@open-mercato/onboarding 0.6.6-develop.5412.1.e2a52b14f0 → 0.6.6-develop.5431.1.384a97c7a2

package/dist/modules/onboarding/api/get/onboarding/verify.js

@@ -1,11 +1,6 @@
-import { after } from "next/server";
+import { after, NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import {
-  AppOriginConfigurationError,
-  AppOriginRejectedError,
-  getSecurityEmailBaseUrl
-} from "@open-mercato/shared/lib/url";
 import { onboardingVerifySchema } from "@open-mercato/onboarding/modules/onboarding/data/validators";
 import { OnboardingService } from "@open-mercato/onboarding/modules/onboarding/lib/service";
 import { sendWorkspaceReadyEmail } from "@open-mercato/onboarding/modules/onboarding/lib/ready-email";
@@ -14,39 +9,25 @@ import {
   redirectToPreparing,
   redirectWithStatus
 } from "@open-mercato/onboarding/modules/onboarding/lib/verify-redirects";
+import { resolveVerifyRedirectBaseUrl } from "@open-mercato/onboarding/modules/onboarding/lib/verify-base-url";
+import {
+  resolveProvisioningIds,
+  runDeferredProvisioning
+} from "@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning";
 import { setupInitialTenant } from "@open-mercato/core/modules/auth/lib/setup-app";
 import { UserConsent } from "@open-mercato/core/modules/auth/data/entities";
 import { computeConsentIntegrityHash } from "@open-mercato/core/modules/auth/lib/consentIntegrity";
 import { resolveConsentClientIp } from "@open-mercato/onboarding/modules/onboarding/lib/consentClientIp";
-import { reindexEntity } from "@open-mercato/core/modules/query_index/lib/reindexer";
-import { purgeIndexScope } from "@open-mercato/core/modules/query_index/lib/purge";
-import { refreshCoverageSnapshot } from "@open-mercato/core/modules/query_index/lib/coverage";
-import { flattenSystemEntityIds } from "@open-mercato/shared/lib/entities/system-entities";
-import { getEntityIds } from "@open-mercato/shared/lib/encryption/entityIds";
+import { runBestEffortProvisioningStep } from "@open-mercato/onboarding/modules/onboarding/lib/provisioning";
 import { getModules } from "@open-mercato/shared/lib/modules/registry";
+import { isUniqueViolation } from "@open-mercato/shared/lib/crud/errors";
 const metadata = {
   path: "/onboarding/onboarding/verify",
   GET: {
     requireAuth: false
   }
 };
-function resolveTrustedBaseUrl(req) {
-  try {
-    return getSecurityEmailBaseUrl(req);
-  } catch (error) {
-    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {
-      console.error("[onboarding.verify] rejected request origin for redirect base", {
-        requestUrl: req.url,
-        reason: error.message
-      });
-      return new URL(req.url).origin;
-    }
-    throw error;
-  }
-}
-const VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5e3;
 const SEED_DEFAULTS_TIMEOUT_MS = 15e3;
-const SEED_EXAMPLES_TIMEOUT_MS = 15e3;
 function createTimeoutPromise(label, timeoutMs) {
   return new Promise((_, reject) => {
     setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
@@ -70,164 +51,50 @@ async function runModuleSetupHook(args) {
       durationMs: Math.max(0, Date.now() - startedAt)
     });
   } catch (error) {
-    console.error("[onboarding.verify] module hook failed", {
-      moduleId: args.moduleId,
-      phase: args.phase,
-      durationMs: Math.max(0, Date.now() - startedAt),
-      timeoutMs: args.timeoutMs,
-      error
-    });
-    throw error;
-  }
-}
-async function markWorkspaceReady(args) {
-  const container = await createRequestContainer();
-  const em = container.resolve("em");
-  const service = new OnboardingService(em);
-  const request = await service.findById(args.requestId);
-  if (!request || request.preparationCompletedAt) return;
-  await service.markPreparationCompleted(request, /* @__PURE__ */ new Date());
-}
-async function enqueueVectorReindex(args) {
-  let searchIndexer = null;
-  try {
-    searchIndexer = args.container.resolve("searchIndexer");
-  } catch {
-    searchIndexer = null;
-  }
-  if (!searchIndexer) return;
-  await Promise.race([
-    searchIndexer.reindexAllToVector({
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      purgeFirst: true,
-      useQueue: true
-    }),
-    createTimeoutPromise("vector reindex enqueue", VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS)
-  ]);
-}
-async function rebuildTenantQueryIndexes(args) {
-  const coverageRefreshKeys = /* @__PURE__ */ new Set();
-  try {
-    const allEntities = getEntityIds();
-    const entityIds = flattenSystemEntityIds(allEntities);
-    for (const entityType of entityIds) {
-      try {
-        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId });
-      } catch (error) {
-        console.error("[onboarding.verify] failed to purge query index scope", {
-          entityType,
-          tenantId: args.tenantId,
-          error
-        });
-      }
-      try {
-        await reindexEntity(args.em, {
-          entityType,
-          tenantId: args.tenantId,
-          force: true,
-          emitVectorizeEvents: false,
-          vectorService: null
-        });
-      } catch (error) {
-        console.error("[onboarding.verify] failed to reindex entity", {
-          entityType,
-          tenantId: args.tenantId,
-          error
-        });
-      }
-      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`);
-      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`);
-    }
-  } catch (error) {
-    console.error("[onboarding.verify] failed to rebuild query indexes", { tenantId: args.tenantId, error });
-  }
-  if (!coverageRefreshKeys.size) return;
-  for (const entry of coverageRefreshKeys) {
-    const [entityType, tenantKey, orgKey] = entry.split("|");
-    const orgScope = orgKey === "__null__" ? null : orgKey;
-    try {
-      await refreshCoverageSnapshot(
-        args.em,
-        {
-          entityType,
-          tenantId: tenantKey,
-          organizationId: orgScope,
-          withDeleted: false
-        }
-      );
-    } catch (error) {
-      console.error("[onboarding.verify] failed to refresh coverage snapshot", {
-        entityType,
-        tenantId: tenantKey,
-        organizationId: orgScope,
-        error
+    if (isUniqueViolation(error)) {
+      console.info("[onboarding.verify] module hook skipped (already seeded)", {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt)
       });
-    }
-  }
-}
-async function runDeferredProvisioning(args) {
-  const container = await createRequestContainer();
-  const em = container.resolve("em");
-  const modules = getModules();
-  for (const mod of modules) {
-    if (!mod.setup?.seedExamples) continue;
-    try {
-      await runModuleSetupHook({
-        moduleId: mod.id,
-        phase: "seedExamples",
-        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,
-        run: () => mod.setup.seedExamples({
-          em,
-          tenantId: args.tenantId,
-          organizationId: args.organizationId,
-          container
-        })
-      });
-    } catch (error) {
-      console.error("[onboarding.verify] deferred seedExamples failed", {
-        moduleId: mod.id,
-        tenantId: args.tenantId,
-        organizationId: args.organizationId,
+    } else {
+      console.error("[onboarding.verify] module hook failed", {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt),
+        timeoutMs: args.timeoutMs,
         error
       });
     }
-  }
-  await markWorkspaceReady({
-    requestId: args.requestId
-  });
-  await sendWorkspaceReadyEmail({
-    requestId: args.requestId,
-    tenantId: args.tenantId
-  }).catch((error) => {
-    console.error("[onboarding.verify] ready email failed", {
-      requestId: args.requestId,
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      error
-    });
     throw error;
-  });
-  await rebuildTenantQueryIndexes({
-    em,
-    tenantId: args.tenantId,
-    organizationId: args.organizationId
-  });
-  await enqueueVectorReindex({
-    container,
-    tenantId: args.tenantId,
-    organizationId: args.organizationId
-  }).catch((error) => {
-    console.warn("[onboarding.verify] vector reindex enqueue did not complete promptly", {
-      tenantId: args.tenantId,
-      organizationId: args.organizationId,
-      reason: error instanceof Error ? error.message : String(error)
+  }
+}
+async function completeProvisionedRequest(args) {
+  const ids = resolveProvisioningIds(args.request);
+  if (!ids) return null;
+  await args.service.markCompleted(args.request, ids);
+  after(async () => {
+    await runDeferredProvisioning({
+      requestId: args.request.id,
+      tenantId: ids.tenantId,
+      organizationId: ids.organizationId
     });
   });
+  return ids;
 }
 async function GET(req) {
   const url = new URL(req.url);
-  const baseUrl = resolveTrustedBaseUrl(req);
+  const baseUrlResult = resolveVerifyRedirectBaseUrl(req);
+  if (!baseUrlResult.ok) {
+    if (baseUrlResult.redirectOrigin) {
+      return redirectWithStatus(baseUrlResult.redirectOrigin, baseUrlResult.status);
+    }
+    return NextResponse.json(
+      { ok: false, error: baseUrlResult.message },
+      { status: baseUrlResult.httpStatus }
+    );
+  }
+  const baseUrl = baseUrlResult.baseUrl;
   const token = url.searchParams.get("token") ?? "";
   const parsed = onboardingVerifySchema.safeParse({ token });
   if (!parsed.success) {
@@ -268,9 +135,13 @@ async function GET(req) {
   const processingStartedAt = request.processingStartedAt?.getTime() ?? 0;
   const processingFresh = request.status === "processing" && processingStartedAt > Date.now() - lockWindowMs;
   if (processingFresh) {
+    const recovered = await completeProvisionedRequest({ service, request });
+    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId);
     return redirectToPreparing(baseUrl, request.tenantId ?? null);
   }
   if (request.status === "processing" && !processingFresh) {
+    const recovered = await completeProvisionedRequest({ service, request });
+    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId);
     await service.resetProcessing(request);
   }
   if (request.status !== "pending") {
@@ -278,10 +149,15 @@ async function GET(req) {
   }
   const claimed = await service.startProcessing(request, /* @__PURE__ */ new Date());
   if (!claimed) {
-    const current = await new OnboardingService(em.fork()).findById(request.id);
+    const currentService = new OnboardingService(em.fork());
+    const current = await currentService.findById(request.id);
     if (current?.status === "completed" && current.tenantId) {
       return current.preparationCompletedAt ? redirectToLogin(baseUrl, current.tenantId) : redirectToPreparing(baseUrl, current.tenantId);
     }
+    if (current?.status === "processing") {
+      const recovered = await completeProvisionedRequest({ service: currentService, request: current });
+      if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId);
+    }
     return redirectToPreparing(baseUrl, current?.tenantId ?? request.tenantId ?? null);
   }
   if (!request.passwordHash) {
@@ -334,36 +210,42 @@ async function GET(req) {
         ipAddress: clientIp,
         source: "onboarding"
       });
-      await em.transactional(async (txEm) => {
-        txEm.create(UserConsent, {
-          userId: resolvedUserId,
-          tenantId: resolvedTenantId,
-          organizationId: resolvedOrganizationId,
-          consentType: "marketing_email",
-          isGranted: true,
-          grantedAt: now,
-          source: "onboarding",
-          ipAddress: clientIp,
-          integrityHash,
-          createdAt: now
-        });
-      });
+      await runBestEffortProvisioningStep(
+        "marketing-consent",
+        () => em.fork().transactional(async (txEm) => {
+          txEm.create(UserConsent, {
+            userId: resolvedUserId,
+            tenantId: resolvedTenantId,
+            organizationId: resolvedOrganizationId,
+            consentType: "marketing_email",
+            isGranted: true,
+            grantedAt: now,
+            source: "onboarding",
+            ipAddress: clientIp,
+            integrityHash,
+            createdAt: now
+          });
+        })
+      );
     }
     const modules = getModules();
     for (const mod of modules) {
-      if (mod.setup?.seedDefaults) {
-        await runModuleSetupHook({
+      if (!mod.setup?.seedDefaults) continue;
+      const seedEm = em.fork();
+      await runBestEffortProvisioningStep(
+        `seedDefaults:${mod.id}`,
+        () => runModuleSetupHook({
           moduleId: mod.id,
           phase: "seedDefaults",
           timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,
           run: () => mod.setup.seedDefaults({
-            em,
+            em: seedEm,
             tenantId: resolvedTenantId,
             organizationId: resolvedOrganizationId,
             container
           })
-        });
-      }
+        })
+      );
     }
     await service.markCompleted(request, {
       tenantId: resolvedTenantId,

package/dist/modules/onboarding/api/get/onboarding/verify.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/onboarding/api/get/onboarding/verify.ts"],
-  "sourcesContent": ["import { after } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { SearchIndexer } from '@open-mercato/search'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  AppOriginConfigurationError,\n  AppOriginRejectedError,\n  getSecurityEmailBaseUrl,\n} from '@open-mercato/shared/lib/url'\nimport { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport {\n  redirectToLogin,\n  redirectToPreparing,\n  redirectWithStatus,\n} from '@open-mercato/onboarding/modules/onboarding/lib/verify-redirects'\nimport { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'\nimport { UserConsent } from '@open-mercato/core/modules/auth/data/entities'\nimport { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'\nimport { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'\nimport { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'\nimport { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'\nimport { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'\nimport { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/verify',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nfunction resolveTrustedBaseUrl(req: Request): string {\n  try {\n    return getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    if (error instanceof AppOriginRejectedError || error instanceof AppOriginConfigurationError) {\n      console.error('[onboarding.verify] rejected request origin for redirect base', {\n        requestUrl: req.url,\n        reason: error.message,\n      })\n      return new URL(req.url).origin\n    }\n    throw error\n  }\n}\n\nconst VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000\nconst SEED_DEFAULTS_TIMEOUT_MS = 15_000\nconst SEED_EXAMPLES_TIMEOUT_MS = 15_000\n\nfunction createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)\n  })\n}\n\nasync function runModuleSetupHook(args: {\n  moduleId: string\n  phase: 'seedDefaults' | 'seedExamples'\n  timeoutMs: number\n  run: () => Promise<void>\n}) {\n  const startedAt = Date.now()\n  console.info('[onboarding.verify] module hook started', {\n    moduleId: args.moduleId,\n    phase: args.phase,\n    timeoutMs: args.timeoutMs,\n  })\n  try {\n    await Promise.race([\n      args.run(),\n      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),\n    ])\n    console.info('[onboarding.verify] module hook completed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n    })\n  } catch (error) {\n    console.error('[onboarding.verify] module hook failed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n      timeoutMs: args.timeoutMs,\n      error,\n    })\n    throw error\n  }\n}\n\nasync function markWorkspaceReady(args: {\n  requestId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findById(args.requestId)\n  if (!request || request.preparationCompletedAt) return\n  await service.markPreparationCompleted(request, new Date())\n}\n\nasync function enqueueVectorReindex(args: {\n  container: { resolve: <T = unknown>(name: string) => T }\n  tenantId: string\n  organizationId: string\n}) {\n  let searchIndexer: SearchIndexer | null = null\n  try {\n    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')\n  } catch {\n    searchIndexer = null\n  }\n  if (!searchIndexer) return\n\n  await Promise.race([\n    searchIndexer.reindexAllToVector({\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      purgeFirst: true,\n      useQueue: true,\n    }),\n    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),\n  ])\n}\n\nasync function rebuildTenantQueryIndexes(args: {\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n}) {\n  const coverageRefreshKeys = new Set<string>()\n  try {\n    const allEntities = getEntityIds()\n    const entityIds = flattenSystemEntityIds(allEntities)\n    for (const entityType of entityIds) {\n      try {\n        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to purge query index scope', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      try {\n        await reindexEntity(args.em, {\n          entityType,\n          tenantId: args.tenantId,\n          force: true,\n          emitVectorizeEvents: false,\n          vectorService: null,\n        })\n      } catch (error) {\n        console.error('[onboarding.verify] failed to reindex entity', {\n          entityType,\n          tenantId: args.tenantId,\n          error,\n        })\n      }\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)\n      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)\n    }\n  } catch (error) {\n    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })\n  }\n\n  if (!coverageRefreshKeys.size) return\n\n  for (const entry of coverageRefreshKeys) {\n    const [entityType, tenantKey, orgKey] = entry.split('|')\n    const orgScope = orgKey === '__null__' ? null : orgKey\n    try {\n      await refreshCoverageSnapshot(\n        args.em,\n        {\n          entityType,\n          tenantId: tenantKey,\n          organizationId: orgScope,\n          withDeleted: false,\n        },\n      )\n    } catch (error) {\n      console.error('[onboarding.verify] failed to refresh coverage snapshot', {\n        entityType,\n        tenantId: tenantKey,\n        organizationId: orgScope,\n        error,\n      })\n    }\n  }\n}\n\nasync function runDeferredProvisioning(args: {\n  requestId: string\n  tenantId: string\n  organizationId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const modules = getModules()\n\n  for (const mod of modules) {\n    if (!mod.setup?.seedExamples) continue\n    try {\n      await runModuleSetupHook({\n        moduleId: mod.id,\n        phase: 'seedExamples',\n        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,\n        run: () => mod.setup!.seedExamples!({\n          em,\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          container,\n        }),\n      })\n    } catch (error) {\n      console.error('[onboarding.verify] deferred seedExamples failed', {\n        moduleId: mod.id,\n        tenantId: args.tenantId,\n        organizationId: args.organizationId,\n        error,\n      })\n    }\n  }\n\n  await markWorkspaceReady({\n    requestId: args.requestId,\n  })\n\n  await sendWorkspaceReadyEmail({\n    requestId: args.requestId,\n    tenantId: args.tenantId,\n  }).catch((error) => {\n    console.error('[onboarding.verify] ready email failed', {\n      requestId: args.requestId,\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      error,\n    })\n    throw error\n  })\n\n  await rebuildTenantQueryIndexes({\n    em,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  })\n\n  await enqueueVectorReindex({\n    container,\n    tenantId: args.tenantId,\n    organizationId: args.organizationId,\n  }).catch((error) => {\n    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {\n      tenantId: args.tenantId,\n      organizationId: args.organizationId,\n      reason: error instanceof Error ? error.message : String(error),\n    })\n  })\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedBaseUrl(req)\n  const token = url.searchParams.get('token') ?? ''\n  const parsed = onboardingVerifySchema.safeParse({ token })\n  if (!parsed.success) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  const service = new OnboardingService(em)\n  const request = await service.findByToken(parsed.data.token)\n  if (!request) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.expiresAt <= new Date() && request.status !== 'completed') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.status === 'completed' && request.tenantId) {\n    if (!request.preparationCompletedAt) {\n      return redirectToPreparing(baseUrl, request.tenantId)\n    }\n    if (!request.readyEmailSentAt) {\n      after(async () => {\n        await sendWorkspaceReadyEmail({\n          requestId: request.id,\n          tenantId: request.tenantId!,\n        }).catch((error) => {\n          console.error('[onboarding.verify] retry ready email failed', {\n            requestId: request.id,\n            tenantId: request.tenantId,\n            organizationId: request.organizationId,\n            error,\n          })\n        })\n      })\n    }\n    return redirectToLogin(baseUrl, request.tenantId)\n  }\n  const lockWindowMs = 15 * 60 * 1000\n  const processingStartedAt = request.processingStartedAt?.getTime() ?? 0\n  const processingFresh = request.status === 'processing' && processingStartedAt > Date.now() - lockWindowMs\n  if (processingFresh) {\n    return redirectToPreparing(baseUrl, request.tenantId ?? null)\n  }\n  if (request.status === 'processing' && !processingFresh) {\n    await service.resetProcessing(request)\n  }\n  if (request.status !== 'pending') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  const claimed = await service.startProcessing(request, new Date())\n  if (!claimed) {\n    // A concurrent verify request already claimed this token (pending \u2192 processing).\n    // Re-read on a fresh fork \u2014 the request EM's identity map still holds the stale\n    // pre-claim copy \u2014 and route off the winner's committed state instead of re-running\n    // provisioning, which would throw USER_EXISTS and could strand the request (#2742).\n    const current = await new OnboardingService(em.fork()).findById(request.id)\n    if (current?.status === 'completed' && current.tenantId) {\n      return current.preparationCompletedAt\n        ? redirectToLogin(baseUrl, current.tenantId)\n        : redirectToPreparing(baseUrl, current.tenantId)\n    }\n    return redirectToPreparing(baseUrl, current?.tenantId ?? request.tenantId ?? null)\n  }\n  if (!request.passwordHash) {\n    console.error('[onboarding.verify] missing password hash for request', request.id)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n\n  let tenantId: string | null = null\n  let organizationId: string | null = null\n  let userId: string | null = null\n\n  try {\n    const setupResult = await setupInitialTenant(em, {\n      orgName: request.organizationName,\n      includeDerivedUsers: false,\n      failIfUserExists: true,\n      primaryUserRoles: ['admin'],\n      includeSuperadminRole: false,\n      primaryUser: {\n        email: request.email,\n        firstName: request.firstName,\n        lastName: request.lastName,\n        displayName: `${request.firstName} ${request.lastName}`.trim(),\n        hashedPassword: request.passwordHash,\n        confirm: true,\n      },\n      modules: getModules(),\n    })\n\n    const resolvedTenantId = String(setupResult.tenantId)\n    const resolvedOrganizationId = String(setupResult.organizationId)\n    tenantId = resolvedTenantId\n    organizationId = resolvedOrganizationId\n\n    const mainUserSnapshot = setupResult.users.find((entry) => entry.user.email === request.email)\n    if (!mainUserSnapshot) throw new Error('USER_NOT_CREATED')\n    const user = mainUserSnapshot.user\n    const resolvedUserId = String(user.id)\n    userId = resolvedUserId\n    await service.updateProvisioningIds(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n\n    if (request.marketingConsent) {\n      const now = new Date()\n      const clientIp = resolveConsentClientIp(req)\n      const integrityHash = computeConsentIntegrityHash({\n        userId: resolvedUserId,\n        consentType: 'marketing_email',\n        isGranted: true,\n        grantedAt: now,\n        ipAddress: clientIp,\n        source: 'onboarding',\n      })\n      // Wrap the request-em consent write in a transaction so it commits\n      // all-or-nothing. setupInitialTenant already manages its own internal\n      // transactions, and the seedDefaults hooks below resolve container\n      // services that fork their own EM (and may enqueue work), so neither can\n      // join this transaction \u2014 only the direct request-em writes are wrapped.\n      await em.transactional(async (txEm) => {\n        txEm.create(UserConsent, {\n          userId: resolvedUserId,\n          tenantId: resolvedTenantId,\n          organizationId: resolvedOrganizationId,\n          consentType: 'marketing_email',\n          isGranted: true,\n          grantedAt: now,\n          source: 'onboarding',\n          ipAddress: clientIp,\n          integrityHash,\n          createdAt: now,\n        })\n      })\n    }\n\n    // Call module seedDefaults + seedExamples hooks\n    const modules = getModules()\n    for (const mod of modules) {\n      if (mod.setup?.seedDefaults) {\n        await runModuleSetupHook({\n          moduleId: mod.id,\n          phase: 'seedDefaults',\n          timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,\n          run: () => mod.setup!.seedDefaults!({\n            em,\n            tenantId: resolvedTenantId,\n            organizationId: resolvedOrganizationId,\n            container,\n          }),\n        })\n      }\n    }\n    await service.markCompleted(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n    // TODO: Move deferred provisioning into a durable job keyed by request id so process restarts can resume\n    // seedExamples/index rebuild/email dispatch instead of leaving completed requests stuck on preparing.\n    after(async () => {\n      await runDeferredProvisioning({\n        requestId: request.id,\n        tenantId: resolvedTenantId,\n        organizationId: resolvedOrganizationId,\n      })\n    })\n    return redirectToPreparing(baseUrl, resolvedTenantId)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'USER_EXISTS') {\n      await service.resetProcessing(request)\n      return redirectWithStatus(baseUrl, 'already_exists')\n    }\n    console.error('[onboarding.verify] failed', error)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n}\n\nexport default GET\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingVerifyQuerySchema = z.object({\n  token: onboardingVerifySchema.shape.token,\n})\n\nconst onboardingVerifyDoc: OpenApiMethodDoc = {\n  summary: 'Verify onboarding token',\n  description: 'Validates the onboarding token, provisions the tenant, seeds demo data, and redirects the user to the login screen.',\n  tags: [onboardingTag],\n  query: onboardingVerifyQuerySchema,\n  responses: [\n    { status: 302, description: 'Redirect to onboarding UI or login' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding verification redirect',\n  methods: {\n    GET: onboardingVerifyDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,aAAa;AACtB,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAC5B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAGpB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,SAAS,sBAAsB,KAAsB;AACnD,MAAI;AACF,WAAO,wBAAwB,GAAG;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B,iBAAiB,6BAA6B;AAC3F,cAAQ,MAAM,iEAAiE;AAAA,QAC7E,YAAY,IAAI;AAAA,QAChB,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO,IAAI,IAAI,IAAI,GAAG,EAAE;AAAA,IAC1B;AACA,UAAM;AAAA,EACR;AACF;AAEA,MAAM,oCAAoC;AAC1C,MAAM,2BAA2B;AACjC,MAAM,2BAA2B;AAEjC,SAAS,qBAAqB,OAAe,WAAmC;AAC9E,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM,OAAO,IAAI,MAAM,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,GAAG,SAAS;AAAA,EAC1F,CAAC;AACH;AAEA,eAAe,mBAAmB,MAK/B;AACD,QAAM,YAAY,KAAK,IAAI;AAC3B,UAAQ,KAAK,2CAA2C;AAAA,IACtD,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,qBAAqB,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS;AAAA,IAC9E,CAAC;AACD,YAAQ,KAAK,6CAA6C;AAAA,MACxD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,0CAA0C;AAAA,MACtD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,MAC9C,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,mBAAmB,MAE/B;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS;AACrD,MAAI,CAAC,WAAW,QAAQ,uBAAwB;AAChD,QAAM,QAAQ,yBAAyB,SAAS,oBAAI,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,MAIjC;AACD,MAAI,gBAAsC;AAC1C,MAAI;AACF,oBAAgB,KAAK,UAAU,QAAuB,eAAe;AAAA,EACvE,QAAQ;AACN,oBAAgB;AAAA,EAClB;AACA,MAAI,CAAC,cAAe;AAEpB,QAAM,QAAQ,KAAK;AAAA,IACjB,cAAc,mBAAmB;AAAA,MAC/B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY;AAAA,MACZ,UAAU;AAAA,IACZ,CAAC;AAAA,IACD,qBAAqB,0BAA0B,iCAAiC;AAAA,EAClF,CAAC;AACH;AAEA,eAAe,0BAA0B,MAItC;AACD,QAAM,sBAAsB,oBAAI,IAAY;AAC5C,MAAI;AACF,UAAM,cAAc,aAAa;AACjC,UAAM,YAAY,uBAAuB,WAAW;AACpD,eAAW,cAAc,WAAW;AAClC,UAAI;AACF,cAAM,gBAAgB,KAAK,IAAI,EAAE,YAAY,UAAU,KAAK,SAAS,CAAC;AAAA,MACxE,SAAS,OAAO;AACd,gBAAQ,MAAM,yDAAyD;AAAA,UACrE;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,UAAI;AACF,cAAM,cAAc,KAAK,IAAI;AAAA,UAC3B;AAAA,UACA,UAAU,KAAK;AAAA,UACf,OAAO;AAAA,UACP,qBAAqB;AAAA,UACrB,eAAe;AAAA,QACjB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ,MAAM,gDAAgD;AAAA,UAC5D;AAAA,UACA,UAAU,KAAK;AAAA,UACf;AAAA,QACF,CAAC;AAAA,MACH;AACA,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,WAAW;AACjE,0BAAoB,IAAI,GAAG,UAAU,IAAI,KAAK,QAAQ,IAAI,KAAK,cAAc,EAAE;AAAA,IACjF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,uDAAuD,EAAE,UAAU,KAAK,UAAU,MAAM,CAAC;AAAA,EACzG;AAEA,MAAI,CAAC,oBAAoB,KAAM;AAE/B,aAAW,SAAS,qBAAqB;AACvC,UAAM,CAAC,YAAY,WAAW,MAAM,IAAI,MAAM,MAAM,GAAG;AACvD,UAAM,WAAW,WAAW,aAAa,OAAO;AAChD,QAAI;AACF,YAAM;AAAA,QACJ,KAAK;AAAA,QACL;AAAA,UACE;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,QACf;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,cAAQ,MAAM,2DAA2D;AAAA,QACvE;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,MAIpC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,WAAW;AAE3B,aAAW,OAAO,SAAS;AACzB,QAAI,CAAC,IAAI,OAAO,aAAc;AAC9B,QAAI;AACF,YAAM,mBAAmB;AAAA,QACvB,UAAU,IAAI;AAAA,QACd,OAAO;AAAA,QACP,WAAW;AAAA,QACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,UAClC;AAAA,UACA,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,oDAAoD;AAAA,QAChE,UAAU,IAAI;AAAA,QACd,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,mBAAmB;AAAA,IACvB,WAAW,KAAK;AAAA,EAClB,CAAC;AAED,QAAM,wBAAwB;AAAA,IAC5B,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,EACjB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,0CAA0C;AAAA,MACtD,WAAW,KAAK;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR,CAAC;AAED,QAAM,0BAA0B;AAAA,IAC9B;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAED,QAAM,qBAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,KAAK,wEAAwE;AAAA,MACnF,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,sBAAsB,GAAG;AACzC,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,uBAAuB,UAAU,EAAE,MAAM,CAAC;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,YAAY,OAAO,KAAK,KAAK;AAC3D,MAAI,CAAC,SAAS;AACZ,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,aAAa,oBAAI,KAAK,KAAK,QAAQ,WAAW,aAAa;AACrE,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,WAAW,eAAe,QAAQ,UAAU;AACtD,QAAI,CAAC,QAAQ,wBAAwB;AACnC,aAAO,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACtD;AACA,QAAI,CAAC,QAAQ,kBAAkB;AAC7B,YAAM,YAAY;AAChB,cAAM,wBAAwB;AAAA,UAC5B,WAAW,QAAQ;AAAA,UACnB,UAAU,QAAQ;AAAA,QACpB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,kBAAQ,MAAM,gDAAgD;AAAA,YAC5D,WAAW,QAAQ;AAAA,YACnB,UAAU,QAAQ;AAAA,YAClB,gBAAgB,QAAQ;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,gBAAgB,SAAS,QAAQ,QAAQ;AAAA,EAClD;AACA,QAAM,eAAe,KAAK,KAAK;AAC/B,QAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,KAAK;AACtE,QAAM,kBAAkB,QAAQ,WAAW,gBAAgB,sBAAsB,KAAK,IAAI,IAAI;AAC9F,MAAI,iBAAiB;AACnB,WAAO,oBAAoB,SAAS,QAAQ,YAAY,IAAI;AAAA,EAC9D;AACA,MAAI,QAAQ,WAAW,gBAAgB,CAAC,iBAAiB;AACvD,UAAM,QAAQ,gBAAgB,OAAO;AAAA,EACvC;AACA,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,QAAM,UAAU,MAAM,QAAQ,gBAAgB,SAAS,oBAAI,KAAK,CAAC;AACjE,MAAI,CAAC,SAAS;AAKZ,UAAM,UAAU,MAAM,IAAI,kBAAkB,GAAG,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE;AAC1E,QAAI,SAAS,WAAW,eAAe,QAAQ,UAAU;AACvD,aAAO,QAAQ,yBACX,gBAAgB,SAAS,QAAQ,QAAQ,IACzC,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACnD;AACA,WAAO,oBAAoB,SAAS,SAAS,YAAY,QAAQ,YAAY,IAAI;AAAA,EACnF;AACA,MAAI,CAAC,QAAQ,cAAc;AACzB,YAAQ,MAAM,yDAAyD,QAAQ,EAAE;AACjF,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AAEA,MAAI,WAA0B;AAC9B,MAAI,iBAAgC;AACpC,MAAI,SAAwB;AAE5B,MAAI;AACF,UAAM,cAAc,MAAM,mBAAmB,IAAI;AAAA,MAC/C,SAAS,QAAQ;AAAA,MACjB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,kBAAkB,CAAC,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,aAAa;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,aAAa,GAAG,QAAQ,SAAS,IAAI,QAAQ,QAAQ,GAAG,KAAK;AAAA,QAC7D,gBAAgB,QAAQ;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC;AAED,UAAM,mBAAmB,OAAO,YAAY,QAAQ;AACpD,UAAM,yBAAyB,OAAO,YAAY,cAAc;AAChE,eAAW;AACX,qBAAiB;AAEjB,UAAM,mBAAmB,YAAY,MAAM,KAAK,CAAC,UAAU,MAAM,KAAK,UAAU,QAAQ,KAAK;AAC7F,QAAI,CAAC,iBAAkB,OAAM,IAAI,MAAM,kBAAkB;AACzD,UAAM,OAAO,iBAAiB;AAC9B,UAAM,iBAAiB,OAAO,KAAK,EAAE;AACrC,aAAS;AACT,UAAM,QAAQ,sBAAsB,SAAS;AAAA,MAC3C,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,kBAAkB;AAC5B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,uBAAuB,GAAG;AAC3C,YAAM,gBAAgB,4BAA4B;AAAA,QAChD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAMD,YAAM,GAAG,cAAc,OAAO,SAAS;AACrC,aAAK,OAAO,aAAa;AAAA,UACvB,QAAQ;AAAA,UACR,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,aAAa;AAAA,UACb,WAAW;AAAA,UACX,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,WAAW;AAC3B,eAAW,OAAO,SAAS;AACzB,UAAI,IAAI,OAAO,cAAc;AAC3B,cAAM,mBAAmB;AAAA,UACvB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,WAAW;AAAA,UACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,YAClC;AAAA,YACA,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,SAAS;AAAA,MACnC,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAGD,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AACD,WAAO,oBAAoB,SAAS,gBAAgB;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,eAAe;AAC7D,YAAM,QAAQ,gBAAgB,OAAO;AACrC,aAAO,mBAAmB,SAAS,gBAAgB;AAAA,IACrD;AACA,YAAQ,MAAM,8BAA8B,KAAK;AACjD,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;AAEA,IAAO,iBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,OAAO,uBAAuB,MAAM;AACtC,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,EACnE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { after, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { onboardingVerifySchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport type { OnboardingRequest } from '@open-mercato/onboarding/modules/onboarding/data/entities'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'\nimport {\n  redirectToLogin,\n  redirectToPreparing,\n  redirectWithStatus,\n} from '@open-mercato/onboarding/modules/onboarding/lib/verify-redirects'\nimport { resolveVerifyRedirectBaseUrl } from '@open-mercato/onboarding/modules/onboarding/lib/verify-base-url'\nimport {\n  resolveProvisioningIds,\n  runDeferredProvisioning,\n} from '@open-mercato/onboarding/modules/onboarding/lib/deferred-provisioning'\nimport { setupInitialTenant } from '@open-mercato/core/modules/auth/lib/setup-app'\nimport { UserConsent } from '@open-mercato/core/modules/auth/data/entities'\nimport { computeConsentIntegrityHash } from '@open-mercato/core/modules/auth/lib/consentIntegrity'\nimport { resolveConsentClientIp } from '@open-mercato/onboarding/modules/onboarding/lib/consentClientIp'\nimport { runBestEffortProvisioningStep } from '@open-mercato/onboarding/modules/onboarding/lib/provisioning'\nimport { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  path: '/onboarding/onboarding/verify',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst SEED_DEFAULTS_TIMEOUT_MS = 15_000\n\nfunction createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)\n  })\n}\n\nasync function runModuleSetupHook(args: {\n  moduleId: string\n  phase: 'seedDefaults' | 'seedExamples'\n  timeoutMs: number\n  run: () => Promise<void>\n}) {\n  const startedAt = Date.now()\n  console.info('[onboarding.verify] module hook started', {\n    moduleId: args.moduleId,\n    phase: args.phase,\n    timeoutMs: args.timeoutMs,\n  })\n  try {\n    await Promise.race([\n      args.run(),\n      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),\n    ])\n    console.info('[onboarding.verify] module hook completed', {\n      moduleId: args.moduleId,\n      phase: args.phase,\n      durationMs: Math.max(0, Date.now() - startedAt),\n    })\n  } catch (error) {\n    if (isUniqueViolation(error)) {\n      // A concurrent verify (or a re-verify after the request was already\n      // provisioned) re-runs seedDefaults against rows that exist. seed hooks\n      // are not fully idempotent, so the collision is expected and harmless \u2014\n      // the workspace already exists. Log at info so real failures stand out.\n      console.info('[onboarding.verify] module hook skipped (already seeded)', {\n        moduleId: args.moduleId,\n        phase: args.phase,\n        durationMs: Math.max(0, Date.now() - startedAt),\n      })\n    } else {\n      console.error('[onboarding.verify] module hook failed', {\n        moduleId: args.moduleId,\n        phase: args.phase,\n        durationMs: Math.max(0, Date.now() - startedAt),\n        timeoutMs: args.timeoutMs,\n        error,\n      })\n    }\n    throw error\n  }\n}\n\nasync function completeProvisionedRequest(args: {\n  service: OnboardingService\n  request: OnboardingRequest\n}) {\n  const ids = resolveProvisioningIds(args.request)\n  if (!ids) return null\n  await args.service.markCompleted(args.request, ids)\n  after(async () => {\n    await runDeferredProvisioning({\n      requestId: args.request.id,\n      tenantId: ids.tenantId,\n      organizationId: ids.organizationId,\n    })\n  })\n  return ids\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrlResult = resolveVerifyRedirectBaseUrl(req)\n  if (!baseUrlResult.ok) {\n    if (baseUrlResult.redirectOrigin) {\n      return redirectWithStatus(baseUrlResult.redirectOrigin, baseUrlResult.status)\n    }\n    return NextResponse.json(\n      { ok: false, error: baseUrlResult.message },\n      { status: baseUrlResult.httpStatus },\n    )\n  }\n  const baseUrl = baseUrlResult.baseUrl\n  const token = url.searchParams.get('token') ?? ''\n  const parsed = onboardingVerifySchema.safeParse({ token })\n  if (!parsed.success) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager)\n  const service = new OnboardingService(em)\n  const request = await service.findByToken(parsed.data.token)\n  if (!request) {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.expiresAt <= new Date() && request.status !== 'completed') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  if (request.status === 'completed' && request.tenantId) {\n    if (!request.preparationCompletedAt) {\n      return redirectToPreparing(baseUrl, request.tenantId)\n    }\n    if (!request.readyEmailSentAt) {\n      after(async () => {\n        await sendWorkspaceReadyEmail({\n          requestId: request.id,\n          tenantId: request.tenantId!,\n        }).catch((error) => {\n          console.error('[onboarding.verify] retry ready email failed', {\n            requestId: request.id,\n            tenantId: request.tenantId,\n            organizationId: request.organizationId,\n            error,\n          })\n        })\n      })\n    }\n    return redirectToLogin(baseUrl, request.tenantId)\n  }\n  const lockWindowMs = 15 * 60 * 1000\n  const processingStartedAt = request.processingStartedAt?.getTime() ?? 0\n  const processingFresh = request.status === 'processing' && processingStartedAt > Date.now() - lockWindowMs\n  if (processingFresh) {\n    const recovered = await completeProvisionedRequest({ service, request })\n    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)\n    return redirectToPreparing(baseUrl, request.tenantId ?? null)\n  }\n  if (request.status === 'processing' && !processingFresh) {\n    const recovered = await completeProvisionedRequest({ service, request })\n    if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)\n    await service.resetProcessing(request)\n  }\n  if (request.status !== 'pending') {\n    return redirectWithStatus(baseUrl, 'invalid')\n  }\n  const claimed = await service.startProcessing(request, new Date())\n  if (!claimed) {\n    // A concurrent verify request already claimed this token (pending \u2192 processing).\n    // Re-read on a fresh fork \u2014 the request EM's identity map still holds the stale\n    // pre-claim copy \u2014 and route off the winner's committed state instead of re-running\n    // provisioning, which would throw USER_EXISTS and could strand the request (#2742).\n    const currentService = new OnboardingService(em.fork())\n    const current = await currentService.findById(request.id)\n    if (current?.status === 'completed' && current.tenantId) {\n      return current.preparationCompletedAt\n        ? redirectToLogin(baseUrl, current.tenantId)\n        : redirectToPreparing(baseUrl, current.tenantId)\n    }\n    if (current?.status === 'processing') {\n      const recovered = await completeProvisionedRequest({ service: currentService, request: current })\n      if (recovered) return redirectToPreparing(baseUrl, recovered.tenantId)\n    }\n    return redirectToPreparing(baseUrl, current?.tenantId ?? request.tenantId ?? null)\n  }\n  if (!request.passwordHash) {\n    console.error('[onboarding.verify] missing password hash for request', request.id)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n\n  let tenantId: string | null = null\n  let organizationId: string | null = null\n  let userId: string | null = null\n\n  try {\n    const setupResult = await setupInitialTenant(em, {\n      orgName: request.organizationName,\n      includeDerivedUsers: false,\n      failIfUserExists: true,\n      primaryUserRoles: ['admin'],\n      includeSuperadminRole: false,\n      primaryUser: {\n        email: request.email,\n        firstName: request.firstName,\n        lastName: request.lastName,\n        displayName: `${request.firstName} ${request.lastName}`.trim(),\n        hashedPassword: request.passwordHash,\n        confirm: true,\n      },\n      modules: getModules(),\n    })\n\n    const resolvedTenantId = String(setupResult.tenantId)\n    const resolvedOrganizationId = String(setupResult.organizationId)\n    tenantId = resolvedTenantId\n    organizationId = resolvedOrganizationId\n\n    const mainUserSnapshot = setupResult.users.find((entry) => entry.user.email === request.email)\n    if (!mainUserSnapshot) throw new Error('USER_NOT_CREATED')\n    const user = mainUserSnapshot.user\n    const resolvedUserId = String(user.id)\n    userId = resolvedUserId\n    await service.updateProvisioningIds(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n\n    if (request.marketingConsent) {\n      const now = new Date()\n      const clientIp = resolveConsentClientIp(req)\n      const integrityHash = computeConsentIntegrityHash({\n        userId: resolvedUserId,\n        consentType: 'marketing_email',\n        isGranted: true,\n        grantedAt: now,\n        ipAddress: clientIp,\n        source: 'onboarding',\n      })\n      // Persist the marketing consent on an isolated EM fork wrapped in a\n      // transaction so it commits all-or-nothing AND a failure here can neither\n      // abort provisioning nor poison the request EM's unit of work before\n      // markCompleted runs. Recording the consent is best-effort: the workspace\n      // is already provisioned, and a lost consent record fails safe (treated as\n      // not granted) and is logged for follow-up rather than stranding the user.\n      await runBestEffortProvisioningStep('marketing-consent', () =>\n        em.fork().transactional(async (txEm) => {\n          txEm.create(UserConsent, {\n            userId: resolvedUserId,\n            tenantId: resolvedTenantId,\n            organizationId: resolvedOrganizationId,\n            consentType: 'marketing_email',\n            isGranted: true,\n            grantedAt: now,\n            source: 'onboarding',\n            ipAddress: clientIp,\n            integrityHash,\n            createdAt: now,\n          })\n        }),\n      )\n    }\n\n    // Call module seedDefaults hooks. Each hook is best-effort and runs on its\n    // own isolated EM fork: a single module's throw or 15s timeout must not\n    // strand the freshly provisioned workspace \u2014 the tenant/org/user already\n    // exist and the request must still reach markCompleted so the user can sign\n    // in. A per-module fork also keeps a failed module's unflushed unit of work\n    // from leaking into (or aborting) the next module's flush. Failures are\n    // logged for follow-up (deferred seedExamples is already non-fatal in the\n    // same way).\n    const modules = getModules()\n    for (const mod of modules) {\n      if (!mod.setup?.seedDefaults) continue\n      const seedEm = em.fork()\n      await runBestEffortProvisioningStep(`seedDefaults:${mod.id}`, () =>\n        runModuleSetupHook({\n          moduleId: mod.id,\n          phase: 'seedDefaults',\n          timeoutMs: SEED_DEFAULTS_TIMEOUT_MS,\n          run: () => mod.setup!.seedDefaults!({\n            em: seedEm,\n            tenantId: resolvedTenantId,\n            organizationId: resolvedOrganizationId,\n            container,\n          }),\n        }),\n      )\n    }\n    await service.markCompleted(request, {\n      tenantId: resolvedTenantId,\n      organizationId: resolvedOrganizationId,\n      userId: resolvedUserId,\n    })\n    // TODO: Move deferred provisioning into a durable job keyed by request id so process restarts can resume\n    // seedExamples/index rebuild/email dispatch instead of leaving completed requests stuck on preparing.\n    after(async () => {\n      await runDeferredProvisioning({\n        requestId: request.id,\n        tenantId: resolvedTenantId,\n        organizationId: resolvedOrganizationId,\n      })\n    })\n    return redirectToPreparing(baseUrl, resolvedTenantId)\n  } catch (error) {\n    if (error instanceof Error && error.message === 'USER_EXISTS') {\n      await service.resetProcessing(request)\n      return redirectWithStatus(baseUrl, 'already_exists')\n    }\n    console.error('[onboarding.verify] failed', error)\n    await service.resetProcessing(request)\n    return redirectWithStatus(baseUrl, 'error')\n  }\n}\n\nexport default GET\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingVerifyQuerySchema = z.object({\n  token: onboardingVerifySchema.shape.token,\n})\n\nconst onboardingVerifyDoc: OpenApiMethodDoc = {\n  summary: 'Verify onboarding token',\n  description: 'Validates the onboarding token, provisions the tenant, seeds demo data, and redirects the user to the login screen.',\n  tags: [onboardingTag],\n  query: onboardingVerifyQuerySchema,\n  responses: [\n    { status: 302, description: 'Redirect to onboarding UI or login' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Onboarding verification redirect',\n  methods: {\n    GET: onboardingVerifyDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,OAAO,oBAAoB;AACpC,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AAEvC,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,mBAAmB;AAC5B,SAAS,mCAAmC;AAC5C,SAAS,8BAA8B;AACvC,SAAS,qCAAqC;AAC9C,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAG3B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,2BAA2B;AAEjC,SAAS,qBAAqB,OAAe,WAAmC;AAC9E,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM,OAAO,IAAI,MAAM,GAAG,KAAK,oBAAoB,SAAS,IAAI,CAAC,GAAG,SAAS;AAAA,EAC1F,CAAC;AACH;AAEA,eAAe,mBAAmB,MAK/B;AACD,QAAM,YAAY,KAAK,IAAI;AAC3B,UAAQ,KAAK,2CAA2C;AAAA,IACtD,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,WAAW,KAAK;AAAA,EAClB,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,qBAAqB,UAAU,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,KAAK,SAAS;AAAA,IAC9E,CAAC;AACD,YAAQ,KAAK,6CAA6C;AAAA,MACxD,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,kBAAkB,KAAK,GAAG;AAK5B,cAAQ,KAAK,4DAA4D;AAAA,QACvE,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,MAChD,CAAC;AAAA,IACH,OAAO;AACL,cAAQ,MAAM,0CAA0C;AAAA,QACtD,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS;AAAA,QAC9C,WAAW,KAAK;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,2BAA2B,MAGvC;AACD,QAAM,MAAM,uBAAuB,KAAK,OAAO;AAC/C,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,KAAK,QAAQ,cAAc,KAAK,SAAS,GAAG;AAClD,QAAM,YAAY;AAChB,UAAM,wBAAwB;AAAA,MAC5B,WAAW,KAAK,QAAQ;AAAA,MACxB,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,6BAA6B,GAAG;AACtD,MAAI,CAAC,cAAc,IAAI;AACrB,QAAI,cAAc,gBAAgB;AAChC,aAAO,mBAAmB,cAAc,gBAAgB,cAAc,MAAM;AAAA,IAC9E;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,IAAI,OAAO,OAAO,cAAc,QAAQ;AAAA,MAC1C,EAAE,QAAQ,cAAc,WAAW;AAAA,IACrC;AAAA,EACF;AACA,QAAM,UAAU,cAAc;AAC9B,QAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,uBAAuB,UAAU,EAAE,MAAM,CAAC;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,YAAY,OAAO,KAAK,KAAK;AAC3D,MAAI,CAAC,SAAS;AACZ,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,aAAa,oBAAI,KAAK,KAAK,QAAQ,WAAW,aAAa;AACrE,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,MAAI,QAAQ,WAAW,eAAe,QAAQ,UAAU;AACtD,QAAI,CAAC,QAAQ,wBAAwB;AACnC,aAAO,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACtD;AACA,QAAI,CAAC,QAAQ,kBAAkB;AAC7B,YAAM,YAAY;AAChB,cAAM,wBAAwB;AAAA,UAC5B,WAAW,QAAQ;AAAA,UACnB,UAAU,QAAQ;AAAA,QACpB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,kBAAQ,MAAM,gDAAgD;AAAA,YAC5D,WAAW,QAAQ;AAAA,YACnB,UAAU,QAAQ;AAAA,YAClB,gBAAgB,QAAQ;AAAA,YACxB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,gBAAgB,SAAS,QAAQ,QAAQ;AAAA,EAClD;AACA,QAAM,eAAe,KAAK,KAAK;AAC/B,QAAM,sBAAsB,QAAQ,qBAAqB,QAAQ,KAAK;AACtE,QAAM,kBAAkB,QAAQ,WAAW,gBAAgB,sBAAsB,KAAK,IAAI,IAAI;AAC9F,MAAI,iBAAiB;AACnB,UAAM,YAAY,MAAM,2BAA2B,EAAE,SAAS,QAAQ,CAAC;AACvE,QAAI,UAAW,QAAO,oBAAoB,SAAS,UAAU,QAAQ;AACrE,WAAO,oBAAoB,SAAS,QAAQ,YAAY,IAAI;AAAA,EAC9D;AACA,MAAI,QAAQ,WAAW,gBAAgB,CAAC,iBAAiB;AACvD,UAAM,YAAY,MAAM,2BAA2B,EAAE,SAAS,QAAQ,CAAC;AACvE,QAAI,UAAW,QAAO,oBAAoB,SAAS,UAAU,QAAQ;AACrE,UAAM,QAAQ,gBAAgB,OAAO;AAAA,EACvC;AACA,MAAI,QAAQ,WAAW,WAAW;AAChC,WAAO,mBAAmB,SAAS,SAAS;AAAA,EAC9C;AACA,QAAM,UAAU,MAAM,QAAQ,gBAAgB,SAAS,oBAAI,KAAK,CAAC;AACjE,MAAI,CAAC,SAAS;AAKZ,UAAM,iBAAiB,IAAI,kBAAkB,GAAG,KAAK,CAAC;AACtD,UAAM,UAAU,MAAM,eAAe,SAAS,QAAQ,EAAE;AACxD,QAAI,SAAS,WAAW,eAAe,QAAQ,UAAU;AACvD,aAAO,QAAQ,yBACX,gBAAgB,SAAS,QAAQ,QAAQ,IACzC,oBAAoB,SAAS,QAAQ,QAAQ;AAAA,IACnD;AACA,QAAI,SAAS,WAAW,cAAc;AACpC,YAAM,YAAY,MAAM,2BAA2B,EAAE,SAAS,gBAAgB,SAAS,QAAQ,CAAC;AAChG,UAAI,UAAW,QAAO,oBAAoB,SAAS,UAAU,QAAQ;AAAA,IACvE;AACA,WAAO,oBAAoB,SAAS,SAAS,YAAY,QAAQ,YAAY,IAAI;AAAA,EACnF;AACA,MAAI,CAAC,QAAQ,cAAc;AACzB,YAAQ,MAAM,yDAAyD,QAAQ,EAAE;AACjF,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AAEA,MAAI,WAA0B;AAC9B,MAAI,iBAAgC;AACpC,MAAI,SAAwB;AAE5B,MAAI;AACF,UAAM,cAAc,MAAM,mBAAmB,IAAI;AAAA,MAC/C,SAAS,QAAQ;AAAA,MACjB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,kBAAkB,CAAC,OAAO;AAAA,MAC1B,uBAAuB;AAAA,MACvB,aAAa;AAAA,QACX,OAAO,QAAQ;AAAA,QACf,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,aAAa,GAAG,QAAQ,SAAS,IAAI,QAAQ,QAAQ,GAAG,KAAK;AAAA,QAC7D,gBAAgB,QAAQ;AAAA,QACxB,SAAS;AAAA,MACX;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC;AAED,UAAM,mBAAmB,OAAO,YAAY,QAAQ;AACpD,UAAM,yBAAyB,OAAO,YAAY,cAAc;AAChE,eAAW;AACX,qBAAiB;AAEjB,UAAM,mBAAmB,YAAY,MAAM,KAAK,CAAC,UAAU,MAAM,KAAK,UAAU,QAAQ,KAAK;AAC7F,QAAI,CAAC,iBAAkB,OAAM,IAAI,MAAM,kBAAkB;AACzD,UAAM,OAAO,iBAAiB;AAC9B,UAAM,iBAAiB,OAAO,KAAK,EAAE;AACrC,aAAS;AACT,UAAM,QAAQ,sBAAsB,SAAS;AAAA,MAC3C,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,kBAAkB;AAC5B,YAAM,MAAM,oBAAI,KAAK;AACrB,YAAM,WAAW,uBAAuB,GAAG;AAC3C,YAAM,gBAAgB,4BAA4B;AAAA,QAChD,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW;AAAA,QACX,QAAQ;AAAA,MACV,CAAC;AAOD,YAAM;AAAA,QAA8B;AAAA,QAAqB,MACvD,GAAG,KAAK,EAAE,cAAc,OAAO,SAAS;AACtC,eAAK,OAAO,aAAa;AAAA,YACvB,QAAQ;AAAA,YACR,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB,aAAa;AAAA,YACb,WAAW;AAAA,YACX,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,WAAW;AAAA,YACX;AAAA,YACA,WAAW;AAAA,UACb,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAUA,UAAM,UAAU,WAAW;AAC3B,eAAW,OAAO,SAAS;AACzB,UAAI,CAAC,IAAI,OAAO,aAAc;AAC9B,YAAM,SAAS,GAAG,KAAK;AACvB,YAAM;AAAA,QAA8B,gBAAgB,IAAI,EAAE;AAAA,QAAI,MAC5D,mBAAmB;AAAA,UACjB,UAAU,IAAI;AAAA,UACd,OAAO;AAAA,UACP,WAAW;AAAA,UACX,KAAK,MAAM,IAAI,MAAO,aAAc;AAAA,YAClC,IAAI;AAAA,YACJ,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,SAAS;AAAA,MACnC,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAGD,UAAM,YAAY;AAChB,YAAM,wBAAwB;AAAA,QAC5B,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AACD,WAAO,oBAAoB,SAAS,gBAAgB;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,eAAe;AAC7D,YAAM,QAAQ,gBAAgB,OAAO;AACrC,aAAO,mBAAmB,SAAS,gBAAgB;AAAA,IACrD;AACA,YAAQ,MAAM,8BAA8B,KAAK;AACjD,UAAM,QAAQ,gBAAgB,OAAO;AACrC,WAAO,mBAAmB,SAAS,OAAO;AAAA,EAC5C;AACF;AAEA,IAAO,iBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,OAAO,uBAAuB,MAAM;AACtC,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,EACnE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/onboarding/api/post/onboarding.js

@@ -13,10 +13,18 @@ import AdminNotificationEmail from "@open-mercato/onboarding/modules/onboarding/
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { formatPasswordRequirements, getPasswordPolicy } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
+import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 const metadata = {
   path: "/onboarding/onboarding",
   POST: {
-    requireAuth: false
+    requireAuth: false,
+    rateLimit: readEndpointRateLimitConfig("ONBOARDING", {
+      points: 10,
+      duration: 60,
+      blockDuration: 60,
+      keyPrefix: "onboarding"
+    })
   }
 };
 async function POST(req) {
@@ -217,6 +225,7 @@ const onboardingPostDoc = {
     { status: 400, description: "Validation failed", schema: onboardingErrorSchema },
     { status: 404, description: "Self-service onboarding disabled", schema: onboardingErrorSchema },
     { status: 409, description: "Existing account or pending request", schema: onboardingErrorSchema },
+    { status: 429, description: "Too many onboarding submissions from this IP", schema: rateLimitErrorSchema },
     { status: 500, description: "Unexpected server error", schema: onboardingErrorSchema }
   ]
 };

package/dist/modules/onboarding/api/post/onboarding.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/onboarding/api/post/onboarding.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { loadDictionary } from '@open-mercato/shared/lib/i18n/server'\nimport { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'\nimport { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { onboardingStartSchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport VerificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/VerificationEmail'\nimport AdminNotificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/AdminNotificationEmail'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\n\nexport const metadata = {\n  path: '/onboarding/onboarding',\n  POST: {\n    requireAuth: false,\n  },\n}\n\nexport async function POST(req: Request) {\n  if (parseBooleanToken(process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? '') !== true) {\n    return NextResponse.json({ ok: false, error: 'Self-service onboarding is disabled.' }, { status: 404 })\n  }\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const rawLocale =\n    payload && typeof payload === 'object' && 'locale' in payload && typeof (payload as any).locale === 'string'\n      ? (payload as any).locale as string\n      : null\n  const locale: Locale = rawLocale && locales.includes(rawLocale as Locale)\n    ? (rawLocale as Locale)\n    : defaultLocale\n  const dict = await loadDictionary(locale)\n  const translate = createFallbackTranslator(dict)\n  const passwordRequirements = formatPasswordRequirements(\n    getPasswordPolicy(),\n    translate,\n    'onboarding.password.requirements',\n  )\n\n  const parsed = onboardingStartSchema.safeParse(payload)\n  if (!parsed.success) {\n    const fieldErrors: Record<string, string> = {}\n    for (const issue of parsed.error.issues) {\n      const path = issue.path[0]\n      if (!path) continue\n      switch (path) {\n        case 'email':\n          fieldErrors.email = translate('onboarding.errors.emailInvalid', 'Enter a valid work email.')\n          break\n        case 'firstName':\n          fieldErrors.firstName = translate('onboarding.errors.firstNameRequired', 'First name is required.')\n          break\n        case 'lastName':\n          fieldErrors.lastName = translate('onboarding.errors.lastNameRequired', 'Last name is required.')\n          break\n        case 'organizationName':\n          fieldErrors.organizationName = translate('onboarding.errors.organizationNameRequired', 'Organization name is required.')\n          break\n        case 'password':\n          fieldErrors.password = translate(\n            'onboarding.errors.passwordRequired',\n            'Password must meet the requirements: {requirements}.',\n            { requirements: passwordRequirements },\n          )\n          break\n        case 'confirmPassword':\n          fieldErrors.confirmPassword = translate('onboarding.errors.passwordMismatch', 'Passwords must match.')\n          break\n        case 'termsAccepted':\n          fieldErrors.termsAccepted = translate('onboarding.form.termsRequired', 'Please accept the terms to continue.')\n          break\n        default:\n          break\n      }\n    }\n    return NextResponse.json({\n      ok: false,\n      error: translate('onboarding.form.genericError', 'Please check the form and try again.'),\n      fieldErrors,\n    }, { status: 400 })\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n\n    const existingUser = await em.findOne(User, { email: parsed.data.email })\n    if (existingUser) {\n      const message = translate('onboarding.errors.emailExists', 'We already have an account with this email. Try signing in or resetting your password.')\n      return NextResponse.json({\n        ok: false,\n        error: message,\n        fieldErrors: { email: message },\n      }, { status: 409 })\n    }\n\n    const service = new OnboardingService(em)\n    let request, token\n    try {\n      const result = await service.createOrUpdateRequest(parsed.data)\n      request = result.request\n      token = result.token\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('PENDING_REQUEST:')) {\n        const minutes = Number(err.message.split(':')[1] || '10')\n        const message = translate('onboarding.errors.pendingRequest', 'We already have a pending verification. Please try again in about {minutes} minutes or contact the administrator.', { minutes })\n        return NextResponse.json({\n          ok: false,\n          error: message,\n          fieldErrors: { email: message },\n        }, { status: 409 })\n      }\n      throw err\n    }\n\n    let baseUrl: string\n    try {\n      baseUrl = getSecurityEmailBaseUrl(req)\n    } catch (error) {\n      const mapped = mapSecurityEmailUrlError(error, {\n        scope: 'onboarding.start',\n        configMessage: 'Self-service onboarding is not configured.',\n      })\n      if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n      throw error\n    }\n    const verifyUrl = `${baseUrl}/api/onboarding/onboarding/verify?token=${token}`\n\n    const firstName = request.firstName || parsed.data.firstName\n    const hasMarketingConsent = request.marketingConsent === true\n    const marketingConsentText = hasMarketingConsent\n      ? translate('onboarding.email.marketingConsentYes', 'Marketing consent: Yes')\n      : translate('onboarding.email.marketingConsentNo', 'Marketing consent: No')\n    const subject = translate('onboarding.email.subject', 'Confirm your email to finish onboarding')\n    const emailCopy = {\n      preview: translate('onboarding.email.preview', 'Confirm your email to activate your Open Mercato workspace'),\n      heading: translate('onboarding.email.heading', 'Welcome to Open Mercato'),\n      greeting: translate('onboarding.email.greeting', 'Hi {firstName},', { firstName }),\n      body: translate(\n        'onboarding.email.body',\n        'We just need to confirm your email address to finish setting up the organization {organizationName}.',\n        { organizationName: request.organizationName },\n      ),\n      cta: translate('onboarding.email.cta', 'Confirm email & activate workspace'),\n      expiry: translate(\n        'onboarding.email.expiry',\n        \"The link will expire in 24 hours. If you didn't request this, you can safely ignore this message.\",\n      ),\n      marketingConsent: marketingConsentText,\n      footer: translate('onboarding.email.footer', 'Open Mercato \u00B7 Onboarding service'),\n    }\n    const emailReact = VerificationEmail({ verifyUrl, copy: emailCopy })\n    try {\n      await sendEmail({ to: request.email, subject, react: emailReact })\n    } catch (err) {\n      request.lastEmailSentAt = null\n      await em.flush()\n      console.error('[onboarding.start] verification email failed', err)\n      return NextResponse.json({\n        ok: false,\n        error: translate(\n          'onboarding.errors.emailSendFailed',\n          'We could not send the verification email. Please try again or contact support.',\n        ),\n      }, { status: 502 })\n    }\n\n    const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'\n    const adminSubject = translate('onboarding.email.adminSubject', 'New self-service onboarding request')\n    const adminCopy = {\n      preview: translate('onboarding.email.adminPreview', 'New onboarding request submitted'),\n      heading: translate('onboarding.email.adminHeading', 'New onboarding request'),\n      body: translate('onboarding.email.adminBody', '{firstName} {lastName} ({email}) submitted an onboarding request for {organizationName}.', {\n        firstName: request.firstName,\n        lastName: request.lastName,\n        email: request.email,\n        organizationName: request.organizationName,\n      }),\n      marketingConsent: marketingConsentText,\n      footer: translate('onboarding.email.adminFooter', 'You can review the tenant after verification is complete.'),\n    }\n    try {\n      await sendEmail({\n        to: adminEmail,\n        subject: adminSubject,\n        react: AdminNotificationEmail({ copy: adminCopy }),\n      })\n    } catch (err) {\n      console.error('[onboarding.start] admin email failed', err)\n    }\n\n    return NextResponse.json({ ok: true, email: request.email })\n  } catch (error) {\n    console.error('[onboarding.start] failed', error)\n    return NextResponse.json({\n      ok: false,\n      error: translate('onboarding.form.genericError', 'Something went wrong. Please try again later.'),\n    }, { status: 500 })\n  }\n}\n\nexport default POST\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingSuccessSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nconst onboardingErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n  fieldErrors: z.record(z.string(), z.string()).optional(),\n})\n\nconst onboardingPostDoc: OpenApiMethodDoc = {\n  summary: 'Submit onboarding request',\n  description: 'Accepts a self-service onboarding form submission and triggers email verification.',\n  tags: [onboardingTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: onboardingStartSchema,\n    description: 'Onboarding form payload with contact and organization information.',\n  },\n  responses: [\n    { status: 200, description: 'Onboarding request accepted.', schema: onboardingSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: onboardingErrorSchema },\n    { status: 404, description: 'Self-service onboarding disabled', schema: onboardingErrorSchema },\n    { status: 409, description: 'Existing account or pending request', schema: onboardingErrorSchema },\n    { status: 500, description: 'Unexpected server error', schema: onboardingErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Self-service onboarding submission',\n  methods: {\n    POST: onboardingPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,sBAAsB;AAC/B,SAAS,eAAe,eAA4B;AACpD,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB;AAClC,OAAO,uBAAuB;AAC9B,OAAO,4BAA4B;AACnC,SAAS,YAAY;AAErB,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,EACf;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI,kBAAkB,QAAQ,IAAI,mCAAmC,EAAE,MAAM,MAAM;AACjF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,YACJ,WAAW,OAAO,YAAY,YAAY,YAAY,WAAW,OAAQ,QAAgB,WAAW,WAC/F,QAAgB,SACjB;AACN,QAAM,SAAiB,aAAa,QAAQ,SAAS,SAAmB,IACnE,YACD;AACJ,QAAM,OAAO,MAAM,eAAe,MAAM;AACxC,QAAM,YAAY,yBAAyB,IAAI;AAC/C,QAAM,uBAAuB;AAAA,IAC3B,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,UAAU,OAAO;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,cAAsC,CAAC;AAC7C,eAAW,SAAS,OAAO,MAAM,QAAQ;AACvC,YAAM,OAAO,MAAM,KAAK,CAAC;AACzB,UAAI,CAAC,KAAM;AACX,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,sBAAY,QAAQ,UAAU,kCAAkC,2BAA2B;AAC3F;AAAA,QACF,KAAK;AACH,sBAAY,YAAY,UAAU,uCAAuC,yBAAyB;AAClG;AAAA,QACF,KAAK;AACH,sBAAY,WAAW,UAAU,sCAAsC,wBAAwB;AAC/F;AAAA,QACF,KAAK;AACH,sBAAY,mBAAmB,UAAU,8CAA8C,gCAAgC;AACvH;AAAA,QACF,KAAK;AACH,sBAAY,WAAW;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,cAAc,qBAAqB;AAAA,UACvC;AACA;AAAA,QACF,KAAK;AACH,sBAAY,kBAAkB,UAAU,sCAAsC,uBAAuB;AACrG;AAAA,QACF,KAAK;AACH,sBAAY,gBAAgB,UAAU,iCAAiC,sCAAsC;AAC7G;AAAA,QACF;AACE;AAAA,MACJ;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,OAAO,UAAU,gCAAgC,sCAAsC;AAAA,MACvF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAElC,UAAM,eAAe,MAAM,GAAG,QAAQ,MAAM,EAAE,OAAO,OAAO,KAAK,MAAM,CAAC;AACxE,QAAI,cAAc;AAChB,YAAM,UAAU,UAAU,iCAAiC,wFAAwF;AACnJ,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa,EAAE,OAAO,QAAQ;AAAA,MAChC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAEA,UAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAI,SAAS;AACb,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,sBAAsB,OAAO,IAAI;AAC9D,gBAAU,OAAO;AACjB,cAAQ,OAAO;AAAA,IACjB,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,kBAAkB,GAAG;AACtE,cAAM,UAAU,OAAO,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI;AACxD,cAAM,UAAU,UAAU,oCAAoC,qHAAqH,EAAE,QAAQ,CAAC;AAC9L,eAAO,aAAa,KAAK;AAAA,UACvB,IAAI;AAAA,UACJ,OAAO;AAAA,UACP,aAAa,EAAE,OAAO,QAAQ;AAAA,QAChC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,YAAM;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,wBAAwB,GAAG;AAAA,IACvC,SAAS,OAAO;AACd,YAAM,SAAS,yBAAyB,OAAO;AAAA,QAC7C,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,CAAC;AACD,UAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,YAAM;AAAA,IACR;AACA,UAAM,YAAY,GAAG,OAAO,2CAA2C,KAAK;AAE5E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK;AACnD,UAAM,sBAAsB,QAAQ,qBAAqB;AACzD,UAAM,uBAAuB,sBACzB,UAAU,wCAAwC,wBAAwB,IAC1E,UAAU,uCAAuC,uBAAuB;AAC5E,UAAM,UAAU,UAAU,4BAA4B,yCAAyC;AAC/F,UAAM,YAAY;AAAA,MAChB,SAAS,UAAU,4BAA4B,4DAA4D;AAAA,MAC3G,SAAS,UAAU,4BAA4B,yBAAyB;AAAA,MACxE,UAAU,UAAU,6BAA6B,mBAAmB,EAAE,UAAU,CAAC;AAAA,MACjF,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,kBAAkB,QAAQ,iBAAiB;AAAA,MAC/C;AAAA,MACA,KAAK,UAAU,wBAAwB,oCAAoC;AAAA,MAC3E,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,MACA,kBAAkB;AAAA,MAClB,QAAQ,UAAU,2BAA2B,sCAAmC;AAAA,IAClF;AACA,UAAM,aAAa,kBAAkB,EAAE,WAAW,MAAM,UAAU,CAAC;AACnE,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,WAAW,CAAC;AAAA,IACnE,SAAS,KAAK;AACZ,cAAQ,kBAAkB;AAC1B,YAAM,GAAG,MAAM;AACf,cAAQ,MAAM,gDAAgD,GAAG;AACjE,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAEA,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,UAAM,eAAe,UAAU,iCAAiC,qCAAqC;AACrG,UAAM,YAAY;AAAA,MAChB,SAAS,UAAU,iCAAiC,kCAAkC;AAAA,MACtF,SAAS,UAAU,iCAAiC,wBAAwB;AAAA,MAC5E,MAAM,UAAU,8BAA8B,4FAA4F;AAAA,QACxI,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,MACD,kBAAkB;AAAA,MAClB,QAAQ,UAAU,gCAAgC,2DAA2D;AAAA,IAC/G;AACA,QAAI;AACF,YAAM,UAAU;AAAA,QACd,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAAA,MACnD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,MAAM,yCAAyC,GAAG;AAAA,IAC5D;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC7D,SAAS,OAAO;AACd,YAAQ,MAAM,6BAA6B,KAAK;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,OAAO,UAAU,gCAAgC,+CAA+C;AAAA,IAClG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACF;AAEA,IAAO,qBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AACzD,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,wBAAwB;AAAA,EAC9F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,sBAAsB;AAAA,IAC/E,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,sBAAsB;AAAA,IAC9F,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,sBAAsB;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport { loadDictionary } from '@open-mercato/shared/lib/i18n/server'\nimport { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'\nimport { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { onboardingStartSchema } from '@open-mercato/onboarding/modules/onboarding/data/validators'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport VerificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/VerificationEmail'\nimport AdminNotificationEmail from '@open-mercato/onboarding/modules/onboarding/emails/AdminNotificationEmail'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\n\nexport const metadata = {\n  path: '/onboarding/onboarding',\n  POST: {\n    requireAuth: false,\n    rateLimit: readEndpointRateLimitConfig('ONBOARDING', {\n      points: 10,\n      duration: 60,\n      blockDuration: 60,\n      keyPrefix: 'onboarding',\n    }),\n  },\n}\n\nexport async function POST(req: Request) {\n  if (parseBooleanToken(process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? '') !== true) {\n    return NextResponse.json({ ok: false, error: 'Self-service onboarding is disabled.' }, { status: 404 })\n  }\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const rawLocale =\n    payload && typeof payload === 'object' && 'locale' in payload && typeof (payload as any).locale === 'string'\n      ? (payload as any).locale as string\n      : null\n  const locale: Locale = rawLocale && locales.includes(rawLocale as Locale)\n    ? (rawLocale as Locale)\n    : defaultLocale\n  const dict = await loadDictionary(locale)\n  const translate = createFallbackTranslator(dict)\n  const passwordRequirements = formatPasswordRequirements(\n    getPasswordPolicy(),\n    translate,\n    'onboarding.password.requirements',\n  )\n\n  const parsed = onboardingStartSchema.safeParse(payload)\n  if (!parsed.success) {\n    const fieldErrors: Record<string, string> = {}\n    for (const issue of parsed.error.issues) {\n      const path = issue.path[0]\n      if (!path) continue\n      switch (path) {\n        case 'email':\n          fieldErrors.email = translate('onboarding.errors.emailInvalid', 'Enter a valid work email.')\n          break\n        case 'firstName':\n          fieldErrors.firstName = translate('onboarding.errors.firstNameRequired', 'First name is required.')\n          break\n        case 'lastName':\n          fieldErrors.lastName = translate('onboarding.errors.lastNameRequired', 'Last name is required.')\n          break\n        case 'organizationName':\n          fieldErrors.organizationName = translate('onboarding.errors.organizationNameRequired', 'Organization name is required.')\n          break\n        case 'password':\n          fieldErrors.password = translate(\n            'onboarding.errors.passwordRequired',\n            'Password must meet the requirements: {requirements}.',\n            { requirements: passwordRequirements },\n          )\n          break\n        case 'confirmPassword':\n          fieldErrors.confirmPassword = translate('onboarding.errors.passwordMismatch', 'Passwords must match.')\n          break\n        case 'termsAccepted':\n          fieldErrors.termsAccepted = translate('onboarding.form.termsRequired', 'Please accept the terms to continue.')\n          break\n        default:\n          break\n      }\n    }\n    return NextResponse.json({\n      ok: false,\n      error: translate('onboarding.form.genericError', 'Please check the form and try again.'),\n      fieldErrors,\n    }, { status: 400 })\n  }\n\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n\n    const existingUser = await em.findOne(User, { email: parsed.data.email })\n    if (existingUser) {\n      const message = translate('onboarding.errors.emailExists', 'We already have an account with this email. Try signing in or resetting your password.')\n      return NextResponse.json({\n        ok: false,\n        error: message,\n        fieldErrors: { email: message },\n      }, { status: 409 })\n    }\n\n    const service = new OnboardingService(em)\n    let request, token\n    try {\n      const result = await service.createOrUpdateRequest(parsed.data)\n      request = result.request\n      token = result.token\n    } catch (err) {\n      if (err instanceof Error && err.message.startsWith('PENDING_REQUEST:')) {\n        const minutes = Number(err.message.split(':')[1] || '10')\n        const message = translate('onboarding.errors.pendingRequest', 'We already have a pending verification. Please try again in about {minutes} minutes or contact the administrator.', { minutes })\n        return NextResponse.json({\n          ok: false,\n          error: message,\n          fieldErrors: { email: message },\n        }, { status: 409 })\n      }\n      throw err\n    }\n\n    let baseUrl: string\n    try {\n      baseUrl = getSecurityEmailBaseUrl(req)\n    } catch (error) {\n      const mapped = mapSecurityEmailUrlError(error, {\n        scope: 'onboarding.start',\n        configMessage: 'Self-service onboarding is not configured.',\n      })\n      if (mapped) return NextResponse.json({ ok: false, error: mapped.body.error }, { status: mapped.status })\n      throw error\n    }\n    const verifyUrl = `${baseUrl}/api/onboarding/onboarding/verify?token=${token}`\n\n    const firstName = request.firstName || parsed.data.firstName\n    const hasMarketingConsent = request.marketingConsent === true\n    const marketingConsentText = hasMarketingConsent\n      ? translate('onboarding.email.marketingConsentYes', 'Marketing consent: Yes')\n      : translate('onboarding.email.marketingConsentNo', 'Marketing consent: No')\n    const subject = translate('onboarding.email.subject', 'Confirm your email to finish onboarding')\n    const emailCopy = {\n      preview: translate('onboarding.email.preview', 'Confirm your email to activate your Open Mercato workspace'),\n      heading: translate('onboarding.email.heading', 'Welcome to Open Mercato'),\n      greeting: translate('onboarding.email.greeting', 'Hi {firstName},', { firstName }),\n      body: translate(\n        'onboarding.email.body',\n        'We just need to confirm your email address to finish setting up the organization {organizationName}.',\n        { organizationName: request.organizationName },\n      ),\n      cta: translate('onboarding.email.cta', 'Confirm email & activate workspace'),\n      expiry: translate(\n        'onboarding.email.expiry',\n        \"The link will expire in 24 hours. If you didn't request this, you can safely ignore this message.\",\n      ),\n      marketingConsent: marketingConsentText,\n      footer: translate('onboarding.email.footer', 'Open Mercato \u00B7 Onboarding service'),\n    }\n    const emailReact = VerificationEmail({ verifyUrl, copy: emailCopy })\n    try {\n      await sendEmail({ to: request.email, subject, react: emailReact })\n    } catch (err) {\n      request.lastEmailSentAt = null\n      await em.flush()\n      console.error('[onboarding.start] verification email failed', err)\n      return NextResponse.json({\n        ok: false,\n        error: translate(\n          'onboarding.errors.emailSendFailed',\n          'We could not send the verification email. Please try again or contact support.',\n        ),\n      }, { status: 502 })\n    }\n\n    const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'\n    const adminSubject = translate('onboarding.email.adminSubject', 'New self-service onboarding request')\n    const adminCopy = {\n      preview: translate('onboarding.email.adminPreview', 'New onboarding request submitted'),\n      heading: translate('onboarding.email.adminHeading', 'New onboarding request'),\n      body: translate('onboarding.email.adminBody', '{firstName} {lastName} ({email}) submitted an onboarding request for {organizationName}.', {\n        firstName: request.firstName,\n        lastName: request.lastName,\n        email: request.email,\n        organizationName: request.organizationName,\n      }),\n      marketingConsent: marketingConsentText,\n      footer: translate('onboarding.email.adminFooter', 'You can review the tenant after verification is complete.'),\n    }\n    try {\n      await sendEmail({\n        to: adminEmail,\n        subject: adminSubject,\n        react: AdminNotificationEmail({ copy: adminCopy }),\n      })\n    } catch (err) {\n      console.error('[onboarding.start] admin email failed', err)\n    }\n\n    return NextResponse.json({ ok: true, email: request.email })\n  } catch (error) {\n    console.error('[onboarding.start] failed', error)\n    return NextResponse.json({\n      ok: false,\n      error: translate('onboarding.form.genericError', 'Something went wrong. Please try again later.'),\n    }, { status: 500 })\n  }\n}\n\nexport default POST\n\nconst onboardingTag = 'Onboarding'\n\nconst onboardingSuccessSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nconst onboardingErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n  fieldErrors: z.record(z.string(), z.string()).optional(),\n})\n\nconst onboardingPostDoc: OpenApiMethodDoc = {\n  summary: 'Submit onboarding request',\n  description: 'Accepts a self-service onboarding form submission and triggers email verification.',\n  tags: [onboardingTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: onboardingStartSchema,\n    description: 'Onboarding form payload with contact and organization information.',\n  },\n  responses: [\n    { status: 200, description: 'Onboarding request accepted.', schema: onboardingSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: onboardingErrorSchema },\n    { status: 404, description: 'Self-service onboarding disabled', schema: onboardingErrorSchema },\n    { status: 409, description: 'Existing account or pending request', schema: onboardingErrorSchema },\n    { status: 429, description: 'Too many onboarding submissions from this IP', schema: rateLimitErrorSchema },\n    { status: 500, description: 'Unexpected server error', schema: onboardingErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: onboardingTag,\n  summary: 'Self-service onboarding submission',\n  methods: {\n    POST: onboardingPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,sBAAsB;AAC/B,SAAS,eAAe,eAA4B;AACpD,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,6BAA6B;AACtC,SAAS,yBAAyB;AAClC,OAAO,uBAAuB;AAC9B,OAAO,4BAA4B;AACnC,SAAS,YAAY;AAErB,SAAS,4BAA4B,yBAAyB;AAC9D,SAAS,yBAAyB;AAClC,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AAE9B,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,WAAW,4BAA4B,cAAc;AAAA,MACnD,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,eAAe;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI,kBAAkB,QAAQ,IAAI,mCAAmC,EAAE,MAAM,MAAM;AACjF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AACA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,YACJ,WAAW,OAAO,YAAY,YAAY,YAAY,WAAW,OAAQ,QAAgB,WAAW,WAC/F,QAAgB,SACjB;AACN,QAAM,SAAiB,aAAa,QAAQ,SAAS,SAAmB,IACnE,YACD;AACJ,QAAM,OAAO,MAAM,eAAe,MAAM;AACxC,QAAM,YAAY,yBAAyB,IAAI;AAC/C,QAAM,uBAAuB;AAAA,IAC3B,kBAAkB;AAAA,IAClB;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,UAAU,OAAO;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,cAAsC,CAAC;AAC7C,eAAW,SAAS,OAAO,MAAM,QAAQ;AACvC,YAAM,OAAO,MAAM,KAAK,CAAC;AACzB,UAAI,CAAC,KAAM;AACX,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,sBAAY,QAAQ,UAAU,kCAAkC,2BAA2B;AAC3F;AAAA,QACF,KAAK;AACH,sBAAY,YAAY,UAAU,uCAAuC,yBAAyB;AAClG;AAAA,QACF,KAAK;AACH,sBAAY,WAAW,UAAU,sCAAsC,wBAAwB;AAC/F;AAAA,QACF,KAAK;AACH,sBAAY,mBAAmB,UAAU,8CAA8C,gCAAgC;AACvH;AAAA,QACF,KAAK;AACH,sBAAY,WAAW;AAAA,YACrB;AAAA,YACA;AAAA,YACA,EAAE,cAAc,qBAAqB;AAAA,UACvC;AACA;AAAA,QACF,KAAK;AACH,sBAAY,kBAAkB,UAAU,sCAAsC,uBAAuB;AACrG;AAAA,QACF,KAAK;AACH,sBAAY,gBAAgB,UAAU,iCAAiC,sCAAsC;AAC7G;AAAA,QACF;AACE;AAAA,MACJ;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,OAAO,UAAU,gCAAgC,sCAAsC;AAAA,MACvF;AAAA,IACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAElC,UAAM,eAAe,MAAM,GAAG,QAAQ,MAAM,EAAE,OAAO,OAAO,KAAK,MAAM,CAAC;AACxE,QAAI,cAAc;AAChB,YAAM,UAAU,UAAU,iCAAiC,wFAAwF;AACnJ,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,aAAa,EAAE,OAAO,QAAQ;AAAA,MAChC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAEA,UAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAI,SAAS;AACb,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,sBAAsB,OAAO,IAAI;AAC9D,gBAAU,OAAO;AACjB,cAAQ,OAAO;AAAA,IACjB,SAAS,KAAK;AACZ,UAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,kBAAkB,GAAG;AACtE,cAAM,UAAU,OAAO,IAAI,QAAQ,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI;AACxD,cAAM,UAAU,UAAU,oCAAoC,qHAAqH,EAAE,QAAQ,CAAC;AAC9L,eAAO,aAAa,KAAK;AAAA,UACvB,IAAI;AAAA,UACJ,OAAO;AAAA,UACP,aAAa,EAAE,OAAO,QAAQ;AAAA,QAChC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,YAAM;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,wBAAwB,GAAG;AAAA,IACvC,SAAS,OAAO;AACd,YAAM,SAAS,yBAAyB,OAAO;AAAA,QAC7C,OAAO;AAAA,QACP,eAAe;AAAA,MACjB,CAAC;AACD,UAAI,OAAQ,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AACvG,YAAM;AAAA,IACR;AACA,UAAM,YAAY,GAAG,OAAO,2CAA2C,KAAK;AAE5E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK;AACnD,UAAM,sBAAsB,QAAQ,qBAAqB;AACzD,UAAM,uBAAuB,sBACzB,UAAU,wCAAwC,wBAAwB,IAC1E,UAAU,uCAAuC,uBAAuB;AAC5E,UAAM,UAAU,UAAU,4BAA4B,yCAAyC;AAC/F,UAAM,YAAY;AAAA,MAChB,SAAS,UAAU,4BAA4B,4DAA4D;AAAA,MAC3G,SAAS,UAAU,4BAA4B,yBAAyB;AAAA,MACxE,UAAU,UAAU,6BAA6B,mBAAmB,EAAE,UAAU,CAAC;AAAA,MACjF,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,kBAAkB,QAAQ,iBAAiB;AAAA,MAC/C;AAAA,MACA,KAAK,UAAU,wBAAwB,oCAAoC;AAAA,MAC3E,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,MACF;AAAA,MACA,kBAAkB;AAAA,MAClB,QAAQ,UAAU,2BAA2B,sCAAmC;AAAA,IAClF;AACA,UAAM,aAAa,kBAAkB,EAAE,WAAW,MAAM,UAAU,CAAC;AACnE,QAAI;AACF,YAAM,UAAU,EAAE,IAAI,QAAQ,OAAO,SAAS,OAAO,WAAW,CAAC;AAAA,IACnE,SAAS,KAAK;AACZ,cAAQ,kBAAkB;AAC1B,YAAM,GAAG,MAAM;AACf,cAAQ,MAAM,gDAAgD,GAAG;AACjE,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAEA,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,UAAM,eAAe,UAAU,iCAAiC,qCAAqC;AACrG,UAAM,YAAY;AAAA,MAChB,SAAS,UAAU,iCAAiC,kCAAkC;AAAA,MACtF,SAAS,UAAU,iCAAiC,wBAAwB;AAAA,MAC5E,MAAM,UAAU,8BAA8B,4FAA4F;AAAA,QACxI,WAAW,QAAQ;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA,QACf,kBAAkB,QAAQ;AAAA,MAC5B,CAAC;AAAA,MACD,kBAAkB;AAAA,MAClB,QAAQ,UAAU,gCAAgC,2DAA2D;AAAA,IAC/G;AACA,QAAI;AACF,YAAM,UAAU;AAAA,QACd,IAAI;AAAA,QACJ,SAAS;AAAA,QACT,OAAO,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAAA,MACnD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,cAAQ,MAAM,yCAAyC,GAAG;AAAA,IAC5D;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,QAAQ,MAAM,CAAC;AAAA,EAC7D,SAAS,OAAO;AACd,YAAQ,MAAM,6BAA6B,KAAK;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,OAAO,UAAU,gCAAgC,+CAA+C;AAAA,IAClG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACF;AAEA,IAAO,qBAAQ;AAEf,MAAM,gBAAgB;AAEtB,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AACzD,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,wBAAwB;AAAA,EAC9F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,sBAAsB;AAAA,IAC/E,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,sBAAsB;AAAA,IAC9F,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,sBAAsB;AAAA,IACjG,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,qBAAqB;AAAA,IACzG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }