feat: wallet login and improved onboarding

.env.example

@@ -127,6 +127,7 @@ STRIPE_PRICE_BUSINESS_1M_YEARLY=
 STRIPE_PRICE_ENTERPRISE_MONTHLY=
 STRIPE_PRICE_ENTERPRISE_YEARLY=
 
+
 # Turnkey Wallet Provider
 TURNKEY_API_PUBLIC_KEY=
 TURNKEY_API_PRIVATE_KEY=

.github/workflows/deploy-keeperhub.yaml

@@ -177,6 +177,54 @@ jobs:
             --filter "name=${SERVICE_NAME}-common-test-irsa-auth" \
             --logs
 
+      - name: Seed onboarding workflows
+        if: steps.skip.outputs.skip_deploy != 'true'
+        env:
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: ${{ steps.vars.outputs.sha_short }}
+          REGION: ${{ env.REGION }}
+          NAMESPACE: ${{ env.NAMESPACE }}
+          SEED_EMAIL: ${{ vars.ONBOARDING_SEED_EMAIL }}
+        run: |
+          set -euo pipefail
+          if [[ "${{ github.ref_name }}" == "prod" ]]; then
+            SSM_PATH="/eks/techops-prod/keeperhub/db-url"
+            MIGRATOR_IMAGE="${ECR_REGISTRY}/keeperhub-prod:migrator-${IMAGE_TAG}"
+          else
+            SSM_PATH="/eks/techops-staging/keeperhub/db-url"
+            MIGRATOR_IMAGE="${ECR_REGISTRY}/keeperhub-staging:migrator-${IMAGE_TAG}"
+          fi
+          DATABASE_URL=$(aws ssm get-parameter --name "${SSM_PATH}" --with-decryption --query "Parameter.Value" --output text --region "${REGION}")
+          kubectl delete job keeperhub-onboarding-seed -n "${NAMESPACE}" --ignore-not-found
+          kubectl apply -n "${NAMESPACE}" -f - <<EOF
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: keeperhub-onboarding-seed
+          spec:
+            backoffLimit: 2
+            ttlSecondsAfterFinished: 600
+            template:
+              spec:
+                restartPolicy: Never
+                containers:
+                  - name: onboarding-seed
+                    image: ${MIGRATOR_IMAGE}
+                    command: ["/bin/sh", "-c"]
+                    args:
+                      - 'pnpm tsx scripts/seed/seed-onboarding-workflows.ts'
+                    env:
+                      - name: DATABASE_URL
+                        value: "${DATABASE_URL}"
+                      - name: ALLOW_REMOTE
+                        value: "1"
+                      - name: SEED_EMAIL
+                        value: "${SEED_EMAIL}"
+          EOF
+          kubectl wait --for=condition=complete job/keeperhub-onboarding-seed -n "${NAMESPACE}" --timeout=120s || true
+          echo "--- onboarding-seed job logs ---"
+          kubectl logs -n "${NAMESPACE}" job/keeperhub-onboarding-seed --tail=30 || true
+
   # DISABLED: remote E2E tests temporarily disabled while KEEP-1351 stabilises auth/rate-limit infrastructure
   e2e-playwright-remote:
     needs: deploy

.github/workflows/deploy-pr-environment.yaml

@@ -785,6 +785,47 @@ jobs:
           echo "--- hmac-seed job logs ---"
           kubectl logs -n "${NAMESPACE}" job/keeperhub-pr-${PR_NUMBER}-hmac-seed --tail=30 || true
 
+      - name: Seed onboarding workflows
+        env:
+          PR_NUMBER: ${{ env.PR_NUMBER }}
+          NAMESPACE: ${{ env.NAMESPACE }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          IMAGE_TAG: ${{ steps.vars.outputs.sha_short }}
+        run: |
+          set -euo pipefail
+          DB_PASSWORD=$(kubectl get secret keeperhub-pr-${PR_NUMBER}-db-credentials -n "${NAMESPACE}" -o jsonpath='{.data.password}' | base64 -d)
+          ENCODED_PASSWORD=$(DB_PASSWORD="${DB_PASSWORD}" python3 -c "import urllib.parse, os; print(urllib.parse.quote(os.environ['DB_PASSWORD'], safe=''))")
+          DB_URL="postgresql://keeperhub:${ENCODED_PASSWORD}@keeperhub-pr-${PR_NUMBER}-db-rw.${NAMESPACE}.svc.cluster.local:5432/keeperhub"
+          kubectl delete job keeperhub-pr-${PR_NUMBER}-onboarding-seed -n "${NAMESPACE}" --ignore-not-found
+          kubectl apply -n "${NAMESPACE}" -f - <<EOF
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: keeperhub-pr-${PR_NUMBER}-onboarding-seed
+          spec:
+            backoffLimit: 2
+            ttlSecondsAfterFinished: 600
+            template:
+              spec:
+                restartPolicy: Never
+                containers:
+                  - name: onboarding-seed
+                    image: ${ECR_REGISTRY}/keeperhub-staging:migrator-${IMAGE_TAG}
+                    command: ["/bin/sh", "-c"]
+                    args:
+                      - 'pnpm tsx scripts/seed/seed-onboarding-workflows.ts || echo "onboarding seed failed - see above"'
+                    env:
+                      - name: DATABASE_URL
+                        value: "${DB_URL}"
+                      - name: ALLOW_REMOTE
+                        value: "1"
+                      - name: SEED_EMAIL
+                        value: "pr-test-do-not-delete@techops.services"
+          EOF
+          kubectl wait --for=condition=complete job/keeperhub-pr-${PR_NUMBER}-onboarding-seed -n "${NAMESPACE}" --timeout=120s || true
+          echo "--- onboarding-seed job logs ---"
+          kubectl logs -n "${NAMESPACE}" job/keeperhub-pr-${PR_NUMBER}-onboarding-seed --tail=30 || true
+
       # Opt-in (deploy-pr-metrics label). Deploys the metrics-collector
       # satellite against the PR DB so its /metrics can be curled directly
       # (ServiceMonitors are off in PR envs). TECH-6484.

.gitignore

@@ -176,3 +176,6 @@ reviews/
 .understand-anything/diff-overlay.json
 .understand-anything/meta.json
 .understand-anything/fingerprints.json
+
+# Self-signed certs generated by `next dev --experimental-https`
+certificates

.npmrc

@@ -170,3 +170,6 @@ minimum-release-age-exclude[]=qrcode-generator
 # only needed because pnpm checks the latest published version on resolve.
 minimum-release-age-exclude[]=deep-diff
 minimum-release-age-exclude[]=@types/deep-diff
+# driver.js (MIT) is the onboarding-tour library; pnpm's release-age gate flags
+# it on resolve, so exclude it so lockfile regeneration / fresh installs succeed.
+minimum-release-age-exclude[]=driver.js

CLAUDE.md

@@ -29,7 +29,8 @@
 - Use optional chaining (`?.`) and nullish coalescing (`??`)
 - Use `const` by default, `let` only when reassignment is needed
 - Always `await` promises in async functions
-- Remove `console.log`, `debugger`, and `alert` from production code
+- Remove `debugger` and `alert` from all code without exception
+- **Logging is context-dependent** — see the Logging section below for the full rule
 - Use Next.js `<Image>` component instead of `<img>` tags
 - Add `rel="noopener"` when using `target="_blank"`
 
@@ -102,6 +103,63 @@ When you must use an ignore comment:
    const result = externalLib.call() as any;
    ```
 
+## Logging
+
+Logging rules differ between server and client code. The Biome `noConsole` rule enforces this boundary: it bans `console.warn/error` on server paths while disabling the rule entirely for `components/**`, `lib/hooks/**`, `app/page.tsx`, `app/workflows/**`, `lib/api-client.ts`, and `tests/**`.
+
+### Server-side (app/api/**, lib/**, app/*/route.ts, scripts/**)
+
+Use the functions from `lib/logging.ts`. Never use `console.warn` or `console.error` on server paths — Biome treats these as errors.
+
+| Function | When to use | Sentry | Prometheus |
+|---|---|---|---|
+| `logSystemError(category, message, error, labels?)` | Infrastructure/DB/auth failures the system should not encounter | yes (error) | yes |
+| `logUserError(category, message, error?, labels?)` | Validation, bad input, external-service rejections caused by the caller | no | yes |
+| `logSystemWarn(category, message, error, labels?)` | Recovery events, pre-reconciliation notes, expected fallbacks worth tracking | yes (warning) | no |
+| `logInfo(message, labels?)` | State transitions and lifecycle events | no | no |
+| `logWarn(message, labels?)` | Benign anomalies that are not operational failures | no | no |
+| `logDebug(message, labels?)` | Verbose tracing, gated by `LOG_LEVEL=debug` | no | no |
+| `logSecurityEvent(name, fields?, sentry?)` | Security detection signals (KEEP-612) | yes | no |
+
+`ErrorCategory` values: `VALIDATION`, `CONFIGURATION`, `EXTERNAL_SERVICE`, `NETWORK_RPC`, `TRANSACTION`, `BILLING`, `DATABASE`, `AUTH`, `INFRASTRUCTURE`, `WORKFLOW_ENGINE`, `UNKNOWN`.
+
+**Message format**: Use a `[Context] message` prefix. The context string is extracted by regex and becomes the `error_context` label in Loki and Prometheus.
+
+```typescript
+// Good
+logSystemError(ErrorCategory.DATABASE, "Failed to create workflow", error, {
+  endpoint: "/api/workflows/create",
+  operation: "create",
+});
+
+logUserError(ErrorCategory.VALIDATION, "[Withdraw] Invalid amount", undefined, {
+  userId: session.user.id,
+});
+
+// Wrong — banned by Biome on server paths
+console.error("something broke", error);
+console.warn("unexpected state");
+```
+
+`console.log/info/debug` are technically allowed by Biome on server paths (the lib/logger facade normalises them to structured JSON) but prefer `logInfo`/`logDebug` so the structured labels and workflow context are included automatically.
+
+### Client-side (components/**, lib/hooks/**, lib/api-client.ts, app/page.tsx, app/workflows/**)
+
+`console.*` is unrestricted — the `noConsole` rule is off for these paths. Logs go to the browser devtools and client-side Sentry; the server observability pipeline (Prometheus, Loki) does not apply.
+
+Use a `[Component]` prefix to match server-side convention and make devtools filtering easy:
+
+```typescript
+// Good
+console.log("[AI Prompt] Generating workflow", { hasNodes, existingWorkflow: !!existingWorkflow });
+console.error("Failed to generate workflow:", error);
+
+// Fine but noisy — keep to meaningful state transitions, not every render
+console.log("[AIPrompt] re-render");
+```
+
+---
+
 ## Design System
 
 Before writing or modifying any UI code, read the relevant spec file in `specs/design-system/`. Use only tokens from `specs/design-system/tokens.css`. Run `node scripts/token-audit.js` before committing UI changes. Zero errors required.

Dockerfile

@@ -83,6 +83,7 @@ ENV NEXT_PUBLIC_BILLING_ENABLED=$NEXT_PUBLIC_BILLING_ENABLED
 ENV NEXT_PUBLIC_GAS_SPONSORSHIP_ENABLED=$NEXT_PUBLIC_GAS_SPONSORSHIP_ENABLED
 ENV NEXT_PUBLIC_TURNSTILE_SITE_KEY=$NEXT_PUBLIC_TURNSTILE_SITE_KEY
 
+
 # Sentry DSN baked into client bundle for error reporting.
 # SENTRY_ORG/PROJECT/AUTH_TOKEN/RELEASE are intentionally NOT set here
 # so this stage is cache-deterministic across commits (see sentry-upload stage).

app/accept-invite/[inviteId]/page.tsx

@@ -9,6 +9,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Spinner } from "@/components/ui/spinner";
+import { isWalletEmail } from "@/lib/auth/wallet-constants";
 import {
   authClient,
   signIn,
@@ -18,6 +19,7 @@ import {
 } from "@/lib/auth-client";
 import { refetchOrganizations } from "@/lib/refetch-organizations";
 import { refetchSidebar } from "@/lib/refetch-sidebar";
+import { acceptWalletInvite } from "@/lib/wallet/invite-accept-client";
 
 type InvitationData = {
   id: string;
@@ -122,7 +124,11 @@ function LoadingState() {
   );
 }
 
-async function trySignUp(email: string, password: string, captchaToken?: string) {
+async function trySignUp(
+  email: string,
+  password: string,
+  captchaToken?: string
+) {
   const response = await signUp.email({
     email,
     password,
@@ -199,12 +205,20 @@ function AcceptDirectState({
 }) {
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState("");
+  const isWallet = isWalletEmail(invitation.email);
 
   const handleAccept = async () => {
     setSubmitting(true);
     setError("");
 
     try {
+      // Wallet (SIWE) invites are accepted by signing the invite challenge with
+      // the connected wallet; the email-match path doesn't apply to them.
+      if (isWallet) {
+        await acceptWalletInvite(invitation.id);
+        onSuccess();
+        return;
+      }
       const result = await acceptInvitation(invitation.id);
       if (!result.success) {
         setError(result.error || "Failed to accept invitation");
@@ -236,8 +250,12 @@ function AcceptDirectState({
 
         <div className="space-y-4">
           <div className="rounded-md bg-muted/50 p-3 text-center text-sm">
-            You&apos;re signed in as{" "}
-            <span className="font-medium">{invitation.email}</span>
+            {isWallet
+              ? "Sign the challenge with your wallet to join."
+              : "You're signed in as "}
+            {!isWallet && (
+              <span className="font-medium">{invitation.email}</span>
+            )}
           </div>
 
           {error && (
@@ -252,7 +270,12 @@ function AcceptDirectState({
             onClick={handleAccept}
           >
             {submitting && <Spinner className="mr-2 size-4" />}
-            {submitting ? "Joining..." : "Accept Invitation"}
+            {(() => {
+              if (submitting) {
+                return isWallet ? "Waiting for signature..." : "Joining...";
+              }
+              return isWallet ? "Sign to join" : "Accept Invitation";
+            })()}
           </Button>
         </div>
       </div>
@@ -507,6 +530,34 @@ function VerificationFormState({
   );
 }
 
+// Logged-out wallet invite: the invitee can't use email/password signup, so
+// steer them to connect their wallet (SIWE). After connecting, their session
+// email matches the invite and the page re-renders into the sign-to-join state.
+function WalletConnectState({ invitation }: { invitation: InvitationData }) {
+  const { openAuthPrompt } = useAuthPrompt();
+  return (
+    <div className="pointer-events-auto flex min-h-screen items-center justify-center p-4">
+      <div className="w-full max-w-md space-y-6 rounded-lg border bg-card p-8 text-center">
+        <div className="space-y-2">
+          <h1 className="font-semibold text-2xl">
+            Join {invitation.organizationName}
+          </h1>
+          <p className="text-muted-foreground text-sm">
+            {invitation.inviterName} invited you to join as{" "}
+            <span className="font-medium text-foreground">
+              {invitation.role}
+            </span>
+            . Connect your wallet to continue, then sign to join.
+          </p>
+        </div>
+        <Button className="w-full" onClick={() => openAuthPrompt()}>
+          Connect your wallet
+        </Button>
+      </div>
+    </div>
+  );
+}
+
 // Component for logged-out users with sign-in/sign-up toggle
 function AuthFormState({
   invitation,
@@ -865,6 +916,14 @@ export default function AcceptInvitePage() {
     );
   }
 
+  if (isWalletEmail(invitation.email)) {
+    return (
+      <div data-page-state={pageState}>
+        <WalletConnectState invitation={invitation} />
+      </div>
+    );
+  }
+
   return (
     <div data-page-state={pageState}>
       <AuthFormState