectListing row,
+ * reads it back via a fresh `findUniqueOrThrow`, prints both timestamps plus
+ * the live column's `information_schema` type as JSON, deletes the row, and
+ * exits 0. On any Prisma error, prints the error and exits 1.
+ */
+import "dotenv/config";
+
+import { PrismaPg } from "@prisma/adapter-pg";
+
+import { PrismaClient } from "../../generated/client/client.js";
+import { DEFAULT_WORKSPACE_ID } from "../../tenancy.js";
+
+// Postgres session timezone pinned to a non-UTC, half-hour offset so any
+// wall-clock (mis)interpretation of the write or read path shows up as a
+// non-round, unmistakable shift rather than a suspiciously-clean hour delta.
+const adapter = new PrismaPg({
+  connectionString: process.env.DATABASE_URL,
+  options: "-c timezone=Asia/Kolkata",
+});
+const prisma = new PrismaClient({ adapter });
+
+// #6254 (the tenancy-fence keystone) retrofitted ProjectListing.workspaceId
+// to NOT NULL plus `project_listings_workspace_site_agree CHECK (workspace_id
+// = site_id)` — siteId must therefore be a well-formed `wksp_` id equal to
+// workspaceId. No production write path resolves an arbitrary literal like
+// the prior `"st_consent-tz-probe"` here (there is no FK to `workspaces`, so
+// the reserved sentinel need not exist as a real row — only be well-shaped),
+// so the sentinel default workspace id stands in for both columns.
+const SITE_ID = DEFAULT_WORKSPACE_ID;
+// 18:30 UTC == 2026-09-21T00:00:00+05:30 — a different calendar date in the
+// session's pinned zone than in UTC, so a naive-offset bug shows up as either
+// a shifted instant OR a shifted date, whichever the bug takes.
+const CONSENT_AT = new Date("2026-09-20T18:30:00.000Z");
+
+async function main(): Promise<void> {
+  const created = await prisma.projectListing.create({
+    data: {
+      siteId: SITE_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      founderName: "Consent TZ Probe",
+      founderEmail: "consent-tz-probe@example.invalid",
+      status: "draft",
+      consentAt: CONSENT_AT,
+    },
+  });
+
+  // A second, independent read — through a fresh query, not the object
+  // `create()` already returned — so the proof covers the READ path too.
+  const reread = await prisma.projectListing.findUniqueOrThrow({
+    where: { id: created.id },
+  });
+
+  const columnType = await prisma.$queryRaw<Array<{ data_type: string }>>`
+    SELECT data_type FROM information_schema.columns
+    WHERE table_name = 'project_listings' AND column_name = 'consent_at'
+  `;
+
+  process.stdout.write(
+    JSON.stringify({
+      writtenIso: CONSENT_AT.toISOString(),
+      createdConsentAtIso: created.consentAt.toISOString(),
+      rereadConsentAtIso: reread.consentAt.toISOString(),
+      liveColumnDataType: columnType[0]?.data_type ?? null,
+    }),
+  );
+
+  await prisma.projectListing.delete({ where: { id: created.id } });
+  await prisma.$disconnect();
+}
+
+main().catch(async (err: unknown) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  await prisma.$disconnect();
+  process.exitCode = 1;
+});

package/templates/database/__tests__/flow-workspace-key.db.test.ts

@@ -0,0 +1,263 @@
+/**
+ * @file flow-workspace-key.db.test.ts
+ *
+ * LIVE-DATABASE proof of the #6155 backfill (spec § 8.4, AC-1). Requires
+ * DATABASE_URL pointing at a Postgres with the migrations applied (`prisma
+ * migrate deploy`); the whole suite SKIPS when DATABASE_URL is unset,
+ * matching `prefixed-ids.db.test.ts` / `artifact-content-store.db.test.ts`
+ * and keeping the workspace Jest run DB-free.
+ *
+ * Raw SQL through `pg`, for the same reason those two files give: the
+ * generated Prisma client is ESM-only and cannot load under this package's
+ * CJS ts-jest transform.
+ *
+ * RECONCILED WITH #6254 (the tenancy-fence keystone, #6373 AC-4). The
+ * ORIGINAL "RE-RUN TECHNIQUE" this file used — insert fresh
+ * `workspace_id IS NULL` rows, then re-execute this migration's own SQL
+ * verbatim to prove its backfill logic — assumed a row COULD land with
+ * `workspace_id` unset. That assumption is no longer true on current main:
+ * `database/migrations/20260922120000_tenancy_fence` retrofits
+ * `flow_definitions.workspace_id` / `flow_sessions.workspace_id` to NOT
+ * NULL, plus a `CHECK (workspace_id = site_id)` equality and a
+ * `CHECK (workspace_id ~ '^wksp_...')` format constraint on BOTH tables.
+ * Together those three constraints mean:
+ *
+ *   - `site_id` must now ALWAYS be a well-formed `wksp_` id equal to
+ *     `workspace_id` — the legacy alias `"default"` (never `wksp_`-shaped)
+ *     and an arbitrary unresolvable string can no longer be written at all,
+ *     with or without `workspace_id` supplied. Attempting either now aborts
+ *     the write outright (a NOT NULL / CHECK violation), rather than landing
+ *     a row with `workspace_id` left NULL — this is the fence doing exactly
+ *     what its own migration text says an unresolvable row must do ("abort
+ *     the transaction rather than pass through silently").
+ *   - The `"default"` alias itself is resolved at the APPLICATION layer
+ *     before a write reaches the database now (the fence migration's own
+ *     header: "the application-code half of D1a... is fixed in the same
+ *     PR") — a fresh row's `site_id` is never the literal string `"default"`
+ *     on live main, only ever the resolved `DEFAULT_WORKSPACE_ID` sentinel.
+ *
+ * So this suite's three cases are reconciled to what main actually does:
+ *
+ *   1. A row whose `site_id` names a real workspace carries a matching
+ *      `workspace_id` from the moment it is written (the shape the OLD
+ *      backfill used to produce is now enforced at write time), and is
+ *      readable through the shape `tenantDb(tenant).flows.byId` /
+ *      `.flowSessions.byId` use (`findFirst({ id, workspaceId })`). The
+ *      shipped `20260919120000_flow_workspace_key` migration is STILL
+ *      re-run verbatim afterward — every `workspace_id IS NULL` row it
+ *      would touch is now unreachable, so this proves the migration stays
+ *      safely re-runnable (NFR3) rather than corrupting an already-correct
+ *      row, not that it backfills one.
+ *   2. A row whose `site_id` matches no workspace can no longer be created
+ *      at all — inserting it (with `workspace_id` omitted, exactly the
+ *      pre-fence shape) is REJECTED by the NOT NULL constraint the fence
+ *      added, never landed unset.
+ *   3. A row whose `site_id` is the resolved sentinel `DEFAULT_WORKSPACE_ID`
+ *      — what the legacy `"default"` alias now resolves to before any write
+ *      reaches the database — carries a matching `workspace_id` from the
+ *      moment it is written, exactly like case 1.
+ *   4. The literal sentinel id written into the migration's own SQL text
+ *      equals `DEFAULT_WORKSPACE_ID` from `../tenancy.js` — read from the
+ *      `.sql` file and compared, so the two cannot drift apart (§ 5.3
+ *      step 5). Unaffected by the fence — no DB write involved.
+ */
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { Client } from "pg";
+
+import { DEFAULT_WORKSPACE_ID } from "../tenancy.js";
+
+const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
+
+/** A run-unique suffix so repeated local runs never collide. */
+const RUN = randomUUID().slice(0, 8);
+
+const MIGRATION_SQL_PATH = join(
+  __dirname,
+  "..",
+  "migrations",
+  "20260919120000_flow_workspace_key",
+  "migration.sql",
+);
+const MIGRATION_SQL = readFileSync(MIGRATION_SQL_PATH, "utf-8");
+
+describeDb(
+  "flow_definitions / flow_sessions workspace_id backfill (#6155, live DB)",
+  () => {
+    let db: Client;
+    let otherWorkspaceId: string;
+    const noSuchSite = `no-such-site-${RUN}`;
+
+    const definitionIds: string[] = [];
+    const sessionIds: string[] = [];
+
+    beforeAll(async () => {
+      db = new Client({ connectionString: process.env.DATABASE_URL });
+      await db.connect();
+
+      // A REAL, non-sentinel workspace — the "pinned, resolvable" case (rule 3:
+      // exact `workspaces.id` equality, nothing to do with the sentinel).
+      const org = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ($1, $2, now()) RETURNING "id"`,
+          [`6155 Org ${RUN}`, `6155-org-${RUN}`],
+        )
+      ).rows[0]!;
+      otherWorkspaceId = (
+        await db.query<{ id: string }>(
+          `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, $2, $3, now()) RETURNING "id"`,
+          [org.id, `6155 Workspace ${RUN}`, `6155-ws-${RUN}`],
+        )
+      ).rows[0]!.id;
+
+      // One FlowDefinition / FlowSession pair, carrying its correct
+      // workspace_id from the moment of insert — the fence's NOT NULL means
+      // there is no longer a `workspace_id IS NULL` pre-state to construct
+      // for a row that CAN legitimately exist (see the file header). `title`
+      // / `status` are also NOT NULL as of the same-day
+      // `20260919130000_flow_definition_admin_columns` migration (no column
+      // default, by that migration's own design — a nameless/unpublished
+      // magnet must never enter the table silently) — both supplied here so
+      // the ONLY thing under test is the workspace_id/site_id shape.
+      const insertPair = async (siteId: string): Promise<void> => {
+        const def = (
+          await db.query<{ id: string }>(
+            `INSERT INTO "flow_definitions"
+               ("site_id", "workspace_id", "slug", "config", "title", "status", "updated_at")
+             VALUES ($1, $1, $2, '{}'::jsonb, 'Test', 'live', now()) RETURNING "id"`,
+            [siteId, `6155-${RUN}-${siteId}`],
+          )
+        ).rows[0]!;
+        definitionIds.push(def.id);
+
+        const sess = (
+          await db.query<{ id: string }>(
+            `INSERT INTO "flow_sessions"
+               ("site_id", "workspace_id", "flow_id", "flow_slug", "config_snapshot", "updated_at")
+             VALUES ($1, $1, $2, $3, '{}'::jsonb, now()) RETURNING "id"`,
+            [siteId, def.id, `6155-${RUN}-${siteId}`],
+          )
+        ).rows[0]!;
+        sessionIds.push(sess.id);
+      };
+
+      // Case 1's row FIRST, then the migration re-run, THEN case 3's row —
+      // deliberately sequenced, not merged into one loop. The migration's
+      // OWN post-assertions (re-read verbatim below) reject ANY row whose
+      // workspace_id names a workspace absent from "workspaces" ("nothing
+      // guessed"); `DEFAULT_WORKSPACE_ID` has no corresponding "workspaces"
+      // row on a freshly-migrated-but-unseeded database (that row is
+      // `database/seed.ts`'s job, not a migration's), so the re-run must
+      // happen BEFORE case 3's row exists, or it would trip that guard for
+      // a row it never touched.
+      await insertPair(otherWorkspaceId);
+
+      // Re-run the shipped migration file verbatim (NFR3 — still
+      // re-runnable). Every `workspace_id IS NULL` row it would touch is now
+      // unreachable (the fence's NOT NULL forbids one from ever existing),
+      // so this is a no-op on the row just inserted — proven by the
+      // "unchanged after re-run" assertion in the first `it()` block below,
+      // not a backfill.
+      await db.query(MIGRATION_SQL);
+
+      await insertPair(DEFAULT_WORKSPACE_ID);
+    });
+
+    afterAll(async () => {
+      await db.query(`DELETE FROM "flow_sessions" WHERE "flow_slug" LIKE $1`, [
+        `6155-${RUN}-%`,
+      ]);
+      await db.query(`DELETE FROM "flow_definitions" WHERE "slug" LIKE $1`, [
+        `6155-${RUN}-%`,
+      ]);
+      await db.query(`DELETE FROM "workspaces" WHERE "slug" = $1`, [
+        `6155-ws-${RUN}`,
+      ]);
+      await db.query(`DELETE FROM "organizations" WHERE "slug" = $1`, [
+        `6155-org-${RUN}`,
+      ]);
+      await db.end();
+    });
+
+    it("a row whose site_id names a real workspace carries a matching workspace_id, unchanged by a migration re-run, and is readable through the accessor's own query shape", async () => {
+      const [defId, sessId] = [definitionIds[0]!, sessionIds[0]!];
+
+      const def = await db.query<{ workspace_id: string | null }>(
+        `SELECT "workspace_id" FROM "flow_definitions" WHERE "id" = $1`,
+        [defId],
+      );
+      expect(def.rows[0]!.workspace_id).toBe(otherWorkspaceId);
+
+      // The shape tenantDb(tenant).flows.byId uses: findFirst({ id, workspaceId }).
+      const readable = await db.query(
+        `SELECT "id" FROM "flow_definitions" WHERE "id" = $1 AND "workspace_id" = $2`,
+        [defId, otherWorkspaceId],
+      );
+      expect(readable.rows).toHaveLength(1);
+
+      const sess = await db.query<{ workspace_id: string | null }>(
+        `SELECT "workspace_id" FROM "flow_sessions" WHERE "id" = $1`,
+        [sessId],
+      );
+      expect(sess.rows[0]!.workspace_id).toBe(otherWorkspaceId);
+
+      const sessReadable = await db.query(
+        `SELECT "id" FROM "flow_sessions" WHERE "id" = $1 AND "workspace_id" = $2`,
+        [sessId, otherWorkspaceId],
+      );
+      expect(sessReadable.rows).toHaveLength(1);
+    });
+
+    it("a row whose site_id matches no workspace can no longer be created — the fence retrofit rejects it outright, never leaving it unset", async () => {
+      // The EXACT pre-fence shape (no workspace_id supplied) — proving that
+      // what used to land a `workspace_id IS NULL` row is now rejected
+      // before it can, on both tables the #6155 backfill covered.
+      await expect(
+        db.query(
+          `INSERT INTO "flow_definitions" ("site_id", "slug", "config", "title", "status", "updated_at")
+           VALUES ($1, $2, '{}'::jsonb, 'Test', 'live', now())`,
+          [noSuchSite, `6155-${RUN}-abort-def`],
+        ),
+      ).rejects.toThrow(/workspace_id/);
+
+      await expect(
+        db.query(
+          `INSERT INTO "flow_sessions" ("site_id", "flow_id", "flow_slug", "config_snapshot", "updated_at")
+           VALUES ($1, $2, $3, '{}'::jsonb, now())`,
+          [noSuchSite, definitionIds[0]!, `6155-${RUN}-abort-sess`],
+        ),
+      ).rejects.toThrow(/workspace_id/);
+    });
+
+    it("a row whose site_id is the resolved sentinel DEFAULT_WORKSPACE_ID carries a matching workspace_id (D2 rule 2's write-time destination)", async () => {
+      const [defId, sessId] = [definitionIds[1]!, sessionIds[1]!];
+
+      const def = await db.query<{ workspace_id: string | null }>(
+        `SELECT "workspace_id" FROM "flow_definitions" WHERE "id" = $1`,
+        [defId],
+      );
+      expect(def.rows[0]!.workspace_id).toBe(DEFAULT_WORKSPACE_ID);
+
+      const sess = await db.query<{ workspace_id: string | null }>(
+        `SELECT "workspace_id" FROM "flow_sessions" WHERE "id" = $1`,
+        [sessId],
+      );
+      expect(sess.rows[0]!.workspace_id).toBe(DEFAULT_WORKSPACE_ID);
+    });
+
+    it("the migration's own literal sentinel id equals DEFAULT_WORKSPACE_ID — the two cannot drift apart", () => {
+      // SQL cannot import database/tenancy.ts (§ 5.3 step 5), so the migration
+      // carries the sentinel as a literal. Pin it against the exported
+      // constant by reading the shipped file, not a re-typed copy of it.
+      const occurrences = MIGRATION_SQL.match(/'wksp_[0-9a-f-]+'/g) ?? [];
+      expect(occurrences.length).toBeGreaterThan(0);
+      for (const literal of occurrences) {
+        expect(literal).toBe(`'${DEFAULT_WORKSPACE_ID}'`);
+      }
+    });
+  },
+);

package/templates/database/__tests__/prefixed-ids.db.test.ts

@@ -25,6 +25,9 @@
  *   4. The relation-free scope columns (workspaceId refs) are CHECKed too.
  *   5. The reserved-range sentinel ids are admitted by the CHECKs.
  */
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
 import { Client } from "pg";
 
 import { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } from "../tenancy.js";
@@ -34,16 +37,82 @@ const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
 const V7_RE =
   /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 
+/**
+ * Every distinct `_format` CHECK constraint name declared across
+ * `database/migrations/*\/migration.sql` — both the inline `CREATE TABLE`
+ * form and the `ALTER TABLE ... ADD CONSTRAINT` form (including the
+ * existence-guarded `DO $$` blocks later migrations use for a NULLABLE
+ * scope column, e.g. 20260919120000_flow_workspace_key). Comment lines are
+ * skipped so a rollback note that merely mentions a constraint name doesn't
+ * count as a second declaration.
+ *
+ * Derived from the migration source rather than hard-coded (#6119): a
+ * hard-coded literal here goes stale the moment a later migration adds a
+ * new prefixed-id model or scope column, failing this test for a reason
+ * that has nothing to do with the database under test. Deriving it instead
+ * still catches the real defect this test guards — the live database
+ * missing a CHECK its own migrations declare (a partial/failed deploy,
+ * migrations applied out of order, one silently dropped) — because the
+ * expected count comes from the repo's migration files while the actual
+ * count comes from a live query against the database those migrations were
+ * run against; the two are independent unless the migrations actually ran
+ * to completion.
+ */
+function declaredFormatCheckCount(): number {
+  const migrationsDir = join(__dirname, "..", "migrations");
+  const names = new Set<string>();
+  for (const entry of readdirSync(migrationsDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const sqlPath = join(migrationsDir, entry.name, "migration.sql");
+    let sql: string;
+    try {
+      sql = readFileSync(sqlPath, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const line of sql.split("\n")) {
+      if (line.trim().startsWith("--")) continue;
+      const match = line.match(/CONSTRAINT\s+"([a-z_]+_format)"/);
+      if (match) names.add(match[1]);
+    }
+  }
+  return names.size;
+}
+
 describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
   let db: Client;
+  // #6254 (the tenancy-fence keystone) retrofitted `leads.workspace_id` to
+  // NOT NULL plus `leads_workspace_site_agree CHECK (workspace_id =
+  // site_id)` and `leads_workspace_id_format CHECK (workspace_id ~
+  // '^wksp_...')`. Every "leads" insert below now needs a well-formed
+  // `wksp_` id in BOTH columns — a real seeded workspace (mirroring
+  // `composite-fence.db.test.ts`'s own fixture pattern), not the prior
+  // free-text `'adr31-test'` literal, which satisfied neither CHECK.
+  let workspaceId: string;
 
   beforeAll(async () => {
     db = new Client({ connectionString: process.env.DATABASE_URL });
     await db.connect();
+
+    const org = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "organizations" ("name", "slug", "updated_at")
+         VALUES ('ADR31 Fence Org', 'adr31-fence-org', now()) RETURNING "id"`,
+      )
+    ).rows[0]!;
+    workspaceId = (
+      await db.query<{ id: string }>(
+        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
+         VALUES ($1, 'ADR31 Fence Workspace', 'adr31-fence-ws', now()) RETURNING "id"`,
+        [org.id],
+      )
+    ).rows[0]!.id;
   });
 
   afterAll(async () => {
-    await db.query(`DELETE FROM "leads" WHERE "site_id" = 'adr31-test'`);
+    await db.query(`DELETE FROM "leads" WHERE "workspace_id" = $1`, [
+      workspaceId,
+    ]);
     await db.query(
       `DELETE FROM "organizations" WHERE "slug" LIKE 'adr31-%'`,
     );
@@ -83,8 +152,9 @@ describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
       expect(org.id.slice("org_".length)).toMatch(V7_RE);
 
       const lead = (await db.query<{ id: string }>(
-        `INSERT INTO "leads" ("site_id", "source", "email", "payload")
-         VALUES ('adr31-test', 'test', 'adr31@example.com', '{}') RETURNING "id"`,
+        `INSERT INTO "leads" ("site_id", "workspace_id", "source", "email", "payload")
+         VALUES ($1, $1, 'test', 'adr31@example.com', '{}') RETURNING "id"`,
+        [workspaceId],
       )).rows[0];
       expect(lead.id).toMatch(/^lead_/);
       expect(lead.id.slice("lead_".length)).toMatch(V7_RE);
@@ -93,10 +163,15 @@ describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
 
   describe("CHECK constraints — the mechanical tier", () => {
     it("REJECTS an insert with a malformed primary key", async () => {
+      // workspace_id (= site_id) is supplied and well-formed here so the
+      // ONLY constraint this insert can violate is leads_id_format — proving
+      // the malformed-id rejection still fires for its original reason,
+      // not the (now also NOT NULL) workspace_id (#6373 AC-3).
       await expect(
         db.query(
-          `INSERT INTO "leads" ("id", "site_id", "source", "email", "payload")
-           VALUES ('bad', 'adr31-test', 'x', 'a@b.co', '{}')`,
+          `INSERT INTO "leads" ("id", "site_id", "workspace_id", "source", "email", "payload")
+           VALUES ('bad', $1, $1, 'x', 'a@b.co', '{}')`,
+          [workspaceId],
         ),
       ).rejects.toThrow(/leads_id_format/);
     });
@@ -104,8 +179,9 @@ describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
     it("REJECTS an insert with a bare (unprefixed) uuid primary key", async () => {
       await expect(
         db.query(
-          `INSERT INTO "leads" ("id", "site_id", "source", "email", "payload")
-           VALUES ('0190f3a2-7c1d-7e4a-9b2c-0123456789ab', 'adr31-test', 'x', 'a@b.co', '{}')`,
+          `INSERT INTO "leads" ("id", "site_id", "workspace_id", "source", "email", "payload")
+           VALUES ('0190f3a2-7c1d-7e4a-9b2c-0123456789ab', $1, $1, 'x', 'a@b.co', '{}')`,
+          [workspaceId],
         ),
       ).rejects.toThrow(/leads_id_format/);
     });
@@ -135,12 +211,12 @@ describeDb("prefixed UUIDv7 ids (ADR-0031, live DB)", () => {
       expect(ws.id).toBe(DEFAULT_WORKSPACE_ID);
     });
 
-    it("carries the full CHECK complement: 27 PK + 12 scope = 39", async () => {
+    it("carries the full CHECK complement declared by the migrations", async () => {
       const { rows } = await db.query<{ n: string }>(
         `SELECT count(*)::text AS n FROM pg_constraint
          WHERE contype = 'c' AND conname LIKE '%_format'`,
       );
-      expect(rows[0].n).toBe("39");
+      expect(rows[0].n).toBe(String(declaredFormatCheckCount()));
     });
   });
 });