@open-mercato/onboarding 0.7.1-develop.7202.1.a52dc6707c → 0.8.0

package/dist/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.js

@@ -39,8 +39,9 @@ async function readPreparationState(requestId) {
     return result.rows[0];
   });
 }
+const PREPARATION_DEADLINE_MS = 18e4;
 async function waitForPreparationComplete(request, tenant) {
-  const deadline = Date.now() + 6e4;
+  const deadline = Date.now() + PREPARATION_DEADLINE_MS;
   let lastState = null;
   while (Date.now() < deadline) {
     await pollOnboardingStatus(request, tenant.tenantId).catch(() => void 0);
@@ -48,8 +49,8 @@ async function waitForPreparationComplete(request, tenant) {
     if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;
     await new Promise((resolve) => setTimeout(resolve, 500));
   }
-  expect(lastState?.preparation_started_at, "deferred preparation lease should be cleared after completion").toBeNull();
   expect(lastState?.preparation_completed_at, "workspace preparation should complete").toBeTruthy();
+  expect(lastState?.preparation_started_at, "deferred preparation lease should be cleared after completion").toBeNull();
 }
 async function submitOnboarding(request, tenant) {
   const response = await request.post(`${BASE_URL}/api/onboarding/onboarding`, {
@@ -118,7 +119,7 @@ test.describe("TC-ONB-002: multi-tenant onboarding parallel login", () => {
     browser,
     request
   }) => {
-    test.setTimeout(12e4);
+    test.setTimeout(PREPARATION_DEADLINE_MS + 12e4);
     const unique = randomUUID().slice(0, 8);
     const tenants = [1, 2].map((index) => ({
       email: `qa-onboarding-parallel-${unique}-${index}@example.test`,

package/dist/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.ts"],
-  "sourcesContent": ["// Adapted from PR #3007 (pkarw) \u2014 multi-tenant parallel onboarding repro for the\n// 2026-06-11 demo pool-exhaustion outage, ported to the preparation_started_at\n// lease column introduced by the single-flight deferred-provisioning fix.\nimport { createHash, randomUUID } from 'node:crypto';\nimport { expect, test, type APIRequestContext, type Browser, type BrowserContext, type Page } from '@playwright/test';\nimport { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';\nimport { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';\n\nexport const integrationMeta = {\n  dependsOnModules: ['onboarding'],\n  requiredEnvVars: ['SELF_SERVICE_ONBOARDING_ENABLED'],\n  requiredAnyEnvVars: ['CONSENT_INTEGRITY_SECRET', 'AUTH_SECRET', 'NEXTAUTH_SECRET', 'JWT_SECRET'],\n};\n\ntype OnboardingTenant = {\n  email: string;\n  organizationName: string;\n  token: string;\n  requestId?: string;\n  tenantId?: string;\n};\n\ntype BrowserTenantSession = {\n  context: BrowserContext;\n  page: Page;\n  refreshRequests: string[];\n};\n\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\nconst ONBOARDING_PASSWORD = 'ParallelPass123!';\n\nfunction hashToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex');\n}\n\nasync function replaceVerificationToken(email: string, token: string): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `update onboarding_requests\n         set token_hash = $2,\n             expires_at = now() + interval '24 hours',\n             updated_at = now()\n       where email_hash = any($1::text[])\n       returning id`,\n      [lookupHashCandidates(email), hashToken(token)],\n    );\n    expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);\n    return result.rows[0].id;\n  });\n}\n\nasync function readPreparationState(requestId: string): Promise<{\n  preparation_completed_at: Date | null;\n  preparation_started_at: Date | null;\n}> {\n  return withClient(async (client) => {\n    const result = await client.query<{\n      preparation_completed_at: Date | null;\n      preparation_started_at: Date | null;\n    }>(\n      `select preparation_completed_at, preparation_started_at\n         from onboarding_requests\n        where id = $1`,\n      [requestId],\n    );\n    expect(result.rowCount, `onboarding request ${requestId} should remain queryable`).toBe(1);\n    return result.rows[0];\n  });\n}\n\nasync function waitForPreparationComplete(\n  request: APIRequestContext,\n  tenant: OnboardingTenant,\n): Promise<void> {\n  const deadline = Date.now() + 60_000;\n  let lastState: Awaited<ReturnType<typeof readPreparationState>> | null = null;\n  while (Date.now() < deadline) {\n    // Drive the same recovery the real preparing page provides: it polls the\n    // status endpoint every ~1s, and each poll re-schedules deferred\n    // provisioning when no fresh claim is held. Watching only the DB would never\n    // recover a deferred runner that crashed after claiming its lease.\n    await pollOnboardingStatus(request, tenant.tenantId!).catch(() => undefined);\n    lastState = await readPreparationState(tenant.requestId!);\n    if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;\n    await new Promise((resolve) => setTimeout(resolve, 500));\n  }\n  expect(lastState?.preparation_started_at, 'deferred preparation lease should be cleared after completion').toBeNull();\n  expect(lastState?.preparation_completed_at, 'workspace preparation should complete').toBeTruthy();\n}\n\nasync function submitOnboarding(request: APIRequestContext, tenant: OnboardingTenant): Promise<void> {\n  const response = await request.post(`${BASE_URL}/api/onboarding/onboarding`, {\n    data: {\n      email: tenant.email,\n      firstName: 'Parallel',\n      lastName: 'Login',\n      organizationName: tenant.organizationName,\n      password: ONBOARDING_PASSWORD,\n      confirmPassword: ONBOARDING_PASSWORD,\n      termsAccepted: true,\n      marketingConsent: true,\n      locale: 'en',\n    },\n  });\n  expect(response.status(), `onboarding start should succeed for ${tenant.email}`).toBe(200);\n}\n\nasync function verifyTenantInBrowser(browser: Browser, token: string): Promise<BrowserTenantSession & { tenantId: string }> {\n  const context = await browser.newContext({ baseURL: BASE_URL });\n  const page = await context.newPage();\n  const refreshRequests: string[] = [];\n  page.on('request', (browserRequest) => {\n    const url = browserRequest.url();\n    if (url.includes('/api/auth/session/refresh')) refreshRequests.push(url);\n  });\n\n  await page.goto(`/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`);\n  await expect(page).toHaveURL(/\\/onboarding\\/preparing\\?tenant=[0-9a-f-]+/);\n  await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n  const tenantId = new URL(page.url()).searchParams.get('tenant');\n  expect(tenantId, 'verify redirect should include tenant id').toMatch(\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,\n  );\n  return { context, page, refreshRequests, tenantId: tenantId! };\n}\n\nasync function pollOnboardingStatus(request: APIRequestContext, tenantId: string) {\n  return request.get(`${BASE_URL}/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(tenantId)}`, {\n    headers: {\n      Cookie: `om_login_tenant=${encodeURIComponent(tenantId)}`,\n    },\n  });\n}\n\nasync function loginAndAssertBackend(session: BrowserTenantSession, tenant: OnboardingTenant): Promise<void> {\n  expect(tenant.tenantId, `tenant id should exist for ${tenant.email}`).toBeTruthy();\n  await expect(session.page).toHaveURL(new RegExp(`/login\\\\?tenant=${tenant.tenantId}`));\n  await expect(session.page.locator('form[data-auth-ready=\"1\"]')).toBeVisible();\n  await session.page.getByLabel('Email').fill(tenant.email);\n  await session.page.getByLabel('Password', { exact: true }).fill(ONBOARDING_PASSWORD);\n  await session.page.getByRole('button', { name: 'Sign in' }).click();\n  await expect(session.page, `browser login should land ${tenant.email} in the backend`).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  await expect(session.page.getByText(/Session expired/i)).toHaveCount(0);\n\n  const profileResult = await session.page.evaluate(async () => {\n    const response = await fetch('/api/auth/profile', { credentials: 'include' });\n    const body = await response.json().catch(() => null);\n    return { status: response.status, body };\n  });\n  expect(profileResult.status, `browser page should keep ${tenant.email} authenticated`).toBe(200);\n  const profile = profileResult.body;\n  expect(profile.email).toBe(tenant.email);\n  expect(profile.roles).toContain('admin');\n\n  await session.page.goto('/backend');\n  await expect(session.page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  expect(session.refreshRequests, `backend should not bounce ${tenant.email} through session refresh`).toHaveLength(0);\n}\n\ntest.describe('TC-ONB-002: multi-tenant onboarding parallel login', () => {\n  test('creates two self-service tenants, handles repeated status polling, and keeps both logins authenticated', async ({\n    browser,\n    request,\n  }) => {\n    // Two full onboardings + parallel browser logins + DB-polled preparation\n    // far exceed the 20s suite default (house pattern: TC-AI-AGENT-SETTINGS-005).\n    test.setTimeout(120_000);\n    const unique = randomUUID().slice(0, 8);\n    const tenants: OnboardingTenant[] = [1, 2].map((index) => ({\n      email: `qa-onboarding-parallel-${unique}-${index}@example.test`,\n      organizationName: `QA Onboarding Parallel ${unique} ${index}`,\n      token: `integration-parallel-${index}-${randomUUID().replace(/-/g, '')}`,\n    }));\n\n    await Promise.all(tenants.map((tenant) => submitOnboarding(request, tenant)));\n\n    for (const tenant of tenants) {\n      tenant.requestId = await replaceVerificationToken(tenant.email, tenant.token);\n    }\n\n    const browserSessions = await Promise.all(\n      tenants.map(async (tenant) => {\n        const session = await verifyTenantInBrowser(browser, tenant.token);\n        tenant.tenantId = session.tenantId;\n        return session;\n      }),\n    );\n\n    try {\n      const statusResponses = await Promise.all(\n        tenants.flatMap((tenant) =>\n          Array.from({ length: 6 }, () => pollOnboardingStatus(request, tenant.tenantId!)),\n        ),\n      );\n      for (const response of statusResponses) {\n        expect(response.status(), 'status polling should not exhaust the app DB pool').toBe(200);\n      }\n\n      await Promise.all(tenants.map((tenant) => waitForPreparationComplete(request, tenant)));\n      await Promise.all(\n        tenants.map((tenant, index) => loginAndAssertBackend(browserSessions[index], tenant)),\n      );\n    } finally {\n      await Promise.all(browserSessions.map((session) => session.context.close()));\n    }\n  });\n});\n"],
-  "mappings": "AAGA,SAAS,YAAY,kBAAkB;AACvC,SAAS,QAAQ,YAAkF;AACnG,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AAE9B,MAAM,kBAAkB;AAAA,EAC7B,kBAAkB,CAAC,YAAY;AAAA,EAC/B,iBAAiB,CAAC,iCAAiC;AAAA,EACnD,oBAAoB,CAAC,4BAA4B,eAAe,mBAAmB,YAAY;AACjG;AAgBA,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AACjD,MAAM,sBAAsB;AAE5B,SAAS,UAAU,OAAuB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,eAAe,yBAAyB,OAAe,OAAgC;AACrF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,qBAAqB,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,IAChD;AACA,WAAO,OAAO,UAAU,uCAAuC,KAAK,EAAE,EAAE,KAAK,CAAC;AAC9E,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAEA,eAAe,qBAAqB,WAGjC;AACD,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAI1B;AAAA;AAAA;AAAA,MAGA,CAAC,SAAS;AAAA,IACZ;AACA,WAAO,OAAO,UAAU,sBAAsB,SAAS,0BAA0B,EAAE,KAAK,CAAC;AACzF,WAAO,OAAO,KAAK,CAAC;AAAA,EACtB,CAAC;AACH;AAEA,eAAe,2BACb,SACA,QACe;AACf,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,YAAqE;AACzE,SAAO,KAAK,IAAI,IAAI,UAAU;AAK5B,UAAM,qBAAqB,SAAS,OAAO,QAAS,EAAE,MAAM,MAAM,MAAS;AAC3E,gBAAY,MAAM,qBAAqB,OAAO,SAAU;AACxD,QAAI,UAAU,4BAA4B,CAAC,UAAU,uBAAwB;AAC7E,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,EACzD;AACA,SAAO,WAAW,wBAAwB,+DAA+D,EAAE,SAAS;AACpH,SAAO,WAAW,0BAA0B,uCAAuC,EAAE,WAAW;AAClG;AAEA,eAAe,iBAAiB,SAA4B,QAAyC;AACnG,QAAM,WAAW,MAAM,QAAQ,KAAK,GAAG,QAAQ,8BAA8B;AAAA,IAC3E,MAAM;AAAA,MACJ,OAAO,OAAO;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,MACV,kBAAkB,OAAO;AAAA,MACzB,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,uCAAuC,OAAO,KAAK,EAAE,EAAE,KAAK,GAAG;AAC3F;AAEA,eAAe,sBAAsB,SAAkB,OAAqE;AAC1H,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,SAAS,CAAC;AAC9D,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,kBAA4B,CAAC;AACnC,OAAK,GAAG,WAAW,CAAC,mBAAmB;AACrC,UAAM,MAAM,eAAe,IAAI;AAC/B,QAAI,IAAI,SAAS,2BAA2B,EAAG,iBAAgB,KAAK,GAAG;AAAA,EACzE,CAAC;AAED,QAAM,KAAK,KAAK,2CAA2C,mBAAmB,KAAK,CAAC,EAAE;AACtF,QAAM,OAAO,IAAI,EAAE,UAAU,4CAA4C;AACzE,QAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAC5E,QAAM,WAAW,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,aAAa,IAAI,QAAQ;AAC9D,SAAO,UAAU,0CAA0C,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,iBAAiB,SAAoB;AAC/D;AAEA,eAAe,qBAAqB,SAA4B,UAAkB;AAChF,SAAO,QAAQ,IAAI,GAAG,QAAQ,8CAA8C,mBAAmB,QAAQ,CAAC,IAAI;AAAA,IAC1G,SAAS;AAAA,MACP,QAAQ,mBAAmB,mBAAmB,QAAQ,CAAC;AAAA,IACzD;AAAA,EACF,CAAC;AACH;AAEA,eAAe,sBAAsB,SAA+B,QAAyC;AAC3G,SAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,EAAE,EAAE,WAAW;AACjF,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,IAAI,OAAO,mBAAmB,OAAO,QAAQ,EAAE,CAAC;AACrF,QAAM,OAAO,QAAQ,KAAK,QAAQ,2BAA2B,CAAC,EAAE,YAAY;AAC5E,QAAM,QAAQ,KAAK,WAAW,OAAO,EAAE,KAAK,OAAO,KAAK;AACxD,QAAM,QAAQ,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,mBAAmB;AACnF,QAAM,QAAQ,KAAK,UAAU,UAAU,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM;AAClE,QAAM,OAAO,QAAQ,MAAM,6BAA6B,OAAO,KAAK,iBAAiB,EAAE,UAAU,qBAAqB;AACtH,QAAM,OAAO,QAAQ,KAAK,UAAU,kBAAkB,CAAC,EAAE,YAAY,CAAC;AAEtE,QAAM,gBAAgB,MAAM,QAAQ,KAAK,SAAS,YAAY;AAC5D,UAAM,WAAW,MAAM,MAAM,qBAAqB,EAAE,aAAa,UAAU,CAAC;AAC5E,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,WAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK;AAAA,EACzC,CAAC;AACD,SAAO,cAAc,QAAQ,4BAA4B,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG;AAC/F,QAAM,UAAU,cAAc;AAC9B,SAAO,QAAQ,KAAK,EAAE,KAAK,OAAO,KAAK;AACvC,SAAO,QAAQ,KAAK,EAAE,UAAU,OAAO;AAEvC,QAAM,QAAQ,KAAK,KAAK,UAAU;AAClC,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,qBAAqB;AAC1D,SAAO,QAAQ,iBAAiB,6BAA6B,OAAO,KAAK,0BAA0B,EAAE,aAAa,CAAC;AACrH;AAEA,KAAK,SAAS,sDAAsD,MAAM;AACxE,OAAK,0GAA0G,OAAO;AAAA,IACpH;AAAA,IACA;AAAA,EACF,MAAM;AAGJ,SAAK,WAAW,IAAO;AACvB,UAAM,SAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,UAAM,UAA8B,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW;AAAA,MACzD,OAAO,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAChD,kBAAkB,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAC3D,OAAO,wBAAwB,KAAK,IAAI,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,IACxE,EAAE;AAEF,UAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,iBAAiB,SAAS,MAAM,CAAC,CAAC;AAE5E,eAAW,UAAU,SAAS;AAC5B,aAAO,YAAY,MAAM,yBAAyB,OAAO,OAAO,OAAO,KAAK;AAAA,IAC9E;AAEA,UAAM,kBAAkB,MAAM,QAAQ;AAAA,MACpC,QAAQ,IAAI,OAAO,WAAW;AAC5B,cAAM,UAAU,MAAM,sBAAsB,SAAS,OAAO,KAAK;AACjE,eAAO,WAAW,QAAQ;AAC1B,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,kBAAkB,MAAM,QAAQ;AAAA,QACpC,QAAQ;AAAA,UAAQ,CAAC,WACf,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,SAAS,OAAO,QAAS,CAAC;AAAA,QACjF;AAAA,MACF;AACA,iBAAW,YAAY,iBAAiB;AACtC,eAAO,SAAS,OAAO,GAAG,mDAAmD,EAAE,KAAK,GAAG;AAAA,MACzF;AAEA,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,2BAA2B,SAAS,MAAM,CAAC,CAAC;AACtF,YAAM,QAAQ;AAAA,QACZ,QAAQ,IAAI,CAAC,QAAQ,UAAU,sBAAsB,gBAAgB,KAAK,GAAG,MAAM,CAAC;AAAA,MACtF;AAAA,IACF,UAAE;AACA,YAAM,QAAQ,IAAI,gBAAgB,IAAI,CAAC,YAAY,QAAQ,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC7E;AAAA,EACF,CAAC;AACH,CAAC;",
+  "sourcesContent": ["// Adapted from PR #3007 (pkarw) \u2014 multi-tenant parallel onboarding repro for the\n// 2026-06-11 demo pool-exhaustion outage, ported to the preparation_started_at\n// lease column introduced by the single-flight deferred-provisioning fix.\nimport { createHash, randomUUID } from 'node:crypto';\nimport { expect, test, type APIRequestContext, type Browser, type BrowserContext, type Page } from '@playwright/test';\nimport { withClient } from '@open-mercato/core/helpers/integration/dbFixtures';\nimport { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes';\n\nexport const integrationMeta = {\n  dependsOnModules: ['onboarding'],\n  requiredEnvVars: ['SELF_SERVICE_ONBOARDING_ENABLED'],\n  requiredAnyEnvVars: ['CONSENT_INTEGRITY_SECRET', 'AUTH_SECRET', 'NEXTAUTH_SECRET', 'JWT_SECRET'],\n};\n\ntype OnboardingTenant = {\n  email: string;\n  organizationName: string;\n  token: string;\n  requestId?: string;\n  tenantId?: string;\n};\n\ntype BrowserTenantSession = {\n  context: BrowserContext;\n  page: Page;\n  refreshRequests: string[];\n};\n\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\nconst ONBOARDING_PASSWORD = 'ParallelPass123!';\n\nfunction hashToken(token: string): string {\n  return createHash('sha256').update(token).digest('hex');\n}\n\nasync function replaceVerificationToken(email: string, token: string): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `update onboarding_requests\n         set token_hash = $2,\n             expires_at = now() + interval '24 hours',\n             updated_at = now()\n       where email_hash = any($1::text[])\n       returning id`,\n      [lookupHashCandidates(email), hashToken(token)],\n    );\n    expect(result.rowCount, `onboarding request should exist for ${email}`).toBe(1);\n    return result.rows[0].id;\n  });\n}\n\nasync function readPreparationState(requestId: string): Promise<{\n  preparation_completed_at: Date | null;\n  preparation_started_at: Date | null;\n}> {\n  return withClient(async (client) => {\n    const result = await client.query<{\n      preparation_completed_at: Date | null;\n      preparation_started_at: Date | null;\n    }>(\n      `select preparation_completed_at, preparation_started_at\n         from onboarding_requests\n        where id = $1`,\n      [requestId],\n    );\n    expect(result.rowCount, `onboarding request ${requestId} should remain queryable`).toBe(1);\n    return result.rows[0];\n  });\n}\n\n// Budget the wait from what the chain can actually take, not from a round number. Deferred\n// provisioning runs every module's `seedExamples` sequentially under its own\n// SEED_EXAMPLES_TIMEOUT_MS (15s) cap \u2014 a dozen such modules ship today, so one chain's\n// worst case is ~180s, and this test drives two of them concurrently on a shared CI runner\n// under V8 coverage. The old 60s deadline asserted a bound the implementation never offered\n// and expired mid-chain (the lease was still being renewed one second before it fired).\nconst PREPARATION_DEADLINE_MS = 180_000;\n\nasync function waitForPreparationComplete(\n  request: APIRequestContext,\n  tenant: OnboardingTenant,\n): Promise<void> {\n  const deadline = Date.now() + PREPARATION_DEADLINE_MS;\n  let lastState: Awaited<ReturnType<typeof readPreparationState>> | null = null;\n  while (Date.now() < deadline) {\n    // Drive the same recovery the real preparing page provides: it polls the\n    // status endpoint every ~1s, and each poll re-schedules deferred\n    // provisioning when no fresh claim is held. Watching only the DB would never\n    // recover a deferred runner that crashed after claiming its lease.\n    await pollOnboardingStatus(request, tenant.tenantId!).catch(() => undefined);\n    lastState = await readPreparationState(tenant.requestId!);\n    if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;\n    await new Promise((resolve) => setTimeout(resolve, 500));\n  }\n  // Completion first: a chain that simply has not finished yet still holds a freshly renewed\n  // lease, so asserting the lease first reports \"lease should be cleared\" for what is really\n  // \"preparation never completed\" \u2014 the misdiagnosis this ordering avoids.\n  expect(lastState?.preparation_completed_at, 'workspace preparation should complete').toBeTruthy();\n  expect(lastState?.preparation_started_at, 'deferred preparation lease should be cleared after completion').toBeNull();\n}\n\nasync function submitOnboarding(request: APIRequestContext, tenant: OnboardingTenant): Promise<void> {\n  const response = await request.post(`${BASE_URL}/api/onboarding/onboarding`, {\n    data: {\n      email: tenant.email,\n      firstName: 'Parallel',\n      lastName: 'Login',\n      organizationName: tenant.organizationName,\n      password: ONBOARDING_PASSWORD,\n      confirmPassword: ONBOARDING_PASSWORD,\n      termsAccepted: true,\n      marketingConsent: true,\n      locale: 'en',\n    },\n  });\n  expect(response.status(), `onboarding start should succeed for ${tenant.email}`).toBe(200);\n}\n\nasync function verifyTenantInBrowser(browser: Browser, token: string): Promise<BrowserTenantSession & { tenantId: string }> {\n  const context = await browser.newContext({ baseURL: BASE_URL });\n  const page = await context.newPage();\n  const refreshRequests: string[] = [];\n  page.on('request', (browserRequest) => {\n    const url = browserRequest.url();\n    if (url.includes('/api/auth/session/refresh')) refreshRequests.push(url);\n  });\n\n  await page.goto(`/api/onboarding/onboarding/verify?token=${encodeURIComponent(token)}`);\n  await expect(page).toHaveURL(/\\/onboarding\\/preparing\\?tenant=[0-9a-f-]+/);\n  await expect(page.getByText('We are preparing your workspace')).toBeVisible();\n  const tenantId = new URL(page.url()).searchParams.get('tenant');\n  expect(tenantId, 'verify redirect should include tenant id').toMatch(\n    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,\n  );\n  return { context, page, refreshRequests, tenantId: tenantId! };\n}\n\nasync function pollOnboardingStatus(request: APIRequestContext, tenantId: string) {\n  return request.get(`${BASE_URL}/api/onboarding/onboarding/status?tenantId=${encodeURIComponent(tenantId)}`, {\n    headers: {\n      Cookie: `om_login_tenant=${encodeURIComponent(tenantId)}`,\n    },\n  });\n}\n\nasync function loginAndAssertBackend(session: BrowserTenantSession, tenant: OnboardingTenant): Promise<void> {\n  expect(tenant.tenantId, `tenant id should exist for ${tenant.email}`).toBeTruthy();\n  await expect(session.page).toHaveURL(new RegExp(`/login\\\\?tenant=${tenant.tenantId}`));\n  await expect(session.page.locator('form[data-auth-ready=\"1\"]')).toBeVisible();\n  await session.page.getByLabel('Email').fill(tenant.email);\n  await session.page.getByLabel('Password', { exact: true }).fill(ONBOARDING_PASSWORD);\n  await session.page.getByRole('button', { name: 'Sign in' }).click();\n  await expect(session.page, `browser login should land ${tenant.email} in the backend`).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  await expect(session.page.getByText(/Session expired/i)).toHaveCount(0);\n\n  const profileResult = await session.page.evaluate(async () => {\n    const response = await fetch('/api/auth/profile', { credentials: 'include' });\n    const body = await response.json().catch(() => null);\n    return { status: response.status, body };\n  });\n  expect(profileResult.status, `browser page should keep ${tenant.email} authenticated`).toBe(200);\n  const profile = profileResult.body;\n  expect(profile.email).toBe(tenant.email);\n  expect(profile.roles).toContain('admin');\n\n  await session.page.goto('/backend');\n  await expect(session.page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n  expect(session.refreshRequests, `backend should not bounce ${tenant.email} through session refresh`).toHaveLength(0);\n}\n\ntest.describe('TC-ONB-002: multi-tenant onboarding parallel login', () => {\n  test('creates two self-service tenants, handles repeated status polling, and keeps both logins authenticated', async ({\n    browser,\n    request,\n  }) => {\n    // Two full onboardings + parallel browser logins + DB-polled preparation\n    // far exceed the 20s suite default (house pattern: TC-AI-AGENT-SETTINGS-005).\n    // The dominant term is PREPARATION_DEADLINE_MS; the rest is onboarding submission,\n    // two browser verifies and two browser logins, so budget it with room to spare\n    // rather than letting the test die before its own poll can reach its deadline.\n    test.setTimeout(PREPARATION_DEADLINE_MS + 120_000);\n    const unique = randomUUID().slice(0, 8);\n    const tenants: OnboardingTenant[] = [1, 2].map((index) => ({\n      email: `qa-onboarding-parallel-${unique}-${index}@example.test`,\n      organizationName: `QA Onboarding Parallel ${unique} ${index}`,\n      token: `integration-parallel-${index}-${randomUUID().replace(/-/g, '')}`,\n    }));\n\n    await Promise.all(tenants.map((tenant) => submitOnboarding(request, tenant)));\n\n    for (const tenant of tenants) {\n      tenant.requestId = await replaceVerificationToken(tenant.email, tenant.token);\n    }\n\n    const browserSessions = await Promise.all(\n      tenants.map(async (tenant) => {\n        const session = await verifyTenantInBrowser(browser, tenant.token);\n        tenant.tenantId = session.tenantId;\n        return session;\n      }),\n    );\n\n    try {\n      const statusResponses = await Promise.all(\n        tenants.flatMap((tenant) =>\n          Array.from({ length: 6 }, () => pollOnboardingStatus(request, tenant.tenantId!)),\n        ),\n      );\n      for (const response of statusResponses) {\n        expect(response.status(), 'status polling should not exhaust the app DB pool').toBe(200);\n      }\n\n      await Promise.all(tenants.map((tenant) => waitForPreparationComplete(request, tenant)));\n      await Promise.all(\n        tenants.map((tenant, index) => loginAndAssertBackend(browserSessions[index], tenant)),\n      );\n    } finally {\n      await Promise.all(browserSessions.map((session) => session.context.close()));\n    }\n  });\n});\n"],
+  "mappings": "AAGA,SAAS,YAAY,kBAAkB;AACvC,SAAS,QAAQ,YAAkF;AACnG,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AAE9B,MAAM,kBAAkB;AAAA,EAC7B,kBAAkB,CAAC,YAAY;AAAA,EAC/B,iBAAiB,CAAC,iCAAiC;AAAA,EACnD,oBAAoB,CAAC,4BAA4B,eAAe,mBAAmB,YAAY;AACjG;AAgBA,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AACjD,MAAM,sBAAsB;AAE5B,SAAS,UAAU,OAAuB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACxD;AAEA,eAAe,yBAAyB,OAAe,OAAgC;AACrF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,qBAAqB,KAAK,GAAG,UAAU,KAAK,CAAC;AAAA,IAChD;AACA,WAAO,OAAO,UAAU,uCAAuC,KAAK,EAAE,EAAE,KAAK,CAAC;AAC9E,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAEA,eAAe,qBAAqB,WAGjC;AACD,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAI1B;AAAA;AAAA;AAAA,MAGA,CAAC,SAAS;AAAA,IACZ;AACA,WAAO,OAAO,UAAU,sBAAsB,SAAS,0BAA0B,EAAE,KAAK,CAAC;AACzF,WAAO,OAAO,KAAK,CAAC;AAAA,EACtB,CAAC;AACH;AAQA,MAAM,0BAA0B;AAEhC,eAAe,2BACb,SACA,QACe;AACf,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,YAAqE;AACzE,SAAO,KAAK,IAAI,IAAI,UAAU;AAK5B,UAAM,qBAAqB,SAAS,OAAO,QAAS,EAAE,MAAM,MAAM,MAAS;AAC3E,gBAAY,MAAM,qBAAqB,OAAO,SAAU;AACxD,QAAI,UAAU,4BAA4B,CAAC,UAAU,uBAAwB;AAC7E,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,EACzD;AAIA,SAAO,WAAW,0BAA0B,uCAAuC,EAAE,WAAW;AAChG,SAAO,WAAW,wBAAwB,+DAA+D,EAAE,SAAS;AACtH;AAEA,eAAe,iBAAiB,SAA4B,QAAyC;AACnG,QAAM,WAAW,MAAM,QAAQ,KAAK,GAAG,QAAQ,8BAA8B;AAAA,IAC3E,MAAM;AAAA,MACJ,OAAO,OAAO;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,MACV,kBAAkB,OAAO;AAAA,MACzB,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,kBAAkB;AAAA,MAClB,QAAQ;AAAA,IACV;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,uCAAuC,OAAO,KAAK,EAAE,EAAE,KAAK,GAAG;AAC3F;AAEA,eAAe,sBAAsB,SAAkB,OAAqE;AAC1H,QAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,SAAS,CAAC;AAC9D,QAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAM,kBAA4B,CAAC;AACnC,OAAK,GAAG,WAAW,CAAC,mBAAmB;AACrC,UAAM,MAAM,eAAe,IAAI;AAC/B,QAAI,IAAI,SAAS,2BAA2B,EAAG,iBAAgB,KAAK,GAAG;AAAA,EACzE,CAAC;AAED,QAAM,KAAK,KAAK,2CAA2C,mBAAmB,KAAK,CAAC,EAAE;AACtF,QAAM,OAAO,IAAI,EAAE,UAAU,4CAA4C;AACzE,QAAM,OAAO,KAAK,UAAU,iCAAiC,CAAC,EAAE,YAAY;AAC5E,QAAM,WAAW,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,aAAa,IAAI,QAAQ;AAC9D,SAAO,UAAU,0CAA0C,EAAE;AAAA,IAC3D;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,iBAAiB,SAAoB;AAC/D;AAEA,eAAe,qBAAqB,SAA4B,UAAkB;AAChF,SAAO,QAAQ,IAAI,GAAG,QAAQ,8CAA8C,mBAAmB,QAAQ,CAAC,IAAI;AAAA,IAC1G,SAAS;AAAA,MACP,QAAQ,mBAAmB,mBAAmB,QAAQ,CAAC;AAAA,IACzD;AAAA,EACF,CAAC;AACH;AAEA,eAAe,sBAAsB,SAA+B,QAAyC;AAC3G,SAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,EAAE,EAAE,WAAW;AACjF,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,IAAI,OAAO,mBAAmB,OAAO,QAAQ,EAAE,CAAC;AACrF,QAAM,OAAO,QAAQ,KAAK,QAAQ,2BAA2B,CAAC,EAAE,YAAY;AAC5E,QAAM,QAAQ,KAAK,WAAW,OAAO,EAAE,KAAK,OAAO,KAAK;AACxD,QAAM,QAAQ,KAAK,WAAW,YAAY,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,mBAAmB;AACnF,QAAM,QAAQ,KAAK,UAAU,UAAU,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM;AAClE,QAAM,OAAO,QAAQ,MAAM,6BAA6B,OAAO,KAAK,iBAAiB,EAAE,UAAU,qBAAqB;AACtH,QAAM,OAAO,QAAQ,KAAK,UAAU,kBAAkB,CAAC,EAAE,YAAY,CAAC;AAEtE,QAAM,gBAAgB,MAAM,QAAQ,KAAK,SAAS,YAAY;AAC5D,UAAM,WAAW,MAAM,MAAM,qBAAqB,EAAE,aAAa,UAAU,CAAC;AAC5E,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACnD,WAAO,EAAE,QAAQ,SAAS,QAAQ,KAAK;AAAA,EACzC,CAAC;AACD,SAAO,cAAc,QAAQ,4BAA4B,OAAO,KAAK,gBAAgB,EAAE,KAAK,GAAG;AAC/F,QAAM,UAAU,cAAc;AAC9B,SAAO,QAAQ,KAAK,EAAE,KAAK,OAAO,KAAK;AACvC,SAAO,QAAQ,KAAK,EAAE,UAAU,OAAO;AAEvC,QAAM,QAAQ,KAAK,KAAK,UAAU;AAClC,QAAM,OAAO,QAAQ,IAAI,EAAE,UAAU,qBAAqB;AAC1D,SAAO,QAAQ,iBAAiB,6BAA6B,OAAO,KAAK,0BAA0B,EAAE,aAAa,CAAC;AACrH;AAEA,KAAK,SAAS,sDAAsD,MAAM;AACxE,OAAK,0GAA0G,OAAO;AAAA,IACpH;AAAA,IACA;AAAA,EACF,MAAM;AAMJ,SAAK,WAAW,0BAA0B,IAAO;AACjD,UAAM,SAAS,WAAW,EAAE,MAAM,GAAG,CAAC;AACtC,UAAM,UAA8B,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,WAAW;AAAA,MACzD,OAAO,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAChD,kBAAkB,0BAA0B,MAAM,IAAI,KAAK;AAAA,MAC3D,OAAO,wBAAwB,KAAK,IAAI,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,IACxE,EAAE;AAEF,UAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,iBAAiB,SAAS,MAAM,CAAC,CAAC;AAE5E,eAAW,UAAU,SAAS;AAC5B,aAAO,YAAY,MAAM,yBAAyB,OAAO,OAAO,OAAO,KAAK;AAAA,IAC9E;AAEA,UAAM,kBAAkB,MAAM,QAAQ;AAAA,MACpC,QAAQ,IAAI,OAAO,WAAW;AAC5B,cAAM,UAAU,MAAM,sBAAsB,SAAS,OAAO,KAAK;AACjE,eAAO,WAAW,QAAQ;AAC1B,eAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,QAAI;AACF,YAAM,kBAAkB,MAAM,QAAQ;AAAA,QACpC,QAAQ;AAAA,UAAQ,CAAC,WACf,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,qBAAqB,SAAS,OAAO,QAAS,CAAC;AAAA,QACjF;AAAA,MACF;AACA,iBAAW,YAAY,iBAAiB;AACtC,eAAO,SAAS,OAAO,GAAG,mDAAmD,EAAE,KAAK,GAAG;AAAA,MACzF;AAEA,YAAM,QAAQ,IAAI,QAAQ,IAAI,CAAC,WAAW,2BAA2B,SAAS,MAAM,CAAC,CAAC;AACtF,YAAM,QAAQ;AAAA,QACZ,QAAQ,IAAI,CAAC,QAAQ,UAAU,sBAAsB,gBAAgB,KAAK,GAAG,MAAM,CAAC;AAAA,MACtF;AAAA,IACF,UAAE;AACA,YAAM,QAAQ,IAAI,gBAAgB,IAAI,CAAC,YAAY,QAAQ,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC7E;AAAA,EACF,CAAC;AACH,CAAC;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/onboarding",
-  "version": "0.7.1-develop.7202.1.a52dc6707c",
+  "version": "0.8.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -70,10 +70,10 @@
     }
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7202.1.a52dc6707c"
+    "@open-mercato/shared": "0.8.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.7.1-develop.7202.1.a52dc6707c",
+    "@open-mercato/shared": "0.8.0",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12",
@@ -86,6 +86,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/onboarding"
-  },
-  "stableVersion": "0.7.0"
+  }
 }

package/src/modules/onboarding/__integration__/TC-ONB-002-multi-tenant-parallel-login.spec.ts

@@ -68,11 +68,19 @@ async function readPreparationState(requestId: string): Promise<{
   });
 }
 
+// Budget the wait from what the chain can actually take, not from a round number. Deferred
+// provisioning runs every module's `seedExamples` sequentially under its own
+// SEED_EXAMPLES_TIMEOUT_MS (15s) cap — a dozen such modules ship today, so one chain's
+// worst case is ~180s, and this test drives two of them concurrently on a shared CI runner
+// under V8 coverage. The old 60s deadline asserted a bound the implementation never offered
+// and expired mid-chain (the lease was still being renewed one second before it fired).
+const PREPARATION_DEADLINE_MS = 180_000;
+
 async function waitForPreparationComplete(
   request: APIRequestContext,
   tenant: OnboardingTenant,
 ): Promise<void> {
-  const deadline = Date.now() + 60_000;
+  const deadline = Date.now() + PREPARATION_DEADLINE_MS;
   let lastState: Awaited<ReturnType<typeof readPreparationState>> | null = null;
   while (Date.now() < deadline) {
     // Drive the same recovery the real preparing page provides: it polls the
@@ -84,8 +92,11 @@ async function waitForPreparationComplete(
     if (lastState.preparation_completed_at && !lastState.preparation_started_at) return;
     await new Promise((resolve) => setTimeout(resolve, 500));
   }
-  expect(lastState?.preparation_started_at, 'deferred preparation lease should be cleared after completion').toBeNull();
+  // Completion first: a chain that simply has not finished yet still holds a freshly renewed
+  // lease, so asserting the lease first reports "lease should be cleared" for what is really
+  // "preparation never completed" — the misdiagnosis this ordering avoids.
   expect(lastState?.preparation_completed_at, 'workspace preparation should complete').toBeTruthy();
+  expect(lastState?.preparation_started_at, 'deferred preparation lease should be cleared after completion').toBeNull();
 }
 
 async function submitOnboarding(request: APIRequestContext, tenant: OnboardingTenant): Promise<void> {
@@ -164,7 +175,10 @@ test.describe('TC-ONB-002: multi-tenant onboarding parallel login', () => {
   }) => {
     // Two full onboardings + parallel browser logins + DB-polled preparation
     // far exceed the 20s suite default (house pattern: TC-AI-AGENT-SETTINGS-005).
-    test.setTimeout(120_000);
+    // The dominant term is PREPARATION_DEADLINE_MS; the rest is onboarding submission,
+    // two browser verifies and two browser logins, so budget it with room to spare
+    // rather than letting the test die before its own poll can reach its deadline.
+    test.setTimeout(PREPARATION_DEADLINE_MS + 120_000);
     const unique = randomUUID().slice(0, 8);
     const tenants: OnboardingTenant[] = [1, 2].map((index) => ({
       email: `qa-onboarding-parallel-${unique}-${index}@example.test`,