@agenticmail/enterprise 0.3.2 → 0.4.0

package/src/server.ts

@@ -7,12 +7,14 @@
  */
 
 import { Hono } from 'hono';
+import type { AppEnv } from './types/hono-env.js';
 import { cors } from 'hono/cors';
 import { serve } from '@hono/node-server';
-import { readFileSync } from 'fs';
+import { readFileSync, existsSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import type { DatabaseAdapter } from './db/adapter.js';
+import { createDbProxy, type DbProxy } from './db/proxy.js';
 import { createAdminRoutes } from './admin/routes.js';
 import { createAuthRoutes } from './auth/routes.js';
 import {
@@ -24,6 +26,7 @@ import {
   auditLogger,
   requireRole,
 } from './middleware/index.js';
+import { ipAccessControl } from './middleware/firewall.js';
 import { HealthMonitor, CircuitBreaker } from './lib/resilience.js';
 
 export interface ServerConfig {
@@ -37,16 +40,26 @@ export interface ServerConfig {
   trustedProxies?: string[];
   /** Enable verbose request logging (default: true) */
   logging?: boolean;
+  /** Agent runtime configuration (enables standalone agent execution) */
+  runtime?: {
+    enabled?: boolean;
+    defaultModel?: { provider: 'anthropic' | 'openai'; modelId: string; thinkingLevel?: string };
+    apiKeys?: { anthropic?: string; openai?: string };
+  };
 }
 
 export interface ServerInstance {
-  app: Hono;
+  app: Hono<AppEnv>;
   start: () => Promise<{ close: () => void }>;
   healthMonitor: HealthMonitor;
 }
 
 export function createServer(config: ServerConfig): ServerInstance {
-  const app = new Hono();
+  const app = new Hono<AppEnv>();
+
+  // Wrap DB in a transparent proxy for hot-swap support during onboarding
+  const dbProxy = createDbProxy(config.db) as DbProxy;
+  config.db = dbProxy;
 
   // ─── DB Circuit Breaker ──────────────────────────────
 
@@ -83,11 +96,14 @@ export function createServer(config: ServerConfig): ServerInstance {
   // Security headers
   app.use('*', securityHeaders());
 
+  // IP access control (firewall)
+  app.use('*', ipAccessControl(() => config.db));
+
   // CORS
   app.use('*', cors({
     origin: config.corsOrigins || '*',
     credentials: true,
-    allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'X-Request-Id'],
+    allowHeaders: ['Content-Type', 'Authorization', 'X-API-Key', 'X-Request-Id', 'X-CSRF-Token'],
     exposeHeaders: ['X-Request-Id', 'X-RateLimit-Limit', 'X-RateLimit-Remaining', 'Retry-After'],
   }));
 
@@ -107,7 +123,7 @@ export function createServer(config: ServerConfig): ServerInstance {
 
   app.get('/health', (c) => c.json({
     status: 'ok',
-    version: '0.3.0',
+    version: '0.4.0',
     uptime: process.uptime(),
   }));
 
@@ -123,14 +139,31 @@ export function createServer(config: ServerConfig): ServerInstance {
     }, status);
   });
 
+  // One-way latch: once setup is complete, skip the bootstrap injection.
+  // Checked once at startup; also flipped by the bootstrap callback.
+  let _setupComplete = false;
+  (async () => {
+    try {
+      const stats = await config.db.getStats();
+      if (stats.totalUsers > 0) _setupComplete = true;
+    } catch { /* not ready yet — will be flipped on first bootstrap */ }
+  })();
+
   // ─── Auth Routes (public) ───────────────────────────
 
-  const authRoutes = createAuthRoutes(config.db, config.jwtSecret);
+  const authRoutes = createAuthRoutes(config.db, config.jwtSecret, {
+    onBootstrap: () => { _setupComplete = true; },
+    onDbConfigure: (newAdapter) => {
+      const old = dbProxy.__swap(newAdapter);
+      engineInitialized = false;
+      return old;
+    },
+  });
   app.route('/auth', authRoutes);
 
   // ─── Protected API Routes ───────────────────────────
 
-  const api = new Hono();
+  const api = new Hono<AppEnv>();
 
   // Authentication middleware
   api.use('*', async (c, next) => {
@@ -139,25 +172,30 @@ export function createServer(config: ServerConfig): ServerInstance {
     if (apiKeyHeader) {
       const key = await dbBreaker.execute(() => config.db.validateApiKey(apiKeyHeader));
       if (!key) return c.json({ error: 'Invalid API key' }, 401);
-      c.set('userId' as any, key.createdBy);
-      c.set('authType' as any, 'api-key');
-      c.set('apiKeyScopes' as any, key.scopes);
+      c.set('userId', key.createdBy);
+      c.set('authType', 'api-key');
+      c.set('apiKeyScopes', key.scopes);
       return next();
     }
 
-    // JWT auth
+    // JWT auth — check httpOnly cookie first, then Authorization header
+    const { getCookie } = await import('hono/cookie');
+    const cookieToken = getCookie(c, 'em_session');
     const authHeader = c.req.header('Authorization');
-    if (!authHeader?.startsWith('Bearer ')) {
+    const jwt = cookieToken || (authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null);
+
+    if (!jwt) {
       return c.json({ error: 'Authentication required' }, 401);
     }
 
     try {
       const { jwtVerify } = await import('jose');
       const secret = new TextEncoder().encode(config.jwtSecret);
-      const { payload } = await jwtVerify(authHeader.slice(7), secret);
-      c.set('userId' as any, payload.sub);
-      c.set('userRole' as any, payload.role);
-      c.set('authType' as any, 'jwt');
+      const { payload } = await jwtVerify(jwt, secret);
+      c.set('userId', payload.sub as string);
+      c.set('userRole', (payload.role as string) || '');
+      c.set('userEmail', (payload.email as string) || '');
+      c.set('authType', cookieToken ? 'cookie' : 'jwt');
       return next();
     } catch {
       return c.json({ error: 'Invalid or expired token' }, 401);
@@ -182,43 +220,71 @@ export function createServer(config: ServerConfig): ServerInstance {
 
       // Initialize engine DB on first request
       if (!engineInitialized) {
-        // Determine dialect from the adapter
-        const dbType = (config.db as any).type || (config.db as any).config?.type || 'sqlite';
-        const dialectMap: Record<string, string> = {
-          sqlite: 'sqlite', postgres: 'postgres', postgresql: 'postgres',
-          mysql: 'mysql', mariadb: 'mysql', turso: 'turso', libsql: 'turso',
-          mongodb: 'mongodb', dynamodb: 'dynamodb',
-        };
-        const dialect = (dialectMap[dbType] || 'sqlite') as any;
+        // Use the adapter's built-in engine DB interface (SQL adapters expose raw query methods)
+        const engineDbInterface = config.db.getEngineDB();
+        if (!engineDbInterface) {
+          return c.json({
+            error: 'Engine not available',
+            detail: `Engine requires a SQL-compatible database. "${config.db.type}" does not support raw SQL queries. Use postgres, mysql, sqlite, or turso.`,
+          }, 501);
+        }
 
-        // Create an EngineDB wrapper around the existing DatabaseAdapter
-        const engineDbWrapper = {
-          run: async (sql: string, params?: any[]) => {
-            await (config.db as any).run?.(sql, params) ?? (config.db as any).query?.(sql, params);
-          },
-          get: async <T = any>(sql: string, params?: any[]): Promise<T | undefined> => {
-            if ((config.db as any).get) return (config.db as any).get(sql, params);
-            const rows = await (config.db as any).query?.(sql, params) ?? [];
-            return rows[0];
-          },
-          all: async <T = any>(sql: string, params?: any[]): Promise<T[]> => {
-            if ((config.db as any).all) return (config.db as any).all(sql, params);
-            return await (config.db as any).query?.(sql, params) ?? [];
-          },
+        // Map adapter dialect to engine dialect
+        const adapterDialect = config.db.getDialect();
+        const dialectMap: Record<string, string> = {
+          sqlite: 'sqlite', postgres: 'postgres', supabase: 'postgres',
+          neon: 'postgres', cockroachdb: 'postgres', mysql: 'mysql',
+          planetscale: 'mysql', turso: 'turso',
         };
+        const engineDialect = (dialectMap[adapterDialect] || adapterDialect) as any;
 
-        const engineDb = new EngineDatabase(engineDbWrapper, dialect, (config.db as any).rawDriver);
+        const engineDb = new EngineDatabase(engineDbInterface, engineDialect);
         const migrationResult = await engineDb.migrate();
         console.log(`[engine] Migrations: ${migrationResult.applied} applied, ${migrationResult.total} total`);
-        setEngineDb(engineDb);
+        await setEngineDb(engineDb, config.db);
         engineInitialized = true;
+
+        // Start agent runtime if configured
+        if (config.runtime?.enabled) {
+          try {
+            const { createAgentRuntime } = await import('./runtime/index.js');
+            const { mountRuntimeApp } = await import('./engine/routes.js');
+            const runtime = createAgentRuntime({
+              engineDb,
+              adminDb: config.db,
+              defaultModel: config.runtime.defaultModel as any,
+              apiKeys: config.runtime.apiKeys,
+              gatewayEnabled: true,
+            });
+            await runtime.start();
+            const runtimeApp = runtime.getApp();
+            if (runtimeApp) {
+              mountRuntimeApp(runtimeApp);
+            }
+            console.log('[runtime] Agent runtime started and mounted at /api/engine/runtime/*');
+          } catch (runtimeErr: any) {
+            console.warn(`[runtime] Failed to start agent runtime: ${runtimeErr.message}`);
+          }
+        }
       }
 
-      // Forward to engine routes
-      const subPath = c.req.path.replace(/^\/api\/engine/, '') || '/';
+      // Forward to engine routes — inject auth context as headers
+      const originalUrl = new URL(c.req.url);
+      const subPath = (c.req.path.replace(/^\/api\/engine/, '') || '/') + originalUrl.search;
+      const headers = new Headers(c.req.raw.headers);
+      const userId = c.get('userId');
+      const userRole = c.get('userRole');
+      const userEmail = c.get('userEmail');
+      const authType = c.get('authType');
+      const requestId = c.get('requestId');
+      if (userId) headers.set('X-User-Id', String(userId));
+      if (userRole) headers.set('X-User-Role', String(userRole));
+      if (userEmail) headers.set('X-User-Email', String(userEmail));
+      if (authType) headers.set('X-Auth-Type', String(authType));
+      if (requestId) headers.set('X-Request-Id', String(requestId));
       const subReq = new Request(new URL(subPath, 'http://localhost'), {
         method: c.req.method,
-        headers: c.req.raw.headers,
+        headers,
         body: c.req.method !== 'GET' && c.req.method !== 'HEAD' ? c.req.raw.body : undefined,
       });
       return engineRoutes.fetch(subReq);
@@ -250,9 +316,55 @@ export function createServer(config: ServerConfig): ServerInstance {
     return dashboardHtml;
   }
 
+  async function serveDashboard(c: any) {
+    let html = getDashboardHtml();
+    if (!_setupComplete) {
+      const injection = `<script>window.__EM_SETUP_STATE__=${JSON.stringify({ needsBootstrap: true })};</script>`;
+      html = html.replace('</head>', injection + '</head>');
+    }
+
+    // Inject domain verification status (informational, does not block)
+    try {
+      const settings = await config.db.getSettings();
+      if (settings.domain && settings.domainStatus) {
+        const domainState = {
+          domain: settings.domain,
+          status: settings.domainStatus,
+          verifiedAt: settings.domainVerifiedAt,
+          dnsChallenge: settings.domainDnsChallenge,
+        };
+        const domainScript = `<script>window.__EM_DOMAIN_STATE__=${JSON.stringify(domainState)};</script>`;
+        html = html.replace('</head>', domainScript + '</head>');
+      }
+    } catch { /* non-blocking */ }
+
+    return c.html(html);
+  }
+
   app.get('/', (c) => c.redirect('/dashboard'));
-  app.get('/dashboard', (c) => c.html(getDashboardHtml()));
-  app.get('/dashboard/*', (c) => c.html(getDashboardHtml()));
+  app.get('/dashboard', serveDashboard);
+
+  // Serve dashboard JS modules and static assets (components/*.js, pages/*.js, app.js, assets/*)
+  const STATIC_MIME: Record<string, string> = { '.js': 'application/javascript; charset=utf-8', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.svg': 'image/svg+xml', '.ico': 'image/x-icon', '.gif': 'image/gif', '.webp': 'image/webp', '.css': 'text/css; charset=utf-8' };
+  app.get('/dashboard/*', (c) => {
+    const reqPath = c.req.path.replace('/dashboard/', '');
+    const ext = reqPath.substring(reqPath.lastIndexOf('.'));
+    const mime = STATIC_MIME[ext];
+    if (mime) {
+      const dir = dirname(fileURLToPath(import.meta.url));
+      const filePath = join(dir, 'dashboard', reqPath);
+      // Prevent path traversal
+      if (!filePath.startsWith(join(dir, 'dashboard'))) {
+        return c.json({ error: 'Forbidden' }, 403);
+      }
+      if (existsSync(filePath)) {
+        const content = readFileSync(filePath);
+        return new Response(content, { status: 200, headers: { 'Content-Type': mime, 'Cache-Control': ext === '.js' ? 'no-cache, no-store, must-revalidate' : 'public, max-age=86400' } });
+      }
+    }
+    // Fall through to SPA handler for non-asset requests
+    return serveDashboard(c);
+  });
 
   // ─── 404 Handler ─────────────────────────────────────
 

package/src/setup/company.ts

@@ -1,7 +1,8 @@
 /**
  * Setup Wizard — Step 1: Company Info
  *
- * Collects company name, admin email, and admin password.
+ * Collects company name, admin email, admin password,
+ * and lets the user choose or customize their subdomain.
  */
 
 export interface CompanyInfo {
@@ -11,11 +12,71 @@ export interface CompanyInfo {
   subdomain: string;
 }
 
+/** Derive a URL-safe subdomain slug from a company name. */
+function toSlug(name: string): string {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-|-$/g, '')
+    .slice(0, 63);
+}
+
+/** Generate alternative subdomain suggestions from a company name. */
+function generateAlternatives(companyName: string): string[] {
+  const base = toSlug(companyName);
+  const words = companyName.trim().split(/\s+/).map(w => w.toLowerCase().replace(/[^a-z0-9]/g, '')).filter(Boolean);
+  const suggestions = new Set<string>();
+
+  // Primary: full slug
+  suggestions.add(base);
+
+  // Abbreviation: first letter of each word (e.g. "AgenticMail Inc" → "ai")
+  if (words.length >= 2) {
+    const initials = words.map(w => w[0]).join('');
+    if (initials.length >= 2) suggestions.add(initials);
+  }
+
+  // First word only (e.g. "agenticmail")
+  if (words[0] && words[0] !== base) {
+    suggestions.add(words[0]);
+  }
+
+  // First word + last word (e.g. "agenticmail-inc")
+  if (words.length >= 3) {
+    suggestions.add(`${words[0]}-${words[words.length - 1]}`);
+  }
+
+  // With common prefixes
+  suggestions.add(`team-${base}`);
+  suggestions.add(`app-${base}`);
+  suggestions.add(`mail-${words[0] || base}`);
+  suggestions.add(`ai-${words[0] || base}`);
+
+  // With "hq" suffix
+  suggestions.add(`${words[0] || base}-hq`);
+
+  // Remove the primary (it's shown as default) and truncate
+  suggestions.delete(base);
+  return [...suggestions].map(s => s.slice(0, 63)).slice(0, 5);
+}
+
+/** Validate a subdomain string. */
+function validateSubdomain(v: string): string | true {
+  const s = v.trim();
+  if (!s) return 'Subdomain is required';
+  if (s.length < 2) return 'Subdomain must be at least 2 characters';
+  if (s.length > 63) return 'Subdomain must be 63 characters or fewer';
+  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(s)) {
+    return 'Subdomain must be lowercase letters, numbers, and hyphens (cannot start or end with a hyphen)';
+  }
+  return true;
+}
+
 export async function promptCompanyInfo(
   inquirer: any,
   chalk: any,
 ): Promise<CompanyInfo> {
-  console.log(chalk.bold.cyan('  Step 1 of 4: Company Info'));
+  console.log(chalk.bold.cyan('  Step 1 of 5: Company Info'));
   console.log(chalk.dim('  Tell us about your organization.\n'));
 
   const { companyName, adminEmail, adminPassword } = await inquirer.prompt([
@@ -53,12 +114,70 @@ export async function promptCompanyInfo(
     },
   ]);
 
-  // Derive subdomain from company name
-  const subdomain = companyName
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-|-$/g, '')
-    .slice(0, 63);
+  // ── Subdomain Selection ─────────────────────────────
+
+  const suggested = toSlug(companyName);
+  const alternatives = generateAlternatives(companyName);
+
+  console.log('');
+  console.log(chalk.bold('  Subdomain'));
+  console.log(chalk.dim('  Used for your dashboard URL and internal routing.\n'));
+
+  // Build choices: suggested (default), alternatives, custom option
+  const choices = [
+    { name: `${suggested}  ${chalk.dim('(recommended)')}`, value: suggested },
+    ...alternatives.map(alt => ({ name: alt, value: alt })),
+    new inquirer.Separator(),
+    { name: `${chalk.italic('Enter my own...')}`, value: '__custom__' },
+    { name: `${chalk.italic('Generate more suggestions')}`, value: '__regenerate__' },
+  ];
+
+  let subdomain: string = suggested;
+  let choosing = true;
+
+  while (choosing) {
+    const { subdomainChoice } = await inquirer.prompt([{
+      type: 'list',
+      name: 'subdomainChoice',
+      message: 'Choose a subdomain:',
+      choices,
+    }]);
+
+    if (subdomainChoice === '__custom__') {
+      const { custom } = await inquirer.prompt([{
+        type: 'input',
+        name: 'custom',
+        message: 'Custom subdomain:',
+        suffix: chalk.dim('  (lowercase, letters/numbers/hyphens)'),
+        validate: validateSubdomain,
+        filter: (v: string) => v.trim().toLowerCase(),
+      }]);
+      subdomain = custom;
+      choosing = false;
+    } else if (subdomainChoice === '__regenerate__') {
+      // Generate a fresh batch with random suffixes
+      const base = toSlug(companyName);
+      const words = companyName.trim().split(/\s+/).map((w: string) => w.toLowerCase().replace(/[^a-z0-9]/g, '')).filter(Boolean);
+      const w = words[0] || base;
+      const rand = () => Math.random().toString(36).slice(2, 5);
+      const fresh = [
+        `${w}-${rand()}`,
+        `${base}-${rand()}`,
+        `${w}-agents`,
+        `${w}-mail`,
+        `${w}-platform`,
+      ];
+      // Replace the middle choices
+      choices.splice(1, alternatives.length,
+        ...fresh.map(alt => ({ name: alt, value: alt })),
+      );
+    } else {
+      subdomain = subdomainChoice;
+      choosing = false;
+    }
+  }
+
+  console.log(chalk.dim(`  Your subdomain: ${chalk.white(subdomain)}\n`));
 
   return { companyName, adminEmail, adminPassword, subdomain };
 }

package/src/setup/database.ts

@@ -5,10 +5,11 @@
  * collects the connection details specific to each one.
  */
 
+import type { DatabaseType } from '../db/adapter.js';
 import { getSupportedDatabases } from '../db/factory.js';
 
 export interface DatabaseSelection {
-  type: string;
+  type: DatabaseType;
   connectionString?: string;
   region?: string;
   accessKeyId?: string;

package/src/setup/domain.ts

@@ -2,6 +2,9 @@
  * Setup Wizard — Step 4: Custom Domain (Optional)
  *
  * Optionally configure a custom domain for the dashboard.
+ * Explains the two DNS records needed:
+ *   1. CNAME/A record — routes traffic to your server
+ *   2. TXT record — proves ownership (handled in Step 5)
  */
 
 export interface DomainSelection {
@@ -19,8 +22,21 @@ export async function promptDomain(
   }
 
   console.log('');
-  console.log(chalk.bold.cyan('  Step 4 of 4: Custom Domain'));
-  console.log(chalk.dim('  Optional — you can add this later.\n'));
+  console.log(chalk.bold.cyan('  Step 4 of 5: Custom Domain'));
+  console.log(chalk.dim('  Point your own domain at this deployment.\n'));
+
+  // Explain what a custom domain does based on deploy target
+  const targetHints: Record<string, string> = {
+    cloud: 'Your dashboard will be accessible at this domain instead of the default .agenticmail.io URL.',
+    docker: 'Configure your reverse proxy (nginx, Caddy, etc.) to route this domain to the Docker container.',
+    fly: 'After deploying, run `fly certs add <domain>` to provision TLS for this domain.',
+    railway: 'Add this domain in your Railway project settings after deploying.',
+  };
+
+  if (targetHints[deployTarget]) {
+    console.log(chalk.dim(`  ${targetHints[deployTarget]}`));
+    console.log('');
+  }
 
   const { wantsDomain } = await inquirer.prompt([{
     type: 'confirm',
@@ -35,12 +51,25 @@ export async function promptDomain(
     type: 'input',
     name: 'domain',
     message: 'Custom domain:',
-    suffix: chalk.dim('  (e.g. agents.acme.com)'),
+    suffix: chalk.dim('  (e.g. agents.agenticmail.io)'),
     validate: (v: string) => {
-      if (!v.includes('.')) return 'Enter a valid domain (e.g. agents.acme.com)';
+      const d = v.trim().toLowerCase();
+      if (!d.includes('.')) return 'Enter a valid domain (e.g. agents.agenticmail.io)';
+      if (d.startsWith('http')) return 'Enter just the domain, not a URL';
+      if (d.endsWith('.')) return 'Do not include a trailing dot';
       return true;
     },
+    filter: (v: string) => v.trim().toLowerCase(),
   }]);
 
+  // Preview what DNS they'll need
+  console.log('');
+  console.log(chalk.dim('  After setup, you will need two DNS records for this domain:'));
+  console.log('');
+  console.log(chalk.dim(`  1. ${chalk.white('CNAME or A record')}  — routes traffic to your server`));
+  console.log(chalk.dim(`     (instructions shown after deployment)`));
+  console.log(chalk.dim(`  2. ${chalk.white('TXT record')}          — proves domain ownership (next step)`));
+  console.log('');
+
   return { customDomain: domain };
 }

package/src/setup/index.ts

@@ -1,33 +1,37 @@
 /**
  * Setup Wizard — Orchestrator
  *
- * Runs the 4-step interactive setup wizard by composing
+ * Runs the 5-step interactive setup wizard by composing
  * the individual step modules. Each step is in its own file
  * so the wizard logic stays manageable.
  *
  * Steps:
- *   1. Company Info   (setup/company.ts)
- *   2. Database       (setup/database.ts)
- *   3. Deployment     (setup/deployment.ts)
- *   4. Custom Domain  (setup/domain.ts)
- *   → Provision       (setup/provision.ts)
+ *   1. Company Info       (setup/company.ts)
+ *   2. Database           (setup/database.ts)
+ *   3. Deployment         (setup/deployment.ts)
+ *   4. Custom Domain      (setup/domain.ts)
+ *   5. Domain Registration (setup/registration.ts)
+ *   → Provision           (setup/provision.ts)
  */
 
 import { promptCompanyInfo } from './company.js';
 import { promptDatabase } from './database.js';
 import { promptDeployment } from './deployment.js';
 import { promptDomain } from './domain.js';
+import { promptRegistration } from './registration.js';
 import { provision } from './provision.js';
 
 export { promptCompanyInfo } from './company.js';
 export { promptDatabase } from './database.js';
 export { promptDeployment } from './deployment.js';
 export { promptDomain } from './domain.js';
+export { promptRegistration } from './registration.js';
 export { provision } from './provision.js';
 export type { CompanyInfo } from './company.js';
 export type { DatabaseSelection } from './database.js';
 export type { DeployTarget, DeploymentSelection } from './deployment.js';
 export type { DomainSelection } from './domain.js';
+export type { RegistrationSelection } from './registration.js';
 export type { ProvisionConfig, ProvisionResult } from './provision.js';
 
 /**
@@ -60,13 +64,21 @@ export async function runSetupWizard(): Promise<void> {
   // ─── Step 4: Custom Domain ───────────────────────
   const domain = await promptDomain(inquirer, chalk, deployTarget);
 
+  // ─── Step 5: Domain Registration ─────────────────
+  const registration = await promptRegistration(
+    inquirer, chalk, ora,
+    domain.customDomain,
+    company.companyName,
+    company.adminEmail,
+  );
+
   // ─── Provision ───────────────────────────────────
   console.log('');
   console.log(chalk.dim('  ─────────────────────────────────────────'));
   console.log('');
 
   const result = await provision(
-    { company, database, deployTarget, domain },
+    { company, database, deployTarget, domain, registration },
     ora,
     chalk,
   );