@open-mercato/onboarding 0.6.5-develop.5382.1.f542de69af → 0.6.5

package/dist/modules/onboarding/lib/deferred-provisioning.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/lib/deferred-provisioning.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { SearchIndexer } from '@open-mercato/search'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport type { OnboardingRequest } from '@open-mercato/onboarding/modules/onboarding/data/entities'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'\nimport { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'\nimport { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'\nimport { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'\nimport { PREPARATION_CLAIM_STALE_MS } from '@open-mercato/onboarding/modules/onboarding/lib/preparation-claim'\n\nconst VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000\nconst SEED_EXAMPLES_TIMEOUT_MS = 15_000\n\nexport function resolveProvisioningIds(request: OnboardingRequest) {\n  if (!request.tenantId || !request.organizationId || !request.userId) return null\n  return {\n    tenantId: request.tenantId,\n    organizationId: request.organizationId,\n    userId: request.userId,\n  }\n}\n\nfunction createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)\n  })\n}\n\nasync function runModuleSetupHook(args: {\n  moduleId: string\n  phase: 'seedExamples'\n  timeoutMs: number\n  run: () => Promise<void>\n}) {\n  const startedAt = Date.now()\n  console.info('[onboarding.verify] module hook started', {\n    moduleId: args.moduleId,\n    phase: args.phase,\n    timeoutMs: args.timeoutMs,\n  })\n  try {\n    await Promise.race([\n      args.run(),\n      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),\n    ])\n    console.info('[onboarding.verify] module hook completed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n    })\n  } catch (error) {\n    if (isUniqueViolation(error)) {\n      // Deferred provisioning is re-triggered on every preparing-page status\n      // poll until preparationCompletedAt is set. seedExamples is not fully\n      // idempotent (e.g. catalog product handles are unique-scoped), so a\n      // re-run that lands before completion collides on an already-seeded row.\n      // The workspace is already provisioned and the collision is expected and\n      // harmless \u2014 log at info so genuine failures still stand out.\n      console.info('[onboarding.verify] module hook skipped (already seeded)', {\n        moduleId: args.moduleId,\n        phase: args.phase,\n        durationMs: Math.max(0, Date.now() - startedAt),\n      })\n    } else {\n      console.error('[onboarding.verify] module hook failed', {\n        moduleId: args.moduleId,\n        phase: args.phase,\n        durationMs: Math.max(0, Date.now() - startedAt),\n        timeoutMs: args.timeoutMs,\n        error,\n      })\n    }\n    throw error\n  }\n}\n\nasync function markWorkspaceReady(args: {\n  requestId: string\n  service: OnboardingService\n}) {\n  const request = await args.service.findById(args.requestId)\n  // The status guard protects a request that was re-submitted (and reset to\n  // pending) while this chain was still running \u2014 completing it would let the\n  // new flow skip its own deferred provisioning.\n  if (!request || request.preparationCompletedAt || request.status !== 'completed') return\n  await args.service.markPreparationCompleted(request, new Date())\n}\n\nasync function enqueueVectorReindex(args: {\n  container: { resolve: <T = unknown>(name: string) => T }\n  tenantId: string\n  organizationId: string\n}) {\n  let searchIndexer: SearchIndexer | null = null\n  try {\n    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')\n  } catch {\n    searchIndexer = null\n  }\n  if (!searchIndexer) return\n\n  await Promise.race([\n    searchIndexer.reindexAllToVector({\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      purgeFirst: true,\n      useQueue: true,\n    }),\n    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),\n  ])\n}\n\nasync function rebuildTenantQueryIndexes(args: {\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n}) {\n  const coverageRefreshKeys = new Set<string>()\n  try {\n    const allEntities = getEntityIds()\n    const entityIds = flattenSystemEntityIds(allEntities)\n    for (const entityType of entityIds) {\n      try {\n        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to purge query index scope', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      try {\n        await reindexEntity(args.em, {\n          entityType,\n          tenantId: args.tenantId,\n          force: true,\n          emitVectorizeEvents: false,\n          vectorService: null,\n        })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to reindex entity', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)\n    }\n  } catch (error) {\n    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })\n  }\n\n  if (!coverageRefreshKeys.size) return\n\n  for (const entry of coverageRefreshKeys) {\n    const [entityType, tenantKey, orgKey] = entry.split('|')\n    const orgScope = orgKey === '__null__' ? null : orgKey\n    try {\n      await refreshCoverageSnapshot(\n        args.em,\n        {\n          entityType,\n          tenantId: tenantKey,\n          organizationId: orgScope,\n          withDeleted: false,\n        },\n      )\n    } catch (error) {\n      console.error('[onboarding.verify] failed to refresh coverage snapshot', {\n        entityType,\n        tenantId: tenantKey,\n        organizationId: orgScope,\n        error,\n      })\n    }\n  }\n}\n\nexport async function runDeferredProvisioning(args: {\n  requestId: string\n  tenantId: string\n  organizationId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n\n  // Single-flight guard: the preparing page polls the status endpoint every\n  // second and each poll (plus the verify handler) schedules this chain. The\n  // atomic claim collapses those triggers into one run per request \u2014 without\n  // it, dozens of concurrent seed + full-reindex chains exhaust the PG\n  // connection pool (2026-06-11 demo outage). A stale claim (crashed runner)\n  // becomes reclaimable after PREPARATION_CLAIM_STALE_MS.\n  const claimedAt = new Date()\n  const claimed = await service.claimPreparation(\n    args.requestId,\n    claimedAt,\n    new Date(claimedAt.getTime() - PREPARATION_CLAIM_STALE_MS),\n  )\n  if (!claimed) {\n    console.info('[onboarding.verify] deferred provisioning skipped (already claimed or completed)', {\n      requestId: args.requestId,\n      tenantId: args.tenantId,\n    })\n    return\n  }\n\n  const modules = getModules()\n\n  for (const mod of modules) {\n    if (!mod.setup?.seedExamples) continue\n    // Heartbeat: keep the lease fresh while legitimately working so a slow run\n    // (many modules \u00D7 15s seed timeout + rebuild) can never look stale and get\n    // double-claimed by a later poll.\n    await service.renewPreparation(args.requestId, new Date()).catch(() => {})\n    try {\n      await runModuleSetupHook({\n        moduleId: mod.id,\n        phase: 'seedExamples',\n        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,\n        run: () => mod.setup!.seedExamples!({\n          em,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          container,\n        }),\n      })\n    } catch (error) {\n      if (isUniqueViolation(error)) {\n        console.info('[onboarding.verify] deferred seedExamples skipped (already applied)', {\n          moduleId: mod.id,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n        })\n      } else {\n        console.error('[onboarding.verify] deferred seedExamples failed', {\n          moduleId: mod.id,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          error,\n        })\n      }\n    }\n  }\n\n  // The rebuild runs BEFORE the completion flag: preparationCompletedAt is the\n  // terminal gate for both the status-route scheduling and claimPreparation,\n  // so a runner that dies mid-rebuild must leave the flag unset \u2014 the stale\n  // claim then makes the whole chain reclaimable and the rebuild self-heals.\n  // rebuildTenantQueryIndexes never throws (it logs per-entity failures).\n  await service.renewPreparation(args.requestId, new Date()).catch(() => {})\n  await rebuildTenantQueryIndexes({\n    em,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  })\n\n  await markWorkspaceReady({\n    requestId: args.requestId,\n    service,\n  })\n\n  // Non-fatal (#2954 contract): an email failure must not abort the chain.\n  // The status endpoint retries the ready email on later polls while\n  // readyEmailSentAt is unset.\n  await sendWorkspaceReadyEmail({\n    requestId: args.requestId,\n    tenantId: args.tenantId,\n  }).catch((error) => {\n    console.error('[onboarding.verify] ready email failed', {\n      requestId: args.requestId,\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      error,\n    })\n  })\n\n  await enqueueVectorReindex({\n    container,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  }).catch((error) => {\n    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      reason: error instanceof Error ? error.message : String(error),\n    })\n  })\n}\n"],
+  "mappings": "AAEA,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAE3B,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAE3C,MAAM,oCAAoC;AAC1C,MAAM,2BAA2B;AAE1B,SAAS,uBAAuB,SAA4B;AACjE,MAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,OAAQ,QAAO;AAC5E,SAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,QAAQ,QAAQ;AAAA,EAClB;AACF;AAEA,SAAS,qBAAqB,OAAe,WAAmC;AAC9E,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM,OAAO,IAAI,MAAM,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,GAAG,SAAS;AAAA,EAC1F,CAAC;AACH;AAEA,eAAe,mBAAmB,MAK/B;AACD,QAAM,YAAY,KAAK,IAAI;AAC3B,UAAQ,KAAK,2CAA2C;AAAA,IACtD,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,qBAAqB,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS;AAAA,IAC9E,CAAC;AACD,YAAQ,KAAK,6CAA6C;AAAA,MACxD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,kBAAkB,KAAK,GAAG;AAO5B,cAAQ,KAAK,4DAA4D;AAAA,QACvE,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,MAChD,CAAC;AAAA,IACH,OAAO;AACL,cAAQ,MAAM,0CAA0C;AAAA,QACtD,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,QAC9C,WAAW,KAAK;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mBAAmB,MAG/B;AACD,QAAM,UAAU,MAAM,KAAK,QAAQ,SAAS,KAAK,SAAS;AAI1D,MAAI,CAAC,WAAW,QAAQ,0BAA0B,QAAQ,WAAW,YAAa;AAClF,QAAM,KAAK,QAAQ,yBAAyB,SAAS,oBAAI,KAAK,CAAC;AACjE;AAEA,eAAe,qBAAqB,MAIjC;AACD,MAAI,gBAAsC;AAC1C,MAAI;AACF,oBAAgB,KAAK,UAAU,QAAuB,eAAe;AAAA,EACvE,QAAQ;AACN,oBAAgB;AAAA,EAClB;AACA,MAAI,CAAC,cAAe;AAEpB,QAAM,QAAQ,KAAK;AAAA,IACjB,cAAc,mBAAmB;AAAA,MAC/B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,IACD,qBAAqB,0BAA0B,iCAAiC;AAAA,EAClF,CAAC;AACH;AAEA,eAAe,0BAA0B,MAItC;AACD,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI;AACF,UAAM,cAAc,aAAa;AACjC,UAAM,YAAY,uBAAuB,WAAW;AACpD,eAAW,cAAc,WAAW;AAClC,UAAI;AACF,cAAM,gBAAgB,KAAK,IAAI,EAAE,YAAY,UAAU,KAAK,SAAS,CAAC;AAAA,MACxE,SAAS,OAAO;AACd,gBAAQ,MAAM,yDAAyD;AAAA,UACrE;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,cAAc,KAAK,IAAI;AAAA,UAC3B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO;AAAA,UACP,qBAAqB;AAAA,UACrB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ,MAAM,gDAAgD;AAAA,UAC5D;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,WAAW;AACjE,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,IAAI,KAAK,cAAc,EAAE;AAAA,IACjF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uDAAuD,EAAE,UAAU,KAAK,UAAU,MAAM,CAAC;AAAA,EACzG;AAEA,MAAI,CAAC,oBAAoB,KAAM;AAE/B,aAAW,SAAS,qBAAqB;AACvC,UAAM,CAAC,YAAY,WAAW,MAAM,IAAI,MAAM,MAAM,GAAG;AACvD,UAAM,WAAW,WAAW,aAAa,OAAO;AAChD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,2DAA2D;AAAA,QACvE;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAsB,wBAAwB,MAI3C;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AAQxC,QAAM,YAAY,oBAAI,KAAK;AAC3B,QAAM,UAAU,MAAM,QAAQ;AAAA,IAC5B,KAAK;AAAA,IACL;AAAA,IACA,IAAI,KAAK,UAAU,QAAQ,IAAI,0BAA0B;AAAA,EAC3D;AACA,MAAI,CAAC,SAAS;AACZ,YAAQ,KAAK,oFAAoF;AAAA,MAC/F,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD;AAAA,EACF;AAEA,QAAM,UAAU,WAAW;AAE3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,OAAO,aAAc;AAI9B,UAAM,QAAQ,iBAAiB,KAAK,WAAW,oBAAI,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACzE,QAAI;AACF,YAAM,mBAAmB;AAAA,QACvB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,WAAW;AAAA,QACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,UAClC;AAAA,UACA,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,kBAAkB,KAAK,GAAG;AAC5B,gBAAQ,KAAK,uEAAuE;AAAA,UAClF,UAAU,IAAI;AAAA,UACd,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,QACvB,CAAC;AAAA,MACH,OAAO;AACL,gBAAQ,MAAM,oDAAoD;AAAA,UAChE,UAAU,IAAI;AAAA,UACd,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAOA,QAAM,QAAQ,iBAAiB,KAAK,WAAW,oBAAI,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACzE,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAED,QAAM,mBAAmB;AAAA,IACvB,WAAW,KAAK;AAAA,IAChB;AAAA,EACF,CAAC;AAKD,QAAM,wBAAwB;AAAA,IAC5B,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,EACjB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,0CAA0C;AAAA,MACtD,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,KAAK,wEAAwE;AAAA,MACnF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/onboarding/lib/preparation-claim.js

@@ -0,0 +1,10 @@
+const PREPARATION_CLAIM_STALE_MS = 10 * 60 * 1e3;
+function isPreparationClaimActive(startedAt, now = /* @__PURE__ */ new Date()) {
+  if (!startedAt) return false;
+  return startedAt.getTime() > now.getTime() - PREPARATION_CLAIM_STALE_MS;
+}
+export {
+  PREPARATION_CLAIM_STALE_MS,
+  isPreparationClaimActive
+};
+//# sourceMappingURL=preparation-claim.js.map

package/dist/modules/onboarding/lib/preparation-claim.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/lib/preparation-claim.ts"],
+  "sourcesContent": ["export const PREPARATION_CLAIM_STALE_MS = 10 * 60 * 1000\n\nexport function isPreparationClaimActive(startedAt: Date | null | undefined, now: Date = new Date()): boolean {\n  if (!startedAt) return false\n  return startedAt.getTime() > now.getTime() - PREPARATION_CLAIM_STALE_MS\n}\n"],
+  "mappings": "AAAO,MAAM,6BAA6B,KAAK,KAAK;AAE7C,SAAS,yBAAyB,WAAoC,MAAY,oBAAI,KAAK,GAAY;AAC5G,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAC/C;",
+  "names": []
+}

package/dist/modules/onboarding/lib/provisioning.js

@@ -0,0 +1,18 @@
+import { isUniqueViolation } from "@open-mercato/shared/lib/crud/errors";
+async function runBestEffortProvisioningStep(step, run, logger = console) {
+  try {
+    await run();
+    return { ok: true };
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      logger.info("[onboarding.verify] non-fatal provisioning step skipped (already applied)", { step });
+      return { ok: false, error };
+    }
+    logger.error("[onboarding.verify] non-fatal provisioning step failed", { step, error });
+    return { ok: false, error };
+  }
+}
+export {
+  runBestEffortProvisioningStep
+};
+//# sourceMappingURL=provisioning.js.map

package/dist/modules/onboarding/lib/provisioning.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/lib/provisioning.ts"],
+  "sourcesContent": ["import { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'\n\nexport type BestEffortProvisioningResult = { ok: true } | { ok: false; error: unknown }\n\ntype BestEffortLogger = Pick<Console, 'error' | 'info'>\n\n/**\n * Runs a non-essential provisioning step without letting its failure abort\n * onboarding. The tenant/org/primary user are created before these steps, so a\n * throw or timeout here (reference-data seeding, marketing-consent recording)\n * must NOT strand a freshly provisioned workspace \u2014 the verify handler still has\n * to reach markCompleted so the user can sign in. Failures are logged for\n * follow-up and reported back to the caller, never re-thrown.\n */\nexport async function runBestEffortProvisioningStep(\n  step: string,\n  run: () => Promise<void>,\n  logger: BestEffortLogger = console,\n): Promise<BestEffortProvisioningResult> {\n  try {\n    await run()\n    return { ok: true }\n  } catch (error) {\n    if (isUniqueViolation(error)) {\n      // Expected when a concurrent verify / re-verify re-applies a step against\n      // rows that already exist (seed hooks are not fully idempotent). The\n      // workspace is already provisioned, so the collision is harmless \u2014 log at\n      // info to keep genuine non-fatal failures visible.\n      logger.info('[onboarding.verify] non-fatal provisioning step skipped (already applied)', { step })\n      return { ok: false, error }\n    }\n    logger.error('[onboarding.verify] non-fatal provisioning step failed', { step, error })\n    return { ok: false, error }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAclC,eAAsB,8BACpB,MACA,KACA,SAA2B,SACY;AACvC,MAAI;AACF,UAAM,IAAI;AACV,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB,SAAS,OAAO;AACd,QAAI,kBAAkB,KAAK,GAAG;AAK5B,aAAO,KAAK,6EAA6E,EAAE,KAAK,CAAC;AACjG,aAAO,EAAE,IAAI,OAAO,MAAM;AAAA,IAC5B;AACA,WAAO,MAAM,0DAA0D,EAAE,MAAM,MAAM,CAAC;AACtF,WAAO,EAAE,IAAI,OAAO,MAAM;AAAA,EAC5B;AACF;",
+  "names": []
+}

package/dist/modules/onboarding/lib/service.js

@@ -36,6 +36,7 @@ class OnboardingService {
       existing.organizationId = null;
       existing.userId = null;
       existing.lastEmailSentAt = now;
+      existing.preparationStartedAt = null;
       existing.preparationCompletedAt = null;
       existing.readyEmailSentAt = null;
       await this.em.flush();
@@ -126,8 +127,38 @@ class OnboardingService {
     request.readyEmailSentAt = sentAt;
     await this.em.flush();
   }
+  async claimPreparation(requestId, claimedAt, staleBefore) {
+    const claimedRows = await this.em.nativeUpdate(
+      OnboardingRequest,
+      {
+        id: requestId,
+        status: "completed",
+        preparationCompletedAt: null,
+        $or: [
+          { preparationStartedAt: null },
+          { preparationStartedAt: { $lt: staleBefore } }
+        ]
+      },
+      { preparationStartedAt: claimedAt, updatedAt: /* @__PURE__ */ new Date() }
+    );
+    return claimedRows > 0;
+  }
+  async renewPreparation(requestId, renewedAt) {
+    const renewedRows = await this.em.nativeUpdate(
+      OnboardingRequest,
+      {
+        id: requestId,
+        status: "completed",
+        preparationCompletedAt: null,
+        preparationStartedAt: { $ne: null }
+      },
+      { preparationStartedAt: renewedAt, updatedAt: /* @__PURE__ */ new Date() }
+    );
+    return renewedRows > 0;
+  }
   async markPreparationCompleted(request, completedAt) {
     request.preparationCompletedAt = completedAt;
+    request.preparationStartedAt = null;
     await this.em.flush();
   }
 }

package/dist/modules/onboarding/lib/service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/onboarding/lib/service.ts"],
-  "sourcesContent": ["import { randomBytes, createHash } from 'node:crypto'\nimport { hash } from 'bcryptjs'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { OnboardingRequest } from '../data/entities'\nimport type { OnboardingStartInput } from '../data/validators'\n\ntype CreateRequestOptions = {\n  expiresInHours?: number\n}\n\nexport class OnboardingService {\n  constructor(private readonly em: EntityManager) {}\n\n  async createOrUpdateRequest(input: OnboardingStartInput, options: CreateRequestOptions = {}) {\n    const expiresInHours = options.expiresInHours ?? 24\n    const token = randomBytes(32).toString('hex')\n    const tokenHash = hashToken(token)\n    const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)\n    const now = new Date()\n    const passwordHash = await hash(input.password, 10)\n\n    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })\n    if (existing) {\n      const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt\n      if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {\n        const remainingMs = 10 * 60 * 1000 - (Date.now() - lastSentAt.getTime())\n        const waitMinutes = Math.max(1, Math.ceil(remainingMs / (60 * 1000)))\n        throw new Error(`PENDING_REQUEST:${waitMinutes}`)\n      }\n      existing.tokenHash = tokenHash\n      existing.status = 'pending'\n      existing.firstName = input.firstName\n      existing.lastName = input.lastName\n      existing.organizationName = input.organizationName\n      existing.locale = input.locale ?? existing.locale ?? 'en'\n      existing.termsAccepted = true\n      existing.marketingConsent = input.marketingConsent ?? false\n      existing.passwordHash = passwordHash\n      existing.expiresAt = expiresAt\n      existing.completedAt = null\n      existing.processingStartedAt = null\n      existing.tenantId = null\n      existing.organizationId = null\n      existing.userId = null\n      existing.lastEmailSentAt = now\n      existing.preparationCompletedAt = null\n      existing.readyEmailSentAt = null\n      await this.em.flush()\n      return { request: existing, token }\n    }\n\n    const request = this.em.create(OnboardingRequest, {\n      email: input.email,\n      tokenHash,\n      status: 'pending',\n      firstName: input.firstName,\n      lastName: input.lastName,\n      organizationName: input.organizationName,\n      locale: input.locale ?? 'en',\n      termsAccepted: true,\n      marketingConsent: input.marketingConsent ?? false,\n      passwordHash,\n      expiresAt,\n      processingStartedAt: null,\n      lastEmailSentAt: now,\n      createdAt: now,\n      updatedAt: now,\n    })\n    await this.em.persist(request).flush()\n    return { request, token }\n  }\n\n  async findPendingByToken(token: string) {\n    const tokenHash = hashToken(token)\n    const now = new Date()\n    return this.em.findOne(OnboardingRequest, {\n      tokenHash,\n      status: 'pending',\n      expiresAt: { $gt: now } as any,\n    })\n  }\n\n  async findByToken(token: string) {\n    const tokenHash = hashToken(token)\n    return this.em.findOne(OnboardingRequest, { tokenHash })\n  }\n\n  async findById(id: string) {\n    return this.em.findOne(OnboardingRequest, { id })\n  }\n\n  async findLatestByTenantId(tenantId: string) {\n    return this.em.findOne(\n      OnboardingRequest,\n      { tenantId, deletedAt: null },\n      { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },\n    )\n  }\n\n  async startProcessing(request: OnboardingRequest, startedAt: Date): Promise<boolean> {\n    const claimedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'pending' },\n      { status: 'processing', processingStartedAt: startedAt, updatedAt: new Date() },\n    )\n    if (claimedRows === 0) return false\n    request.status = 'processing'\n    request.processingStartedAt = startedAt\n    return true\n  }\n\n  async resetProcessing(request: OnboardingRequest): Promise<boolean> {\n    const revertedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'processing' },\n      { status: 'pending', processingStartedAt: null, updatedAt: new Date() },\n    )\n    if (revertedRows === 0) return false\n    request.status = 'pending'\n    request.processingStartedAt = null\n    return true\n  }\n\n  async updateProvisioningIds(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    await this.em.flush()\n  }\n\n  async markCompleted(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.status = 'completed'\n    request.completedAt = new Date()\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    request.processingStartedAt = null\n    request.passwordHash = null\n    await this.em.flush()\n  }\n\n  async markReadyEmailSent(request: OnboardingRequest, sentAt: Date) {\n    request.readyEmailSentAt = sentAt\n    await this.em.flush()\n  }\n\n  async markPreparationCompleted(request: OnboardingRequest, completedAt: Date) {\n    request.preparationCompletedAt = completedAt\n    await this.em.flush()\n  }\n}\n\nfunction hashToken(token: string) {\n  return createHash('sha256').update(token).digest('hex')\n}\n"],
-  "mappings": "AAAA,SAAS,aAAa,kBAAkB;AACxC,SAAS,YAAY;AAErB,SAAS,yBAAyB;AAO3B,MAAM,kBAAkB;AAAA,EAC7B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,sBAAsB,OAA6B,UAAgC,CAAC,GAAG;AAC3F,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,GAAI;AACvE,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,eAAe,MAAM,KAAK,MAAM,UAAU,EAAE;AAElD,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,mBAAmB,EAAE,OAAO,MAAM,MAAM,CAAC;AAChF,QAAI,UAAU;AACZ,YAAM,aAAa,SAAS,mBAAmB,SAAS,aAAa,SAAS;AAC9E,UAAI,CAAC,WAAW,YAAY,EAAE,SAAS,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,KAAM;AAC3H,cAAM,cAAc,KAAK,KAAK,OAAQ,KAAK,IAAI,IAAI,WAAW,QAAQ;AACtE,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,KAAK,eAAe,KAAK,IAAK,CAAC;AACpE,cAAM,IAAI,MAAM,mBAAmB,WAAW,EAAE;AAAA,MAClD;AACA,eAAS,YAAY;AACrB,eAAS,SAAS;AAClB,eAAS,YAAY,MAAM;AAC3B,eAAS,WAAW,MAAM;AAC1B,eAAS,mBAAmB,MAAM;AAClC,eAAS,SAAS,MAAM,UAAU,SAAS,UAAU;AACrD,eAAS,gBAAgB;AACzB,eAAS,mBAAmB,MAAM,oBAAoB;AACtD,eAAS,eAAe;AACxB,eAAS,YAAY;AACrB,eAAS,cAAc;AACvB,eAAS,sBAAsB;AAC/B,eAAS,WAAW;AACpB,eAAS,iBAAiB;AAC1B,eAAS,SAAS;AAClB,eAAS,kBAAkB;AAC3B,eAAS,yBAAyB;AAClC,eAAS,mBAAmB;AAC5B,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,SAAS,UAAU,MAAM;AAAA,IACpC;AAEA,UAAM,UAAU,KAAK,GAAG,OAAO,mBAAmB;AAAA,MAChD,OAAO,MAAM;AAAA,MACb;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,QAAQ,MAAM,UAAU;AAAA,MACxB,eAAe;AAAA,MACf,kBAAkB,MAAM,oBAAoB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,mBAAmB,OAAe;AACtC,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,KAAK,GAAG,QAAQ,mBAAmB;AAAA,MACxC;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,EAAE,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,OAAe;AAC/B,UAAM,YAAY,UAAU,KAAK;AACjC,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,UAAU,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,GAAG,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,qBAAqB,UAAkB;AAC3C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA,EAAE,UAAU,WAAW,KAAK;AAAA,MAC5B,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAA4B,WAAmC;AACnF,UAAM,cAAc,MAAM,KAAK,GAAG;AAAA,MAChC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,UAAU;AAAA,MACpC,EAAE,QAAQ,cAAc,qBAAqB,WAAW,WAAW,oBAAI,KAAK,EAAE;AAAA,IAChF;AACA,QAAI,gBAAgB,EAAG,QAAO;AAC9B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAA8C;AAClE,UAAM,eAAe,MAAM,KAAK,GAAG;AAAA,MACjC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,aAAa;AAAA,MACvC,EAAE,QAAQ,WAAW,qBAAqB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,IACxE;AACA,QAAI,iBAAiB,EAAG,QAAO;AAC/B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,SAA4B,MAAoE;AAC1H,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,cAAc,SAA4B,MAAoE;AAClH,YAAQ,SAAS;AACjB,YAAQ,cAAc,oBAAI,KAAK;AAC/B,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,YAAQ,sBAAsB;AAC9B,YAAQ,eAAe;AACvB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,mBAAmB,SAA4B,QAAc;AACjE,YAAQ,mBAAmB;AAC3B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,yBAAyB,SAA4B,aAAmB;AAC5E,YAAQ,yBAAyB;AACjC,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,UAAU,OAAe;AAChC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;",
+  "sourcesContent": ["import { randomBytes, createHash } from 'node:crypto'\nimport { hash } from 'bcryptjs'\nimport { EntityManager } from '@mikro-orm/postgresql'\nimport { OnboardingRequest } from '../data/entities'\nimport type { OnboardingStartInput } from '../data/validators'\n\ntype CreateRequestOptions = {\n  expiresInHours?: number\n}\n\nexport class OnboardingService {\n  constructor(private readonly em: EntityManager) {}\n\n  async createOrUpdateRequest(input: OnboardingStartInput, options: CreateRequestOptions = {}) {\n    const expiresInHours = options.expiresInHours ?? 24\n    const token = randomBytes(32).toString('hex')\n    const tokenHash = hashToken(token)\n    const expiresAt = new Date(Date.now() + expiresInHours * 60 * 60 * 1000)\n    const now = new Date()\n    const passwordHash = await hash(input.password, 10)\n\n    const existing = await this.em.findOne(OnboardingRequest, { email: input.email })\n    if (existing) {\n      const lastSentAt = existing.lastEmailSentAt ?? existing.updatedAt ?? existing.createdAt\n      if (['pending', 'processing'].includes(existing.status) && lastSentAt && lastSentAt.getTime() > Date.now() - 10 * 60 * 1000) {\n        const remainingMs = 10 * 60 * 1000 - (Date.now() - lastSentAt.getTime())\n        const waitMinutes = Math.max(1, Math.ceil(remainingMs / (60 * 1000)))\n        throw new Error(`PENDING_REQUEST:${waitMinutes}`)\n      }\n      existing.tokenHash = tokenHash\n      existing.status = 'pending'\n      existing.firstName = input.firstName\n      existing.lastName = input.lastName\n      existing.organizationName = input.organizationName\n      existing.locale = input.locale ?? existing.locale ?? 'en'\n      existing.termsAccepted = true\n      existing.marketingConsent = input.marketingConsent ?? false\n      existing.passwordHash = passwordHash\n      existing.expiresAt = expiresAt\n      existing.completedAt = null\n      existing.processingStartedAt = null\n      existing.tenantId = null\n      existing.organizationId = null\n      existing.userId = null\n      existing.lastEmailSentAt = now\n      existing.preparationStartedAt = null\n      existing.preparationCompletedAt = null\n      existing.readyEmailSentAt = null\n      await this.em.flush()\n      return { request: existing, token }\n    }\n\n    const request = this.em.create(OnboardingRequest, {\n      email: input.email,\n      tokenHash,\n      status: 'pending',\n      firstName: input.firstName,\n      lastName: input.lastName,\n      organizationName: input.organizationName,\n      locale: input.locale ?? 'en',\n      termsAccepted: true,\n      marketingConsent: input.marketingConsent ?? false,\n      passwordHash,\n      expiresAt,\n      processingStartedAt: null,\n      lastEmailSentAt: now,\n      createdAt: now,\n      updatedAt: now,\n    })\n    await this.em.persist(request).flush()\n    return { request, token }\n  }\n\n  async findPendingByToken(token: string) {\n    const tokenHash = hashToken(token)\n    const now = new Date()\n    return this.em.findOne(OnboardingRequest, {\n      tokenHash,\n      status: 'pending',\n      expiresAt: { $gt: now } as any,\n    })\n  }\n\n  async findByToken(token: string) {\n    const tokenHash = hashToken(token)\n    return this.em.findOne(OnboardingRequest, { tokenHash })\n  }\n\n  async findById(id: string) {\n    return this.em.findOne(OnboardingRequest, { id })\n  }\n\n  async findLatestByTenantId(tenantId: string) {\n    return this.em.findOne(\n      OnboardingRequest,\n      { tenantId, deletedAt: null },\n      { orderBy: { updatedAt: 'DESC', createdAt: 'DESC' } },\n    )\n  }\n\n  async startProcessing(request: OnboardingRequest, startedAt: Date): Promise<boolean> {\n    const claimedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'pending' },\n      { status: 'processing', processingStartedAt: startedAt, updatedAt: new Date() },\n    )\n    if (claimedRows === 0) return false\n    request.status = 'processing'\n    request.processingStartedAt = startedAt\n    return true\n  }\n\n  async resetProcessing(request: OnboardingRequest): Promise<boolean> {\n    const revertedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      { id: request.id, status: 'processing' },\n      { status: 'pending', processingStartedAt: null, updatedAt: new Date() },\n    )\n    if (revertedRows === 0) return false\n    request.status = 'pending'\n    request.processingStartedAt = null\n    return true\n  }\n\n  async updateProvisioningIds(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    await this.em.flush()\n  }\n\n  async markCompleted(request: OnboardingRequest, data: { tenantId: string; organizationId: string; userId: string }) {\n    request.status = 'completed'\n    request.completedAt = new Date()\n    request.tenantId = data.tenantId\n    request.organizationId = data.organizationId\n    request.userId = data.userId\n    request.processingStartedAt = null\n    request.passwordHash = null\n    await this.em.flush()\n  }\n\n  async markReadyEmailSent(request: OnboardingRequest, sentAt: Date) {\n    request.readyEmailSentAt = sentAt\n    await this.em.flush()\n  }\n\n  async claimPreparation(requestId: string, claimedAt: Date, staleBefore: Date): Promise<boolean> {\n    const claimedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      {\n        id: requestId,\n        status: 'completed',\n        preparationCompletedAt: null,\n        $or: [\n          { preparationStartedAt: null },\n          { preparationStartedAt: { $lt: staleBefore } },\n        ],\n      },\n      { preparationStartedAt: claimedAt, updatedAt: new Date() },\n    )\n    return claimedRows > 0\n  }\n\n  async renewPreparation(requestId: string, renewedAt: Date): Promise<boolean> {\n    const renewedRows = await this.em.nativeUpdate(\n      OnboardingRequest,\n      {\n        id: requestId,\n        status: 'completed',\n        preparationCompletedAt: null,\n        preparationStartedAt: { $ne: null },\n      },\n      { preparationStartedAt: renewedAt, updatedAt: new Date() },\n    )\n    return renewedRows > 0\n  }\n\n  async markPreparationCompleted(request: OnboardingRequest, completedAt: Date) {\n    request.preparationCompletedAt = completedAt\n    request.preparationStartedAt = null\n    await this.em.flush()\n  }\n}\n\nfunction hashToken(token: string) {\n  return createHash('sha256').update(token).digest('hex')\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa,kBAAkB;AACxC,SAAS,YAAY;AAErB,SAAS,yBAAyB;AAO3B,MAAM,kBAAkB;AAAA,EAC7B,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,sBAAsB,OAA6B,UAAgC,CAAC,GAAG;AAC3F,UAAM,iBAAiB,QAAQ,kBAAkB;AACjD,UAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,GAAI;AACvE,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,eAAe,MAAM,KAAK,MAAM,UAAU,EAAE;AAElD,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,mBAAmB,EAAE,OAAO,MAAM,MAAM,CAAC;AAChF,QAAI,UAAU;AACZ,YAAM,aAAa,SAAS,mBAAmB,SAAS,aAAa,SAAS;AAC9E,UAAI,CAAC,WAAW,YAAY,EAAE,SAAS,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,KAAM;AAC3H,cAAM,cAAc,KAAK,KAAK,OAAQ,KAAK,IAAI,IAAI,WAAW,QAAQ;AACtE,cAAM,cAAc,KAAK,IAAI,GAAG,KAAK,KAAK,eAAe,KAAK,IAAK,CAAC;AACpE,cAAM,IAAI,MAAM,mBAAmB,WAAW,EAAE;AAAA,MAClD;AACA,eAAS,YAAY;AACrB,eAAS,SAAS;AAClB,eAAS,YAAY,MAAM;AAC3B,eAAS,WAAW,MAAM;AAC1B,eAAS,mBAAmB,MAAM;AAClC,eAAS,SAAS,MAAM,UAAU,SAAS,UAAU;AACrD,eAAS,gBAAgB;AACzB,eAAS,mBAAmB,MAAM,oBAAoB;AACtD,eAAS,eAAe;AACxB,eAAS,YAAY;AACrB,eAAS,cAAc;AACvB,eAAS,sBAAsB;AAC/B,eAAS,WAAW;AACpB,eAAS,iBAAiB;AAC1B,eAAS,SAAS;AAClB,eAAS,kBAAkB;AAC3B,eAAS,uBAAuB;AAChC,eAAS,yBAAyB;AAClC,eAAS,mBAAmB;AAC5B,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,SAAS,UAAU,MAAM;AAAA,IACpC;AAEA,UAAM,UAAU,KAAK,GAAG,OAAO,mBAAmB;AAAA,MAChD,OAAO,MAAM;AAAA,MACb;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,MAAM;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,QAAQ,MAAM,UAAU;AAAA,MACxB,eAAe;AAAA,MACf,kBAAkB,MAAM,oBAAoB;AAAA,MAC5C;AAAA,MACA;AAAA,MACA,qBAAqB;AAAA,MACrB,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AACrC,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAAA,EAEA,MAAM,mBAAmB,OAAe;AACtC,UAAM,YAAY,UAAU,KAAK;AACjC,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,KAAK,GAAG,QAAQ,mBAAmB;AAAA,MACxC;AAAA,MACA,QAAQ;AAAA,MACR,WAAW,EAAE,KAAK,IAAI;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,YAAY,OAAe;AAC/B,UAAM,YAAY,UAAU,KAAK;AACjC,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,UAAU,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,SAAS,IAAY;AACzB,WAAO,KAAK,GAAG,QAAQ,mBAAmB,EAAE,GAAG,CAAC;AAAA,EAClD;AAAA,EAEA,MAAM,qBAAqB,UAAkB;AAC3C,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA,EAAE,UAAU,WAAW,KAAK;AAAA,MAC5B,EAAE,SAAS,EAAE,WAAW,QAAQ,WAAW,OAAO,EAAE;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAA4B,WAAmC;AACnF,UAAM,cAAc,MAAM,KAAK,GAAG;AAAA,MAChC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,UAAU;AAAA,MACpC,EAAE,QAAQ,cAAc,qBAAqB,WAAW,WAAW,oBAAI,KAAK,EAAE;AAAA,IAChF;AACA,QAAI,gBAAgB,EAAG,QAAO;AAC9B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAA8C;AAClE,UAAM,eAAe,MAAM,KAAK,GAAG;AAAA,MACjC;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,QAAQ,aAAa;AAAA,MACvC,EAAE,QAAQ,WAAW,qBAAqB,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,IACxE;AACA,QAAI,iBAAiB,EAAG,QAAO;AAC/B,YAAQ,SAAS;AACjB,YAAQ,sBAAsB;AAC9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,SAA4B,MAAoE;AAC1H,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,cAAc,SAA4B,MAAoE;AAClH,YAAQ,SAAS;AACjB,YAAQ,cAAc,oBAAI,KAAK;AAC/B,YAAQ,WAAW,KAAK;AACxB,YAAQ,iBAAiB,KAAK;AAC9B,YAAQ,SAAS,KAAK;AACtB,YAAQ,sBAAsB;AAC9B,YAAQ,eAAe;AACvB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,mBAAmB,SAA4B,QAAc;AACjE,YAAQ,mBAAmB;AAC3B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAiB,WAAmB,WAAiB,aAAqC;AAC9F,UAAM,cAAc,MAAM,KAAK,GAAG;AAAA,MAChC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,wBAAwB;AAAA,QACxB,KAAK;AAAA,UACH,EAAE,sBAAsB,KAAK;AAAA,UAC7B,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE;AAAA,QAC/C;AAAA,MACF;AAAA,MACA,EAAE,sBAAsB,WAAW,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC3D;AACA,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,iBAAiB,WAAmB,WAAmC;AAC3E,UAAM,cAAc,MAAM,KAAK,GAAG;AAAA,MAChC;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,wBAAwB;AAAA,QACxB,sBAAsB,EAAE,KAAK,KAAK;AAAA,MACpC;AAAA,MACA,EAAE,sBAAsB,WAAW,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC3D;AACA,WAAO,cAAc;AAAA,EACvB;AAAA,EAEA,MAAM,yBAAyB,SAA4B,aAAmB;AAC5E,YAAQ,yBAAyB;AACjC,YAAQ,uBAAuB;AAC/B,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,UAAU,OAAe;AAChC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;",
   "names": []
 }

package/dist/modules/onboarding/lib/verify-base-url.js

@@ -0,0 +1,86 @@
+import {
+  AppOriginConfigurationError,
+  AppOriginRejectedError,
+  getSecurityEmailBaseUrl,
+  resolveRequestOrigin
+} from "@open-mercato/shared/lib/url";
+function normalizeOrigin(raw) {
+  try {
+    return new URL(raw).origin;
+  } catch {
+    return null;
+  }
+}
+function originPort(url) {
+  if (url.port) return url.port;
+  if (url.protocol === "https:") return "443";
+  if (url.protocol === "http:") return "80";
+  return "";
+}
+function isLoopbackHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function originsMatchForRedirect(configuredOrigin, requestOrigin) {
+  if (configuredOrigin === requestOrigin) return true;
+  try {
+    const configured = new URL(configuredOrigin);
+    const request = new URL(requestOrigin);
+    return configured.protocol === request.protocol && isLoopbackHostname(configured.hostname) && isLoopbackHostname(request.hostname) && originPort(configured) === originPort(request);
+  } catch {
+    return false;
+  }
+}
+function resolveVerifyRedirectBaseUrl(req, env = process.env) {
+  try {
+    const baseUrl = getSecurityEmailBaseUrl(req, env);
+    const configuredOrigin = normalizeOrigin(baseUrl);
+    const requestOrigin = normalizeOrigin(resolveRequestOrigin(req)) ?? normalizeOrigin(req.url);
+    if (configuredOrigin && requestOrigin && !originsMatchForRedirect(configuredOrigin, requestOrigin)) {
+      console.error("[onboarding.verify] APP_URL does not match verification request origin", {
+        requestUrl: req.url,
+        configuredOrigin,
+        requestOrigin
+      });
+      return {
+        ok: false,
+        status: "redirect_misconfigured",
+        message: "Onboarding verification redirect is misconfigured.",
+        redirectOrigin: requestOrigin,
+        httpStatus: 400
+      };
+    }
+    return { ok: true, baseUrl };
+  } catch (error) {
+    if (error instanceof AppOriginRejectedError) {
+      console.error("[onboarding.verify] rejected request origin for redirect base", {
+        requestUrl: req.url,
+        reason: error.message
+      });
+      return {
+        ok: false,
+        status: "origin_not_allowed",
+        message: "Onboarding verification request origin is not allowed.",
+        redirectOrigin: null,
+        httpStatus: 400
+      };
+    }
+    if (error instanceof AppOriginConfigurationError) {
+      console.error("[onboarding.verify] APP_URL is required for onboarding verification redirects", {
+        requestUrl: req.url,
+        reason: error.message
+      });
+      return {
+        ok: false,
+        status: "url_not_configured",
+        message: "Onboarding verification redirect is not configured.",
+        redirectOrigin: null,
+        httpStatus: 500
+      };
+    }
+    throw error;
+  }
+}
+export {
+  resolveVerifyRedirectBaseUrl
+};
+//# sourceMappingURL=verify-base-url.js.map

package/dist/modules/onboarding/lib/verify-base-url.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/lib/verify-base-url.ts"],
+  "sourcesContent": ["import {\n  AppOriginConfigurationError,\n  AppOriginRejectedError,\n  getSecurityEmailBaseUrl,\n  resolveRequestOrigin,\n} from '@open-mercato/shared/lib/url'\n\ntype EnvLike = Record<string, string | undefined>\n\nexport type VerifyRedirectBaseUrlResult =\n  | { ok: true; baseUrl: string }\n  | {\n    ok: false\n    status: 'origin_not_allowed' | 'redirect_misconfigured' | 'url_not_configured'\n    message: string\n    redirectOrigin: string | null\n    httpStatus: number\n  }\n\nfunction normalizeOrigin(raw: string): string | null {\n  try {\n    return new URL(raw).origin\n  } catch {\n    return null\n  }\n}\n\nfunction originPort(url: URL): string {\n  if (url.port) return url.port\n  if (url.protocol === 'https:') return '443'\n  if (url.protocol === 'http:') return '80'\n  return ''\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'\n}\n\nfunction originsMatchForRedirect(configuredOrigin: string, requestOrigin: string): boolean {\n  if (configuredOrigin === requestOrigin) return true\n  try {\n    const configured = new URL(configuredOrigin)\n    const request = new URL(requestOrigin)\n    return (\n      configured.protocol === request.protocol &&\n      isLoopbackHostname(configured.hostname) &&\n      isLoopbackHostname(request.hostname) &&\n      originPort(configured) === originPort(request)\n    )\n  } catch {\n    return false\n  }\n}\n\nexport function resolveVerifyRedirectBaseUrl(\n  req: Request,\n  env: EnvLike = process.env,\n): VerifyRedirectBaseUrlResult {\n  try {\n    const baseUrl = getSecurityEmailBaseUrl(req, env)\n    const configuredOrigin = normalizeOrigin(baseUrl)\n    const requestOrigin = normalizeOrigin(resolveRequestOrigin(req)) ?? normalizeOrigin(req.url)\n    if (configuredOrigin && requestOrigin && !originsMatchForRedirect(configuredOrigin, requestOrigin)) {\n      console.error('[onboarding.verify] APP_URL does not match verification request origin', {\n        requestUrl: req.url,\n        configuredOrigin,\n        requestOrigin,\n      })\n      return {\n        ok: false,\n        status: 'redirect_misconfigured',\n        message: 'Onboarding verification redirect is misconfigured.',\n        redirectOrigin: requestOrigin,\n        httpStatus: 400,\n      }\n    }\n    return { ok: true, baseUrl }\n  } catch (error) {\n    if (error instanceof AppOriginRejectedError) {\n      console.error('[onboarding.verify] rejected request origin for redirect base', {\n        requestUrl: req.url,\n        reason: error.message,\n      })\n      return {\n        ok: false,\n        status: 'origin_not_allowed',\n        message: 'Onboarding verification request origin is not allowed.',\n        redirectOrigin: null,\n        httpStatus: 400,\n      }\n    }\n    if (error instanceof AppOriginConfigurationError) {\n      console.error('[onboarding.verify] APP_URL is required for onboarding verification redirects', {\n        requestUrl: req.url,\n        reason: error.message,\n      })\n      return {\n        ok: false,\n        status: 'url_not_configured',\n        message: 'Onboarding verification redirect is not configured.',\n        redirectOrigin: null,\n        httpStatus: 500,\n      }\n    }\n    throw error\n  }\n}\n"],
+  "mappings": "AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP,SAAS,gBAAgB,KAA4B;AACnD,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAkB;AACpC,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AAEA,SAAS,mBAAmB,UAA2B;AACrD,SAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,wBAAwB,kBAA0B,eAAgC;AACzF,MAAI,qBAAqB,cAAe,QAAO;AAC/C,MAAI;AACF,UAAM,aAAa,IAAI,IAAI,gBAAgB;AAC3C,UAAM,UAAU,IAAI,IAAI,aAAa;AACrC,WACE,WAAW,aAAa,QAAQ,YAChC,mBAAmB,WAAW,QAAQ,KACtC,mBAAmB,QAAQ,QAAQ,KACnC,WAAW,UAAU,MAAM,WAAW,OAAO;AAAA,EAEjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,6BACd,KACA,MAAe,QAAQ,KACM;AAC7B,MAAI;AACF,UAAM,UAAU,wBAAwB,KAAK,GAAG;AAChD,UAAM,mBAAmB,gBAAgB,OAAO;AAChD,UAAM,gBAAgB,gBAAgB,qBAAqB,GAAG,CAAC,KAAK,gBAAgB,IAAI,GAAG;AAC3F,QAAI,oBAAoB,iBAAiB,CAAC,wBAAwB,kBAAkB,aAAa,GAAG;AAClG,cAAQ,MAAM,0EAA0E;AAAA,QACtF,YAAY,IAAI;AAAA,QAChB;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,YAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ;AAAA,EAC7B,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAwB;AAC3C,cAAQ,MAAM,iEAAiE;AAAA,QAC7E,YAAY,IAAI;AAAA,QAChB,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,YAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,iBAAiB,6BAA6B;AAChD,cAAQ,MAAM,iFAAiF;AAAA,QAC7F,YAAY,IAAI;AAAA,QAChB,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,gBAAgB;AAAA,QAChB,YAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;",
+  "names": []
+}

package/dist/modules/onboarding/migrations/Migration20260611120000.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260611120000 extends Migration {
+  async up() {
+    this.addSql(`alter table "onboarding_requests" add column "preparation_started_at" timestamptz null;`);
+  }
+  async down() {
+    this.addSql(`alter table "onboarding_requests" drop column "preparation_started_at";`);
+  }
+}
+export {
+  Migration20260611120000
+};
+//# sourceMappingURL=Migration20260611120000.js.map

package/dist/modules/onboarding/migrations/Migration20260611120000.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/migrations/Migration20260611120000.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260611120000 extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" add column \"preparation_started_at\" timestamptz null;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" drop column \"preparation_started_at\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,gCAAgC,UAAU;AAAA,EAErD,MAAe,KAAoB;AACjC,SAAK,OAAO,yFAAyF;AAAA,EACvG;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,yEAAyE;AAAA,EACvF;AAEF;",
+  "names": []
+}

package/generated/entities/onboarding_request/index.ts

@@ -16,6 +16,7 @@ export const tenant_id = "tenant_id";
 export const organization_id = "organization_id";
 export const user_id = "user_id";
 export const last_email_sent_at = "last_email_sent_at";
+export const preparation_started_at = "preparation_started_at";
 export const preparation_completed_at = "preparation_completed_at";
 export const ready_email_sent_at = "ready_email_sent_at";
 export const created_at = "created_at";

package/generated/entity-fields-registry.ts

@@ -20,6 +20,7 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "organization_id": "organization_id",
       "user_id": "user_id",
       "last_email_sent_at": "last_email_sent_at",
+      "preparation_started_at": "preparation_started_at",
       "preparation_completed_at": "preparation_completed_at",
       "ready_email_sent_at": "ready_email_sent_at",
       "created_at": "created_at",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.5-develop.5382.1.f542de69af",
+  "version": "0.6.5",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -69,10 +69,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5382.1.f542de69af"
+    "@open-mercato/shared": "0.6.5"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.5382.1.f542de69af",
+    "@open-mercato/shared": "0.6.5",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11"
@@ -84,6 +84,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/onboarding"
-  },
-  "stableVersion": "0.6.4"
+  }
 }

package/src/__tests__/deferred-provisioning.test.ts

@@ -0,0 +1,210 @@
+const seedExamples = jest.fn(async () => {
+  await new Promise((resolve) => setImmediate(resolve))
+})
+const purgeIndexScope = jest.fn(async () => {})
+const reindexEntity = jest.fn(async () => {})
+const refreshCoverageSnapshot = jest.fn(async () => {})
+const sendWorkspaceReadyEmail = jest.fn(async () => true)
+
+type ClaimState = {
+  status: string
+  preparationStartedAt: Date | null
+  preparationCompletedAt: Date | null
+}
+
+const claimState: ClaimState = {
+  status: 'completed',
+  preparationStartedAt: null,
+  preparationCompletedAt: null,
+}
+
+const claimPreparation = jest.fn(async (_requestId: string, claimedAt: Date, staleBefore: Date) => {
+  if (claimState.status !== 'completed') return false
+  if (claimState.preparationCompletedAt) return false
+  if (claimState.preparationStartedAt && claimState.preparationStartedAt.getTime() >= staleBefore.getTime()) {
+    return false
+  }
+  claimState.preparationStartedAt = claimedAt
+  return true
+})
+
+const renewPreparation = jest.fn(async (_requestId: string, renewedAt: Date) => {
+  if (claimState.status !== 'completed') return false
+  if (claimState.preparationCompletedAt) return false
+  if (!claimState.preparationStartedAt) return false
+  claimState.preparationStartedAt = renewedAt
+  return true
+})
+
+const findById = jest.fn(async (id: string) => ({
+  id,
+  status: claimState.status,
+  preparationCompletedAt: claimState.preparationCompletedAt,
+}))
+
+const markPreparationCompleted = jest.fn(async (_request: unknown, completedAt: Date) => {
+  claimState.preparationCompletedAt = completedAt
+  claimState.preparationStartedAt = null
+})
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(async () => ({
+    resolve: (name: string) => {
+      if (name === 'em') return {}
+      throw new Error(`unexpected resolve(${name})`)
+    },
+  })),
+}))
+
+jest.mock('@open-mercato/shared/lib/modules/registry', () => ({
+  getModules: () => [{ id: 'catalog', setup: { seedExamples } }],
+}))
+
+jest.mock('@open-mercato/shared/lib/entities/system-entities', () => ({
+  flattenSystemEntityIds: () => ['catalog:product'],
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/entityIds', () => ({
+  getEntityIds: () => ({}),
+}))
+
+jest.mock('@open-mercato/core/modules/query_index/lib/reindexer', () => ({
+  reindexEntity: (...args: unknown[]) => reindexEntity(...(args as [])),
+}))
+
+jest.mock('@open-mercato/core/modules/query_index/lib/purge', () => ({
+  purgeIndexScope: (...args: unknown[]) => purgeIndexScope(...(args as [])),
+}))
+
+jest.mock('@open-mercato/core/modules/query_index/lib/coverage', () => ({
+  refreshCoverageSnapshot: (...args: unknown[]) => refreshCoverageSnapshot(...(args as [])),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/ready-email', () => ({
+  sendWorkspaceReadyEmail: (...args: unknown[]) => sendWorkspaceReadyEmail(...(args as [])),
+}))
+
+jest.mock('@open-mercato/onboarding/modules/onboarding/lib/service', () => ({
+  OnboardingService: jest.fn().mockImplementation(() => ({
+    claimPreparation,
+    renewPreparation,
+    findById,
+    markPreparationCompleted,
+  })),
+}))
+
+import { runDeferredProvisioning } from '@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning'
+
+const RUN_ARGS = {
+  requestId: 'req-1',
+  tenantId: '11111111-1111-4111-8111-111111111111',
+  organizationId: '33333333-3333-4333-8333-333333333333',
+}
+
+describe('runDeferredProvisioning single-flight claim', () => {
+  beforeEach(() => {
+    jest.useFakeTimers({ doNotFake: ['setImmediate'] })
+    jest.clearAllMocks()
+    claimState.status = 'completed'
+    claimState.preparationStartedAt = null
+    claimState.preparationCompletedAt = null
+    sendWorkspaceReadyEmail.mockResolvedValue(true)
+  })
+
+  afterEach(() => {
+    jest.useRealTimers()
+  })
+
+  it('runs the provisioning chain only once when triggered concurrently by status polls (demo pool-exhaustion repro)', async () => {
+    // Repro for the 2026-06-11 demo outage: the preparing page polls
+    // /onboarding/status every ~1s and each poll scheduled a FULL
+    // runDeferredProvisioning chain (seedExamples for every module + a forced
+    // purge/reindex of every system entity) until preparationCompletedAt was
+    // flushed. Dozens of concurrent chains exhausted the 20-connection PG pool,
+    // the completion flag write itself timed out, and the loop never
+    // terminated. Concurrent triggers must collapse into exactly one run.
+    await Promise.all([
+      runDeferredProvisioning(RUN_ARGS),
+      runDeferredProvisioning(RUN_ARGS),
+      runDeferredProvisioning(RUN_ARGS),
+    ])
+
+    expect(seedExamples).toHaveBeenCalledTimes(1)
+    expect(markPreparationCompleted).toHaveBeenCalledTimes(1)
+    expect(purgeIndexScope).toHaveBeenCalledTimes(1)
+    expect(reindexEntity).toHaveBeenCalledTimes(1)
+    expect(sendWorkspaceReadyEmail).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not run any heavy work when preparation already completed', async () => {
+    claimState.preparationCompletedAt = new Date()
+
+    await runDeferredProvisioning(RUN_ARGS)
+
+    expect(seedExamples).not.toHaveBeenCalled()
+    expect(purgeIndexScope).not.toHaveBeenCalled()
+    expect(reindexEntity).not.toHaveBeenCalled()
+    expect(sendWorkspaceReadyEmail).not.toHaveBeenCalled()
+  })
+
+  it('re-claims and recovers when a previous claim went stale', async () => {
+    claimState.preparationStartedAt = new Date(Date.now() - 20 * 60 * 1000)
+
+    await runDeferredProvisioning(RUN_ARGS)
+
+    expect(seedExamples).toHaveBeenCalledTimes(1)
+    expect(markPreparationCompleted).toHaveBeenCalledTimes(1)
+  })
+
+  it('renews the lease while working so a slow run never looks stale', async () => {
+    await runDeferredProvisioning(RUN_ARGS)
+
+    expect(renewPreparation).toHaveBeenCalled()
+    expect(renewPreparation.mock.invocationCallOrder[0]).toBeLessThan(
+      markPreparationCompleted.mock.invocationCallOrder[0],
+    )
+  })
+
+  it('does not complete a request that was re-submitted (reset to pending) mid-chain', async () => {
+    // A user can re-onboard the same email while an old chain is still running:
+    // createOrUpdateRequest resets the request to pending. The stale chain must
+    // not mark THAT request prepared — the new flow owns deferred provisioning.
+    findById.mockImplementationOnce(async (id: string) => ({
+      id,
+      status: 'pending',
+      preparationCompletedAt: null,
+    }))
+
+    await runDeferredProvisioning(RUN_ARGS)
+
+    expect(markPreparationCompleted).not.toHaveBeenCalled()
+  })
+
+  it('marks preparation completed only after the query-index rebuild (death mid-rebuild stays recoverable)', async () => {
+    // preparationCompletedAt is the terminal gate for both the status-route
+    // scheduling and claimPreparation. If it were written before the rebuild,
+    // a runner dying mid-rebuild would leave the tenant permanently without
+    // index rows — nothing would ever reclaim the run.
+    await runDeferredProvisioning(RUN_ARGS)
+
+    expect(reindexEntity).toHaveBeenCalled()
+    expect(markPreparationCompleted).toHaveBeenCalled()
+    expect(reindexEntity.mock.invocationCallOrder[0]).toBeLessThan(
+      markPreparationCompleted.mock.invocationCallOrder[0],
+    )
+  })
+
+  it('still rebuilds query indexes when the ready email fails', async () => {
+    // #2954's contract: post-provisioning steps are non-fatal. A transient
+    // SMTP failure must not abort the chain before the query-index rebuild,
+    // otherwise the tenant is left permanently without index rows (the
+    // completion flag is already set, so nothing ever retries the rebuild).
+    sendWorkspaceReadyEmail.mockRejectedValue(new Error('smtp down'))
+
+    await expect(runDeferredProvisioning(RUN_ARGS)).resolves.toBeUndefined()
+
+    expect(markPreparationCompleted).toHaveBeenCalledTimes(1)
+    expect(purgeIndexScope).toHaveBeenCalledTimes(1)
+    expect(reindexEntity).toHaveBeenCalledTimes(1)
+  })
+})

package/src/__tests__/onboarding-submit-rate-limit.test.ts

@@ -0,0 +1,22 @@
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(),
+}))
+
+import { metadata, openApi } from '../modules/onboarding/api/post/onboarding'
+
+describe('onboarding submission rate limiting', () => {
+  it('declares an IP rate limit so the API dispatcher throttles unauthenticated submissions', () => {
+    expect(metadata.POST.requireAuth).toBe(false)
+    expect(metadata.POST.rateLimit).toEqual({
+      points: 10,
+      duration: 60,
+      blockDuration: 60,
+      keyPrefix: 'onboarding',
+    })
+  })
+
+  it('documents the 429 response in the OpenAPI doc', () => {
+    const errors = openApi.methods?.POST?.errors ?? []
+    expect(errors.some((entry) => entry.status === 429)).toBe(true)
+  })
+})