@open-mercato/onboarding 0.7.1-develop.7150.1.c1941e0c22 → 0.7.1-develop.7151.1.00d0391847

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:onboarding] found 38 entry points
+[build:onboarding] found 39 entry points
 [build:onboarding] built successfully

package/dist/modules/onboarding/__integration__/TC-ONBOARDING-EMAIL-001.spec.js

@@ -0,0 +1,119 @@
+import { expect, test } from "@playwright/test";
+import { getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { getTokenScope } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { withClient } from "@open-mercato/core/helpers/integration/dbFixtures";
+import { emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
+import {
+  clearCapturedSystemEmails,
+  isChannelSeedingAvailable,
+  seedSystemEmailChannel,
+  waitForCapturedSystemEmail
+} from "@open-mercato/core/helpers/integration/communicationChannelsFixtures";
+function emailLookup(email) {
+  return { clause: "email_hash = any($1)", values: emailHashLookupValues(email) };
+}
+async function deleteOnboardingRequest(email) {
+  const lookup = emailLookup(email);
+  await withClient(async (client) => {
+    await client.query(`delete from onboarding_requests where ${lookup.clause}`, [lookup.values]);
+  }).catch(() => void 0);
+}
+async function markOnboardingReady(email, tenantId, organizationId, userId) {
+  const lookup = emailLookup(email);
+  await withClient(async (client) => {
+    const result = await client.query(
+      `update onboarding_requests
+       set status = 'completed',
+           tenant_id = $2,
+           organization_id = $3,
+           user_id = $4,
+           preparation_completed_at = now(),
+           ready_email_sent_at = null
+       where ${lookup.clause}`,
+      [lookup.values, tenantId, organizationId, userId]
+    );
+    expect(result.rowCount, `markOnboardingReady should match the onboarding request for ${email}`).toBeGreaterThan(0);
+  });
+}
+test.describe("TC-ONBOARDING-EMAIL-001: Onboarding emails use system channel", () => {
+  test("start, ready, and demo feedback emails dispatch through Communications Hub", async ({ request }) => {
+    test.slow();
+    const token = await getAuthToken(request, "admin");
+    const scope = getTokenScope(token);
+    const seedingAvailable = await isChannelSeedingAvailable(request, token);
+    test.skip(!seedingAvailable, "OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled.");
+    const stamp = Date.now();
+    const onboardingEmail = `qa-onboarding-email-${stamp}@example.test`;
+    const feedbackEmail = `qa-demo-feedback-${stamp}@example.test`;
+    const adminEmail = process.env.ADMIN_EMAIL ?? "piotr@catchthetornado.com";
+    await seedSystemEmailChannel(request, token);
+    await clearCapturedSystemEmails(request, token, { systemRecipient: onboardingEmail });
+    await clearCapturedSystemEmails(request, token, { systemRecipient: adminEmail });
+    try {
+      const start = await request.post("/api/onboarding/onboarding", {
+        headers: { "Content-Type": "application/json" },
+        data: {
+          email: onboardingEmail,
+          firstName: "QA",
+          lastName: "Onboarding",
+          organizationName: `QA Onboarding ${stamp}`,
+          password: `Valid1!Pass${stamp}`,
+          confirmPassword: `Valid1!Pass${stamp}`,
+          termsAccepted: true,
+          marketingConsent: false
+        }
+      });
+      expect(start.status()).toBe(200);
+      const verificationEmail = await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === "Confirm your email to finish onboarding",
+        { description: "onboarding verification email", systemRecipient: onboardingEmail }
+      );
+      expect(verificationEmail.scope.tenantId).toBe("system");
+      expect(verificationEmail.content.bodyFormat).toBe("html");
+      await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => String(email.metadata?.to ?? "").includes("@") && email.metadata?.subject === "New self-service onboarding request",
+        { description: "onboarding admin email", systemRecipient: adminEmail }
+      );
+      await markOnboardingReady(onboardingEmail, scope.tenantId, scope.organizationId, scope.userId);
+      await clearCapturedSystemEmails(request, token);
+      const status = await request.get(`/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(scope.tenantId)}`, {
+        headers: {
+          cookie: `om_login_tenant=${encodeURIComponent(scope.tenantId)}`
+        }
+      });
+      expect(status.status()).toBe(200);
+      const readyEmail = await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === "Your Open Mercato workspace is ready",
+        { description: "onboarding ready email" }
+      );
+      expect(readyEmail.scope.tenantId).toBe(scope.tenantId);
+      expect(readyEmail.content.bodyFormat).toBe("html");
+      await clearCapturedSystemEmails(request, token);
+      const feedback = await request.post("/api/onboarding/demo-feedback", {
+        headers: { "Content-Type": "application/json" },
+        data: {
+          email: feedbackEmail,
+          message: "Integration coverage feedback",
+          termsAccepted: true,
+          marketingConsent: false
+        }
+      });
+      expect(feedback.status()).toBe(200);
+      await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => String(email.metadata?.to ?? "").includes("@") && email.metadata?.subject === `Demo feedback from ${feedbackEmail}`,
+        { description: "demo feedback admin email", systemRecipient: adminEmail }
+      );
+    } finally {
+      await deleteOnboardingRequest(onboardingEmail);
+    }
+  });
+});
+//# sourceMappingURL=TC-ONBOARDING-EMAIL-001.spec.js.map

package/dist/modules/onboarding/__integration__/TC-ONBOARDING-EMAIL-001.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/onboarding/__integration__/TC-ONBOARDING-EMAIL-001.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { withClient } from '@open-mercato/core/helpers/integration/dbFixtures'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport {\n  clearCapturedSystemEmails,\n  isChannelSeedingAvailable,\n  seedSystemEmailChannel,\n  waitForCapturedSystemEmail,\n} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'\n\n// `onboarding_requests.email` is encrypted at rest, so a plaintext `where email = $1` matches\n// nothing. `email_hash` is the deterministic lookup key the service itself uses; the candidate\n// list covers key rotation the same way `lookupHashCandidates` does for the application.\nfunction emailLookup(email: string): { clause: string; values: string[] } {\n  return { clause: 'email_hash = any($1)', values: emailHashLookupValues(email) }\n}\n\nasync function deleteOnboardingRequest(email: string): Promise<void> {\n  const lookup = emailLookup(email)\n  await withClient(async (client) => {\n    await client.query(`delete from onboarding_requests where ${lookup.clause}`, [lookup.values])\n  }).catch(() => undefined)\n}\n\nasync function markOnboardingReady(email: string, tenantId: string, organizationId: string, userId: string): Promise<void> {\n  const lookup = emailLookup(email)\n  await withClient(async (client) => {\n    const result = await client.query(\n      `update onboarding_requests\n       set status = 'completed',\n           tenant_id = $2,\n           organization_id = $3,\n           user_id = $4,\n           preparation_completed_at = now(),\n           ready_email_sent_at = null\n       where ${lookup.clause}`,\n      [lookup.values, tenantId, organizationId, userId],\n    )\n    // Fail loudly here rather than let the status call 404 three assertions later.\n    expect(result.rowCount, `markOnboardingReady should match the onboarding request for ${email}`).toBeGreaterThan(0)\n  })\n}\n\ntest.describe('TC-ONBOARDING-EMAIL-001: Onboarding emails use system channel', () => {\n  test('start, ready, and demo feedback emails dispatch through Communications Hub', async ({ request }) => {\n    test.slow()\n    const token = await getAuthToken(request, 'admin')\n    const scope = getTokenScope(token)\n    const seedingAvailable = await isChannelSeedingAvailable(request, token)\n    test.skip(!seedingAvailable, 'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled.')\n\n    const stamp = Date.now()\n    const onboardingEmail = `qa-onboarding-email-${stamp}@example.test`\n    const feedbackEmail = `qa-demo-feedback-${stamp}@example.test`\n    const adminEmail = process.env.ADMIN_EMAIL ?? 'piotr@catchthetornado.com'\n\n    await seedSystemEmailChannel(request, token)\n    await clearCapturedSystemEmails(request, token, { systemRecipient: onboardingEmail })\n    await clearCapturedSystemEmails(request, token, { systemRecipient: adminEmail })\n\n    try {\n      const start = await request.post('/api/onboarding/onboarding', {\n        headers: { 'Content-Type': 'application/json' },\n        data: {\n          email: onboardingEmail,\n          firstName: 'QA',\n          lastName: 'Onboarding',\n          organizationName: `QA Onboarding ${stamp}`,\n          password: `Valid1!Pass${stamp}`,\n          confirmPassword: `Valid1!Pass${stamp}`,\n          termsAccepted: true,\n          marketingConsent: false,\n        },\n      })\n      expect(start.status()).toBe(200)\n\n      const verificationEmail = await waitForCapturedSystemEmail(\n        request,\n        token,\n        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === 'Confirm your email to finish onboarding',\n        { description: 'onboarding verification email', systemRecipient: onboardingEmail },\n      )\n      expect(verificationEmail.scope.tenantId).toBe('system')\n      expect(verificationEmail.content.bodyFormat).toBe('html')\n\n      await waitForCapturedSystemEmail(\n        request,\n        token,\n        (email) => String(email.metadata?.to ?? '').includes('@') && email.metadata?.subject === 'New self-service onboarding request',\n        { description: 'onboarding admin email', systemRecipient: adminEmail },\n      )\n\n      await markOnboardingReady(onboardingEmail, scope.tenantId, scope.organizationId, scope.userId)\n      await clearCapturedSystemEmails(request, token)\n\n      const status = await request.get(`/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(scope.tenantId)}`, {\n        headers: {\n          cookie: `om_login_tenant=${encodeURIComponent(scope.tenantId)}`,\n        },\n      })\n      expect(status.status()).toBe(200)\n      const readyEmail = await waitForCapturedSystemEmail(\n        request,\n        token,\n        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === 'Your Open Mercato workspace is ready',\n        { description: 'onboarding ready email' },\n      )\n      expect(readyEmail.scope.tenantId).toBe(scope.tenantId)\n      expect(readyEmail.content.bodyFormat).toBe('html')\n\n      await clearCapturedSystemEmails(request, token)\n      const feedback = await request.post('/api/onboarding/demo-feedback', {\n        headers: { 'Content-Type': 'application/json' },\n        data: {\n          email: feedbackEmail,\n          message: 'Integration coverage feedback',\n          termsAccepted: true,\n          marketingConsent: false,\n        },\n      })\n      expect(feedback.status()).toBe(200)\n\n      await waitForCapturedSystemEmail(\n        request,\n        token,\n        (email) => String(email.metadata?.to ?? '').includes('@') && email.metadata?.subject === `Demo feedback from ${feedbackEmail}`,\n        { description: 'demo feedback admin email', systemRecipient: adminEmail },\n      )\n    } finally {\n      await deleteOnboardingRequest(onboardingEmail)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,YAAY,OAAqD;AACxE,SAAO,EAAE,QAAQ,wBAAwB,QAAQ,sBAAsB,KAAK,EAAE;AAChF;AAEA,eAAe,wBAAwB,OAA8B;AACnE,QAAM,SAAS,YAAY,KAAK;AAChC,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,yCAAyC,OAAO,MAAM,IAAI,CAAC,OAAO,MAAM,CAAC;AAAA,EAC9F,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAEA,eAAe,oBAAoB,OAAe,UAAkB,gBAAwB,QAA+B;AACzH,QAAM,SAAS,YAAY,KAAK;AAChC,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,eAOS,OAAO,MAAM;AAAA,MACtB,CAAC,OAAO,QAAQ,UAAU,gBAAgB,MAAM;AAAA,IAClD;AAEA,WAAO,OAAO,UAAU,+DAA+D,KAAK,EAAE,EAAE,gBAAgB,CAAC;AAAA,EACnH,CAAC;AACH;AAEA,KAAK,SAAS,iEAAiE,MAAM;AACnF,OAAK,8EAA8E,OAAO,EAAE,QAAQ,MAAM;AACxG,SAAK,KAAK;AACV,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,UAAM,QAAQ,cAAc,KAAK;AACjC,UAAM,mBAAmB,MAAM,0BAA0B,SAAS,KAAK;AACvE,SAAK,KAAK,CAAC,kBAAkB,gDAAgD;AAE7E,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,kBAAkB,uBAAuB,KAAK;AACpD,UAAM,gBAAgB,oBAAoB,KAAK;AAC/C,UAAM,aAAa,QAAQ,IAAI,eAAe;AAE9C,UAAM,uBAAuB,SAAS,KAAK;AAC3C,UAAM,0BAA0B,SAAS,OAAO,EAAE,iBAAiB,gBAAgB,CAAC;AACpF,UAAM,0BAA0B,SAAS,OAAO,EAAE,iBAAiB,WAAW,CAAC;AAE/E,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,KAAK,8BAA8B;AAAA,QAC7D,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM;AAAA,UACJ,OAAO;AAAA,UACP,WAAW;AAAA,UACX,UAAU;AAAA,UACV,kBAAkB,iBAAiB,KAAK;AAAA,UACxC,UAAU,cAAc,KAAK;AAAA,UAC7B,iBAAiB,cAAc,KAAK;AAAA,UACpC,eAAe;AAAA,UACf,kBAAkB;AAAA,QACpB;AAAA,MACF,CAAC;AACD,aAAO,MAAM,OAAO,CAAC,EAAE,KAAK,GAAG;AAE/B,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,CAAC,UAAU,MAAM,UAAU,OAAO,mBAAmB,MAAM,UAAU,YAAY;AAAA,QACjF,EAAE,aAAa,iCAAiC,iBAAiB,gBAAgB;AAAA,MACnF;AACA,aAAO,kBAAkB,MAAM,QAAQ,EAAE,KAAK,QAAQ;AACtD,aAAO,kBAAkB,QAAQ,UAAU,EAAE,KAAK,MAAM;AAExD,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,CAAC,UAAU,OAAO,MAAM,UAAU,MAAM,EAAE,EAAE,SAAS,GAAG,KAAK,MAAM,UAAU,YAAY;AAAA,QACzF,EAAE,aAAa,0BAA0B,iBAAiB,WAAW;AAAA,MACvE;AAEA,YAAM,oBAAoB,iBAAiB,MAAM,UAAU,MAAM,gBAAgB,MAAM,MAAM;AAC7F,YAAM,0BAA0B,SAAS,KAAK;AAE9C,YAAM,SAAS,MAAM,QAAQ,IAAI,8CAA8C,mBAAmB,MAAM,QAAQ,CAAC,IAAI;AAAA,QACnH,SAAS;AAAA,UACP,QAAQ,mBAAmB,mBAAmB,MAAM,QAAQ,CAAC;AAAA,QAC/D;AAAA,MACF,CAAC;AACD,aAAO,OAAO,OAAO,CAAC,EAAE,KAAK,GAAG;AAChC,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA,CAAC,UAAU,MAAM,UAAU,OAAO,mBAAmB,MAAM,UAAU,YAAY;AAAA,QACjF,EAAE,aAAa,yBAAyB;AAAA,MAC1C;AACA,aAAO,WAAW,MAAM,QAAQ,EAAE,KAAK,MAAM,QAAQ;AACrD,aAAO,WAAW,QAAQ,UAAU,EAAE,KAAK,MAAM;AAEjD,YAAM,0BAA0B,SAAS,KAAK;AAC9C,YAAM,WAAW,MAAM,QAAQ,KAAK,iCAAiC;AAAA,QACnE,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM;AAAA,UACJ,OAAO;AAAA,UACP,SAAS;AAAA,UACT,eAAe;AAAA,UACf,kBAAkB;AAAA,QACpB;AAAA,MACF,CAAC;AACD,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAElC,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,CAAC,UAAU,OAAO,MAAM,UAAU,MAAM,EAAE,EAAE,SAAS,GAAG,KAAK,MAAM,UAAU,YAAY,sBAAsB,aAAa;AAAA,QAC5H,EAAE,aAAa,6BAA6B,iBAAiB,WAAW;AAAA,MAC1E;AAAA,IACF,UAAE;AACA,YAAM,wBAAwB,eAAe;AAAA,IAC/C;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/onboarding/api/demo-feedback/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { sendEmail } from "@open-mercato/shared/lib/email/send";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import FeedbackEmail from "@open-mercato/onboarding/modules/onboarding/emails/FeedbackEmail";
 import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
 import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
@@ -42,6 +43,7 @@ async function POST(req) {
   }
   const { email, message, marketingConsent } = parsed.data;
   const adminEmail = process.env.ADMIN_EMAIL || "piotr@catchthetornado.com";
+  await createRequestContainer();
   const marketingText = marketingConsent ? "Marketing consent: Yes" : "Marketing consent: No";
   const adminCopy = {
     preview: `Demo feedback from ${email}`,

package/dist/modules/onboarding/api/demo-feedback/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/onboarding/api/demo-feedback/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport FeedbackEmail from '@open-mercato/onboarding/modules/onboarding/emails/FeedbackEmail'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('onboarding').child({ component: 'demo-feedback' })\n\nconst demoFeedbackIpRateLimitConfig = readEndpointRateLimitConfig('DEMO_FEEDBACK_IP', {\n  points: 5, duration: 300, blockDuration: 300, keyPrefix: 'demo-feedback-ip',\n})\n\nexport const metadata = {\n  path: '/onboarding/demo-feedback',\n  POST: {\n    requireAuth: false,\n  },\n}\n\nconst feedbackSchema = z.object({\n  email: z.string().email(),\n  message: z.string().max(5000).optional().default(''),\n  termsAccepted: z.literal(true),\n  marketingConsent: z.boolean().optional().default(false),\n})\n\nexport async function POST(req: Request) {\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: demoFeedbackIpRateLimitConfig,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const parsed = feedbackSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Please check the form and try again.' }, { status: 400 })\n  }\n\n  const { email, message, marketingConsent } = parsed.data\n  const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'\n\n  const marketingText = marketingConsent ? 'Marketing consent: Yes' : 'Marketing consent: No'\n\n  const adminCopy = {\n    preview: `Demo feedback from ${email}`,\n    heading: 'New demo feedback',\n    body: `${email} submitted a feedback/contact request from the demo environment.`,\n    senderEmailLabel: 'From email:',\n    senderEmail: email,\n    messageLabel: 'Message:',\n    message: message || '(no message provided)',\n    marketingConsent: marketingText,\n    footer: 'Open Mercato \\u00b7 Demo feedback',\n  }\n\n  try {\n    await sendEmail({\n      to: adminEmail,\n      subject: `Demo feedback from ${email}`,\n      react: FeedbackEmail({ copy: adminCopy }),\n    })\n  } catch (err) {\n    logger.error('Admin email failed', { err })\n    return NextResponse.json({ ok: false, error: 'Failed to send feedback. Please try again.' }, { status: 502 })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport default POST\n\nconst feedbackTag = 'Demo'\n\nconst feedbackPostDoc: OpenApiMethodDoc = {\n  summary: 'Submit demo feedback',\n  description: 'Sends a feedback/contact request from the demo environment to the configured admin.',\n  tags: [feedbackTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: feedbackSchema,\n    description: 'Feedback form payload.',\n  },\n  responses: [\n    { status: 200, description: 'Feedback sent successfully.' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: feedbackTag,\n  summary: 'Demo feedback submission',\n  methods: {\n    POST: feedbackPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,iBAAiB;AAC1B,OAAO,mBAAmB;AAC1B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAE5C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,gCAAgC,4BAA4B,oBAAoB;AAAA,EACpF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAK,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,EACf;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACnD,eAAe,EAAE,QAAQ,IAAI;AAAA,EAC7B,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAK;AACxD,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,SAAS,eAAe,UAAU,OAAO;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,EAAE,OAAO,SAAS,iBAAiB,IAAI,OAAO;AACpD,QAAM,aAAa,QAAQ,IAAI,eAAe;AAE9C,QAAM,gBAAgB,mBAAmB,2BAA2B;AAEpE,QAAM,YAAY;AAAA,IAChB,SAAS,sBAAsB,KAAK;AAAA,IACpC,SAAS;AAAA,IACT,MAAM,GAAG,KAAK;AAAA,IACd,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,SAAS,WAAW;AAAA,IACpB,kBAAkB;AAAA,IAClB,QAAQ;AAAA,EACV;AAEA,MAAI;AACF,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,sBAAsB,KAAK;AAAA,MACpC,OAAO,cAAc,EAAE,MAAM,UAAU,CAAC;AAAA,IAC1C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9G;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,IAAO,gBAAQ;AAEf,MAAM,cAAc;AAEpB,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,WAAW;AAAA,EAClB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,EAC5D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport FeedbackEmail from '@open-mercato/onboarding/modules/onboarding/emails/FeedbackEmail'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('onboarding').child({ component: 'demo-feedback' })\n\nconst demoFeedbackIpRateLimitConfig = readEndpointRateLimitConfig('DEMO_FEEDBACK_IP', {\n  points: 5, duration: 300, blockDuration: 300, keyPrefix: 'demo-feedback-ip',\n})\n\nexport const metadata = {\n  path: '/onboarding/demo-feedback',\n  POST: {\n    requireAuth: false,\n  },\n}\n\nconst feedbackSchema = z.object({\n  email: z.string().email(),\n  message: z.string().max(5000).optional().default(''),\n  termsAccepted: z.literal(true),\n  marketingConsent: z.boolean().optional().default(false),\n})\n\nexport async function POST(req: Request) {\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: demoFeedbackIpRateLimitConfig,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid payload' }, { status: 400 })\n  }\n\n  const parsed = feedbackSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Please check the form and try again.' }, { status: 400 })\n  }\n\n  const { email, message, marketingConsent } = parsed.data\n  const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'\n  // Load-bearing despite the discarded result: building the request container is what runs\n  // `communication_channels`' DI registration, and that is the only caller of\n  // `registerEmailTransport`. Without it `sendEmail` below finds no registered transport and\n  // throws `EMAIL_TRANSPORT_NOT_CONFIGURED`. This route is the one `sendEmail` call site with no\n  // container of its own, so the dependency has to be satisfied explicitly here.\n  await createRequestContainer()\n\n  const marketingText = marketingConsent ? 'Marketing consent: Yes' : 'Marketing consent: No'\n\n  const adminCopy = {\n    preview: `Demo feedback from ${email}`,\n    heading: 'New demo feedback',\n    body: `${email} submitted a feedback/contact request from the demo environment.`,\n    senderEmailLabel: 'From email:',\n    senderEmail: email,\n    messageLabel: 'Message:',\n    message: message || '(no message provided)',\n    marketingConsent: marketingText,\n    footer: 'Open Mercato \\u00b7 Demo feedback',\n  }\n\n  try {\n    await sendEmail({\n      to: adminEmail,\n      subject: `Demo feedback from ${email}`,\n      react: FeedbackEmail({ copy: adminCopy }),\n    })\n  } catch (err) {\n    logger.error('Admin email failed', { err })\n    return NextResponse.json({ ok: false, error: 'Failed to send feedback. Please try again.' }, { status: 502 })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport default POST\n\nconst feedbackTag = 'Demo'\n\nconst feedbackPostDoc: OpenApiMethodDoc = {\n  summary: 'Submit demo feedback',\n  description: 'Sends a feedback/contact request from the demo environment to the configured admin.',\n  tags: [feedbackTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: feedbackSchema,\n    description: 'Feedback form payload.',\n  },\n  responses: [\n    { status: 200, description: 'Feedback sent successfully.' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: feedbackTag,\n  summary: 'Demo feedback submission',\n  methods: {\n    POST: feedbackPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,iBAAiB;AAC1B,SAAS,8BAA8B;AACvC,OAAO,mBAAmB;AAC1B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC;AAE5C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,gCAAgC,4BAA4B,oBAAoB;AAAA,EACpF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAK,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,EACf;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,SAAS,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EACnD,eAAe,EAAE,QAAQ,IAAI;AAAA,EAC7B,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAK;AACxD,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,SAAS,eAAe,UAAU,OAAO;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,QAAM,EAAE,OAAO,SAAS,iBAAiB,IAAI,OAAO;AACpD,QAAM,aAAa,QAAQ,IAAI,eAAe;AAM9C,QAAM,uBAAuB;AAE7B,QAAM,gBAAgB,mBAAmB,2BAA2B;AAEpE,QAAM,YAAY;AAAA,IAChB,SAAS,sBAAsB,KAAK;AAAA,IACpC,SAAS;AAAA,IACT,MAAM,GAAG,KAAK;AAAA,IACd,kBAAkB;AAAA,IAClB,aAAa;AAAA,IACb,cAAc;AAAA,IACd,SAAS,WAAW;AAAA,IACpB,kBAAkB;AAAA,IAClB,QAAQ;AAAA,EACV;AAEA,MAAI;AACF,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,sBAAsB,KAAK;AAAA,MACpC,OAAO,cAAc,EAAE,MAAM,UAAU,CAAC;AAAA,IAC1C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9G;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,IAAO,gBAAQ;AAEf,MAAM,cAAc;AAEpB,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,WAAW;AAAA,EAClB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,EAC5D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/onboarding/lib/ready-email.js

@@ -38,7 +38,9 @@ async function sendWorkspaceReadyEmail(args) {
   await sendEmail({
     to: request.email,
     subject,
-    react: WorkspaceReadyEmail({ loginUrl, copy: emailCopy })
+    react: WorkspaceReadyEmail({ loginUrl, copy: emailCopy }),
+    tenantId: args.tenantId,
+    organizationId: request.organizationId ?? null
   });
   await service.markReadyEmailSent(request, /* @__PURE__ */ new Date());
   return true;

package/dist/modules/onboarding/lib/ready-email.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/onboarding/lib/ready-email.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { loadDictionary } from '@open-mercato/shared/lib/i18n/server'\nimport { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'\nimport { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { getSecurityEmailBaseUrl } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport WorkspaceReadyEmail from '@open-mercato/onboarding/modules/onboarding/emails/WorkspaceReadyEmail'\n\nfunction resolveLocale(rawLocale: string | null | undefined): Locale {\n  if (rawLocale && locales.includes(rawLocale as Locale)) return rawLocale as Locale\n  return defaultLocale\n}\n\nexport async function sendWorkspaceReadyEmail(args: {\n  requestId: string\n  tenantId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findById(args.requestId)\n  if (!request || request.readyEmailSentAt) return false\n  const locale = resolveLocale(request.locale)\n  const dict = await loadDictionary(locale)\n  const translate = createFallbackTranslator(dict)\n  const baseUrl = getSecurityEmailBaseUrl()\n  const loginUrl = `${baseUrl}/login?tenant=${encodeURIComponent(args.tenantId)}`\n  const firstName = request.firstName?.trim() || request.organizationName?.trim() || request.email\n  const subject = translate('onboarding.readyEmail.subject', 'Your Open Mercato workspace is ready')\n  const emailCopy = {\n    preview: translate('onboarding.readyEmail.preview', 'Your workspace is ready. Use your secure login link to sign in.'),\n    heading: translate('onboarding.readyEmail.heading', 'Your workspace is ready'),\n    greeting: translate('onboarding.readyEmail.greeting', 'Hi {firstName},', { firstName }),\n    body: translate(\n      'onboarding.readyEmail.body',\n      'Your Open Mercato workspace for {organizationName} has finished preparing. Use the secure link below to sign in.',\n      { organizationName: request.organizationName },\n    ),\n    cta: translate('onboarding.readyEmail.cta', 'Open login'),\n    footer: translate('onboarding.readyEmail.footer', 'Open Mercato \u00B7 Onboarding service'),\n  }\n\n  await sendEmail({\n    to: request.email,\n    subject,\n    react: WorkspaceReadyEmail({ loginUrl, copy: emailCopy }),\n  })\n  await service.markReadyEmailSent(request, new Date())\n  return true\n}\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,eAAe,eAA4B;AACpD,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,OAAO,yBAAyB;AAEhC,SAAS,cAAc,WAA8C;AACnE,MAAI,aAAa,QAAQ,SAAS,SAAmB,EAAG,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,wBAAwB,MAG3C;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS;AACrD,MAAI,CAAC,WAAW,QAAQ,iBAAkB,QAAO;AACjD,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAM,OAAO,MAAM,eAAe,MAAM;AACxC,QAAM,YAAY,yBAAyB,IAAI;AAC/C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,GAAG,OAAO,iBAAiB,mBAAmB,KAAK,QAAQ,CAAC;AAC7E,QAAM,YAAY,QAAQ,WAAW,KAAK,KAAK,QAAQ,kBAAkB,KAAK,KAAK,QAAQ;AAC3F,QAAM,UAAU,UAAU,iCAAiC,sCAAsC;AACjG,QAAM,YAAY;AAAA,IAChB,SAAS,UAAU,iCAAiC,iEAAiE;AAAA,IACrH,SAAS,UAAU,iCAAiC,yBAAyB;AAAA,IAC7E,UAAU,UAAU,kCAAkC,mBAAmB,EAAE,UAAU,CAAC;AAAA,IACtF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,kBAAkB,QAAQ,iBAAiB;AAAA,IAC/C;AAAA,IACA,KAAK,UAAU,6BAA6B,YAAY;AAAA,IACxD,QAAQ,UAAU,gCAAgC,sCAAmC;AAAA,EACvF;AAEA,QAAM,UAAU;AAAA,IACd,IAAI,QAAQ;AAAA,IACZ;AAAA,IACA,OAAO,oBAAoB,EAAE,UAAU,MAAM,UAAU,CAAC;AAAA,EAC1D,CAAC;AACD,QAAM,QAAQ,mBAAmB,SAAS,oBAAI,KAAK,CAAC;AACpD,SAAO;AACT;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { loadDictionary } from '@open-mercato/shared/lib/i18n/server'\nimport { defaultLocale, locales, type Locale } from '@open-mercato/shared/lib/i18n/config'\nimport { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { getSecurityEmailBaseUrl } from '@open-mercato/shared/lib/url'\nimport { OnboardingService } from '@open-mercato/onboarding/modules/onboarding/lib/service'\nimport WorkspaceReadyEmail from '@open-mercato/onboarding/modules/onboarding/emails/WorkspaceReadyEmail'\n\nfunction resolveLocale(rawLocale: string | null | undefined): Locale {\n  if (rawLocale && locales.includes(rawLocale as Locale)) return rawLocale as Locale\n  return defaultLocale\n}\n\nexport async function sendWorkspaceReadyEmail(args: {\n  requestId: string\n  tenantId: string\n}) {\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const service = new OnboardingService(em)\n  const request = await service.findById(args.requestId)\n  if (!request || request.readyEmailSentAt) return false\n  const locale = resolveLocale(request.locale)\n  const dict = await loadDictionary(locale)\n  const translate = createFallbackTranslator(dict)\n  const baseUrl = getSecurityEmailBaseUrl()\n  const loginUrl = `${baseUrl}/login?tenant=${encodeURIComponent(args.tenantId)}`\n  const firstName = request.firstName?.trim() || request.organizationName?.trim() || request.email\n  const subject = translate('onboarding.readyEmail.subject', 'Your Open Mercato workspace is ready')\n  const emailCopy = {\n    preview: translate('onboarding.readyEmail.preview', 'Your workspace is ready. Use your secure login link to sign in.'),\n    heading: translate('onboarding.readyEmail.heading', 'Your workspace is ready'),\n    greeting: translate('onboarding.readyEmail.greeting', 'Hi {firstName},', { firstName }),\n    body: translate(\n      'onboarding.readyEmail.body',\n      'Your Open Mercato workspace for {organizationName} has finished preparing. Use the secure link below to sign in.',\n      { organizationName: request.organizationName },\n    ),\n    cta: translate('onboarding.readyEmail.cta', 'Open login'),\n    footer: translate('onboarding.readyEmail.footer', 'Open Mercato \u00B7 Onboarding service'),\n  }\n\n  await sendEmail({\n    to: request.email,\n    subject,\n    react: WorkspaceReadyEmail({ loginUrl, copy: emailCopy }),\n    tenantId: args.tenantId,\n    organizationId: request.organizationId ?? null,\n  })\n  await service.markReadyEmailSent(request, new Date())\n  return true\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,eAAe,eAA4B;AACpD,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,OAAO,yBAAyB;AAEhC,SAAS,cAAc,WAA8C;AACnE,MAAI,aAAa,QAAQ,SAAS,SAAmB,EAAG,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,wBAAwB,MAG3C;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,UAAU,IAAI,kBAAkB,EAAE;AACxC,QAAM,UAAU,MAAM,QAAQ,SAAS,KAAK,SAAS;AACrD,MAAI,CAAC,WAAW,QAAQ,iBAAkB,QAAO;AACjD,QAAM,SAAS,cAAc,QAAQ,MAAM;AAC3C,QAAM,OAAO,MAAM,eAAe,MAAM;AACxC,QAAM,YAAY,yBAAyB,IAAI;AAC/C,QAAM,UAAU,wBAAwB;AACxC,QAAM,WAAW,GAAG,OAAO,iBAAiB,mBAAmB,KAAK,QAAQ,CAAC;AAC7E,QAAM,YAAY,QAAQ,WAAW,KAAK,KAAK,QAAQ,kBAAkB,KAAK,KAAK,QAAQ;AAC3F,QAAM,UAAU,UAAU,iCAAiC,sCAAsC;AACjG,QAAM,YAAY;AAAA,IAChB,SAAS,UAAU,iCAAiC,iEAAiE;AAAA,IACrH,SAAS,UAAU,iCAAiC,yBAAyB;AAAA,IAC7E,UAAU,UAAU,kCAAkC,mBAAmB,EAAE,UAAU,CAAC;AAAA,IACtF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,EAAE,kBAAkB,QAAQ,iBAAiB;AAAA,IAC/C;AAAA,IACA,KAAK,UAAU,6BAA6B,YAAY;AAAA,IACxD,QAAQ,UAAU,gCAAgC,sCAAmC;AAAA,EACvF;AAEA,QAAM,UAAU;AAAA,IACd,IAAI,QAAQ;AAAA,IACZ;AAAA,IACA,OAAO,oBAAoB,EAAE,UAAU,MAAM,UAAU,CAAC;AAAA,IACxD,UAAU,KAAK;AAAA,IACf,gBAAgB,QAAQ,kBAAkB;AAAA,EAC5C,CAAC;AACD,QAAM,QAAQ,mBAAmB,SAAS,oBAAI,KAAK,CAAC;AACpD,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.7.1-develop.7150.1.c1941e0c22",
+  "version": "0.7.1-develop.7151.1.00d0391847",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,10 +70,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7150.1.c1941e0c22"
+    "@open-mercato/shared": "0.7.1-develop.7151.1.00d0391847"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7150.1.c1941e0c22",
+    "@open-mercato/shared": "0.7.1-develop.7151.1.00d0391847",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12",

package/src/__tests__/demo-feedback-email.test.ts

@@ -5,6 +5,10 @@ jest.mock('@open-mercato/shared/lib/email/send', () => ({
   sendEmail: jest.fn((args: unknown) => sendEmailMock(args)),
 }))
 
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn().mockResolvedValue({}),
+}))
+
 jest.mock('@open-mercato/core/modules/auth/lib/rateLimitCheck', () => ({
   checkAuthRateLimit: jest.fn((args: unknown) => checkAuthRateLimitMock(args)),
 }))
@@ -18,8 +22,11 @@ jest.mock('@open-mercato/onboarding/modules/onboarding/emails/FeedbackEmail', ()
   default: jest.fn(() => null),
 }))
 
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { POST } from '../modules/onboarding/api/demo-feedback/route'
 
+const createRequestContainerMock = createRequestContainer as jest.MockedFunction<typeof createRequestContainer>
+
 function makeRequest(sendCopy?: boolean) {
   return new Request('http://localhost/api/onboarding/demo-feedback', {
     method: 'POST',
@@ -61,4 +68,21 @@ describe('POST /api/onboarding/demo-feedback', () => {
       expect.objectContaining({ to: 'unverified@example.com' }),
     )
   })
+
+  it('builds the request container before sending, so the email transport is registered', async () => {
+    // The route discards the container; its only purpose is running the DI registration that calls
+    // `registerEmailTransport`. Deleting that line would otherwise leave this suite green while
+    // every demo-feedback send failed with `EMAIL_TRANSPORT_NOT_CONFIGURED` in production.
+    let containerBuiltBeforeSend = false
+    createRequestContainerMock.mockImplementation(async () => ({}) as never)
+    sendEmailMock.mockImplementation(async () => {
+      containerBuiltBeforeSend = createRequestContainerMock.mock.calls.length > 0
+    })
+
+    const response = await POST(makeRequest())
+
+    expect(response.status).toBe(200)
+    expect(createRequestContainerMock).toHaveBeenCalled()
+    expect(containerBuiltBeforeSend).toBe(true)
+  })
 })

package/src/__tests__/ready-email.test.ts

@@ -47,6 +47,7 @@ function makeReadyRequest(overrides: Record<string, unknown> = {}) {
     organizationName: 'Acme Corp',
     locale: 'en',
     tenantId: 'tenant-uuid',
+    organizationId: 'organization-uuid',
     readyEmailSentAt: null,
     ...overrides,
   })
@@ -80,6 +81,10 @@ describe('sendWorkspaceReadyEmail', () => {
     expect(props.loginUrl).toBe('https://app.openmercato.com/login?tenant=tenant-uuid')
     expect(props.loginUrl).not.toContain('evil.com')
     expect(sendEmailMock).toHaveBeenCalledTimes(1)
+    expect(sendEmailMock).toHaveBeenCalledWith(expect.objectContaining({
+      tenantId: 'tenant-uuid',
+      organizationId: 'organization-uuid',
+    }))
     expect(markReadyEmailSentMock).toHaveBeenCalledTimes(1)
   })
 

package/src/modules/onboarding/__integration__/TC-ONBOARDING-EMAIL-001.spec.ts

@@ -0,0 +1,135 @@
+import { expect, test } from '@playwright/test'
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { withClient } from '@open-mercato/core/helpers/integration/dbFixtures'
+import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
+import {
+  clearCapturedSystemEmails,
+  isChannelSeedingAvailable,
+  seedSystemEmailChannel,
+  waitForCapturedSystemEmail,
+} from '@open-mercato/core/helpers/integration/communicationChannelsFixtures'
+
+// `onboarding_requests.email` is encrypted at rest, so a plaintext `where email = $1` matches
+// nothing. `email_hash` is the deterministic lookup key the service itself uses; the candidate
+// list covers key rotation the same way `lookupHashCandidates` does for the application.
+function emailLookup(email: string): { clause: string; values: string[] } {
+  return { clause: 'email_hash = any($1)', values: emailHashLookupValues(email) }
+}
+
+async function deleteOnboardingRequest(email: string): Promise<void> {
+  const lookup = emailLookup(email)
+  await withClient(async (client) => {
+    await client.query(`delete from onboarding_requests where ${lookup.clause}`, [lookup.values])
+  }).catch(() => undefined)
+}
+
+async function markOnboardingReady(email: string, tenantId: string, organizationId: string, userId: string): Promise<void> {
+  const lookup = emailLookup(email)
+  await withClient(async (client) => {
+    const result = await client.query(
+      `update onboarding_requests
+       set status = 'completed',
+           tenant_id = $2,
+           organization_id = $3,
+           user_id = $4,
+           preparation_completed_at = now(),
+           ready_email_sent_at = null
+       where ${lookup.clause}`,
+      [lookup.values, tenantId, organizationId, userId],
+    )
+    // Fail loudly here rather than let the status call 404 three assertions later.
+    expect(result.rowCount, `markOnboardingReady should match the onboarding request for ${email}`).toBeGreaterThan(0)
+  })
+}
+
+test.describe('TC-ONBOARDING-EMAIL-001: Onboarding emails use system channel', () => {
+  test('start, ready, and demo feedback emails dispatch through Communications Hub', async ({ request }) => {
+    test.slow()
+    const token = await getAuthToken(request, 'admin')
+    const scope = getTokenScope(token)
+    const seedingAvailable = await isChannelSeedingAvailable(request, token)
+    test.skip(!seedingAvailable, 'OM_ENABLE_TEST_CHANNEL_SEEDING is not enabled.')
+
+    const stamp = Date.now()
+    const onboardingEmail = `qa-onboarding-email-${stamp}@example.test`
+    const feedbackEmail = `qa-demo-feedback-${stamp}@example.test`
+    const adminEmail = process.env.ADMIN_EMAIL ?? 'piotr@catchthetornado.com'
+
+    await seedSystemEmailChannel(request, token)
+    await clearCapturedSystemEmails(request, token, { systemRecipient: onboardingEmail })
+    await clearCapturedSystemEmails(request, token, { systemRecipient: adminEmail })
+
+    try {
+      const start = await request.post('/api/onboarding/onboarding', {
+        headers: { 'Content-Type': 'application/json' },
+        data: {
+          email: onboardingEmail,
+          firstName: 'QA',
+          lastName: 'Onboarding',
+          organizationName: `QA Onboarding ${stamp}`,
+          password: `Valid1!Pass${stamp}`,
+          confirmPassword: `Valid1!Pass${stamp}`,
+          termsAccepted: true,
+          marketingConsent: false,
+        },
+      })
+      expect(start.status()).toBe(200)
+
+      const verificationEmail = await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === 'Confirm your email to finish onboarding',
+        { description: 'onboarding verification email', systemRecipient: onboardingEmail },
+      )
+      expect(verificationEmail.scope.tenantId).toBe('system')
+      expect(verificationEmail.content.bodyFormat).toBe('html')
+
+      await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => String(email.metadata?.to ?? '').includes('@') && email.metadata?.subject === 'New self-service onboarding request',
+        { description: 'onboarding admin email', systemRecipient: adminEmail },
+      )
+
+      await markOnboardingReady(onboardingEmail, scope.tenantId, scope.organizationId, scope.userId)
+      await clearCapturedSystemEmails(request, token)
+
+      const status = await request.get(`/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(scope.tenantId)}`, {
+        headers: {
+          cookie: `om_login_tenant=${encodeURIComponent(scope.tenantId)}`,
+        },
+      })
+      expect(status.status()).toBe(200)
+      const readyEmail = await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => email.metadata?.to === onboardingEmail && email.metadata?.subject === 'Your Open Mercato workspace is ready',
+        { description: 'onboarding ready email' },
+      )
+      expect(readyEmail.scope.tenantId).toBe(scope.tenantId)
+      expect(readyEmail.content.bodyFormat).toBe('html')
+
+      await clearCapturedSystemEmails(request, token)
+      const feedback = await request.post('/api/onboarding/demo-feedback', {
+        headers: { 'Content-Type': 'application/json' },
+        data: {
+          email: feedbackEmail,
+          message: 'Integration coverage feedback',
+          termsAccepted: true,
+          marketingConsent: false,
+        },
+      })
+      expect(feedback.status()).toBe(200)
+
+      await waitForCapturedSystemEmail(
+        request,
+        token,
+        (email) => String(email.metadata?.to ?? '').includes('@') && email.metadata?.subject === `Demo feedback from ${feedbackEmail}`,
+        { description: 'demo feedback admin email', systemRecipient: adminEmail },
+      )
+    } finally {
+      await deleteOnboardingRequest(onboardingEmail)
+    }
+  })
+})

package/src/modules/onboarding/api/demo-feedback/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { sendEmail } from '@open-mercato/shared/lib/email/send'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import FeedbackEmail from '@open-mercato/onboarding/modules/onboarding/emails/FeedbackEmail'
 import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
 import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
@@ -48,6 +49,12 @@ export async function POST(req: Request) {
 
   const { email, message, marketingConsent } = parsed.data
   const adminEmail = process.env.ADMIN_EMAIL || 'piotr@catchthetornado.com'
+  // Load-bearing despite the discarded result: building the request container is what runs
+  // `communication_channels`' DI registration, and that is the only caller of
+  // `registerEmailTransport`. Without it `sendEmail` below finds no registered transport and
+  // throws `EMAIL_TRANSPORT_NOT_CONFIGURED`. This route is the one `sendEmail` call site with no
+  // container of its own, so the dependency has to be satisfied explicitly here.
+  await createRequestContainer()
 
   const marketingText = marketingConsent ? 'Marketing consent: Yes' : 'Marketing consent: No'
 

package/src/modules/onboarding/lib/ready-email.ts

@@ -46,6 +46,8 @@ export async function sendWorkspaceReadyEmail(args: {
     to: request.email,
     subject,
     react: WorkspaceReadyEmail({ loginUrl, copy: emailCopy }),
+    tenantId: args.tenantId,
+    organizationId: request.organizationId ?? null,
   })
   await service.markReadyEmailSent(request, new Date())
   return true