@open-mercato/onboarding 0.6.5-develop.5048.1.fd82f4ae17 → 0.6.5-develop.5116.1.f0af9e5080

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:onboarding] found 24 entry points
+[build:onboarding] found 25 entry points
 [build:onboarding] built successfully

package/dist/modules/onboarding/api/get/onboarding/status.js

@@ -10,9 +10,27 @@ const metadata = {
     requireAuth: false
   }
 };
+const ONBOARDING_LOGIN_TENANT_COOKIE = "om_login_tenant";
 const onboardingStatusQuerySchema = z.object({
   tenantId: z.string().uuid()
 });
+function readCookie(req, name) {
+  const header = req.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const separatorIndex = part.indexOf("=");
+    if (separatorIndex === -1) continue;
+    const key = part.slice(0, separatorIndex).trim();
+    if (key !== name) continue;
+    const rawValue = part.slice(separatorIndex + 1).trim();
+    try {
+      return decodeURIComponent(rawValue);
+    } catch {
+      return rawValue;
+    }
+  }
+  return null;
+}
 async function GET(req) {
   const url = new URL(req.url);
   const tenantId = url.searchParams.get("tenantId") || url.searchParams.get("tenant") || "";
@@ -20,6 +38,10 @@ async function GET(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: false, error: "Invalid tenant id." }, { status: 400 });
   }
+  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE);
+  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {
+    return NextResponse.json({ ok: false, error: "Not authorized for this tenant." }, { status: 403 });
+  }
   let baseUrl;
   try {
     baseUrl = getSecurityEmailBaseUrl(req);
@@ -88,6 +110,7 @@ const onboardingStatusDoc = {
   ],
   errors: [
     { status: 400, description: "Invalid tenant id or request origin.", schema: onboardingStatusErrorSchema },
+    { status: 403, description: "Caller is not authorized for this tenant.", schema: onboardingStatusErrorSchema },
     { status: 404, description: "Onboarding request not found.", schema: onboardingStatusErrorSchema },
     { status: 500, description: "Onboarding status is not configured.", schema: onboardingStatusErrorSchema }
   ]

package/dist/modules/onboarding/api/get/onboarding/status.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/onboarding/api/get/onboarding/status.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/status',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst onboardingStatusQuerySchema = z.object({\n  tenantId: z.string().uuid(),\n})\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''\n  const parsed = onboardingStatusQuerySchema.safeParse({ tenantId })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'onboarding.status',\n      configMessage: 'Onboarding status is not configured.',\n    })\n    if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n    throw error\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findLatestByTenantId(parsed.data.tenantId)\n  if (!request) {\n    return NextResponse.json({ ok: false, error: 'Onboarding request not found.' }, { status: 404 })\n  }\n\n  let emailSent = Boolean(request.readyEmailSentAt)\n  const ready = request.status === 'completed' && Boolean(request.preparationCompletedAt)\n  const loginUrl = ready && request.tenantId ? `${baseUrl}/login?tenant=${encodeURIComponent(request.tenantId)}` : null\n\n  if (ready && request.tenantId && !request.readyEmailSentAt) {\n    try {\n      emailSent = await sendWorkspaceReadyEmail({\n        requestId: request.id,\n        tenantId: request.tenantId,\n      })\n    } catch (error) {\n      console.error('[onboarding.status] ready email retry failed', {\n        requestId: request.id,\n        tenantId: request.tenantId,\n        organizationId: request.organizationId,\n        error,\n      })\n    }\n  }\n\n  return NextResponse.json({\n    ok: true,\n    status: request.status,\n    ready,\n    emailSent,\n    tenantId: request.tenantId ?? parsed.data.tenantId,\n    loginUrl,\n  })\n}\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingStatusSuccessSchema = z.object({\n  ok: z.literal(true),\n  status: z.enum(['pending', 'processing', 'completed', 'expired']),\n  ready: z.boolean(),\n  emailSent: z.boolean(),\n  tenantId: z.string().uuid(),\n  loginUrl: z.string().nullable(),\n})\n\nconst onboardingStatusErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst onboardingStatusDoc: OpenApiMethodDoc = {\n  summary: 'Get onboarding preparation status',\n  description: 'Resolves whether a tenant workspace finished deferred onboarding preparation and can be opened.',\n  tags: [onboardingTag],\n  query: onboardingStatusQuerySchema,\n  responses: [\n    { status: 200, description: 'Onboarding status resolved.', schema: onboardingStatusSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },\n    { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },\n    { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding preparation status',\n  methods: {\n    GET: onboardingStatusDoc,\n  },\n}\n\nexport default GET\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,aAAa,IAAI,QAAQ,KAAK;AACvF,QAAM,SAAS,4BAA4B,UAAU,EAAE,SAAS,CAAC;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,UAAM;AAAA,EACR;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,qBAAqB,OAAO,KAAK,QAAQ;AACvE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AAEA,MAAI,YAAY,QAAQ,QAAQ,gBAAgB;AAChD,QAAM,QAAQ,QAAQ,WAAW,eAAe,QAAQ,QAAQ,sBAAsB;AACtF,QAAM,WAAW,SAAS,QAAQ,WAAW,GAAG,OAAO,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC,KAAK;AAEjH,MAAI,SAAS,QAAQ,YAAY,CAAC,QAAQ,kBAAkB;AAC1D,QAAI;AACF,kBAAY,MAAM,wBAAwB;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,gDAAgD;AAAA,QAC5D,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC1C;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB;AAEtB,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,KAAK,CAAC,WAAW,cAAc,aAAa,SAAS,CAAC;AAAA,EAChE,OAAO,EAAE,QAAQ;AAAA,EACjB,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,8BAA8B;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,IACxG,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,4BAA4B;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,EAC1G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;AAEA,IAAO,iBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/status',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst ONBOARDING_LOGIN_TENANT_COOKIE = 'om_login_tenant'\n\nconst onboardingStatusQuerySchema = z.object({\n  tenantId: z.string().uuid(),\n})\n\nfunction readCookie(req: Request, name: string): string | null {\n  const header = req.headers.get('cookie')\n  if (!header) return null\n  for (const part of header.split(';')) {\n    const separatorIndex = part.indexOf('=')\n    if (separatorIndex === -1) continue\n    const key = part.slice(0, separatorIndex).trim()\n    if (key !== name) continue\n    const rawValue = part.slice(separatorIndex + 1).trim()\n    try {\n      return decodeURIComponent(rawValue)\n    } catch {\n      return rawValue\n    }\n  }\n  return null\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''\n  const parsed = onboardingStatusQuerySchema.safeParse({ tenantId })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })\n  }\n\n  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE)\n  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Not authorized for this tenant.' }, { status: 403 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'onboarding.status',\n      configMessage: 'Onboarding status is not configured.',\n    })\n    if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n    throw error\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findLatestByTenantId(parsed.data.tenantId)\n  if (!request) {\n    return NextResponse.json({ ok: false, error: 'Onboarding request not found.' }, { status: 404 })\n  }\n\n  let emailSent = Boolean(request.readyEmailSentAt)\n  const ready = request.status === 'completed' && Boolean(request.preparationCompletedAt)\n  const loginUrl = ready && request.tenantId ? `${baseUrl}/login?tenant=${encodeURIComponent(request.tenantId)}` : null\n\n  if (ready && request.tenantId && !request.readyEmailSentAt) {\n    try {\n      emailSent = await sendWorkspaceReadyEmail({\n        requestId: request.id,\n        tenantId: request.tenantId,\n      })\n    } catch (error) {\n      console.error('[onboarding.status] ready email retry failed', {\n        requestId: request.id,\n        tenantId: request.tenantId,\n        organizationId: request.organizationId,\n        error,\n      })\n    }\n  }\n\n  return NextResponse.json({\n    ok: true,\n    status: request.status,\n    ready,\n    emailSent,\n    tenantId: request.tenantId ?? parsed.data.tenantId,\n    loginUrl,\n  })\n}\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingStatusSuccessSchema = z.object({\n  ok: z.literal(true),\n  status: z.enum(['pending', 'processing', 'completed', 'expired']),\n  ready: z.boolean(),\n  emailSent: z.boolean(),\n  tenantId: z.string().uuid(),\n  loginUrl: z.string().nullable(),\n})\n\nconst onboardingStatusErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst onboardingStatusDoc: OpenApiMethodDoc = {\n  summary: 'Get onboarding preparation status',\n  description: 'Resolves whether a tenant workspace finished deferred onboarding preparation and can be opened.',\n  tags: [onboardingTag],\n  query: onboardingStatusQuerySchema,\n  responses: [\n    { status: 200, description: 'Onboarding status resolved.', schema: onboardingStatusSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },\n    { status: 403, description: 'Caller is not authorized for this tenant.', schema: onboardingStatusErrorSchema },\n    { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },\n    { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding preparation status',\n  methods: {\n    GET: onboardingStatusDoc,\n  },\n}\n\nexport default GET\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,iCAAiC;AAEvC,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAED,SAAS,WAAW,KAAc,MAA6B;AAC7D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,iBAAiB,KAAK,QAAQ,GAAG;AACvC,QAAI,mBAAmB,GAAI;AAC3B,UAAM,MAAM,KAAK,MAAM,GAAG,cAAc,EAAE,KAAK;AAC/C,QAAI,QAAQ,KAAM;AAClB,UAAM,WAAW,KAAK,MAAM,iBAAiB,CAAC,EAAE,KAAK;AACrD,QAAI;AACF,aAAO,mBAAmB,QAAQ;AAAA,IACpC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,aAAa,IAAI,QAAQ,KAAK;AACvF,QAAM,SAAS,4BAA4B,UAAU,EAAE,SAAS,CAAC;AACjE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,oBAAoB,WAAW,KAAK,8BAA8B;AACxE,MAAI,CAAC,qBAAqB,sBAAsB,OAAO,KAAK,UAAU;AACpE,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnG;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,UAAM;AAAA,EACR;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,qBAAqB,OAAO,KAAK,QAAQ;AACvE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjG;AAEA,MAAI,YAAY,QAAQ,QAAQ,gBAAgB;AAChD,QAAM,QAAQ,QAAQ,WAAW,eAAe,QAAQ,QAAQ,sBAAsB;AACtF,QAAM,WAAW,SAAS,QAAQ,WAAW,GAAG,OAAO,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC,KAAK;AAEjH,MAAI,SAAS,QAAQ,YAAY,CAAC,QAAQ,kBAAkB;AAC1D,QAAI;AACF,kBAAY,MAAM,wBAAwB;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,gDAAgD;AAAA,QAC5D,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,YAAY,OAAO,KAAK;AAAA,IAC1C;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB;AAEtB,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,KAAK,CAAC,WAAW,cAAc,aAAa,SAAS,CAAC;AAAA,EAChE,OAAO,EAAE,QAAQ;AAAA,EACjB,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,8BAA8B;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,IACxG,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,4BAA4B;AAAA,IAC7G,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,4BAA4B;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,4BAA4B;AAAA,EAC1G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;AAEA,IAAO,iBAAQ;",
   "names": []
 }

package/dist/modules/onboarding/api/get/onboarding/verify.js

@@ -12,7 +12,7 @@ import { sendWorkspaceReadyEmail } from "@open-mercato/onboarding/modules/onboar
 import { setupInitialTenant } from "@open-mercato/core/modules/auth/lib/setup-app";
 import { UserConsent } from "@open-mercato/core/modules/auth/data/entities";
 import { computeConsentIntegrityHash } from "@open-mercato/core/modules/auth/lib/consentIntegrity";
-import { getClientIp } from "@open-mercato/shared/lib/ratelimit/helpers";
+import { resolveConsentClientIp } from "@open-mercato/onboarding/modules/onboarding/lib/consentClientIp";
 import { reindexEntity } from "@open-mercato/core/modules/query_index/lib/reindexer";
 import { purgeIndexScope } from "@open-mercato/core/modules/query_index/lib/purge";
 import { refreshCoverageSnapshot } from "@open-mercato/core/modules/query_index/lib/coverage";
@@ -353,7 +353,7 @@ async function GET(req) {
     });
     if (request.marketingConsent) {
       const now = /* @__PURE__ */ new Date();
-      const clientIp = getClientIp(req, 1) ?? null;
+      const clientIp = resolveConsentClientIp(req);
       const integrityHash = computeConsentIntegrityHash({
         userId: resolvedUserId,
         consentType: "marketing_email",

package/dist/modules/onboarding/api/get/onboarding/verify.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/onboarding/api/get/onboarding/verify.ts"],
-  "sourcesContent": ["import { after, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { SearchIndexer } from '@open-mercato/search'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  AppOriginConfigurationError,\n  AppOriginRejectedError,\n  getSecurityEmailBaseUrl,\n} from '@open-mercato/shared/lib/url'\nimport { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'\nimport { UserConsent } from '@open-mercato/core/modules/auth/data/entities'\nimport { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'\nimport { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'\nimport { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/verify',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nfunction resolveTrustedBaseUrl(req: Request): string {\n  try {\n    return getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {\n      console.error('[onboarding.verify] rejected request origin for redirect base', {\n        requestUrl: req.url,\n        reason: error.message,\n      })\n      return new URL(req.url).origin\n    }\n    throw error\n  }\n}\n\nfunction clearAuthCookies(response: NextResponse) {\n  response.cookies.set('auth_token', '', { path: '/', maxAge: 0 })\n  response.cookies.set('session_token', '', { path: '/', maxAge: 0 })\n  response.cookies.set('om_login_tenant', '', { path: '/', maxAge: 0 })\n}\n\nfunction redirectWithStatus(baseUrl: string, status: string) {\n  const response = NextResponse.redirect(`${baseUrl}/onboarding?status=${encodeURIComponent(status)}`)\n  clearAuthCookies(response)\n  return response\n}\n\nfunction redirectToPreparing(baseUrl: string, tenantId: string | null) {\n  const tenantParam = tenantId ? `?tenant=${encodeURIComponent(tenantId)}` : ''\n  const response = NextResponse.redirect(`${baseUrl}/onboarding/preparing${tenantParam}`)\n  clearAuthCookies(response)\n  if (tenantId) {\n    response.cookies.set('om_login_tenant', tenantId, {\n      httpOnly: false,\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      path: '/',\n      maxAge: 60 * 60 * 24 * 14,\n    })\n  }\n  return response\n}\n\nfunction redirectToLogin(baseUrl: string, tenantId: string | null) {\n  const tenantParam = tenantId ? `?tenant=${encodeURIComponent(tenantId)}` : ''\n  const response = NextResponse.redirect(`${baseUrl}/login${tenantParam}`)\n  clearAuthCookies(response)\n  if (tenantId) {\n    response.cookies.set('om_login_tenant', tenantId, {\n      httpOnly: false,\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      path: '/',\n      maxAge: 60 * 60 * 24 * 14,\n    })\n  }\n  return response\n}\n\nconst VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000\nconst SEED_DEFAULTS_TIMEOUT_MS = 15_000\nconst SEED_EXAMPLES_TIMEOUT_MS = 15_000\n\nfunction createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)\n  })\n}\n\nasync function runModuleSetupHook(args: {\n  moduleId: string\n  phase: 'seedDefaults' | 'seedExamples'\n  timeoutMs: number\n  run: () => Promise<void>\n}) {\n  const startedAt = Date.now()\n  console.info('[onboarding.verify] module hook started', {\n    moduleId: args.moduleId,\n    phase: args.phase,\n    timeoutMs: args.timeoutMs,\n  })\n  try {\n    await Promise.race([\n      args.run(),\n      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),\n    ])\n    console.info('[onboarding.verify] module hook completed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n    })\n  } catch (error) {\n    console.error('[onboarding.verify] module hook failed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n      timeoutMs: args.timeoutMs,\n      error,\n    })\n    throw error\n  }\n}\n\nasync function markWorkspaceReady(args: {\n  requestId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findById(args.requestId)\n  if (!request || request.preparationCompletedAt) return\n  await service.markPreparationCompleted(request, new Date())\n}\n\nasync function enqueueVectorReindex(args: {\n  container: { resolve: <T = unknown>(name: string) => T }\n  tenantId: string\n  organizationId: string\n}) {\n  let searchIndexer: SearchIndexer | null = null\n  try {\n    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')\n  } catch {\n    searchIndexer = null\n  }\n  if (!searchIndexer) return\n\n  await Promise.race([\n    searchIndexer.reindexAllToVector({\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      purgeFirst: true,\n      useQueue: true,\n    }),\n    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),\n  ])\n}\n\nasync function rebuildTenantQueryIndexes(args: {\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n}) {\n  const coverageRefreshKeys = new Set<string>()\n  try {\n    const allEntities = getEntityIds()\n    const entityIds = flattenSystemEntityIds(allEntities)\n    for (const entityType of entityIds) {\n      try {\n        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to purge query index scope', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      try {\n        await reindexEntity(args.em, {\n          entityType,\n          tenantId: args.tenantId,\n          force: true,\n          emitVectorizeEvents: false,\n          vectorService: null,\n        })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to reindex entity', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)\n    }\n  } catch (error) {\n    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })\n  }\n\n  if (!coverageRefreshKeys.size) return\n\n  for (const entry of coverageRefreshKeys) {\n    const [entityType, tenantKey, orgKey] = entry.split('|')\n    const orgScope = orgKey === '__null__' ? null : orgKey\n    try {\n      await refreshCoverageSnapshot(\n        args.em,\n        {\n          entityType,\n          tenantId: tenantKey,\n          organizationId: orgScope,\n          withDeleted: false,\n        },\n      )\n    } catch (error) {\n      console.error('[onboarding.verify] failed to refresh coverage snapshot', {\n        entityType,\n        tenantId: tenantKey,\n        organizationId: orgScope,\n        error,\n      })\n    }\n  }\n}\n\nasync function runDeferredProvisioning(args: {\n  requestId: string\n  tenantId: string\n  organizationId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const modules = getModules()\n\n  for (const mod of modules) {\n    if (!mod.setup?.seedExamples) continue\n    try {\n      await runModuleSetupHook({\n        moduleId: mod.id,\n        phase: 'seedExamples',\n        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,\n        run: () => mod.setup!.seedExamples!({\n          em,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          container,\n        }),\n      })\n    } catch (error) {\n      console.error('[onboarding.verify] deferred seedExamples failed', {\n        moduleId: mod.id,\n        tenantId: args.tenantId,\n        organizationId: args.organizationId,\n        error,\n      })\n    }\n  }\n\n  await markWorkspaceReady({\n    requestId: args.requestId,\n  })\n\n  await sendWorkspaceReadyEmail({\n    requestId: args.requestId,\n    tenantId: args.tenantId,\n  }).catch((error) => {\n    console.error('[onboarding.verify] ready email failed', {\n      requestId: args.requestId,\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      error,\n    })\n    throw error\n  })\n\n  await rebuildTenantQueryIndexes({\n    em,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  })\n\n  await enqueueVectorReindex({\n    container,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  }).catch((error) => {\n    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      reason: error instanceof Error ? error.message : String(error),\n    })\n  })\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedBaseUrl(req)\n  const token = url.searchParams.get('token') ?? ''\n  const parsed = onboardingVerifySchema.safeParse({ token })\n  if (!parsed.success) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  const service = new OnboardingService(em)\n  const request = await service.findByToken(parsed.data.token)\n  if (!request) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.expiresAt <= new Date() && request.status !== 'completed') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.status === 'completed' && request.tenantId) {\n    if (!request.preparationCompletedAt) {\n      return redirectToPreparing(baseUrl, request.tenantId)\n    }\n    if (!request.readyEmailSentAt) {\n      after(async () => {\n        await sendWorkspaceReadyEmail({\n          requestId: request.id,\n          tenantId: request.tenantId!,\n        }).catch((error) => {\n          console.error('[onboarding.verify] retry ready email failed', {\n            requestId: request.id,\n            tenantId: request.tenantId,\n            organizationId: request.organizationId,\n            error,\n          })\n        })\n      })\n    }\n    return redirectToLogin(baseUrl, request.tenantId)\n  }\n  const lockWindowMs = 15 * 60 * 1000\n  const processingStartedAt = request.processingStartedAt?.getTime() ?? 0\n  const processingFresh = request.status === 'processing' && processingStartedAt > Date.now() - lockWindowMs\n  if (processingFresh) {\n    return redirectToPreparing(baseUrl, request.tenantId ?? null)\n  }\n  if (request.status === 'processing' && !processingFresh) {\n    await service.resetProcessing(request)\n  }\n  if (request.status !== 'pending') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  await service.startProcessing(request, new Date())\n  if (!request.passwordHash) {\n    console.error('[onboarding.verify] missing password hash for request', request.id)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n\n  let tenantId: string | null = null\n  let organizationId: string | null = null\n  let userId: string | null = null\n\n  try {\n    const setupResult = await setupInitialTenant(em, {\n      orgName: request.organizationName,\n      includeDerivedUsers: false,\n      failIfUserExists: true,\n      primaryUserRoles: ['admin'],\n      includeSuperadminRole: false,\n      primaryUser: {\n        email: request.email,\n        firstName: request.firstName,\n        lastName: request.lastName,\n        displayName: `${request.firstName} ${request.lastName}`.trim(),\n        hashedPassword: request.passwordHash,\n        confirm: true,\n      },\n      modules: getModules(),\n    })\n\n    const resolvedTenantId = String(setupResult.tenantId)\n    const resolvedOrganizationId = String(setupResult.organizationId)\n    tenantId = resolvedTenantId\n    organizationId = resolvedOrganizationId\n\n    const mainUserSnapshot = setupResult.users.find((entry) => entry.user.email === request.email)\n    if (!mainUserSnapshot) throw new Error('USER_NOT_CREATED')\n    const user = mainUserSnapshot.user\n    const resolvedUserId = String(user.id)\n    userId = resolvedUserId\n    await service.updateProvisioningIds(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n\n    if (request.marketingConsent) {\n      const now = new Date()\n      const clientIp = getClientIp(req, 1) ?? null\n      const integrityHash = computeConsentIntegrityHash({\n        userId: resolvedUserId,\n        consentType: 'marketing_email',\n        isGranted: true,\n        grantedAt: now,\n        ipAddress: clientIp,\n        source: 'onboarding',\n      })\n      // Wrap the request-em consent write in a transaction so it commits\n      // all-or-nothing. setupInitialTenant already manages its own internal\n      // transactions, and the seedDefaults hooks below resolve container\n      // services that fork their own EM (and may enqueue work), so neither can\n      // join this transaction \u2014 only the direct request-em writes are wrapped.\n      await em.transactional(async (txEm) => {\n        txEm.create(UserConsent, {\n          userId: resolvedUserId,\n          tenantId: resolvedTenantId,\n          organizationId: resolvedOrganizationId,\n          consentType: 'marketing_email',\n          isGranted: true,\n          grantedAt: now,\n          source: 'onboarding',\n          ipAddress: clientIp,\n          integrityHash,\n          createdAt: now,\n        })\n      })\n    }\n\n    // Call module seedDefaults + seedExamples hooks\n    const modules = getModules()\n    for (const mod of modules) {\n      if (mod.setup?.seedDefaults) {\n        await runModuleSetupHook({\n          moduleId: mod.id,\n          phase: 'seedDefaults',\n          timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,\n          run: () => mod.setup!.seedDefaults!({\n            em,\n            tenantId: resolvedTenantId,\n            organizationId: resolvedOrganizationId,\n            container,\n          }),\n        })\n      }\n    }\n    await service.markCompleted(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n    // TODO: Move deferred provisioning into a durable job keyed by request id so process restarts can resume\n    // seedExamples/index rebuild/email dispatch instead of leaving completed requests stuck on preparing.\n    after(async () => {\n      await runDeferredProvisioning({\n        requestId: request.id,\n        tenantId: resolvedTenantId,\n        organizationId: resolvedOrganizationId,\n      })\n    })\n    return redirectToPreparing(baseUrl, resolvedTenantId)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'USER_EXISTS') {\n      await service.resetProcessing(request)\n      return redirectWithStatus(baseUrl, 'already_exists')\n    }\n    console.error('[onboarding.verify] failed', error)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n}\n\nexport default GET\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingVerifyQuerySchema = z.object({\n  token: onboardingVerifySchema.shape.token,\n})\n\nconst onboardingVerifyDoc: OpenApiMethodDoc = {\n  summary: 'Verify onboarding token',\n  description: 'Validates the onboarding token, provisions the tenant, seeds demo data, and redirects the user to the login screen.',\n  tags: [onboardingTag],\n  query: onboardingVerifyQuerySchema,\n  responses: [\n    { status: 302, description: 'Redirect to onboarding UI or login' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding verification redirect',\n  methods: {\n    GET: onboardingVerifyDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,OAAO,oBAAoB;AACpC,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAC5B,SAAS,mCAAmC;AAC5C,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,SAAS,sBAAsB,KAAsB;AACnD,MAAI;AACF,WAAO,wBAAwB,GAAG;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,iBAAiB,6BAA6B;AAC3F,cAAQ,MAAM,iEAAiE;AAAA,QAC7E,YAAY,IAAI;AAAA,QAChB,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO,IAAI,IAAI,IAAI,GAAG,EAAE;AAAA,IAC1B;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiB,UAAwB;AAChD,WAAS,QAAQ,IAAI,cAAc,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC/D,WAAS,QAAQ,IAAI,iBAAiB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClE,WAAS,QAAQ,IAAI,mBAAmB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AACtE;AAEA,SAAS,mBAAmB,SAAiB,QAAgB;AAC3D,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,sBAAsB,mBAAmB,MAAM,CAAC,EAAE;AACnG,mBAAiB,QAAQ;AACzB,SAAO;AACT;AAEA,SAAS,oBAAoB,SAAiB,UAAyB;AACrE,QAAM,cAAc,WAAW,WAAW,mBAAmB,QAAQ,CAAC,KAAK;AAC3E,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,wBAAwB,WAAW,EAAE;AACtF,mBAAiB,QAAQ;AACzB,MAAI,UAAU;AACZ,aAAS,QAAQ,IAAI,mBAAmB,UAAU;AAAA,MAChD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ,KAAK,KAAK,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiB,UAAyB;AACjE,QAAM,cAAc,WAAW,WAAW,mBAAmB,QAAQ,CAAC,KAAK;AAC3E,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,SAAS,WAAW,EAAE;AACvE,mBAAiB,QAAQ;AACzB,MAAI,UAAU;AACZ,aAAS,QAAQ,IAAI,mBAAmB,UAAU;AAAA,MAChD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ,KAAK,KAAK,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,MAAM,oCAAoC;AAC1C,MAAM,2BAA2B;AACjC,MAAM,2BAA2B;AAEjC,SAAS,qBAAqB,OAAe,WAAmC;AAC9E,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM,OAAO,IAAI,MAAM,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,GAAG,SAAS;AAAA,EAC1F,CAAC;AACH;AAEA,eAAe,mBAAmB,MAK/B;AACD,QAAM,YAAY,KAAK,IAAI;AAC3B,UAAQ,KAAK,2CAA2C;AAAA,IACtD,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,qBAAqB,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS;AAAA,IAC9E,CAAC;AACD,YAAQ,KAAK,6CAA6C;AAAA,MACxD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,0CAA0C;AAAA,MACtD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,MAC9C,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mBAAmB,MAE/B;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS;AACrD,MAAI,CAAC,WAAW,QAAQ,uBAAwB;AAChD,QAAM,QAAQ,yBAAyB,SAAS,oBAAI,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,MAIjC;AACD,MAAI,gBAAsC;AAC1C,MAAI;AACF,oBAAgB,KAAK,UAAU,QAAuB,eAAe;AAAA,EACvE,QAAQ;AACN,oBAAgB;AAAA,EAClB;AACA,MAAI,CAAC,cAAe;AAEpB,QAAM,QAAQ,KAAK;AAAA,IACjB,cAAc,mBAAmB;AAAA,MAC/B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,IACD,qBAAqB,0BAA0B,iCAAiC;AAAA,EAClF,CAAC;AACH;AAEA,eAAe,0BAA0B,MAItC;AACD,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI;AACF,UAAM,cAAc,aAAa;AACjC,UAAM,YAAY,uBAAuB,WAAW;AACpD,eAAW,cAAc,WAAW;AAClC,UAAI;AACF,cAAM,gBAAgB,KAAK,IAAI,EAAE,YAAY,UAAU,KAAK,SAAS,CAAC;AAAA,MACxE,SAAS,OAAO;AACd,gBAAQ,MAAM,yDAAyD;AAAA,UACrE;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,cAAc,KAAK,IAAI;AAAA,UAC3B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO;AAAA,UACP,qBAAqB;AAAA,UACrB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ,MAAM,gDAAgD;AAAA,UAC5D;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,WAAW;AACjE,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,IAAI,KAAK,cAAc,EAAE;AAAA,IACjF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uDAAuD,EAAE,UAAU,KAAK,UAAU,MAAM,CAAC;AAAA,EACzG;AAEA,MAAI,CAAC,oBAAoB,KAAM;AAE/B,aAAW,SAAS,qBAAqB;AACvC,UAAM,CAAC,YAAY,WAAW,MAAM,IAAI,MAAM,MAAM,GAAG;AACvD,UAAM,WAAW,WAAW,aAAa,OAAO;AAChD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,2DAA2D;AAAA,QACvE;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,MAIpC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,WAAW;AAE3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,OAAO,aAAc;AAC9B,QAAI;AACF,YAAM,mBAAmB;AAAA,QACvB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,WAAW;AAAA,QACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,UAClC;AAAA,UACA,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,oDAAoD;AAAA,QAChE,UAAU,IAAI;AAAA,QACd,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,mBAAmB;AAAA,IACvB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,QAAM,wBAAwB;AAAA,IAC5B,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,EACjB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,0CAA0C;AAAA,MACtD,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR,CAAC;AAED,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAED,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,KAAK,wEAAwE;AAAA,MACnF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,uBAAuB,UAAU,EAAE,MAAM,CAAC;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,YAAY,OAAO,KAAK,KAAK;AAC3D,MAAI,CAAC,SAAS;AACZ,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,aAAa,oBAAI,KAAK,KAAK,QAAQ,WAAW,aAAa;AACrE,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,WAAW,eAAe,QAAQ,UAAU;AACtD,QAAI,CAAC,QAAQ,wBAAwB;AACnC,aAAO,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACtD;AACA,QAAI,CAAC,QAAQ,kBAAkB;AAC7B,YAAM,YAAY;AAChB,cAAM,wBAAwB;AAAA,UAC5B,WAAW,QAAQ;AAAA,UACnB,UAAU,QAAQ;AAAA,QACpB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,kBAAQ,MAAM,gDAAgD;AAAA,YAC5D,WAAW,QAAQ;AAAA,YACnB,UAAU,QAAQ;AAAA,YAClB,gBAAgB,QAAQ;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,gBAAgB,SAAS,QAAQ,QAAQ;AAAA,EAClD;AACA,QAAM,eAAe,KAAK,KAAK;AAC/B,QAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,KAAK;AACtE,QAAM,kBAAkB,QAAQ,WAAW,gBAAgB,sBAAsB,KAAK,IAAI,IAAI;AAC9F,MAAI,iBAAiB;AACnB,WAAO,oBAAoB,SAAS,QAAQ,YAAY,IAAI;AAAA,EAC9D;AACA,MAAI,QAAQ,WAAW,gBAAgB,CAAC,iBAAiB;AACvD,UAAM,QAAQ,gBAAgB,OAAO;AAAA,EACvC;AACA,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,QAAM,QAAQ,gBAAgB,SAAS,oBAAI,KAAK,CAAC;AACjD,MAAI,CAAC,QAAQ,cAAc;AACzB,YAAQ,MAAM,yDAAyD,QAAQ,EAAE;AACjF,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AAEA,MAAI,WAA0B;AAC9B,MAAI,iBAAgC;AACpC,MAAI,SAAwB;AAE5B,MAAI;AACF,UAAM,cAAc,MAAM,mBAAmB,IAAI;AAAA,MAC/C,SAAS,QAAQ;AAAA,MACjB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,kBAAkB,CAAC,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,aAAa;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,aAAa,GAAG,QAAQ,SAAS,IAAI,QAAQ,QAAQ,GAAG,KAAK;AAAA,QAC7D,gBAAgB,QAAQ;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC;AAED,UAAM,mBAAmB,OAAO,YAAY,QAAQ;AACpD,UAAM,yBAAyB,OAAO,YAAY,cAAc;AAChE,eAAW;AACX,qBAAiB;AAEjB,UAAM,mBAAmB,YAAY,MAAM,KAAK,CAAC,UAAU,MAAM,KAAK,UAAU,QAAQ,KAAK;AAC7F,QAAI,CAAC,iBAAkB,OAAM,IAAI,MAAM,kBAAkB;AACzD,UAAM,OAAO,iBAAiB;AAC9B,UAAM,iBAAiB,OAAO,KAAK,EAAE;AACrC,aAAS;AACT,UAAM,QAAQ,sBAAsB,SAAS;AAAA,MAC3C,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,kBAAkB;AAC5B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,YAAY,KAAK,CAAC,KAAK;AACxC,YAAM,gBAAgB,4BAA4B;AAAA,QAChD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAMD,YAAM,GAAG,cAAc,OAAO,SAAS;AACrC,aAAK,OAAO,aAAa;AAAA,UACvB,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,UACb,WAAW;AAAA,UACX,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,WAAW;AAC3B,eAAW,OAAO,SAAS;AACzB,UAAI,IAAI,OAAO,cAAc;AAC3B,cAAM,mBAAmB;AAAA,UACvB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,WAAW;AAAA,UACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,YAClC;AAAA,YACA,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,SAAS;AAAA,MACnC,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAGD,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AACD,WAAO,oBAAoB,SAAS,gBAAgB;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,eAAe;AAC7D,YAAM,QAAQ,gBAAgB,OAAO;AACrC,aAAO,mBAAmB,SAAS,gBAAgB;AAAA,IACrD;AACA,YAAQ,MAAM,8BAA8B,KAAK;AACjD,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;AAEA,IAAO,iBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,OAAO,uBAAuB,MAAM;AACtC,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,EACnE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { after, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { SearchIndexer } from '@open-mercato/search'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  AppOriginConfigurationError,\n  AppOriginRejectedError,\n  getSecurityEmailBaseUrl,\n} from '@open-mercato/shared/lib/url'\nimport { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'\nimport { UserConsent } from '@open-mercato/core/modules/auth/data/entities'\nimport { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'\nimport { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'\nimport { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'\nimport { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'\nimport { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/verify',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nfunction resolveTrustedBaseUrl(req: Request): string {\n  try {\n    return getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {\n      console.error('[onboarding.verify] rejected request origin for redirect base', {\n        requestUrl: req.url,\n        reason: error.message,\n      })\n      return new URL(req.url).origin\n    }\n    throw error\n  }\n}\n\nfunction clearAuthCookies(response: NextResponse) {\n  response.cookies.set('auth_token', '', { path: '/', maxAge: 0 })\n  response.cookies.set('session_token', '', { path: '/', maxAge: 0 })\n  response.cookies.set('om_login_tenant', '', { path: '/', maxAge: 0 })\n}\n\nfunction redirectWithStatus(baseUrl: string, status: string) {\n  const response = NextResponse.redirect(`${baseUrl}/onboarding?status=${encodeURIComponent(status)}`)\n  clearAuthCookies(response)\n  return response\n}\n\nfunction redirectToPreparing(baseUrl: string, tenantId: string | null) {\n  const tenantParam = tenantId ? `?tenant=${encodeURIComponent(tenantId)}` : ''\n  const response = NextResponse.redirect(`${baseUrl}/onboarding/preparing${tenantParam}`)\n  clearAuthCookies(response)\n  if (tenantId) {\n    response.cookies.set('om_login_tenant', tenantId, {\n      httpOnly: false,\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      path: '/',\n      maxAge: 60 * 60 * 24 * 14,\n    })\n  }\n  return response\n}\n\nfunction redirectToLogin(baseUrl: string, tenantId: string | null) {\n  const tenantParam = tenantId ? `?tenant=${encodeURIComponent(tenantId)}` : ''\n  const response = NextResponse.redirect(`${baseUrl}/login${tenantParam}`)\n  clearAuthCookies(response)\n  if (tenantId) {\n    response.cookies.set('om_login_tenant', tenantId, {\n      httpOnly: false,\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      path: '/',\n      maxAge: 60 * 60 * 24 * 14,\n    })\n  }\n  return response\n}\n\nconst VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000\nconst SEED_DEFAULTS_TIMEOUT_MS = 15_000\nconst SEED_EXAMPLES_TIMEOUT_MS = 15_000\n\nfunction createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)\n  })\n}\n\nasync function runModuleSetupHook(args: {\n  moduleId: string\n  phase: 'seedDefaults' | 'seedExamples'\n  timeoutMs: number\n  run: () => Promise<void>\n}) {\n  const startedAt = Date.now()\n  console.info('[onboarding.verify] module hook started', {\n    moduleId: args.moduleId,\n    phase: args.phase,\n    timeoutMs: args.timeoutMs,\n  })\n  try {\n    await Promise.race([\n      args.run(),\n      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),\n    ])\n    console.info('[onboarding.verify] module hook completed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n    })\n  } catch (error) {\n    console.error('[onboarding.verify] module hook failed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n      timeoutMs: args.timeoutMs,\n      error,\n    })\n    throw error\n  }\n}\n\nasync function markWorkspaceReady(args: {\n  requestId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findById(args.requestId)\n  if (!request || request.preparationCompletedAt) return\n  await service.markPreparationCompleted(request, new Date())\n}\n\nasync function enqueueVectorReindex(args: {\n  container: { resolve: <T = unknown>(name: string) => T }\n  tenantId: string\n  organizationId: string\n}) {\n  let searchIndexer: SearchIndexer | null = null\n  try {\n    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')\n  } catch {\n    searchIndexer = null\n  }\n  if (!searchIndexer) return\n\n  await Promise.race([\n    searchIndexer.reindexAllToVector({\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      purgeFirst: true,\n      useQueue: true,\n    }),\n    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),\n  ])\n}\n\nasync function rebuildTenantQueryIndexes(args: {\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n}) {\n  const coverageRefreshKeys = new Set<string>()\n  try {\n    const allEntities = getEntityIds()\n    const entityIds = flattenSystemEntityIds(allEntities)\n    for (const entityType of entityIds) {\n      try {\n        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to purge query index scope', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      try {\n        await reindexEntity(args.em, {\n          entityType,\n          tenantId: args.tenantId,\n          force: true,\n          emitVectorizeEvents: false,\n          vectorService: null,\n        })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to reindex entity', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)\n    }\n  } catch (error) {\n    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })\n  }\n\n  if (!coverageRefreshKeys.size) return\n\n  for (const entry of coverageRefreshKeys) {\n    const [entityType, tenantKey, orgKey] = entry.split('|')\n    const orgScope = orgKey === '__null__' ? null : orgKey\n    try {\n      await refreshCoverageSnapshot(\n        args.em,\n        {\n          entityType,\n          tenantId: tenantKey,\n          organizationId: orgScope,\n          withDeleted: false,\n        },\n      )\n    } catch (error) {\n      console.error('[onboarding.verify] failed to refresh coverage snapshot', {\n        entityType,\n        tenantId: tenantKey,\n        organizationId: orgScope,\n        error,\n      })\n    }\n  }\n}\n\nasync function runDeferredProvisioning(args: {\n  requestId: string\n  tenantId: string\n  organizationId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const modules = getModules()\n\n  for (const mod of modules) {\n    if (!mod.setup?.seedExamples) continue\n    try {\n      await runModuleSetupHook({\n        moduleId: mod.id,\n        phase: 'seedExamples',\n        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,\n        run: () => mod.setup!.seedExamples!({\n          em,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          container,\n        }),\n      })\n    } catch (error) {\n      console.error('[onboarding.verify] deferred seedExamples failed', {\n        moduleId: mod.id,\n        tenantId: args.tenantId,\n        organizationId: args.organizationId,\n        error,\n      })\n    }\n  }\n\n  await markWorkspaceReady({\n    requestId: args.requestId,\n  })\n\n  await sendWorkspaceReadyEmail({\n    requestId: args.requestId,\n    tenantId: args.tenantId,\n  }).catch((error) => {\n    console.error('[onboarding.verify] ready email failed', {\n      requestId: args.requestId,\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      error,\n    })\n    throw error\n  })\n\n  await rebuildTenantQueryIndexes({\n    em,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  })\n\n  await enqueueVectorReindex({\n    container,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  }).catch((error) => {\n    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      reason: error instanceof Error ? error.message : String(error),\n    })\n  })\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedBaseUrl(req)\n  const token = url.searchParams.get('token') ?? ''\n  const parsed = onboardingVerifySchema.safeParse({ token })\n  if (!parsed.success) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  const service = new OnboardingService(em)\n  const request = await service.findByToken(parsed.data.token)\n  if (!request) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.expiresAt <= new Date() && request.status !== 'completed') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.status === 'completed' && request.tenantId) {\n    if (!request.preparationCompletedAt) {\n      return redirectToPreparing(baseUrl, request.tenantId)\n    }\n    if (!request.readyEmailSentAt) {\n      after(async () => {\n        await sendWorkspaceReadyEmail({\n          requestId: request.id,\n          tenantId: request.tenantId!,\n        }).catch((error) => {\n          console.error('[onboarding.verify] retry ready email failed', {\n            requestId: request.id,\n            tenantId: request.tenantId,\n            organizationId: request.organizationId,\n            error,\n          })\n        })\n      })\n    }\n    return redirectToLogin(baseUrl, request.tenantId)\n  }\n  const lockWindowMs = 15 * 60 * 1000\n  const processingStartedAt = request.processingStartedAt?.getTime() ?? 0\n  const processingFresh = request.status === 'processing' && processingStartedAt > Date.now() - lockWindowMs\n  if (processingFresh) {\n    return redirectToPreparing(baseUrl, request.tenantId ?? null)\n  }\n  if (request.status === 'processing' && !processingFresh) {\n    await service.resetProcessing(request)\n  }\n  if (request.status !== 'pending') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  await service.startProcessing(request, new Date())\n  if (!request.passwordHash) {\n    console.error('[onboarding.verify] missing password hash for request', request.id)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n\n  let tenantId: string | null = null\n  let organizationId: string | null = null\n  let userId: string | null = null\n\n  try {\n    const setupResult = await setupInitialTenant(em, {\n      orgName: request.organizationName,\n      includeDerivedUsers: false,\n      failIfUserExists: true,\n      primaryUserRoles: ['admin'],\n      includeSuperadminRole: false,\n      primaryUser: {\n        email: request.email,\n        firstName: request.firstName,\n        lastName: request.lastName,\n        displayName: `${request.firstName} ${request.lastName}`.trim(),\n        hashedPassword: request.passwordHash,\n        confirm: true,\n      },\n      modules: getModules(),\n    })\n\n    const resolvedTenantId = String(setupResult.tenantId)\n    const resolvedOrganizationId = String(setupResult.organizationId)\n    tenantId = resolvedTenantId\n    organizationId = resolvedOrganizationId\n\n    const mainUserSnapshot = setupResult.users.find((entry) => entry.user.email === request.email)\n    if (!mainUserSnapshot) throw new Error('USER_NOT_CREATED')\n    const user = mainUserSnapshot.user\n    const resolvedUserId = String(user.id)\n    userId = resolvedUserId\n    await service.updateProvisioningIds(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n\n    if (request.marketingConsent) {\n      const now = new Date()\n      const clientIp = resolveConsentClientIp(req)\n      const integrityHash = computeConsentIntegrityHash({\n        userId: resolvedUserId,\n        consentType: 'marketing_email',\n        isGranted: true,\n        grantedAt: now,\n        ipAddress: clientIp,\n        source: 'onboarding',\n      })\n      // Wrap the request-em consent write in a transaction so it commits\n      // all-or-nothing. setupInitialTenant already manages its own internal\n      // transactions, and the seedDefaults hooks below resolve container\n      // services that fork their own EM (and may enqueue work), so neither can\n      // join this transaction \u2014 only the direct request-em writes are wrapped.\n      await em.transactional(async (txEm) => {\n        txEm.create(UserConsent, {\n          userId: resolvedUserId,\n          tenantId: resolvedTenantId,\n          organizationId: resolvedOrganizationId,\n          consentType: 'marketing_email',\n          isGranted: true,\n          grantedAt: now,\n          source: 'onboarding',\n          ipAddress: clientIp,\n          integrityHash,\n          createdAt: now,\n        })\n      })\n    }\n\n    // Call module seedDefaults + seedExamples hooks\n    const modules = getModules()\n    for (const mod of modules) {\n      if (mod.setup?.seedDefaults) {\n        await runModuleSetupHook({\n          moduleId: mod.id,\n          phase: 'seedDefaults',\n          timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,\n          run: () => mod.setup!.seedDefaults!({\n            em,\n            tenantId: resolvedTenantId,\n            organizationId: resolvedOrganizationId,\n            container,\n          }),\n        })\n      }\n    }\n    await service.markCompleted(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n    // TODO: Move deferred provisioning into a durable job keyed by request id so process restarts can resume\n    // seedExamples/index rebuild/email dispatch instead of leaving completed requests stuck on preparing.\n    after(async () => {\n      await runDeferredProvisioning({\n        requestId: request.id,\n        tenantId: resolvedTenantId,\n        organizationId: resolvedOrganizationId,\n      })\n    })\n    return redirectToPreparing(baseUrl, resolvedTenantId)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'USER_EXISTS') {\n      await service.resetProcessing(request)\n      return redirectWithStatus(baseUrl, 'already_exists')\n    }\n    console.error('[onboarding.verify] failed', error)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n}\n\nexport default GET\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingVerifyQuerySchema = z.object({\n  token: onboardingVerifySchema.shape.token,\n})\n\nconst onboardingVerifyDoc: OpenApiMethodDoc = {\n  summary: 'Verify onboarding token',\n  description: 'Validates the onboarding token, provisions the tenant, seeds demo data, and redirects the user to the login screen.',\n  tags: [onboardingTag],\n  query: onboardingVerifyQuerySchema,\n  responses: [\n    { status: 302, description: 'Redirect to onboarding UI or login' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding verification redirect',\n  methods: {\n    GET: onboardingVerifyDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,OAAO,oBAAoB;AACpC,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAC5B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,SAAS,sBAAsB,KAAsB;AACnD,MAAI;AACF,WAAO,wBAAwB,GAAG;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,iBAAiB,6BAA6B;AAC3F,cAAQ,MAAM,iEAAiE;AAAA,QAC7E,YAAY,IAAI;AAAA,QAChB,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO,IAAI,IAAI,IAAI,GAAG,EAAE;AAAA,IAC1B;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiB,UAAwB;AAChD,WAAS,QAAQ,IAAI,cAAc,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAC/D,WAAS,QAAQ,IAAI,iBAAiB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AAClE,WAAS,QAAQ,IAAI,mBAAmB,IAAI,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;AACtE;AAEA,SAAS,mBAAmB,SAAiB,QAAgB;AAC3D,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,sBAAsB,mBAAmB,MAAM,CAAC,EAAE;AACnG,mBAAiB,QAAQ;AACzB,SAAO;AACT;AAEA,SAAS,oBAAoB,SAAiB,UAAyB;AACrE,QAAM,cAAc,WAAW,WAAW,mBAAmB,QAAQ,CAAC,KAAK;AAC3E,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,wBAAwB,WAAW,EAAE;AACtF,mBAAiB,QAAQ;AACzB,MAAI,UAAU;AACZ,aAAS,QAAQ,IAAI,mBAAmB,UAAU;AAAA,MAChD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ,KAAK,KAAK,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiB,UAAyB;AACjE,QAAM,cAAc,WAAW,WAAW,mBAAmB,QAAQ,CAAC,KAAK;AAC3E,QAAM,WAAW,aAAa,SAAS,GAAG,OAAO,SAAS,WAAW,EAAE;AACvE,mBAAiB,QAAQ;AACzB,MAAI,UAAU;AACZ,aAAS,QAAQ,IAAI,mBAAmB,UAAU;AAAA,MAChD,UAAU;AAAA,MACV,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,MACN,QAAQ,KAAK,KAAK,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,MAAM,oCAAoC;AAC1C,MAAM,2BAA2B;AACjC,MAAM,2BAA2B;AAEjC,SAAS,qBAAqB,OAAe,WAAmC;AAC9E,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM,OAAO,IAAI,MAAM,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,GAAG,SAAS;AAAA,EAC1F,CAAC;AACH;AAEA,eAAe,mBAAmB,MAK/B;AACD,QAAM,YAAY,KAAK,IAAI;AAC3B,UAAQ,KAAK,2CAA2C;AAAA,IACtD,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,qBAAqB,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS;AAAA,IAC9E,CAAC;AACD,YAAQ,KAAK,6CAA6C;AAAA,MACxD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,0CAA0C;AAAA,MACtD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,MAC9C,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mBAAmB,MAE/B;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS;AACrD,MAAI,CAAC,WAAW,QAAQ,uBAAwB;AAChD,QAAM,QAAQ,yBAAyB,SAAS,oBAAI,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,MAIjC;AACD,MAAI,gBAAsC;AAC1C,MAAI;AACF,oBAAgB,KAAK,UAAU,QAAuB,eAAe;AAAA,EACvE,QAAQ;AACN,oBAAgB;AAAA,EAClB;AACA,MAAI,CAAC,cAAe;AAEpB,QAAM,QAAQ,KAAK;AAAA,IACjB,cAAc,mBAAmB;AAAA,MAC/B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,IACD,qBAAqB,0BAA0B,iCAAiC;AAAA,EAClF,CAAC;AACH;AAEA,eAAe,0BAA0B,MAItC;AACD,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI;AACF,UAAM,cAAc,aAAa;AACjC,UAAM,YAAY,uBAAuB,WAAW;AACpD,eAAW,cAAc,WAAW;AAClC,UAAI;AACF,cAAM,gBAAgB,KAAK,IAAI,EAAE,YAAY,UAAU,KAAK,SAAS,CAAC;AAAA,MACxE,SAAS,OAAO;AACd,gBAAQ,MAAM,yDAAyD;AAAA,UACrE;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,cAAc,KAAK,IAAI;AAAA,UAC3B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO;AAAA,UACP,qBAAqB;AAAA,UACrB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ,MAAM,gDAAgD;AAAA,UAC5D;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,WAAW;AACjE,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,IAAI,KAAK,cAAc,EAAE;AAAA,IACjF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uDAAuD,EAAE,UAAU,KAAK,UAAU,MAAM,CAAC;AAAA,EACzG;AAEA,MAAI,CAAC,oBAAoB,KAAM;AAE/B,aAAW,SAAS,qBAAqB;AACvC,UAAM,CAAC,YAAY,WAAW,MAAM,IAAI,MAAM,MAAM,GAAG;AACvD,UAAM,WAAW,WAAW,aAAa,OAAO;AAChD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,2DAA2D;AAAA,QACvE;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,MAIpC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,WAAW;AAE3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,OAAO,aAAc;AAC9B,QAAI;AACF,YAAM,mBAAmB;AAAA,QACvB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,WAAW;AAAA,QACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,UAClC;AAAA,UACA,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,oDAAoD;AAAA,QAChE,UAAU,IAAI;AAAA,QACd,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,mBAAmB;AAAA,IACvB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,QAAM,wBAAwB;AAAA,IAC5B,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,EACjB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,0CAA0C;AAAA,MACtD,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR,CAAC;AAED,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAED,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,KAAK,wEAAwE;AAAA,MACnF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,uBAAuB,UAAU,EAAE,MAAM,CAAC;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,YAAY,OAAO,KAAK,KAAK;AAC3D,MAAI,CAAC,SAAS;AACZ,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,aAAa,oBAAI,KAAK,KAAK,QAAQ,WAAW,aAAa;AACrE,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,WAAW,eAAe,QAAQ,UAAU;AACtD,QAAI,CAAC,QAAQ,wBAAwB;AACnC,aAAO,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACtD;AACA,QAAI,CAAC,QAAQ,kBAAkB;AAC7B,YAAM,YAAY;AAChB,cAAM,wBAAwB;AAAA,UAC5B,WAAW,QAAQ;AAAA,UACnB,UAAU,QAAQ;AAAA,QACpB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,kBAAQ,MAAM,gDAAgD;AAAA,YAC5D,WAAW,QAAQ;AAAA,YACnB,UAAU,QAAQ;AAAA,YAClB,gBAAgB,QAAQ;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,gBAAgB,SAAS,QAAQ,QAAQ;AAAA,EAClD;AACA,QAAM,eAAe,KAAK,KAAK;AAC/B,QAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,KAAK;AACtE,QAAM,kBAAkB,QAAQ,WAAW,gBAAgB,sBAAsB,KAAK,IAAI,IAAI;AAC9F,MAAI,iBAAiB;AACnB,WAAO,oBAAoB,SAAS,QAAQ,YAAY,IAAI;AAAA,EAC9D;AACA,MAAI,QAAQ,WAAW,gBAAgB,CAAC,iBAAiB;AACvD,UAAM,QAAQ,gBAAgB,OAAO;AAAA,EACvC;AACA,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,QAAM,QAAQ,gBAAgB,SAAS,oBAAI,KAAK,CAAC;AACjD,MAAI,CAAC,QAAQ,cAAc;AACzB,YAAQ,MAAM,yDAAyD,QAAQ,EAAE;AACjF,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AAEA,MAAI,WAA0B;AAC9B,MAAI,iBAAgC;AACpC,MAAI,SAAwB;AAE5B,MAAI;AACF,UAAM,cAAc,MAAM,mBAAmB,IAAI;AAAA,MAC/C,SAAS,QAAQ;AAAA,MACjB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,kBAAkB,CAAC,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,aAAa;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,aAAa,GAAG,QAAQ,SAAS,IAAI,QAAQ,QAAQ,GAAG,KAAK;AAAA,QAC7D,gBAAgB,QAAQ;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC;AAED,UAAM,mBAAmB,OAAO,YAAY,QAAQ;AACpD,UAAM,yBAAyB,OAAO,YAAY,cAAc;AAChE,eAAW;AACX,qBAAiB;AAEjB,UAAM,mBAAmB,YAAY,MAAM,KAAK,CAAC,UAAU,MAAM,KAAK,UAAU,QAAQ,KAAK;AAC7F,QAAI,CAAC,iBAAkB,OAAM,IAAI,MAAM,kBAAkB;AACzD,UAAM,OAAO,iBAAiB;AAC9B,UAAM,iBAAiB,OAAO,KAAK,EAAE;AACrC,aAAS;AACT,UAAM,QAAQ,sBAAsB,SAAS;AAAA,MAC3C,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,kBAAkB;AAC5B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,uBAAuB,GAAG;AAC3C,YAAM,gBAAgB,4BAA4B;AAAA,QAChD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAMD,YAAM,GAAG,cAAc,OAAO,SAAS;AACrC,aAAK,OAAO,aAAa;AAAA,UACvB,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,UACb,WAAW;AAAA,UACX,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,WAAW;AAC3B,eAAW,OAAO,SAAS;AACzB,UAAI,IAAI,OAAO,cAAc;AAC3B,cAAM,mBAAmB;AAAA,UACvB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,WAAW;AAAA,UACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,YAClC;AAAA,YACA,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,SAAS;AAAA,MACnC,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAGD,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AACD,WAAO,oBAAoB,SAAS,gBAAgB;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,eAAe;AAC7D,YAAM,QAAQ,gBAAgB,OAAO;AACrC,aAAO,mBAAmB,SAAS,gBAAgB;AAAA,IACrD;AACA,YAAQ,MAAM,8BAA8B,KAAK;AACjD,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;AAEA,IAAO,iBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,OAAO,uBAAuB,MAAM;AACtC,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,EACnE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/onboarding/lib/consentClientIp.js

@@ -0,0 +1,11 @@
+import { getCachedRateLimiterService } from "@open-mercato/core/bootstrap";
+import { getClientIp } from "@open-mercato/shared/lib/ratelimit/helpers";
+function resolveConsentClientIp(req) {
+  const rateLimiterService = getCachedRateLimiterService();
+  if (!rateLimiterService) return null;
+  return getClientIp(req, rateLimiterService.trustProxyDepth) ?? null;
+}
+export {
+  resolveConsentClientIp
+};
+//# sourceMappingURL=consentClientIp.js.map

package/dist/modules/onboarding/lib/consentClientIp.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/lib/consentClientIp.ts"],
+  "sourcesContent": ["import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\n\n/**\n * Resolve the client IP to persist on a legal-consent record, honoring the\n * deployment-wide reverse-proxy trust depth (`RATE_LIMIT_TRUST_PROXY_DEPTH`)\n * exposed by the rate limiter service instead of a hardcoded depth. When the\n * trust depth is unknown, return null so a spoofable `X-Forwarded-For` value is\n * never signed into the consent integrity hash.\n */\nexport function resolveConsentClientIp(req: Request): string | null {\n  const rateLimiterService = getCachedRateLimiterService()\n  if (!rateLimiterService) return null\n  return getClientIp(req, rateLimiterService.trustProxyDepth) ?? null\n}\n"],
+  "mappings": "AAAA,SAAS,mCAAmC;AAC5C,SAAS,mBAAmB;AASrB,SAAS,uBAAuB,KAA6B;AAClE,QAAM,qBAAqB,4BAA4B;AACvD,MAAI,CAAC,mBAAoB,QAAO;AAChC,SAAO,YAAY,KAAK,mBAAmB,eAAe,KAAK;AACjE;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.5-develop.5048.1.fd82f4ae17",
+  "version": "0.6.5-develop.5116.1.f0af9e5080",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -69,10 +69,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5048.1.fd82f4ae17"
+    "@open-mercato/shared": "0.6.5-develop.5116.1.f0af9e5080"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5048.1.fd82f4ae17",
+    "@open-mercato/shared": "0.6.5-develop.5116.1.f0af9e5080",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"

package/src/__tests__/consentClientIp.test.ts

@@ -0,0 +1,47 @@
+import { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'
+
+const getCachedRateLimiterService = jest.fn()
+
+jest.mock('@open-mercato/core/bootstrap', () => ({
+  getCachedRateLimiterService: () => getCachedRateLimiterService(),
+}))
+
+function makeRequest(headers: Record<string, string>): Request {
+  return new Request('http://localhost/onboarding/onboarding/verify', { headers })
+}
+
+describe('resolveConsentClientIp', () => {
+  beforeEach(() => {
+    getCachedRateLimiterService.mockReset()
+  })
+
+  it('ignores a spoofed X-Forwarded-For when no proxy is trusted (trustProxyDepth=0)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 0 })
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6' })
+    expect(resolveConsentClientIp(req)).toBeNull()
+  })
+
+  it('honors the configured trust depth instead of a hardcoded 1 (trustProxyDepth=2)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 2 })
+    const req = makeRequest({ 'x-forwarded-for': 'client, proxy2, proxy1' })
+    expect(resolveConsentClientIp(req)).toBe('proxy2')
+  })
+
+  it('records the trusted client IP for a single-proxy deployment (trustProxyDepth=1)', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 1 })
+    const req = makeRequest({ 'x-forwarded-for': 'client, edge' })
+    expect(resolveConsentClientIp(req)).toBe('edge')
+  })
+
+  it('falls back to X-Real-IP when X-Forwarded-For is untrusted', () => {
+    getCachedRateLimiterService.mockReturnValue({ trustProxyDepth: 0 })
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6', 'x-real-ip': '10.0.0.5' })
+    expect(resolveConsentClientIp(req)).toBe('10.0.0.5')
+  })
+
+  it('returns null when the rate limiter service is unavailable', () => {
+    getCachedRateLimiterService.mockReturnValue(null)
+    const req = makeRequest({ 'x-forwarded-for': '6.6.6.6' })
+    expect(resolveConsentClientIp(req)).toBeNull()
+  })
+})

package/src/__tests__/status-endpoint-auth.test.ts

@@ -0,0 +1,111 @@
+import { OnboardingRequest } from '../modules/onboarding/data/entities'
+
+const findLatestByTenantId = jest.fn()
+const sendWorkspaceReadyEmail = jest.fn()
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(async () => ({
+    resolve: (name: string) => {
+      if (name === 'em') return {}
+      throw new Error(`unexpected resolve(${name})`)
+    },
+  })),
+}))
+
+jest.mock('@open-mercato/shared/lib/url', () => ({
+  getSecurityEmailBaseUrl: () => 'https://app.example.com',
+  mapSecurityEmailUrlError: () => null,
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/service', () => ({
+  OnboardingService: jest.fn().mockImplementation(() => ({
+    findLatestByTenantId,
+  })),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/ready-email', () => ({
+  sendWorkspaceReadyEmail,
+}))
+
+import { GET } from '../modules/onboarding/api/get/onboarding/status'
+
+const TENANT_ID = '11111111-1111-4111-8111-111111111111'
+const OTHER_TENANT_ID = '22222222-2222-4222-8222-222222222222'
+
+function makeRequest(overrides: Record<string, unknown> = {}) {
+  return Object.assign(new OnboardingRequest(), {
+    id: 'req-1',
+    status: 'completed',
+    tenantId: TENANT_ID,
+    organizationId: 'org-1',
+    preparationCompletedAt: new Date(),
+    readyEmailSentAt: new Date(),
+    ...overrides,
+  })
+}
+
+function buildRequest(args: { tenantId: string; cookie?: string }) {
+  const headers = new Headers()
+  if (args.cookie !== undefined) headers.set('cookie', args.cookie)
+  return new Request(`https://app.example.com/api/onboarding/onboarding/status?tenantId=${args.tenantId}`, {
+    headers,
+  })
+}
+
+describe('onboarding status endpoint authorization', () => {
+  beforeEach(() => {
+    findLatestByTenantId.mockReset()
+    sendWorkspaceReadyEmail.mockReset()
+    findLatestByTenantId.mockResolvedValue(makeRequest())
+  })
+
+  it('returns 403 and does not look up tenant state when no om_login_tenant cookie is present', async () => {
+    const res = await GET(buildRequest({ tenantId: TENANT_ID }))
+    expect(res.status).toBe(403)
+    const body = await res.json()
+    expect(body).toEqual({ ok: false, error: 'Not authorized for this tenant.' })
+    expect(findLatestByTenantId).not.toHaveBeenCalled()
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('returns 403 when the om_login_tenant cookie is for a different tenant', async () => {
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${OTHER_TENANT_ID}` }),
+    )
+    expect(res.status).toBe(403)
+    expect(findLatestByTenantId).not.toHaveBeenCalled()
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('does not trigger the ready email side effect for an unauthorized caller', async () => {
+    findLatestByTenantId.mockResolvedValue(
+      makeRequest({ readyEmailSentAt: null }),
+    )
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${OTHER_TENANT_ID}` }),
+    )
+    expect(res.status).toBe(403)
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('returns the status when the om_login_tenant cookie matches the requested tenant', async () => {
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `other=foo; om_login_tenant=${TENANT_ID}` }),
+    )
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.ok).toBe(true)
+    expect(body.tenantId).toBe(TENANT_ID)
+    expect(body.ready).toBe(true)
+    expect(body.loginUrl).toBe(`https://app.example.com/login?tenant=${TENANT_ID}`)
+    expect(findLatestByTenantId).toHaveBeenCalledWith(TENANT_ID)
+  })
+
+  it('returns 404 for an authorized caller when no onboarding record exists', async () => {
+    findLatestByTenantId.mockResolvedValue(null)
+    const res = await GET(
+      buildRequest({ tenantId: TENANT_ID, cookie: `om_login_tenant=${TENANT_ID}` }),
+    )
+    expect(res.status).toBe(404)
+  })
+})

package/src/modules/onboarding/api/get/onboarding/status.ts

@@ -14,10 +14,30 @@ export const metadata = {
   },
 }
 
+const ONBOARDING_LOGIN_TENANT_COOKIE = 'om_login_tenant'
+
 const onboardingStatusQuerySchema = z.object({
   tenantId: z.string().uuid(),
 })
 
+function readCookie(req: Request, name: string): string | null {
+  const header = req.headers.get('cookie')
+  if (!header) return null
+  for (const part of header.split(';')) {
+    const separatorIndex = part.indexOf('=')
+    if (separatorIndex === -1) continue
+    const key = part.slice(0, separatorIndex).trim()
+    if (key !== name) continue
+    const rawValue = part.slice(separatorIndex + 1).trim()
+    try {
+      return decodeURIComponent(rawValue)
+    } catch {
+      return rawValue
+    }
+  }
+  return null
+}
+
 export async function GET(req: Request) {
   const url = new URL(req.url)
   const tenantId = url.searchParams.get('tenantId') || url.searchParams.get('tenant') || ''
@@ -26,6 +46,11 @@ export async function GET(req: Request) {
     return NextResponse.json({ ok: false, error: 'Invalid tenant id.' }, { status: 400 })
   }
 
+  const loginTenantCookie = readCookie(req, ONBOARDING_LOGIN_TENANT_COOKIE)
+  if (!loginTenantCookie || loginTenantCookie !== parsed.data.tenantId) {
+    return NextResponse.json({ ok: false, error: 'Not authorized for this tenant.' }, { status: 403 })
+  }
+
   let baseUrl: string
   try {
     baseUrl = getSecurityEmailBaseUrl(req)
@@ -101,6 +126,7 @@ const onboardingStatusDoc: OpenApiMethodDoc = {
   ],
   errors: [
     { status: 400, description: 'Invalid tenant id or request origin.', schema: onboardingStatusErrorSchema },
+    { status: 403, description: 'Caller is not authorized for this tenant.', schema: onboardingStatusErrorSchema },
     { status: 404, description: 'Onboarding request not found.', schema: onboardingStatusErrorSchema },
     { status: 500, description: 'Onboarding status is not configured.', schema: onboardingStatusErrorSchema },
   ],

package/src/modules/onboarding/api/get/onboarding/verify.ts

@@ -14,7 +14,7 @@ import { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboar
 import { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'
 import { UserConsent } from '@open-mercato/core/modules/auth/data/entities'
 import { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'
-import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'
 import { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'
 import { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'
 import { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'
@@ -403,7 +403,7 @@ export async function GET(req: Request) {
 
     if (request.marketingConsent) {
       const now = new Date()
-      const clientIp = getClientIp(req, 1) ?? null
+      const clientIp = resolveConsentClientIp(req)
       const integrityHash = computeConsentIntegrityHash({
         userId: resolvedUserId,
         consentType: 'marketing_email',

package/src/modules/onboarding/lib/consentClientIp.ts

@@ -0,0 +1,15 @@
+import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'
+import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
+
+/**
+ * Resolve the client IP to persist on a legal-consent record, honoring the
+ * deployment-wide reverse-proxy trust depth (`RATE_LIMIT_TRUST_PROXY_DEPTH`)
+ * exposed by the rate limiter service instead of a hardcoded depth. When the
+ * trust depth is unknown, return null so a spoofable `X-Forwarded-For` value is
+ * never signed into the consent integrity hash.
+ */
+export function resolveConsentClientIp(req: Request): string | null {
+  const rateLimiterService = getCachedRateLimiterService()
+  if (!rateLimiterService) return null
+  return getClientIp(req, rateLimiterService.trustProxyDepth) ?? null
+}