@ossy/platform 3.11.0 → 3.12.0

package/Dockerfile

@@ -1,16 +1,15 @@
 # Build context: ossy/packages/platform directory.
-# From repo root: docker build -f ossy/packages/platform/Dockerfile ossy/packages/platform
-# In CI, this image is built and pushed to ghcr.io/ossy-se/runtime:latest by the Publish workflow.
+# From repo root: docker build -f packages/platform/Dockerfile packages/platform
+# Pushed by the manual "Deploy platform runtime" workflow (not npm Publish).
 FROM node:24-bookworm-slim
 
 WORKDIR /app
 
 COPY package.json ./
 
-# Install production deps only.
-# @ossy/router and @ossy/sdk must be resolvable — in production these are
-# published npm packages; in monorepo CI use npm pack + install.
-RUN npm install --omit=dev --no-audit --no-fund --loglevel=error
+# Production deps from npm. --legacy-peer-deps: transitive peers on an older
+# lockstep patch must not fail the image when ranges are otherwise valid.
+RUN npm install --omit=dev --no-audit --no-fund --loglevel=error --legacy-peer-deps
 
 COPY src ./src
 COPY docker-healthcheck.js ./docker-healthcheck.js
@@ -29,7 +28,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
 
 # Required env vars at runtime:
 #   OSSY_API_KEY   — Ossy API JWT for CMS reads
-#   OSSY_API_URL   — (optional) override API base, default https://api.ossy.se/api/v0
+#   OSSY_API_URL   — (optional) override API base, default https://ossy.se/api/v0
 #   PORT           — (optional) override listen port, default 3000
 #   OSSY_SERVICE_NAME — (optional) `/health` service label, default runtime
 CMD ["node", "src/runtime.js"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -27,6 +27,7 @@
     "./test/flow-runner.js": "./src/test/flow-runner.js",
     "./test/playwright.config.js": "./src/test/playwright.config.js",
     "./locale": "./src/locale.js",
+    "./verify-sign-in-session": "./src/verify-sign-in-session.js",
     "./storage-keys": "./src/storage/storage-keys.js",
     "./mcp": "./src/mcp/mount-platform-mcp.js"
   },
@@ -45,16 +46,16 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/event-store": "^3.11.0",
+    "@ossy/event-store": "^3.12.0",
     "@ossy/locale": "^3.4.0",
     "@ossy/manifest": "^3.9.0",
     "@ossy/observability": "^3.0.9",
     "@ossy/policies": "^3.0.9",
     "@ossy/schema": "^3.8.0",
-    "@ossy/sdk": "^3.5.0",
-    "@ossy/tokens": "^3.5.0",
-    "@ossy/users": "^3.11.0",
-    "@ossy/workspaces": "^3.11.0",
+    "@ossy/sdk": "^3.12.0",
+    "@ossy/tokens": "^3.11.1",
+    "@ossy/users": "^3.12.0",
+    "@ossy/workspaces": "^3.12.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -75,5 +76,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "53ff8456920e09151c9d88df4a6c3ee958d811eb"
+  "gitHead": "c2650803219ad1831559b512848358d9550ffad2"
 }

package/src/index.js

@@ -8,6 +8,7 @@ export { validateSchemasForImport, ALLOWED_FIELD_TYPES, normalizeFieldType, reso
 export { IntegrationService } from './integration.service.js'
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
+export { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 export { TokenService } from './token.service.js'
 export { UsersMiddleware } from './users.middleware.js'
 export { WorkspacesMiddleware } from './workspaces.middleware.js'

package/src/proxy-internal.js

@@ -14,6 +14,25 @@ function normalizeWorkspaceIdHeader (value) {
   return first || undefined
 }
 
+/**
+ * Map `/@ossy…` to the same-process path (`/actions` or `/api/v0…`).
+ * @param {string} originalUrl
+ * @returns {string}
+ */
+export function ossyProxyLocalPath (originalUrl) {
+  const pathAfterOssy = String(originalUrl || '').replace(/^\/@ossy/, '') || '/'
+  const pathOnly = pathAfterOssy.split('?')[0]
+  if (pathOnly === '/actions' || pathOnly === '/events') {
+    return pathAfterOssy.startsWith('/') ? pathAfterOssy : `/${pathAfterOssy}`
+  }
+  return `/api/v0${pathAfterOssy.startsWith('/') ? pathAfterOssy : `/${pathAfterOssy}`}`
+}
+
+/** Absolute OSSY_API_URL → HTTP hop. Unset / relative → same Express app. */
+export function isRemoteOssyApiUrl (envUrl = process.env.OSSY_API_URL) {
+  return /^https?:\/\//i.test(String(envUrl || '').trim())
+}
+
 export function ProxyInternal () {
   return (req, res, next) => {
     if (!req.originalUrl.startsWith('/@ossy')) {
@@ -47,15 +66,20 @@ export function ProxyInternal () {
       return
     }
 
+    if (!isRemoteOssyApiUrl()) {
+      const dest = ossyProxyLocalPath(req.originalUrl)
+      log.info(`[@ossy/platform][proxy] ${req.method} ${req.originalUrl} → ${dest} (same origin)`)
+      req.url = dest
+      req.originalUrl = dest
+      return next()
+    }
+
     log.info(`[@ossy/platform][proxy] ${req.method} ${req.originalUrl}`)
 
-    const domain = (process.env.OSSY_API_URL || 'https://api.ossy.se')
+    const domain = String(process.env.OSSY_API_URL).trim()
       .replace(/\/api\/v0\/?$/, '')
       .replace(/\/$/, '')
-    const pathAfterOssy = req.originalUrl.replace(/^\/@ossy/, '') || '/'
-    // POST /actions lives on the app server root — not under /api/v0.
-    const upstreamPath = pathAfterOssy === '/actions' ? '/actions' : `/api/v0${pathAfterOssy}`
-    const url = `${domain}${upstreamPath}`
+    const url = `${domain}${ossyProxyLocalPath(req.originalUrl)}`
     const forwardedHeaders = JSON.parse(JSON.stringify(req.headers))
     const workspaceId = normalizeWorkspaceIdHeader(req.get('workspaceId'))
 

package/src/proxy-internal.spec.js

@@ -0,0 +1,62 @@
+import { afterEach, describe, expect, it, jest } from '@jest/globals'
+import {
+  isRemoteOssyApiUrl,
+  ossyProxyLocalPath,
+  ProxyInternal,
+} from './proxy-internal.js'
+
+describe('ossyProxyLocalPath', () => {
+  it('maps REST under /@ossy onto /api/v0', () => {
+    expect(ossyProxyLocalPath('/@ossy/users/me')).toBe('/api/v0/users/me')
+    expect(ossyProxyLocalPath('/@ossy/apps/ask?domain=ossy.se'))
+      .toBe('/api/v0/apps/ask?domain=ossy.se')
+  })
+
+  it('keeps POST /actions and GET /events at the server root', () => {
+    expect(ossyProxyLocalPath('/@ossy/actions')).toBe('/actions')
+    expect(ossyProxyLocalPath('/@ossy/actions?x=1')).toBe('/actions?x=1')
+    expect(ossyProxyLocalPath('/@ossy/events')).toBe('/events')
+  })
+})
+
+describe('isRemoteOssyApiUrl', () => {
+  it('treats unset, empty, and relative values as same-origin', () => {
+    expect(isRemoteOssyApiUrl(undefined)).toBe(false)
+    expect(isRemoteOssyApiUrl('')).toBe(false)
+    expect(isRemoteOssyApiUrl('/api/v0')).toBe(false)
+  })
+
+  it('treats absolute http(s) as a remote hop', () => {
+    expect(isRemoteOssyApiUrl('https://ossy.se/api/v0')).toBe(true)
+    expect(isRemoteOssyApiUrl('http://localhost:3006')).toBe(true)
+  })
+})
+
+describe('ProxyInternal same-origin rewrite', () => {
+  const original = process.env.OSSY_API_URL
+
+  afterEach(() => {
+    if (original === undefined) delete process.env.OSSY_API_URL
+    else process.env.OSSY_API_URL = original
+  })
+
+  it('rewrites /@ossy onto this process when OSSY_API_URL is unset', () => {
+    delete process.env.OSSY_API_URL
+    const req = { originalUrl: '/@ossy/users/me', url: '/@ossy/users/me', method: 'GET' }
+    const next = jest.fn()
+    ProxyInternal()(req, {}, next)
+    expect(req.url).toBe('/api/v0/users/me')
+    expect(req.originalUrl).toBe('/api/v0/users/me')
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+
+  it('rewrites /@ossy/actions onto POST /actions', () => {
+    delete process.env.OSSY_API_URL
+    const req = { originalUrl: '/@ossy/actions', url: '/@ossy/actions', method: 'POST' }
+    const next = jest.fn()
+    ProxyInternal()(req, {}, next)
+    expect(req.url).toBe('/actions')
+    expect(req.originalUrl).toBe('/actions')
+    expect(next).toHaveBeenCalledTimes(1)
+  })
+})

package/src/runtime.js

@@ -71,13 +71,24 @@ async function getSiteContext (domain) {
  *
  * Environment variables:
  *   OSSY_API_KEY  — API JWT for CMS reads (required)
- *   OSSY_API_URL  — Override API base URL (default: https://api.ossy.se/api/v0)
+ *   OSSY_API_URL  — Override API base URL (default: https://ossy.se/api/v0)
  *   PORT          — Override listen port (default: 3000)
  */
 export async function startRuntime ({ port } = {}) {
   const resolvedPort = port ?? resolvePort()
 
   const app = express()
+  // CloudFront → ALB → Node: hop count so `req.ip` is the viewer (#769).
+  // Default 2. Avoid `true` (leftmost XFF — spoofable). Override via OSSY_TRUST_PROXY_HOPS.
+  {
+    const raw = process.env.OSSY_TRUST_PROXY_HOPS
+    if (raw != null && String(raw).trim() !== '') {
+      const hops = Number(raw)
+      app.set('trust proxy', Number.isFinite(hops) && hops >= 0 ? hops : 2)
+    } else {
+      app.set('trust proxy', 2)
+    }
+  }
   // Liveness for ALB/ECS — before site loading so probes never depend on CMS/domain.
   // Prefer OSSY_SERVICE_NAME (ECS task env) when set.
   mountHealthEndpoint(app)
@@ -97,7 +108,7 @@ export async function startRuntime ({ port } = {}) {
     next()
   })
 
-  // Proxy /@ossy/* to the upstream Ossy API
+  // Proxy leftover /@ossy/* onto this process (/api/v0, /actions) unless OSSY_API_URL is absolute.
   app.use(ProxyInternal())
 
   // Force a fresh site download without waiting for the TTL to expire

package/src/server.js

@@ -43,8 +43,11 @@ import {
 import {
   clearAuthCookie,
   clearWorkspaceFromUserAppSettings,
+  mergeUserAppSettingsCookie,
   readWorkspaceIdFromCookies,
+  setAuthCookie,
 } from './user-app-settings.js'
+import { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 const log = createLogger('@ossy/platform')
 const MONGO_TIMEOUT_MS = resolveTimeoutMs('OSSY_MONGO_TIMEOUT_MS', 10_000)
 const SSR_RENDER_TIMEOUT_MS = resolveTimeoutMs('OSSY_SSR_RENDER_TIMEOUT_MS', 30_000)
@@ -323,6 +326,17 @@ export async function startServer (options = {}) {
   }
 
   const app = express()
+  // CloudFront → ALB → Node: hop count so `req.ip` is the viewer (#769).
+  // Default 2. Avoid `true` (leftmost XFF — spoofable). Override via OSSY_TRUST_PROXY_HOPS.
+  {
+    const raw = process.env.OSSY_TRUST_PROXY_HOPS
+    if (raw != null && String(raw).trim() !== '') {
+      const hops = Number(raw)
+      app.set('trust proxy', Number.isFinite(hops) && hops >= 0 ? hops : 2)
+    } else {
+      app.set('trust proxy', 2)
+    }
+  }
   // Liveness for ALB/ECS — before auth so probes never depend on cookies/Mongo.
   // Prefer OSSY_SERVICE_NAME (ECS task env) when set.
   mountHealthEndpoint(app)
@@ -427,6 +441,9 @@ export async function startServer (options = {}) {
         clearAuthCookie(res)
         clearWorkspaceFromUserAppSettings(req, res)
       }
+      if (actionId === '@ossy/authentication/actions/verify-sign-in' && result?.token) {
+        await applyVerifySignInSessionCookies(req, res, result)
+      }
       res.json(result ?? { ok: true })
     } catch (err) {
       // Still clear auth on sign-out failures so a broken session can recover.
@@ -670,6 +687,7 @@ export default startServer
 export { loadLayoutsById, resolvePageLayoutRender }
 export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
+export { applyVerifySignInSessionCookies } from './verify-sign-in-session.js'
 export { IntegrationService } from './integration.service.js'
 export { StorageClient } from './storage/storage.client.js'
 export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './storage/storage-keys.js'

package/src/site-loader.js

@@ -10,7 +10,7 @@ const CACHE_TTL_MS = 5 * 60 * 1000 // 5 minutes
 const DOWNLOAD_CONCURRENCY = 10
 const BASE_DIR = path.join(os.tmpdir(), 'ossy-rt')
 
-const API_URL = process.env.OSSY_API_URL || 'https://api.ossy.se/api/v0'
+const API_URL = process.env.OSSY_API_URL || 'https://ossy.se/api/v0'
 const API_KEY = process.env.OSSY_API_KEY
 
 /** @type {Map<string, { buildDir: string, workspaceId: string, loadedAt: number }>} */

package/src/tasks/task-service.js

@@ -4,6 +4,7 @@ import { IntegrationService } from '../integration.service.js'
 import { createLogger } from '@ossy/observability'
 import { isPrimaryTaskForAction, taskIdFromActionId } from '@ossy/schema'
 import { TaskRunService } from '../audit/task-run-service.js'
+import { resolveClientIp, runWithEventContext } from '@ossy/event-store'
 
 const SCHEDULER_INTERVAL_MS = 60_000
 const _serviceLog = createLogger('TaskService')
@@ -108,18 +109,20 @@ export class TaskService {
       log: context.log ?? createLogger(id),
     }
 
-    return TaskRunService.execute({
-      taskId: id,
-      handler: task.handler,
-      context: invokeContext,
-      trigger: 'invoke',
-      triggeredBy: {
-        channel: context.req ? undefined : 'api',
-        actionInvocationId: context.actionInvocationId ?? null,
-      },
-      executionEnv: 'ossy_server',
-      audit,
-    })
+    return runWithEventContext({ ip: resolveClientIp(context.req) }, () =>
+      TaskRunService.execute({
+        taskId: id,
+        handler: task.handler,
+        context: invokeContext,
+        trigger: 'invoke',
+        triggeredBy: {
+          channel: context.req ? undefined : 'api',
+          actionInvocationId: context.actionInvocationId ?? null,
+        },
+        executionEnv: 'ossy_server',
+        audit,
+      }),
+    )
   }
 
   /** @param {string} id */

package/src/test/flow-runner.js

@@ -26,6 +26,7 @@ import { assertDownloadFilenames, resolveDownloadTarget } from './flow-download.
 import { resolveFilesTarget } from './flow-files.js'
 import { resolvePressKey } from './flow-press.js'
 import { resolveViewportSize } from './flow-viewport.js'
+import { flowBelongsToShard, parseFlowShard, sortFlowsForShard } from './flow-shard.js'
 
 export {
   applyFormFieldOverrides,
@@ -39,6 +40,12 @@ export {
   resolveActionMatchers,
   resolveActionService,
 } from './flow-action.js'
+export {
+  flowBelongsToShard,
+  flowIdsForShard,
+  parseFlowShard,
+  sortFlowsForShard,
+} from './flow-shard.js'
 export { resolveClickTarget } from './flow-click.js'
 export {
   assertDownloadFilenames,
@@ -405,13 +412,13 @@ export async function runFlow (flow, options = {}) {
       const selector = actionSelector(actionId, matchers)
       const actionTimeout = step.timeout ?? 15000
       const actionDeadline = Date.now() + actionTimeout
-      // SSR markup is visible before React attaches onClick. Wait a paint+microtask
-      // so hydration can finish; then use DOM click() (Playwright pointer clicks can
-      // miss React handlers when overlays intercept hit-testing).
+      // SSR markup is visible before React attaches onClick. Wait for visibility,
+      // then click: form submits use remount-safe evaluate + requestSubmit; other
+      // CTAs use Playwright click (programmatic el.click() often skips React onClick).
       //
-      // Re-query the live node after the settle wait: concurrent auth/workspace
-      // fetches can remount the tree and detach Playwright locators mid-scroll
-      // (and wipe uncontrolled form state). Retry within the action timeout.
+      // Re-query the live node after settle: concurrent auth/workspace fetches can
+      // remount the tree and detach Playwright locators mid-scroll (and wipe
+      // uncontrolled form state). Retry within the action timeout.
       // Prefer an actionable match when duplicates exist (e.g. hero CTA under a page overlay).
       let clicked = false
       let lastError
@@ -432,52 +439,63 @@ export async function runFlow (flow, options = {}) {
               state: 'visible',
               timeout: Math.min(5000, Math.max(250, actionDeadline - Date.now())),
             })
-            // Scroll inside evaluate via a fresh querySelector — Playwright's
-            // scrollIntoViewIfNeeded holds a locator through a stability wait and
-            // throws "not attached" when GetWorkspace remounts PackageServiceToggle.
             const fieldRestore = { ...(context.fields ?? {}) }
             if (context.email != null && fieldRestore.email == null) {
               fieldRestore.email = context.email
             }
-            await page.evaluate(async ({ selector: sel, fields }) => {
-              await new Promise((resolve) => {
-                requestAnimationFrame(() => requestAnimationFrame(resolve))
-              })
-              await new Promise((resolve) => setTimeout(resolve, 500))
-              const el = document.querySelector(sel)
-              if (!el) throw new Error(`Action control disappeared after settle: ${sel}`)
-              if (typeof el.scrollIntoView === 'function') {
-                el.scrollIntoView({ block: 'nearest', inline: 'nearest' })
-              }
-              const form = el.closest('form')
-              if (form && fields && typeof fields === 'object') {
-                for (const [name, value] of Object.entries(fields)) {
-                  if (value == null || typeof value === 'object') continue
-                  const input = form.querySelector(`[name="${name}"]`)
-                  if (!input || input.disabled) continue
-                  // File inputs throw InvalidStateError if value is set programmatically.
-                  if (input instanceof HTMLInputElement && input.type === 'file') continue
-                  const asText = String(value)
-                  if (input.value === asText) continue
-                  const proto = Object.getPrototypeOf(input)
-                  const desc = Object.getOwnPropertyDescriptor(proto, 'value')
-                  desc?.set?.call(input, asText)
-                  input.dispatchEvent(new Event('input', { bubbles: true }))
-                  input.dispatchEvent(new Event('change', { bubbles: true }))
+            // Form submits: restore fills + requestSubmit in one evaluate (remount-safe).
+            // Other CTAs (Enable, Publish, OpenExport): Playwright click — programmatic
+            // el.click() often never invokes React onClick (no /actions POST; publish stays off).
+            const isSubmitButton = await candidate.evaluate((el) => {
+              const form = (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                ? el.form
+                : el.closest?.('form')
+              if (!form) return false
+              return (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                ? el.type === 'submit'
+                : el.getAttribute?.('type') === 'submit'
+            })
+            if (isSubmitButton) {
+              await page.evaluate(async ({ selector: sel, fields }) => {
+                await new Promise((resolve) => {
+                  requestAnimationFrame(() => requestAnimationFrame(resolve))
+                })
+                await new Promise((resolve) => setTimeout(resolve, 500))
+                const el = document.querySelector(sel)
+                if (!el) throw new Error(`Action control disappeared after settle: ${sel}`)
+                if (typeof el.scrollIntoView === 'function') {
+                  el.scrollIntoView({ block: 'nearest', inline: 'nearest' })
                 }
-              }
-              const isSubmit = form && (
-                (el instanceof HTMLButtonElement && el.type === 'submit')
-                || el.getAttribute('type') === 'submit'
-              )
-              if (isSubmit && typeof form.requestSubmit === 'function') {
-                form.requestSubmit(el)
-              } else if (typeof el.click === 'function') {
-                el.click()
-              } else {
-                el.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, view: window }))
-              }
-            }, { selector, fields: fieldRestore })
+                const form = (el instanceof HTMLButtonElement || el instanceof HTMLInputElement)
+                  ? el.form
+                  : el.closest?.('form')
+                if (form && fields && typeof fields === 'object') {
+                  for (const [name, value] of Object.entries(fields)) {
+                    if (value == null || typeof value === 'object') continue
+                    const input = form.querySelector(`[name="${name}"]`)
+                    if (!input || input.disabled) continue
+                    if (input instanceof HTMLInputElement && input.type === 'file') continue
+                    const asText = String(value)
+                    if (input.value === asText) continue
+                    const proto = Object.getPrototypeOf(input)
+                    const desc = Object.getOwnPropertyDescriptor(proto, 'value')
+                    desc?.set?.call(input, asText)
+                    input.dispatchEvent(new Event('input', { bubbles: true }))
+                    input.dispatchEvent(new Event('change', { bubbles: true }))
+                  }
+                }
+                if (form && typeof form.requestSubmit === 'function') {
+                  form.requestSubmit(el)
+                  return
+                }
+                if (typeof el.click === 'function') el.click()
+              }, { selector, fields: fieldRestore })
+            } else {
+              await candidate.scrollIntoViewIfNeeded().catch(() => {})
+              await candidate.click({
+                timeout: Math.min(5000, Math.max(250, actionDeadline - Date.now())),
+              })
+            }
             clicked = true
             break
           } catch (err) {
@@ -538,6 +556,42 @@ export async function runFlow (flow, options = {}) {
       continue
     }
 
+    if (step.inputs != null) {
+      if (!page) throw new Error('inputs step requires a Playwright page')
+      const inputsTimeout = step.timeout ?? 15000
+      for (const [selector, valueSpec] of Object.entries(step.inputs)) {
+        const value = resolveContextValue(valueSpec, context)
+        if (value == null) {
+          throw new Error(`inputs step: no value resolved for selector "${selector}"`)
+        }
+        const resolvedSelector = interpolateContextString(selector, context, {
+          escape: escapeCssAttrValue,
+        })
+        const locator = page.locator(resolvedSelector).first()
+        await locator.waitFor({ state: 'visible', timeout: inputsTimeout })
+        const asText = String(value)
+        for (let attempt = 0; attempt < 3; attempt++) {
+          await locator.fill(asText)
+          await locator.blur().catch(() => {})
+          try {
+            await expectFn(locator).toHaveValue(asText, { timeout: 2000 })
+            break
+          } catch (err) {
+            if (attempt === 2) throw err
+            await page.waitForTimeout(150)
+          }
+        }
+        // Remount-safe action submits restore from context.fields by input name.
+        // Keep ad-hoc fills (e.g. sign-in code) in that map so settle remounts
+        // do not wipe values before requestSubmit.
+        const name = await locator.getAttribute('name')
+        if (name) {
+          context.fields = { ...(context.fields ?? {}), [name]: asText }
+        }
+      }
+      continue
+    }
+
     if (step.capture != null) {
       if (!page) throw new Error('capture step requires a Playwright page')
       for (const [key, spec] of Object.entries(step.capture)) {
@@ -567,37 +621,109 @@ export async function runFlow (flow, options = {}) {
       const to = resolveContextValue(emailStep.to ?? '$email', context)
       const templateId = emailStep.id ?? emailStep.templateId
       const clickLabel = emailStep.click ?? emailStep.link
+      const extract = emailStep.extract
       if (!to) throw new Error('email step requires "to" (recipient email)')
       if (!templateId) throw new Error('email step requires "id" (email template id)')
-      if (!clickLabel) throw new Error('email step requires "click" (link text in the email)')
+      if (!clickLabel && !extract) {
+        throw new Error('email step requires "click" or "extract"')
+      }
 
       const inboxPath = router.getPathname({ id: 'dev-inbox', language: locale }) ?? '/dev/inbox'
       const params = new URLSearchParams({ to: String(to), template: String(templateId) })
       const inboxUrl = `${baseURL}${inboxPath}?${params}`
-      const pattern = linkNamePattern(clickLabel)
       const deadline = Date.now() + (emailStep.timeout ?? 20000)
 
-      let clicked = false
-      while (Date.now() < deadline && !clicked) {
-        await page.goto(inboxUrl)
-        // Scope to email HTML body so chrome auth links (e.g. header "Sign in")
-        // cannot steal the click when the CTA label collides.
-        const body = page.locator('[data-email-body]').first()
-        const link = body.getByRole('link', { name: pattern }).first()
+      const openInboxBody = async (inboxPage) => {
+        await inboxPage.goto(inboxUrl)
+        const body = inboxPage.locator('[data-email-body]').first()
+        await body.waitFor({ state: 'visible', timeout: 2000 })
+        return body
+      }
+
+      // Extract-only must not navigate the flow page — SPA React state (e.g. SignIn
+      // success + code form for PWA) is lost on goto/goBack remount.
+      if (extract && !clickLabel) {
+        const inboxPage = await page.context().newPage()
+        let extracted = false
         try {
-          await body.waitFor({ state: 'visible', timeout: 2000 })
-          await link.waitFor({ state: 'visible', timeout: 2000 })
-          await Promise.all([
-            page.waitForLoadState('domcontentloaded'),
-            link.click(),
-          ])
-          clicked = true
-        } catch {
-          await page.waitForTimeout(500)
+          while (Date.now() < deadline && !extracted) {
+            try {
+              const body = await openInboxBody(inboxPage)
+              for (const [key, spec] of Object.entries(extract)) {
+                const selector = typeof spec === 'string' ? spec : spec.selector
+                const attr = typeof spec === 'object' ? spec.attr : undefined
+                const resolvedSelector = interpolateContextString(selector, context, {
+                  escape: escapeCssAttrValue,
+                })
+                const locator = body.locator(resolvedSelector).first()
+                await locator.waitFor({ state: 'attached', timeout: 2000 })
+                const value = attr
+                  ? await locator.getAttribute(attr)
+                  : await locator.textContent()
+                context[key] = typeof value === 'string' ? value.trim() : value
+              }
+              extracted = true
+            } catch {
+              await page.waitForTimeout(500)
+            }
+          }
+        } finally {
+          await inboxPage.close().catch(() => {})
+        }
+        if (!extracted) {
+          throw new Error(`Email extract failed for to=${to}, template=${templateId}`)
         }
+        continue
       }
-      if (!clicked) {
-        throw new Error(`Email link "${clickLabel}" not found for to=${to}, template=${templateId}`)
+
+      if (extract && clickLabel) {
+        let extracted = false
+        while (Date.now() < deadline && !extracted) {
+          try {
+            const body = await openInboxBody(page)
+            for (const [key, spec] of Object.entries(extract)) {
+              const selector = typeof spec === 'string' ? spec : spec.selector
+              const attr = typeof spec === 'object' ? spec.attr : undefined
+              const resolvedSelector = interpolateContextString(selector, context, {
+                escape: escapeCssAttrValue,
+              })
+              const locator = body.locator(resolvedSelector).first()
+              await locator.waitFor({ state: 'attached', timeout: 2000 })
+              const value = attr
+                ? await locator.getAttribute(attr)
+                : await locator.textContent()
+              context[key] = typeof value === 'string' ? value.trim() : value
+            }
+            extracted = true
+          } catch {
+            await page.waitForTimeout(500)
+          }
+        }
+        if (!extracted) {
+          throw new Error(`Email extract failed for to=${to}, template=${templateId}`)
+        }
+      }
+
+      if (clickLabel) {
+        const pattern = linkNamePattern(clickLabel)
+        let clicked = false
+        while (Date.now() < deadline && !clicked) {
+          const body = await openInboxBody(page)
+          const link = body.getByRole('link', { name: pattern }).first()
+          try {
+            await link.waitFor({ state: 'visible', timeout: 2000 })
+            await Promise.all([
+              page.waitForLoadState('domcontentloaded'),
+              link.click(),
+            ])
+            clicked = true
+          } catch {
+            await page.waitForTimeout(500)
+          }
+        }
+        if (!clicked) {
+          throw new Error(`Email link "${clickLabel}" not found for to=${to}, template=${templateId}`)
+        }
       }
       continue
     }
@@ -721,17 +847,32 @@ export function registerFlow (mod, options = {}) {
 /**
  * Register all flows listed in `manifest.flows[]`.
  * @param {string} manifestPath Absolute path to build/manifest.json
+ * @param {{ shard?: string }} [options] Optional shard override (`N/M`); defaults to `E2E_FLOW_SHARD`
  */
-export async function registerFlowsFromManifest (manifestPath) {
+export async function registerFlowsFromManifest (manifestPath, options = {}) {
   const manifest = loadManifest(manifestPath)
   const buildDir = path.dirname(manifestPath)
   const staticDir = path.join(buildDir, 'public', 'static')
-
-  for (const entry of manifest.flows ?? []) {
+  const shard = parseFlowShard(options.shard ?? process.env.E2E_FLOW_SHARD)
+  // Sort by stable flow id so independently built matrix jobs partition identically
+  // even when package discovery/`readdir` order differs (#768 / #770).
+  const flows = sortFlowsForShard(manifest.flows ?? [])
+  let registered = 0
+
+  for (let i = 0; i < flows.length; i++) {
+    if (!flowBelongsToShard(i, shard)) continue
+    const entry = flows[i]
     const chunkName = entry.entry.replace(/^\/static\//, '')
     const chunkPath = path.join(staticDir, chunkName)
     const mod = await import(pathToFileURL(chunkPath).href + `?ts=${Date.now()}`)
     registerFlow(mod, { manifestPath, locale: manifest.config?.defaultLanguage })
+    registered += 1
+  }
+
+  if (shard) {
+    console.log(
+      `[e2e] flow shard ${shard.index}/${shard.total}: registered ${registered}/${flows.length} flows`,
+    )
   }
 }
 

package/src/test/flow-shard.js

@@ -0,0 +1,66 @@
+/**
+ * CI flow partitioning helpers.
+ *
+ * All product flows register from one Playwright `runner.spec.js`, so Playwright's
+ * file-level `--shard` leaves shards 2..N empty. Matrix jobs set `E2E_FLOW_SHARD=N/M`
+ * and the flow runner registers only that slice.
+ *
+ * Membership is by **stable flow id order**, not discovery/`readdir` order — each
+ * matrix job builds independently (#768 / #770).
+ */
+
+/**
+ * Parse `E2E_FLOW_SHARD` / explicit shard string (`1/4`) into 1-based index + total.
+ *
+ * @param {string | undefined | null} value
+ * @returns {{ index: number, total: number } | null}
+ */
+export function parseFlowShard (value = process.env.E2E_FLOW_SHARD) {
+  if (value == null || value === '') return null
+  const match = String(value).trim().match(/^(\d+)\s*\/\s*(\d+)$/)
+  if (!match) {
+    throw new Error(`Invalid E2E_FLOW_SHARD "${value}" (expected N/M, e.g. 1/4)`)
+  }
+  const index = Number(match[1])
+  const total = Number(match[2])
+  if (!Number.isInteger(index) || !Number.isInteger(total) || total < 1 || index < 1 || index > total) {
+    throw new Error(`Invalid E2E_FLOW_SHARD "${value}" (index must be 1..total)`)
+  }
+  return { index, total }
+}
+
+/**
+ * Deterministic order for shard partitioning (localeCompare on flow id).
+ *
+ * @param {Array<{ id?: string }>} flows
+ * @returns {Array<{ id?: string }>}
+ */
+export function sortFlowsForShard (flows) {
+  return [...(flows ?? [])].sort((a, b) =>
+    String(a?.id ?? '').localeCompare(String(b?.id ?? '')),
+  )
+}
+
+/**
+ * Stable round-robin membership for CI flow matrix jobs.
+ * @param {number} flowIndex 0-based position in the **id-sorted** flow list
+ * @param {{ index: number, total: number } | null} shard
+ */
+export function flowBelongsToShard (flowIndex, shard) {
+  if (!shard) return true
+  return flowIndex % shard.total === shard.index - 1
+}
+
+/**
+ * Flow ids owned by a shard for a given (unordered) manifest list.
+ *
+ * @param {Array<{ id?: string }>} flows
+ * @param {{ index: number, total: number } | null} shard
+ * @returns {string[]}
+ */
+export function flowIdsForShard (flows, shard) {
+  const ordered = sortFlowsForShard(flows)
+  return ordered
+    .filter((_, i) => flowBelongsToShard(i, shard))
+    .map((flow) => String(flow.id ?? ''))
+}

package/src/test/flow-shard.spec.js

@@ -0,0 +1,73 @@
+import { describe, expect, it } from '@jest/globals'
+import {
+  flowBelongsToShard,
+  flowIdsForShard,
+  parseFlowShard,
+  sortFlowsForShard,
+} from './flow-shard.js'
+
+describe('parseFlowShard', () => {
+  it('returns null for empty values', () => {
+    expect(parseFlowShard(undefined)).toBeNull()
+    expect(parseFlowShard(null)).toBeNull()
+    expect(parseFlowShard('')).toBeNull()
+  })
+
+  it('parses N/M', () => {
+    expect(parseFlowShard('1/4')).toEqual({ index: 1, total: 4 })
+    expect(parseFlowShard(' 3 / 4 ')).toEqual({ index: 3, total: 4 })
+  })
+
+  it('rejects invalid shapes', () => {
+    expect(() => parseFlowShard('4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+    expect(() => parseFlowShard('0/4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+    expect(() => parseFlowShard('5/4')).toThrow(/Invalid E2E_FLOW_SHARD/)
+  })
+})
+
+describe('flowBelongsToShard', () => {
+  it('keeps every flow when shard is null', () => {
+    expect(flowBelongsToShard(0, null)).toBe(true)
+    expect(flowBelongsToShard(7, null)).toBe(true)
+  })
+
+  it('round-robins indices across shards', () => {
+    const shard1 = { index: 1, total: 4 }
+    const shard2 = { index: 2, total: 4 }
+    const owned = [...Array(8).keys()].filter(i => flowBelongsToShard(i, shard1))
+    const owned2 = [...Array(8).keys()].filter(i => flowBelongsToShard(i, shard2))
+    expect(owned).toEqual([0, 4])
+    expect(owned2).toEqual([1, 5])
+  })
+})
+
+describe('sortFlowsForShard / flowIdsForShard', () => {
+  it('sorts by stable id regardless of input order', () => {
+    const a = [{ id: 'zeta' }, { id: 'alpha' }, { id: 'mu' }]
+    const b = [{ id: 'mu' }, { id: 'zeta' }, { id: 'alpha' }]
+    expect(sortFlowsForShard(a).map(f => f.id)).toEqual(['alpha', 'mu', 'zeta'])
+    expect(sortFlowsForShard(b).map(f => f.id)).toEqual(['alpha', 'mu', 'zeta'])
+  })
+
+  it('assigns the same ids to shard 1/4 for two different input orders', () => {
+    const shard = { index: 1, total: 4 }
+    const orderA = [
+      { id: '@ossy/z/flows/c' },
+      { id: '@ossy/a/flows/x' },
+      { id: '@ossy/m/flows/y' },
+      { id: '@ossy/b/flows/w' },
+      { id: '@ossy/n/flows/v' },
+      { id: '@ossy/c/flows/u' },
+      { id: '@ossy/d/flows/t' },
+      { id: '@ossy/e/flows/s' },
+    ]
+    const orderB = [...orderA].reverse()
+
+    expect(flowIdsForShard(orderA, shard)).toEqual(flowIdsForShard(orderB, shard))
+    // id-sorted: a/x, b/w, c/u, d/t, e/s, m/y, n/v, z/c → shard 1 owns indices 0,4
+    expect(flowIdsForShard(orderA, shard)).toEqual([
+      '@ossy/a/flows/x',
+      '@ossy/e/flows/s',
+    ])
+  })
+})

package/src/test/test.util.js

@@ -173,6 +173,43 @@ export class TestUtil {
     return ev.payload.token
   }
 
+  /**
+   * Resolve a six-digit sign-in code from its stored HMAC digest (integration tests only).
+   *
+   * @param {string} subjectId
+   * @returns {Promise<string>}
+   */
+  static async getLatestVerificationCodeForSubject(subjectId) {
+    const ev = await EventStore.Collection.findOne(
+      {
+        type: TOKEN_SCHEMA,
+        event: 'Created',
+        'payload.type': 'Verification',
+        'payload.subject': subjectId,
+      },
+      { sort: { created: -1 } },
+    )
+    const codeHash = ev?.payload?.codeHash
+    if (!codeHash) {
+      return Promise.reject(new Error('No verification code hash found for subject'))
+    }
+
+    const secret = process.env.TOKEN_SECRET
+    if (!secret) {
+      return Promise.reject(new Error('TOKEN_SECRET is required to resolve verification codes in tests'))
+    }
+
+    const { createHmac } = await import('node:crypto')
+    const hashCode = (code) => createHmac('sha256', secret).update(code).digest('hex')
+
+    for (let i = 0; i < 1_000_000; i += 1) {
+      const code = String(i).padStart(6, '0')
+      if (hashCode(code) === codeHash) return code
+    }
+
+    return Promise.reject(new Error('Could not resolve verification code from hash'))
+  }
+
   static async getLatestEmailChangeJwtForSubject(subjectId) {
     const ev = await EventStore.Collection.findOne(
       {

package/src/verify-sign-in-session.js

@@ -0,0 +1,24 @@
+import { ActionService } from './actions/action.service.js'
+import { mergeUserAppSettingsCookie, setAuthCookie } from './user-app-settings.js'
+
+/**
+ * Set auth (and optional single-workspace default) cookies after verify-sign-in.
+ *
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {{ sub: string, token: string }} session
+ */
+export async function applyVerifySignInSessionCookies (req, res, { sub, token }) {
+  setAuthCookie(res, token)
+  try {
+    const workspaces = await ActionService.invoke('@ossy/workspaces/actions/list', {
+      payload: { userId: sub },
+      req,
+    })
+    if (workspaces.length === 1) {
+      mergeUserAppSettingsCookie(req, res, { workspaceId: workspaces[0].id })
+    }
+  } catch {
+    // Cookie for the session is enough; workspace default is best-effort.
+  }
+}