@open-mercato/onboarding 0.6.6-develop.5412.1.e2a52b14f0 → 0.6.6-develop.5431.1.384a97c7a2

package/src/modules/onboarding/i18n/de.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "Wir schließen die Vorbereitung der Demo-Umgebung für {tenant} ab. Sobald alles bereit ist, senden wir Ihnen eine E-Mail mit dem korrekten Tenant-Login-Link.",
   "onboarding.preparing.emailNotice": "Sie müssen diese Seite nicht geöffnet lassen. Wir senden Ihnen eine E-Mail, sobald alles bereit ist.",
   "onboarding.preparing.homeCta": "Zur Startseite",
+  "onboarding.preparing.loginCta": "Tenant-Login öffnen",
   "onboarding.preparing.redirecting": "Ihr Arbeitsbereich ist bereit. Wir leiten Sie jetzt zur Tenant-Anmeldung weiter.",
+  "onboarding.preparing.statusErrorBody": "Der Arbeitsbereichstatus konnte nicht geprüft werden. Der Arbeitsbereich wird möglicherweise noch vorbereitet; diese Seite versucht es weiter.",
+  "onboarding.preparing.statusErrorTitle": "Statusprüfung fehlgeschlagen",
   "onboarding.preparing.title": "Wir bereiten Ihren Arbeitsbereich vor",
   "onboarding.readyEmail.body": "Ihr Open Mercato-Arbeitsbereich für {organizationName} ist fertig vorbereitet. Verwenden Sie den sicheren Link unten, um sich anzumelden.",
   "onboarding.readyEmail.cta": "Login öffnen",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Ihr Arbeitsbereich ist bereit. Verwenden Sie Ihren sicheren Login-Link zur Anmeldung.",
   "onboarding.readyEmail.subject": "Ihr Open Mercato-Arbeitsbereich ist bereit",
   "onboarding.subtitle": "Erzählen Sie uns ein wenig über sich und wir richten alles für Sie ein.",
-  "onboarding.title": "Erstellen Sie Ihren Open Mercato-Arbeitsbereich"
+  "onboarding.title": "Erstellen Sie Ihren Open Mercato-Arbeitsbereich",
+  "onboarding.verifyStatus.alreadyExists": "Es existiert bereits ein Konto mit dieser E-Mail-Adresse. Versuchen Sie, sich anzumelden oder Ihr Passwort zurückzusetzen.",
+  "onboarding.verifyStatus.error": "Die Verifizierung konnte nicht abgeschlossen werden. Bitte versuchen Sie es erneut oder kontaktieren Sie den Support.",
+  "onboarding.verifyStatus.invalid": "Der Verifizierungslink ist ungültig oder abgelaufen. Senden Sie das Onboarding-Formular erneut, um einen neuen Link zu erhalten.",
+  "onboarding.verifyStatus.originNotAllowed": "Der Verifizierungslink wurde von einem nicht erlaubten Origin geöffnet. Prüfen Sie APP_URL und APP_ALLOWED_ORIGINS und öffnen Sie den Link erneut.",
+  "onboarding.verifyStatus.redirectMisconfigured": "Der Verifizierungslink kann nicht sicher weiterleiten, weil APP_URL nicht zur URL passt, die die Anfrage verarbeitet hat. Prüfen Sie APP_URL und APP_ALLOWED_ORIGINS und öffnen Sie den Link erneut.",
+  "onboarding.verifyStatus.urlNotConfigured": "Die Onboarding-Verifizierung ist nicht konfiguriert. APP_URL muss gesetzt sein, bevor Verifizierungslinks verwendet werden können."
 }

package/src/modules/onboarding/i18n/en.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "We are finishing the demo environment for {tenant}. We will send you an email with the correct tenant login link as soon as it is ready.",
   "onboarding.preparing.emailNotice": "You do not need to keep this page open. We will email you when everything is ready.",
   "onboarding.preparing.homeCta": "Go to home page",
+  "onboarding.preparing.loginCta": "Open tenant login",
   "onboarding.preparing.redirecting": "Your workspace is ready. Redirecting you to the tenant login page now.",
+  "onboarding.preparing.statusErrorBody": "We could not check the workspace status. The workspace may still be preparing; this page will keep retrying.",
+  "onboarding.preparing.statusErrorTitle": "Workspace status check failed",
   "onboarding.preparing.title": "We are preparing your workspace",
   "onboarding.readyEmail.body": "Your Open Mercato workspace for {organizationName} has finished preparing. Use the secure link below to sign in.",
   "onboarding.readyEmail.cta": "Open login",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Your workspace is ready. Use your secure login link to sign in.",
   "onboarding.readyEmail.subject": "Your Open Mercato workspace is ready",
   "onboarding.subtitle": "Tell us a bit about you and we will set everything up.",
-  "onboarding.title": "Create your Open Mercato workspace"
+  "onboarding.title": "Create your Open Mercato workspace",
+  "onboarding.verifyStatus.alreadyExists": "We already have an account with this email. Try signing in or resetting your password.",
+  "onboarding.verifyStatus.error": "We could not complete verification. Please try again or contact support.",
+  "onboarding.verifyStatus.invalid": "The verification link is invalid or expired. Submit the onboarding form again to receive a new link.",
+  "onboarding.verifyStatus.originNotAllowed": "The verification link was opened from an origin that is not allowed. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.",
+  "onboarding.verifyStatus.redirectMisconfigured": "The verification link cannot redirect safely because APP_URL does not match the URL that handled the request. Check APP_URL and APP_ALLOWED_ORIGINS, then open the verification link again.",
+  "onboarding.verifyStatus.urlNotConfigured": "Onboarding verification is not configured. APP_URL must be set before verification links can be used."
 }

package/src/modules/onboarding/i18n/es.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "Estamos terminando de preparar el entorno de demostración para {tenant}. Le enviaremos un correo con el enlace correcto de acceso al tenant en cuanto esté listo.",
   "onboarding.preparing.emailNotice": "No necesita mantener esta página abierta. Le enviaremos un correo cuando todo esté listo.",
   "onboarding.preparing.homeCta": "Ir a la página principal",
+  "onboarding.preparing.loginCta": "Abrir acceso al tenant",
   "onboarding.preparing.redirecting": "Su espacio de trabajo ya está listo. Ahora le redirigimos a la página de acceso del tenant.",
+  "onboarding.preparing.statusErrorBody": "No pudimos comprobar el estado del espacio de trabajo. Es posible que aún se esté preparando; esta página seguirá intentándolo.",
+  "onboarding.preparing.statusErrorTitle": "Falló la comprobación de estado",
   "onboarding.preparing.title": "Estamos preparando su espacio de trabajo",
   "onboarding.readyEmail.body": "Su espacio de trabajo de Open Mercato para {organizationName} ya está listo. Use el enlace seguro de abajo para iniciar sesión.",
   "onboarding.readyEmail.cta": "Abrir acceso",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Su espacio de trabajo está listo. Use su enlace seguro de acceso para iniciar sesión.",
   "onboarding.readyEmail.subject": "Su espacio de trabajo de Open Mercato está listo",
   "onboarding.subtitle": "Cuéntenos un poco sobre usted y configuraremos todo.",
-  "onboarding.title": "Cree su espacio de trabajo en Open Mercato"
+  "onboarding.title": "Cree su espacio de trabajo en Open Mercato",
+  "onboarding.verifyStatus.alreadyExists": "Ya tenemos una cuenta con este correo electrónico. Intente iniciar sesión o restablecer su contraseña.",
+  "onboarding.verifyStatus.error": "No pudimos completar la verificación. Intente de nuevo o comuníquese con soporte.",
+  "onboarding.verifyStatus.invalid": "El enlace de verificación no es válido o caducó. Envíe de nuevo el formulario de onboarding para recibir un enlace nuevo.",
+  "onboarding.verifyStatus.originNotAllowed": "El enlace de verificación se abrió desde un origen no permitido. Revise APP_URL y APP_ALLOWED_ORIGINS y abra el enlace de nuevo.",
+  "onboarding.verifyStatus.redirectMisconfigured": "El enlace de verificación no puede redirigir de forma segura porque APP_URL no coincide con la URL que procesó la solicitud. Revise APP_URL y APP_ALLOWED_ORIGINS y abra el enlace de nuevo.",
+  "onboarding.verifyStatus.urlNotConfigured": "La verificación de onboarding no está configurada. APP_URL debe estar definido antes de usar enlaces de verificación."
 }

package/src/modules/onboarding/i18n/pl.json

@@ -77,7 +77,10 @@
   "onboarding.preparing.descriptionWithTenant": "Kończymy przygotowywać środowisko demo dla {tenant}. Gdy będzie gotowe, wyślemy Ci e-mail z poprawnym linkiem logowania do tenanta.",
   "onboarding.preparing.emailNotice": "Nie musisz zostawiać tej strony otwartej. Gdy wszystko będzie gotowe, wyślemy Ci e-mail.",
   "onboarding.preparing.homeCta": "Przejdź na stronę główną",
+  "onboarding.preparing.loginCta": "Otwórz logowanie do tenanta",
   "onboarding.preparing.redirecting": "Twój obszar roboczy jest gotowy. Przekierowujemy Cię teraz do strony logowania tenanta.",
+  "onboarding.preparing.statusErrorBody": "Nie udało się sprawdzić statusu obszaru roboczego. Obszar może nadal się przygotowywać; ta strona będzie ponawiać próbę.",
+  "onboarding.preparing.statusErrorTitle": "Nie udało się sprawdzić statusu obszaru",
   "onboarding.preparing.title": "Przygotowujemy Twój obszar roboczy",
   "onboarding.readyEmail.body": "Twój obszar roboczy Open Mercato dla {organizationName} jest już gotowy. Użyj bezpiecznego linku poniżej, aby się zalogować.",
   "onboarding.readyEmail.cta": "Otwórz logowanie",
@@ -87,5 +90,11 @@
   "onboarding.readyEmail.preview": "Twój obszar roboczy jest gotowy. Użyj bezpiecznego linku logowania, aby się zalogować.",
   "onboarding.readyEmail.subject": "Twój obszar roboczy Open Mercato jest gotowy",
   "onboarding.subtitle": "Opowiedz nam trochę o sobie, a my wszystko skonfigurujemy.",
-  "onboarding.title": "Utwórz swój obszar roboczy Open Mercato"
+  "onboarding.title": "Utwórz swój obszar roboczy Open Mercato",
+  "onboarding.verifyStatus.alreadyExists": "Mamy już konto z tym adresem email. Spróbuj się zalogować lub zresetować hasło.",
+  "onboarding.verifyStatus.error": "Nie udało się zakończyć weryfikacji. Spróbuj ponownie lub skontaktuj się z pomocą techniczną.",
+  "onboarding.verifyStatus.invalid": "Link weryfikacyjny jest nieprawidłowy albo wygasł. Wyślij formularz onboardingu ponownie, aby otrzymać nowy link.",
+  "onboarding.verifyStatus.originNotAllowed": "Link weryfikacyjny otwarto z niedozwolonego originu. Sprawdź APP_URL i APP_ALLOWED_ORIGINS, a potem otwórz link ponownie.",
+  "onboarding.verifyStatus.redirectMisconfigured": "Link weryfikacyjny nie może bezpiecznie przekierować, bo APP_URL nie zgadza się z URL-em, który obsłużył request. Sprawdź APP_URL i APP_ALLOWED_ORIGINS, a potem otwórz link ponownie.",
+  "onboarding.verifyStatus.urlNotConfigured": "Weryfikacja onboardingu nie jest skonfigurowana. APP_URL musi być ustawiony, zanim linki weryfikacyjne będą działać."
 }

package/src/modules/onboarding/lib/deferred-provisioning.ts

@@ -0,0 +1,258 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { SearchIndexer } from '@open-mercato/search'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { flattenSystemEntityIds } from '@open-mercato/shared/lib/entities/system-entities'
+import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { getModules } from '@open-mercato/shared/lib/modules/registry'
+import type { OnboardingRequest } from '@open-mercato/onboarding/modules/onboarding/data/entities'
+import { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'
+import { sendWorkspaceReadyEmail } from '@open-mercato/onboarding/modules/onboarding/lib/ready-email'
+import { reindexEntity } from '@open-mercato/core/modules/query_index/lib/reindexer'
+import { purgeIndexScope } from '@open-mercato/core/modules/query_index/lib/purge'
+import { refreshCoverageSnapshot } from '@open-mercato/core/modules/query_index/lib/coverage'
+import { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'
+
+const VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS = 5_000
+const SEED_EXAMPLES_TIMEOUT_MS = 15_000
+
+export function resolveProvisioningIds(request: OnboardingRequest) {
+  if (!request.tenantId || !request.organizationId || !request.userId) return null
+  return {
+    tenantId: request.tenantId,
+    organizationId: request.organizationId,
+    userId: request.userId,
+  }
+}
+
+function createTimeoutPromise(label: string, timeoutMs: number): Promise<never> {
+  return new Promise((_, reject) => {
+    setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs)
+  })
+}
+
+async function runModuleSetupHook(args: {
+  moduleId: string
+  phase: 'seedExamples'
+  timeoutMs: number
+  run: () => Promise<void>
+}) {
+  const startedAt = Date.now()
+  console.info('[onboarding.verify] module hook started', {
+    moduleId: args.moduleId,
+    phase: args.phase,
+    timeoutMs: args.timeoutMs,
+  })
+  try {
+    await Promise.race([
+      args.run(),
+      createTimeoutPromise(`module ${args.moduleId} ${args.phase}`, args.timeoutMs),
+    ])
+    console.info('[onboarding.verify] module hook completed', {
+      moduleId: args.moduleId,
+      phase: args.phase,
+      durationMs: Math.max(0, Date.now() - startedAt),
+    })
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      // Deferred provisioning is re-triggered on every preparing-page status
+      // poll until preparationCompletedAt is set. seedExamples is not fully
+      // idempotent (e.g. catalog product handles are unique-scoped), so a
+      // re-run that lands before completion collides on an already-seeded row.
+      // The workspace is already provisioned and the collision is expected and
+      // harmless — log at info so genuine failures still stand out.
+      console.info('[onboarding.verify] module hook skipped (already seeded)', {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt),
+      })
+    } else {
+      console.error('[onboarding.verify] module hook failed', {
+        moduleId: args.moduleId,
+        phase: args.phase,
+        durationMs: Math.max(0, Date.now() - startedAt),
+        timeoutMs: args.timeoutMs,
+        error,
+      })
+    }
+    throw error
+  }
+}
+
+async function markWorkspaceReady(args: {
+  requestId: string
+}) {
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const service = new OnboardingService(em)
+  const request = await service.findById(args.requestId)
+  if (!request || request.preparationCompletedAt) return
+  await service.markPreparationCompleted(request, new Date())
+}
+
+async function enqueueVectorReindex(args: {
+  container: { resolve: <T = unknown>(name: string) => T }
+  tenantId: string
+  organizationId: string
+}) {
+  let searchIndexer: SearchIndexer | null = null
+  try {
+    searchIndexer = args.container.resolve<SearchIndexer>('searchIndexer')
+  } catch {
+    searchIndexer = null
+  }
+  if (!searchIndexer) return
+
+  await Promise.race([
+    searchIndexer.reindexAllToVector({
+      tenantId: args.tenantId,
+      organizationId: args.organizationId,
+      purgeFirst: true,
+      useQueue: true,
+    }),
+    createTimeoutPromise('vector reindex enqueue', VECTOR_REINDEX_ENQUEUE_TIMEOUT_MS),
+  ])
+}
+
+async function rebuildTenantQueryIndexes(args: {
+  em: EntityManager
+  tenantId: string
+  organizationId: string
+}) {
+  const coverageRefreshKeys = new Set<string>()
+  try {
+    const allEntities = getEntityIds()
+    const entityIds = flattenSystemEntityIds(allEntities)
+    for (const entityType of entityIds) {
+      try {
+        await purgeIndexScope(args.em, { entityType, tenantId: args.tenantId })
+      } catch (error) {
+        console.error('[onboarding.verify] failed to purge query index scope', {
+          entityType,
+          tenantId: args.tenantId,
+          error,
+        })
+      }
+      try {
+        await reindexEntity(args.em, {
+          entityType,
+          tenantId: args.tenantId,
+          force: true,
+          emitVectorizeEvents: false,
+          vectorService: null,
+        })
+      } catch (error) {
+        console.error('[onboarding.verify] failed to reindex entity', {
+          entityType,
+          tenantId: args.tenantId,
+          error,
+        })
+      }
+      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|__null__`)
+      coverageRefreshKeys.add(`${entityType}|${args.tenantId}|${args.organizationId}`)
+    }
+  } catch (error) {
+    console.error('[onboarding.verify] failed to rebuild query indexes', { tenantId: args.tenantId, error })
+  }
+
+  if (!coverageRefreshKeys.size) return
+
+  for (const entry of coverageRefreshKeys) {
+    const [entityType, tenantKey, orgKey] = entry.split('|')
+    const orgScope = orgKey === '__null__' ? null : orgKey
+    try {
+      await refreshCoverageSnapshot(
+        args.em,
+        {
+          entityType,
+          tenantId: tenantKey,
+          organizationId: orgScope,
+          withDeleted: false,
+        },
+      )
+    } catch (error) {
+      console.error('[onboarding.verify] failed to refresh coverage snapshot', {
+        entityType,
+        tenantId: tenantKey,
+        organizationId: orgScope,
+        error,
+      })
+    }
+  }
+}
+
+export async function runDeferredProvisioning(args: {
+  requestId: string
+  tenantId: string
+  organizationId: string
+}) {
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const modules = getModules()
+
+  for (const mod of modules) {
+    if (!mod.setup?.seedExamples) continue
+    try {
+      await runModuleSetupHook({
+        moduleId: mod.id,
+        phase: 'seedExamples',
+        timeoutMs: SEED_EXAMPLES_TIMEOUT_MS,
+        run: () => mod.setup!.seedExamples!({
+          em,
+          tenantId: args.tenantId,
+          organizationId: args.organizationId,
+          container,
+        }),
+      })
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        console.info('[onboarding.verify] deferred seedExamples skipped (already applied)', {
+          moduleId: mod.id,
+          tenantId: args.tenantId,
+          organizationId: args.organizationId,
+        })
+      } else {
+        console.error('[onboarding.verify] deferred seedExamples failed', {
+          moduleId: mod.id,
+          tenantId: args.tenantId,
+          organizationId: args.organizationId,
+          error,
+        })
+      }
+    }
+  }
+
+  await markWorkspaceReady({
+    requestId: args.requestId,
+  })
+
+  await sendWorkspaceReadyEmail({
+    requestId: args.requestId,
+    tenantId: args.tenantId,
+  }).catch((error) => {
+    console.error('[onboarding.verify] ready email failed', {
+      requestId: args.requestId,
+      tenantId: args.tenantId,
+      organizationId: args.organizationId,
+      error,
+    })
+    throw error
+  })
+
+  await rebuildTenantQueryIndexes({
+    em,
+    tenantId: args.tenantId,
+    organizationId: args.organizationId,
+  })
+
+  await enqueueVectorReindex({
+    container,
+    tenantId: args.tenantId,
+    organizationId: args.organizationId,
+  }).catch((error) => {
+    console.warn('[onboarding.verify] vector reindex enqueue did not complete promptly', {
+      tenantId: args.tenantId,
+      organizationId: args.organizationId,
+      reason: error instanceof Error ? error.message : String(error),
+    })
+  })
+}

package/src/modules/onboarding/lib/provisioning.ts

@@ -0,0 +1,35 @@
+import { isUniqueViolation } from '@open-mercato/shared/lib/crud/errors'
+
+export type BestEffortProvisioningResult = { ok: true } | { ok: false; error: unknown }
+
+type BestEffortLogger = Pick<Console, 'error' | 'info'>
+
+/**
+ * Runs a non-essential provisioning step without letting its failure abort
+ * onboarding. The tenant/org/primary user are created before these steps, so a
+ * throw or timeout here (reference-data seeding, marketing-consent recording)
+ * must NOT strand a freshly provisioned workspace — the verify handler still has
+ * to reach markCompleted so the user can sign in. Failures are logged for
+ * follow-up and reported back to the caller, never re-thrown.
+ */
+export async function runBestEffortProvisioningStep(
+  step: string,
+  run: () => Promise<void>,
+  logger: BestEffortLogger = console,
+): Promise<BestEffortProvisioningResult> {
+  try {
+    await run()
+    return { ok: true }
+  } catch (error) {
+    if (isUniqueViolation(error)) {
+      // Expected when a concurrent verify / re-verify re-applies a step against
+      // rows that already exist (seed hooks are not fully idempotent). The
+      // workspace is already provisioned, so the collision is harmless — log at
+      // info to keep genuine non-fatal failures visible.
+      logger.info('[onboarding.verify] non-fatal provisioning step skipped (already applied)', { step })
+      return { ok: false, error }
+    }
+    logger.error('[onboarding.verify] non-fatal provisioning step failed', { step, error })
+    return { ok: false, error }
+  }
+}

package/src/modules/onboarding/lib/verify-base-url.ts

@@ -0,0 +1,107 @@
+import {
+  AppOriginConfigurationError,
+  AppOriginRejectedError,
+  getSecurityEmailBaseUrl,
+  resolveRequestOrigin,
+} from '@open-mercato/shared/lib/url'
+
+type EnvLike = Record<string, string | undefined>
+
+export type VerifyRedirectBaseUrlResult =
+  | { ok: true; baseUrl: string }
+  | {
+    ok: false
+    status: 'origin_not_allowed' | 'redirect_misconfigured' | 'url_not_configured'
+    message: string
+    redirectOrigin: string | null
+    httpStatus: number
+  }
+
+function normalizeOrigin(raw: string): string | null {
+  try {
+    return new URL(raw).origin
+  } catch {
+    return null
+  }
+}
+
+function originPort(url: URL): string {
+  if (url.port) return url.port
+  if (url.protocol === 'https:') return '443'
+  if (url.protocol === 'http:') return '80'
+  return ''
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1'
+}
+
+function originsMatchForRedirect(configuredOrigin: string, requestOrigin: string): boolean {
+  if (configuredOrigin === requestOrigin) return true
+  try {
+    const configured = new URL(configuredOrigin)
+    const request = new URL(requestOrigin)
+    return (
+      configured.protocol === request.protocol &&
+      isLoopbackHostname(configured.hostname) &&
+      isLoopbackHostname(request.hostname) &&
+      originPort(configured) === originPort(request)
+    )
+  } catch {
+    return false
+  }
+}
+
+export function resolveVerifyRedirectBaseUrl(
+  req: Request,
+  env: EnvLike = process.env,
+): VerifyRedirectBaseUrlResult {
+  try {
+    const baseUrl = getSecurityEmailBaseUrl(req, env)
+    const configuredOrigin = normalizeOrigin(baseUrl)
+    const requestOrigin = normalizeOrigin(resolveRequestOrigin(req)) ?? normalizeOrigin(req.url)
+    if (configuredOrigin && requestOrigin && !originsMatchForRedirect(configuredOrigin, requestOrigin)) {
+      console.error('[onboarding.verify] APP_URL does not match verification request origin', {
+        requestUrl: req.url,
+        configuredOrigin,
+        requestOrigin,
+      })
+      return {
+        ok: false,
+        status: 'redirect_misconfigured',
+        message: 'Onboarding verification redirect is misconfigured.',
+        redirectOrigin: requestOrigin,
+        httpStatus: 400,
+      }
+    }
+    return { ok: true, baseUrl }
+  } catch (error) {
+    if (error instanceof AppOriginRejectedError) {
+      console.error('[onboarding.verify] rejected request origin for redirect base', {
+        requestUrl: req.url,
+        reason: error.message,
+      })
+      return {
+        ok: false,
+        status: 'origin_not_allowed',
+        message: 'Onboarding verification request origin is not allowed.',
+        redirectOrigin: null,
+        httpStatus: 400,
+      }
+    }
+    if (error instanceof AppOriginConfigurationError) {
+      console.error('[onboarding.verify] APP_URL is required for onboarding verification redirects', {
+        requestUrl: req.url,
+        reason: error.message,
+      })
+      return {
+        ok: false,
+        status: 'url_not_configured',
+        message: 'Onboarding verification redirect is not configured.',
+        redirectOrigin: null,
+        httpStatus: 500,
+      }
+    }
+    throw error
+  }
+}