feat(onboarding): SERENITY_SITE_ALLOWLIST cohort gate + markets[] DTO (LLMO-5201, LLMO-5202)

[luis6156]

Summary

Implements T1 (LLMO-5201) and T2 (LLMO-5202) from the Semrush onboarding orchestration epic (LLMO-5007).

• T1 — Add SERENITY_SITE_ALLOWLIST cohort gate: orgs in the allowlist enter the Semrush provisioning path (M5–M8); all others fall through to the existing v1/v2 flow unchanged. Env-driven — no DB flag required for the prototype phase.
• T2 — Accept optional markets[{market, language}] in POST /llmo/onboard. Validates market (^[A-Z]{2}$) and language (BCP-47 subtag) per entry. Backward-compat: synthesizes [{market: region, language: 'en'}] when region is supplied without markets. When both are present, markets wins. cadence preserved unchanged. markets is threaded into performLlmoOnboarding for the T3b fan-out.

What changed

src/support/llmo-onboarding-mode.js

• Export SERENITY_SITE_ALLOWLIST = 'SERENITY_SITE_ALLOWLIST' constant (consistent with LLMO_BRANDALF_FLAG pattern)
• Add isSerenityOnboardingEnabled(organizationId, imsOrgId, env) — checks the comma-separated allowlist against both SpaceCat org ID and IMS org ID; whitespace-tolerant

src/controllers/llmo/llmo.js

• Destructure markets from request body
• Validate each entry: market must be ^[A-Z]{2}$, language must be BCP-47 (^[a-z]{2,3}(-[a-z]{2,4})?$)
• Backward-compat fallback: synthesize from region when markets absent; markets wins when both present
• Pass resolvedMarkets into performLlmoOnboarding

src/controllers/llmo/llmo-onboarding.js

• Import isSerenityOnboardingEnabled
• Destructure markets from params
• After upsertBrand in the v2 path, enter the serenity gate block when the org is allowlisted — placeholder for T3a/b/c (LLMO-5203–5205)

docs/openapi/llmo-api.yaml

• markets[] request field with per-item validation patterns
• Updated region deprecation note
• requested/succeeded/failed fields on 200 response
• New 207 response schema

Branch note for T3

T3a (LLMO-5203), T3b (LLMO-5204), T3c (LLMO-5205) should branch from this branch (feat/LLMO-5201-5202-cohort-gate-markets), not from main. The markets variable and the serenity gate block are already in place — T3 only needs to fill in the M5/M7/M8 logic inside the gate.

Test plan

• isSerenityOnboardingEnabled: 6 unit tests (missing env, SpaceCat org match, IMS org match, no match, whitespace trimming, undefined env)
• performLlmoOnboarding gate: serenity log fires when allowlisted; skipped when not allowlisted
• onboardCustomer markets[]: valid markets forwarded, region synthesized, markets wins over region, invalid market code → 400, invalid language → 400, empty array → 400, neither supplied → no markets key
• Non-allowlisted orgs: all pre-existing tests pass unchanged

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a cohort gate for the upcoming Serenity (Semrush) provisioning path in LLMO onboarding. An env-var-based allowlist (SERENITY_SITE_ALLOWLIST) is checked after upsertBrand in the v2 flow; matching orgs currently only log a placeholder message, with actual provisioning to follow in later tasks.

Changes:

• Export SERENITY_SITE_ALLOWLIST constant and add isSerenityOnboardingEnabled(orgId, imsOrgId, env) helper that matches against a comma-separated, whitespace-tolerant allowlist.
• Insert a gated placeholder log in performLlmoOnboarding right after the v2 upsertBrand step.
• Add unit tests for the helper and integration tests covering allowlisted vs non-allowlisted paths.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/support/llmo-onboarding-mode.js	New constant and isSerenityOnboardingEnabled helper.
src/controllers/llmo/llmo-onboarding.js	Calls the helper after v2 brand upsert and logs a placeholder.
test/support/llmo-onboarding-mode.test.js	Six unit tests for the new helper.
test/controllers/llmo/llmo-onboarding.test.js	Two integration tests: allowlisted logs, non-allowlisted does not.

[github-actions]

This PR will trigger a minor release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!