- Shipped
- August 3, 2026 at 4:48 AM UTC
- Author
- Kamo
- Commit
- 11d10a7
Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page to retype credentials and solve a third ***. Reuse the enter-as primitive instead: on the FIRST successful verification, when the verified user holds an eligible membership in their register org, mint a login-equivalent *** via PostAuth***Service and wrap it in the same single-use 180s OTK that kamo-internal's /validate page already consumes. - EmailVerificationService: verify methods now return VerificationResult(userId, firstVerification) so re-verification of an already-verified account (e.g. after a resend) can never re-mint; resolveRootDomain exposed package-static for host resolution. - **************** fails closed on any missing or ineligible membership (register /team PROSPECTs keep the login redirect), unresolved domain, incomplete custom-domain SSL setup, or error — verification success itself is never affected. - /verify-email response gains additive otk + autoLoginHost fields; shape unchanged when minting is skipped.