@open-mercato/onboarding 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/onboarding/migrations/Migration20260710133207_onboarding.js

@@ -0,0 +1,15 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260710133207_onboarding extends Migration {
+  up() {
+    this.addSql(`alter table "onboarding_requests" add "email_hash" text null;`);
+    this.addSql(`alter table "onboarding_requests" add constraint "onboarding_requests_email_hash_unique" unique ("email_hash");`);
+  }
+  down() {
+    this.addSql(`alter table "onboarding_requests" drop constraint if exists "onboarding_requests_email_hash_unique";`);
+    this.addSql(`alter table "onboarding_requests" drop column "email_hash";`);
+  }
+}
+export {
+  Migration20260710133207_onboarding
+};
+//# sourceMappingURL=Migration20260710133207_onboarding.js.map

package/dist/modules/onboarding/migrations/Migration20260710133207_onboarding.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/migrations/Migration20260710133207_onboarding.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260710133207_onboarding extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" add \"email_hash\" text null;`);\n    this.addSql(`alter table \"onboarding_requests\" add constraint \"onboarding_requests_email_hash_unique\" unique (\"email_hash\");`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`alter table \"onboarding_requests\" drop constraint if exists \"onboarding_requests_email_hash_unique\";`);\n    this.addSql(`alter table \"onboarding_requests\" drop column \"email_hash\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,2CAA2C,UAAU;AAAA,EAEvD,KAA2B;AAClC,SAAK,OAAO,+DAA+D;AAC3E,SAAK,OAAO,iHAAiH;AAAA,EAC/H;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,sGAAsG;AAClH,SAAK,OAAO,6DAA6D;AAAA,EAC3E;AAEF;",
+  "names": []
+}

package/generated/entities/onboarding_request/index.ts

@@ -1,5 +1,6 @@
 export const id = "id";
 export const email = "email";
+export const email_hash = "email_hash";
 export const token_hash = "token_hash";
 export const status = "status";
 export const first_name = "first_name";

package/generated/entity-fields-registry.ts

@@ -4,6 +4,7 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
     "onboarding_request": {
       "id": "id",
       "email": "email",
+      "email_hash": "email_hash",
       "token_hash": "token_hash",
       "status": "status",
       "first_name": "first_name",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.6.7",
+  "version": "0.6.8-develop.6875.1.871a4afc94",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,13 +70,13 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.7"
+    "@open-mercato/shared": "0.6.8-develop.6875.1.871a4afc94"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7",
+    "@open-mercato/shared": "0.6.8-develop.6875.1.871a4afc94",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
     "typescript": "7.0.2"
   },
   "publishConfig": {
@@ -86,5 +86,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/onboarding"
-  }
+  },
+  "stableVersion": "0.6.7"
 }

package/src/__tests__/backfill-legacy-request.test.ts

@@ -0,0 +1,213 @@
+import { createHash, randomBytes } from 'node:crypto'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
+import type { TenantDek } from '@open-mercato/shared/lib/encryption/kms'
+import { OnboardingRequest } from '../modules/onboarding/data/entities'
+import { OnboardingService } from '../modules/onboarding/lib/service'
+import { defaultEncryptionMaps } from '../modules/onboarding/encryption'
+
+jest.mock('bcryptjs', () => ({
+  hash: jest.fn().mockResolvedValue('freshly_hashed_password'),
+}))
+
+const LEGACY_EMAIL = 'legacy.signup@example.com'
+const SYSTEM_KEY = randomBytes(32).toString('base64')
+
+function hashToken(token: string) {
+  return createHash('sha256').update(token).digest('hex')
+}
+
+function makeLegacyPlaintextRow(): OnboardingRequest {
+  return Object.assign(new OnboardingRequest(), {
+    id: 'legacy-row',
+    email: LEGACY_EMAIL,
+    emailHash: null,
+    tokenHash: hashToken('legacy-token'),
+    status: 'pending',
+    firstName: 'Ada',
+    lastName: 'Lovelace',
+    organizationName: 'Analytical Engines',
+    locale: 'en',
+    termsAccepted: true,
+    marketingConsent: false,
+    passwordHash: 'legacy_bcrypt_hash',
+    expiresAt: new Date(Date.now() + 86_400_000),
+    completedAt: null,
+    processingStartedAt: null,
+    tenantId: null,
+    organizationId: null,
+    userId: null,
+    lastEmailSentAt: new Date(Date.now() - 60 * 60 * 1000),
+    preparationStartedAt: null,
+    preparationCompletedAt: null,
+    readyEmailSentAt: null,
+    createdAt: new Date(Date.now() - 7 * 86_400_000),
+    updatedAt: new Date(Date.now() - 7 * 86_400_000),
+    deletedAt: null,
+  })
+}
+
+function matchesCondition(actual: unknown, condition: unknown): boolean {
+  if (condition !== null && typeof condition === 'object' && !(condition instanceof Date)) {
+    const operators = condition as Record<string, unknown>
+    if ('$in' in operators) return (operators.$in as unknown[]).includes(actual)
+    if ('$gt' in operators) return (actual as Date) > (operators.$gt as Date)
+    if ('$ne' in operators) return actual !== operators.$ne
+    return false
+  }
+  return actual === condition
+}
+
+function matchesFilter(row: Record<string, unknown>, filter: Record<string, unknown>): boolean {
+  return Object.entries(filter).every(([key, condition]) => {
+    if (key === '$or') return (condition as Record<string, unknown>[]).some((branch) => matchesFilter(row, branch))
+    return matchesCondition(row[key], condition)
+  })
+}
+
+/**
+ * Minimal filter-evaluating EntityManager stand-in. The point of this suite is that a
+ * backfilled row is still *found* by the service's real lookup, so the fake has to
+ * actually evaluate the `$or` the service builds rather than record the call.
+ */
+function makeEm(rows: OnboardingRequest[]) {
+  const created: OnboardingRequest[] = []
+  return {
+    findOne: jest.fn(async (_entity: unknown, where: Record<string, unknown>) =>
+      rows.find((row) => matchesFilter(row as unknown as Record<string, unknown>, where)) ?? null),
+    create: jest.fn((_entity: unknown, data: Record<string, unknown>) => {
+      const row = Object.assign(new OnboardingRequest(), data)
+      created.push(row)
+      return row
+    }),
+    persist: jest.fn(() => ({ flush: jest.fn(async () => {}) })),
+    flush: jest.fn(async () => {}),
+    created,
+  } as unknown as EntityManager & { created: OnboardingRequest[]; findOne: jest.Mock; create: jest.Mock }
+}
+
+function makeEncryptionService(em: EntityManager) {
+  const kms = {
+    isHealthy: () => true,
+    async getTenantDek(tenantId: string): Promise<TenantDek | null> {
+      return { tenantId, key: SYSTEM_KEY, fetchedAt: Date.now() }
+    },
+    async createTenantDek(tenantId: string): Promise<TenantDek | null> {
+      return this.getTenantDek(tenantId)
+    },
+  }
+  return new TenantDataEncryptionService(em, { kms, defaultEncryptionMaps })
+}
+
+/**
+ * Applies exactly what `mercato entities backfill-system-encryption` applies to one row:
+ * the mapped fields go through `encryptEntityPayload` under the system key, and the
+ * resulting ciphertext plus lookup hash are written back to the record.
+ */
+async function backfillRow(service: TenantDataEncryptionService, row: OnboardingRequest): Promise<void> {
+  const encrypted = await service.encryptEntityPayload('onboarding:onboarding_request', {
+    email: row.email,
+    email_hash: row.emailHash ?? null,
+    first_name: row.firstName,
+    last_name: row.lastName,
+    organization_name: row.organizationName,
+    password_hash: row.passwordHash ?? null,
+  }, null, null)
+  row.email = encrypted.email as string
+  row.emailHash = encrypted.email_hash as string
+  row.firstName = encrypted.first_name as string
+  row.lastName = encrypted.last_name as string
+  row.organizationName = encrypted.organization_name as string
+  row.passwordHash = encrypted.password_hash as string
+}
+
+describe('backfilled legacy onboarding request (#3876)', () => {
+  const originalToggle = process.env.TENANT_DATA_ENCRYPTION
+
+  beforeEach(() => {
+    process.env.TENANT_DATA_ENCRYPTION = 'yes'
+  })
+
+  afterEach(() => {
+    if (originalToggle === undefined) delete process.env.TENANT_DATA_ENCRYPTION
+    else process.env.TENANT_DATA_ENCRYPTION = originalToggle
+  })
+
+  it('encrypts every mapped field and populates the lookup hash', async () => {
+    const row = makeLegacyPlaintextRow()
+    const em = makeEm([row])
+
+    await backfillRow(makeEncryptionService(em), row)
+
+    for (const value of [row.email, row.firstName, row.lastName, row.organizationName, row.passwordHash]) {
+      expect(value).toMatch(/^[^:]+:[^:]+:[^:]+:v1$/)
+    }
+    expect(lookupHashCandidates(LEGACY_EMAIL)).toContain(row.emailHash)
+  })
+
+  it('still resolves the row on resubmit instead of creating a duplicate', async () => {
+    const row = makeLegacyPlaintextRow()
+    const em = makeEm([row])
+    await backfillRow(makeEncryptionService(em), row)
+
+    const service = new OnboardingService(em)
+    const { request } = await service.createOrUpdateRequest({
+      email: LEGACY_EMAIL,
+      firstName: 'Ada',
+      lastName: 'Lovelace',
+      organizationName: 'Analytical Engines',
+      password: 'Secret1!',
+      confirmPassword: 'Secret1!',
+      termsAccepted: true,
+      marketingConsent: false,
+    } as never)
+
+    expect(request.id).toBe('legacy-row')
+    expect(em.created).toHaveLength(0)
+    expect(em.create).not.toHaveBeenCalled()
+  })
+
+  it('still resolves the row by verification token after the backfill', async () => {
+    const row = makeLegacyPlaintextRow()
+    const em = makeEm([row])
+    await backfillRow(makeEncryptionService(em), row)
+
+    const found = await new OnboardingService(em).findPendingByToken('legacy-token')
+
+    expect(found?.id).toBe('legacy-row')
+  })
+
+  it('leaves a row the backfill already processed unchanged on a second pass', async () => {
+    const row = makeLegacyPlaintextRow()
+    const em = makeEm([row])
+    const service = makeEncryptionService(em)
+
+    await backfillRow(service, row)
+    const afterFirstPass = { email: row.email, emailHash: row.emailHash, passwordHash: row.passwordHash }
+    await backfillRow(service, row)
+
+    expect(row.email).toBe(afterFirstPass.email)
+    expect(row.emailHash).toBe(afterFirstPass.emailHash)
+    expect(row.passwordHash).toBe(afterFirstPass.passwordHash)
+  })
+
+  it('still finds a row that was never backfilled, through the legacy plaintext branch', async () => {
+    const row = makeLegacyPlaintextRow()
+    const em = makeEm([row])
+
+    const found = await new OnboardingService(em).createOrUpdateRequest({
+      email: LEGACY_EMAIL,
+      firstName: 'Ada',
+      lastName: 'Lovelace',
+      organizationName: 'Analytical Engines',
+      password: 'Secret1!',
+      confirmPassword: 'Secret1!',
+      termsAccepted: true,
+      marketingConsent: false,
+    } as never)
+
+    expect(found.request.id).toBe('legacy-row')
+    expect(em.create).not.toHaveBeenCalled()
+  })
+})

package/src/__tests__/encryption.test.ts

@@ -0,0 +1,19 @@
+import { defaultEncryptionMaps } from '../modules/onboarding/encryption'
+
+describe('onboarding encryption map', () => {
+  it('protects pre-tenant PII and the transient password hash with a system key', () => {
+    expect(defaultEncryptionMaps).toEqual([
+      {
+        entityId: 'onboarding:onboarding_request',
+        keyScope: 'system',
+        fields: [
+          { field: 'email', hashField: 'email_hash' },
+          { field: 'first_name' },
+          { field: 'last_name' },
+          { field: 'organization_name' },
+          { field: 'password_hash' },
+        ],
+      },
+    ])
+  })
+})

package/src/__tests__/service.test.ts

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { OnboardingRequest } from '../modules/onboarding/data/entities'
 import { OnboardingService } from '../modules/onboarding/lib/service'
+import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 
 jest.mock('bcryptjs', () => ({
   hash: jest.fn().mockResolvedValue('hashed_password'),
@@ -127,6 +128,21 @@ describe('OnboardingService', () => {
       const result = await service.createOrUpdateRequest(makeStartInput())
       const createArgs = em.create.mock.calls[0][1]
       expect(createArgs.status).toBe('pending')
+      expect(createArgs.emailHash).toBe(hashForLookup('user@example.com'))
+    })
+
+    it('looks up encrypted and legacy plaintext emails without querying ciphertext as plaintext', async () => {
+      const em = createMockEm()
+      const service = new OnboardingService(em)
+
+      await service.createOrUpdateRequest(makeStartInput())
+
+      expect(em.findOne).toHaveBeenCalledWith(OnboardingRequest, {
+        $or: [
+          { emailHash: { $in: lookupHashCandidates('user@example.com') } },
+          { email: 'user@example.com', emailHash: null },
+        ],
+      }, undefined)
     })
 
     it('throws PENDING_REQUEST when within cooldown', async () => {

package/src/modules/onboarding/__integration__/TC-ONB-001-self-service-consent.spec.ts

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { expect, test } from '@playwright/test';
 import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';
 
 export const integrationMeta = {
   dependsOnModules: ['onboarding'],
@@ -26,6 +27,15 @@ type UserConsentRow = {
   granted_at: Date | null;
 };
 
+type PendingRequestAtRest = {
+  email: string;
+  email_hash: string | null;
+  first_name: string;
+  last_name: string;
+  organization_name: string;
+  password_hash: string;
+};
+
 const ONBOARDING_PASSWORD = 'IntegrationPass123!';
 const BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';
 
@@ -40,15 +50,32 @@ async function replaceVerificationToken(email: string, token: string): Promise<s
          set token_hash = $2,
              expires_at = now() + interval '24 hours',
              updated_at = now()
-       where email = $1
+       where email_hash = any($1::text[])
        returning id`,
-      [email, hashToken(token)],
+      [lookupHashCandidates(email), hashToken(token)],
     );
     expect(result.rowCount, 'onboarding request should exist after submitting the form').toBe(1);
     return result.rows[0].id;
   });
 }
 
+async function readPendingRequestAtRest(email: string): Promise<PendingRequestAtRest> {
+  return withClient(async (client) => {
+    const result = await client.query<PendingRequestAtRest>(
+      `select email, email_hash, first_name, last_name, organization_name, password_hash
+         from onboarding_requests
+        where email_hash = any($1::text[])`,
+      [lookupHashCandidates(email)],
+    );
+    expect(result.rowCount, 'onboarding request should be queryable by its lookup hash').toBe(1);
+    return result.rows[0];
+  });
+}
+
+function expectEncryptedPayload(value: string): void {
+  expect(value).toMatch(/^[^:]+:[^:]+:[^:]+:v1$/);
+}
+
 async function readCompletedRequest(requestId: string): Promise<OnboardingRequestRow> {
   return withClient(async (client) => {
     const result = await client.query<OnboardingRequestRow>(
@@ -142,6 +169,14 @@ test.describe('TC-ONB-001: self-service onboarding with marketing consent', () =
     await expect(page.getByRole('status')).toContainText('Check your inbox');
     await expect(page.getByRole('status')).toContainText(email);
 
+    const pendingAtRest = await readPendingRequestAtRest(email);
+    expect(lookupHashCandidates(email)).toContain(pendingAtRest.email_hash);
+    expectEncryptedPayload(pendingAtRest.email);
+    expectEncryptedPayload(pendingAtRest.first_name);
+    expectEncryptedPayload(pendingAtRest.last_name);
+    expectEncryptedPayload(pendingAtRest.organization_name);
+    expectEncryptedPayload(pendingAtRest.password_hash);
+
     const requestId = await replaceVerificationToken(email, token);
     const verifyUrl = `${BASE_URL}/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`;
 

package/src/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.ts

@@ -4,6 +4,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { expect, test, type APIRequestContext, type Browser, type BrowserContext, type Page } from '@playwright/test';
 import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';
 
 export const integrationMeta = {
   dependsOnModules: ['onboarding'],
@@ -39,9 +40,9 @@ async function replaceVerificationToken(email: string, token: string): Promise<s
          set token_hash = $2,
              expires_at = now() + interval '24 hours',
              updated_at = now()
-       where email = $1
+       where email_hash = any($1::text[])
        returning id`,
-      [email, hashToken(token)],
+      [lookupHashCandidates(email), hashToken(token)],
     );
     expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);
     return result.rows[0].id;

package/src/modules/onboarding/api/post/onboarding.ts

@@ -3,6 +3,8 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'
 import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
 import { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'
@@ -107,7 +109,13 @@ export async function POST(req: Request) {
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
 
-    const existingUser = await em.findOne(User, { email: parsed.data.email })
+    const existingUser = await findOneWithDecryption(em, User, {
+      deletedAt: null,
+      $or: [
+        { email: parsed.data.email },
+        { emailHash: { $in: lookupHashCandidates(parsed.data.email) } },
+      ],
+    })
     if (existingUser) {
       const message = translate('onboarding.errors.emailExists', 'We already have an account with this email. Try signing in or resetting your password.')
       return NextResponse.json({

package/src/modules/onboarding/data/entities.ts

@@ -4,6 +4,7 @@ type OnboardingStatus = 'pending' | 'processing' | 'completed' | 'expired'
 
 @Entity({ tableName: 'onboarding_requests' })
 @Unique({ properties: ['email'] })
+@Unique({ properties: ['emailHash'] })
 @Unique({ properties: ['tokenHash'] })
 export class OnboardingRequest {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
@@ -12,6 +13,9 @@ export class OnboardingRequest {
   @Property({ type: 'text' })
   email!: string
 
+  @Property({ name: 'email_hash', type: 'text', nullable: true })
+  emailHash?: string | null
+
   @Property({ name: 'token_hash', type: 'text' })
   tokenHash!: string
 

package/src/modules/onboarding/encryption.ts

@@ -3,11 +3,13 @@ import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryptio
 export const defaultEncryptionMaps: ModuleEncryptionMap[] = [
   {
     entityId: 'onboarding:onboarding_request',
+    keyScope: 'system',
     fields: [
-      { field: 'email' },
+      { field: 'email', hashField: 'email_hash' },
       { field: 'first_name' },
       { field: 'last_name' },
       { field: 'organization_name' },
+      { field: 'password_hash' },
     ],
   },
 ]

package/src/modules/onboarding/i18n/ko.json

@@ -0,0 +1,100 @@
+{
+  "demoFeedback.button.ariaLabel": "피드백 양식 열기",
+  "demoFeedback.button.askQuestion": "질문하기",
+  "demoFeedback.button.contactUs": "문의하기",
+  "demoFeedback.button.feedback": "피드백",
+  "demoFeedback.dialog.description": "방금 보신 것은 실제 시스템의 약 80%입니다.\n몇 달이 아닌 몇 주 안에 이를 프로덕션 준비가 된 솔루션으로 전환하는 방법에 대해 이야기해 봅시다.",
+  "demoFeedback.dialog.successBody": "곧 연락드리겠습니다.",
+  "demoFeedback.dialog.successTitle": "감사합니다!",
+  "demoFeedback.dialog.title": "Open Mercato 팀과 상담하기",
+  "demoFeedback.errors.emailInvalid": "유효한 이메일 주소를 입력하세요.",
+  "demoFeedback.errors.generic": "문제가 발생했습니다. 다시 시도해 주세요.",
+  "demoFeedback.errors.termsRequired": "계속하려면 약관에 동의해 주세요.",
+  "demoFeedback.form.email": "이메일 주소",
+  "demoFeedback.form.marketingLabel": "CT Tornado로부터 이메일을 통한 직접 마케팅 수신에 동의합니다. 언제든지 동의를 철회할 수 있습니다. {termsLink} 및 {privacyLink}를 참고하세요.",
+  "demoFeedback.form.message": "메시지 (선택 사항)",
+  "demoFeedback.form.privacyLink": "개인정보 처리방침",
+  "demoFeedback.form.submit": "연락 받기",
+  "demoFeedback.form.suppressPopup": "이 팝업을 자동으로 표시하지 않기",
+  "demoFeedback.form.termsAnd": " 및 ",
+  "demoFeedback.form.termsLabel": "다음을 읽고 동의합니다: ",
+  "demoFeedback.form.termsLink": "이용 약관",
+  "onboarding.disabled.cta": "로그인으로 이동",
+  "onboarding.disabled.description": "현재 워크스페이스 생성은 수동으로 처리되고 있습니다. 계속하기 전에 Open Mercato 팀 또는 관리자에게 접근 권한을 요청하세요.",
+  "onboarding.disabled.title": "셀프 서비스 온보딩을 현재 사용할 수 없습니다",
+  "onboarding.email.adminBody": "{firstName} {lastName} ({email}) 님이 {organizationName}에 대한 온보딩 요청을 제출했습니다.",
+  "onboarding.email.adminFooter": "검증이 완료된 후 테넌트를 검토할 수 있습니다.",
+  "onboarding.email.adminHeading": "새 온보딩 요청",
+  "onboarding.email.adminPreview": "새 온보딩 요청이 제출되었습니다",
+  "onboarding.email.adminSubject": "새로운 셀프 서비스 온보딩 요청",
+  "onboarding.email.body": "{organizationName} 조직 설정을 마치려면 이메일 주소 확인이 필요합니다.",
+  "onboarding.email.cta": "이메일 확인 및 워크스페이스 활성화",
+  "onboarding.email.expiry": "이 링크는 24시간 후 만료됩니다. 요청하지 않으셨다면 이 메시지를 무시하셔도 됩니다.",
+  "onboarding.email.footer": "Open Mercato · 온보딩 서비스",
+  "onboarding.email.greeting": "안녕하세요 {firstName}님,",
+  "onboarding.email.heading": "Open Mercato에 오신 것을 환영합니다",
+  "onboarding.email.marketingConsentNo": "마케팅 동의: 아니오",
+  "onboarding.email.marketingConsentYes": "마케팅 동의: 예",
+  "onboarding.email.preview": "Open Mercato 워크스페이스를 활성화하려면 이메일을 확인하세요",
+  "onboarding.email.subject": "온보딩을 완료하려면 이메일을 확인하세요",
+  "onboarding.errors.emailExists": "이미 이 이메일로 등록된 계정이 있습니다. 로그인하거나 비밀번호를 재설정해 보세요.",
+  "onboarding.errors.emailInvalid": "유효한 업무용 이메일을 입력하세요.",
+  "onboarding.errors.emailSendFailed": "확인 이메일을 보내지 못했습니다. 다시 시도하거나 지원팀에 문의하세요.",
+  "onboarding.errors.firstNameRequired": "이름은 필수입니다.",
+  "onboarding.errors.lastNameRequired": "성은 필수입니다.",
+  "onboarding.errors.organizationNameRequired": "조직 이름은 필수입니다.",
+  "onboarding.errors.passwordMismatch": "비밀번호가 일치해야 합니다.",
+  "onboarding.errors.passwordRequired": "비밀번호는 다음 요구 사항을 충족해야 합니다: {requirements}.",
+  "onboarding.errors.pendingRequest": "이미 대기 중인 검증이 있습니다. 약 {minutes}분 후에 다시 시도하거나 관리자에게 문의하세요.",
+  "onboarding.errors.termsRequired": "계속하려면 약관에 동의해 주세요.",
+  "onboarding.form.confirmPassword": "비밀번호 확인",
+  "onboarding.form.email": "업무용 이메일",
+  "onboarding.form.emailExists": "이미 이 이메일로 등록된 계정이 있습니다. 로그인하거나 비밀번호를 재설정해 보세요.",
+  "onboarding.form.firstName": "이름",
+  "onboarding.form.genericError": "문제가 발생했습니다. 다시 시도하거나 지원팀에 문의하세요.",
+  "onboarding.form.lastName": "성",
+  "onboarding.form.legalEntity": "오픈 메르카토 sp. z o.o., 등록 사무소는 ul. Wyspa Słodowa 7, 50-266 Wrocław, 폴란드는 브로츠와프의 브로츠와프-파브리치나 지방 법원이 관리하는 국가 법원 등록부(KRS)의 기업가 등록부, 국가 법원 등록부 제6상업부에 KRS 번호 0001253104, VAT 번호(NIP)로 등록되었습니다. PL8982336029, REGON 545230330, 자본금 PLN 80,000.00, 전액 지불됨.",
+  "onboarding.form.loading": "전송 중...",
+  "onboarding.form.marketingLabel": "제공한 이메일 주소로 CT Tornado로부터 직접 마케팅을 수신하는 데 동의합니다. 언제든지 동의를 철회할 수 있으며(예: 수신 거부 링크를 통해), CT Tornado가 정당한 이익에 따라 메일링 리스트 관리, 동의 증빙 보관, 수신 거부 기록을 위해 제 이메일 주소를 처리할 수 있다는 점을 알고 있습니다. {termsLink} 및 {privacyLink}를 참고하세요.",
+  "onboarding.form.organizationName": "조직 이름",
+  "onboarding.form.password": "비밀번호",
+  "onboarding.form.privacyLink": "개인정보 처리방침",
+  "onboarding.form.submit": "확인 이메일 보내기",
+  "onboarding.form.successBody": "{email}로 확인 링크를 보냈습니다. 워크스페이스를 활성화하려면 24시간 이내에 확인해 주세요.",
+  "onboarding.form.successTitle": "받은편지함을 확인하세요",
+  "onboarding.form.termsAnd": " 및 ",
+  "onboarding.form.termsLabel": "다음을 읽고 동의합니다: ",
+  "onboarding.form.termsLink": "이용 약관",
+  "onboarding.form.termsRequired": "계속하려면 약관에 동의해 주세요.",
+  "onboarding.password.requirements.digit": "숫자 1개",
+  "onboarding.password.requirements.help": "비밀번호 요구 사항: {requirements}",
+  "onboarding.password.requirements.minLength": "최소 {min}자",
+  "onboarding.password.requirements.separator": ", ",
+  "onboarding.password.requirements.special": "특수 문자 1개",
+  "onboarding.password.requirements.uppercase": "대문자 1개",
+  "onboarding.preparing.backCta": "온보딩으로 돌아가기",
+  "onboarding.preparing.description": "데모 환경을 준비하고 있습니다. 준비가 완료되는 대로 올바른 테넌트 로그인 링크가 담긴 이메일을 보내드리겠습니다.",
+  "onboarding.preparing.descriptionWithTenant": "{tenant}의 데모 환경을 준비하고 있습니다. 준비가 완료되는 대로 올바른 테넌트 로그인 링크가 담긴 이메일을 보내드리겠습니다.",
+  "onboarding.preparing.emailNotice": "이 페이지를 계속 열어둘 필요는 없습니다. 모든 준비가 완료되면 이메일로 알려드리겠습니다.",
+  "onboarding.preparing.homeCta": "홈페이지로 이동",
+  "onboarding.preparing.loginCta": "테넌트 로그인 열기",
+  "onboarding.preparing.redirecting": "워크스페이스가 준비되었습니다. 지금 테넌트 로그인 페이지로 이동합니다.",
+  "onboarding.preparing.statusErrorBody": "워크스페이스 상태를 확인하지 못했습니다. 워크스페이스가 아직 준비 중일 수 있으며, 이 페이지는 계속 재시도합니다.",
+  "onboarding.preparing.statusErrorTitle": "워크스페이스 상태 확인 실패",
+  "onboarding.preparing.title": "워크스페이스를 준비하고 있습니다",
+  "onboarding.readyEmail.body": "{organizationName}의 Open Mercato 워크스페이스 준비가 완료되었습니다. 아래의 보안 링크를 사용해 로그인하세요.",
+  "onboarding.readyEmail.cta": "로그인 열기",
+  "onboarding.readyEmail.footer": "Open Mercato · 온보딩 서비스",
+  "onboarding.readyEmail.greeting": "안녕하세요 {firstName}님,",
+  "onboarding.readyEmail.heading": "워크스페이스가 준비되었습니다",
+  "onboarding.readyEmail.preview": "워크스페이스가 준비되었습니다. 보안 로그인 링크로 로그인하세요.",
+  "onboarding.readyEmail.subject": "Open Mercato 워크스페이스가 준비되었습니다",
+  "onboarding.subtitle": "간단한 정보를 알려주시면 모든 것을 설정해 드리겠습니다.",
+  "onboarding.title": "Open Mercato 워크스페이스 만들기",
+  "onboarding.verifyStatus.alreadyExists": "이미 이 이메일로 등록된 계정이 있습니다. 로그인하거나 비밀번호를 재설정해 보세요.",
+  "onboarding.verifyStatus.error": "검증을 완료하지 못했습니다. 다시 시도하거나 지원팀에 문의하세요.",
+  "onboarding.verifyStatus.invalid": "확인 링크가 유효하지 않거나 만료되었습니다. 새 링크를 받으려면 온보딩 양식을 다시 제출하세요.",
+  "onboarding.verifyStatus.originNotAllowed": "허용되지 않은 출처에서 확인 링크가 열렸습니다. APP_URL과 APP_ALLOWED_ORIGINS를 확인한 후 확인 링크를 다시 여세요.",
+  "onboarding.verifyStatus.redirectMisconfigured": "APP_URL이 요청을 처리한 URL과 일치하지 않아 확인 링크가 안전하게 리디렉션될 수 없습니다. APP_URL과 APP_ALLOWED_ORIGINS를 확인한 후 확인 링크를 다시 여세요.",
+  "onboarding.verifyStatus.urlNotConfigured": "온보딩 검증이 구성되지 않았습니다. 확인 링크를 사용하려면 APP_URL을 설정해야 합니다."
+}