@open-mercato/core 0.6.1-develop.3260.1.dc719cac84 → 0.6.1-develop.3278.1.a4d26475e4

package/src/modules/customer_accounts/data/enrichers.ts

@@ -1,6 +1,7 @@
 import type { ResponseEnricher, EnricherContext } from '@open-mercato/shared/lib/crud/response-enricher'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { CustomerUser } from './entities'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CustomerUser, DomainMapping, type DomainStatus } from './entities'
 
 type EntityRecord = Record<string, unknown> & { id: string }
 type EnricherScope = EnricherContext & { em: EntityManager }
@@ -42,11 +43,17 @@ const personAccountStatusEnricher: ResponseEnricher<EntityRecord, PersonAccountE
     const em = context.em.fork()
     const recordIds = records.map((r) => r.id)
 
-    const users = await em.find(CustomerUser, {
-      personEntityId: { $in: recordIds },
-      tenantId: context.tenantId,
-      deletedAt: null,
-    })
+    const users = await findWithDecryption(
+      em,
+      CustomerUser,
+      {
+        personEntityId: { $in: recordIds },
+        tenantId: context.tenantId,
+        deletedAt: null,
+      },
+      undefined,
+      { tenantId: context.tenantId, organizationId: context.organizationId },
+    )
 
     const userByPersonId = new Map<string, CustomerUser>()
     for (const user of users) {
@@ -92,11 +99,17 @@ const companyUserCountEnricher: ResponseEnricher<EntityRecord, CompanyUserCountE
     const em = context.em.fork()
     const recordIds = records.map((r) => r.id)
 
-    const users = await em.find(CustomerUser, {
-      customerEntityId: { $in: recordIds },
-      tenantId: context.tenantId,
-      deletedAt: null,
-    })
+    const users = await findWithDecryption(
+      em,
+      CustomerUser,
+      {
+        customerEntityId: { $in: recordIds },
+        tenantId: context.tenantId,
+        deletedAt: null,
+      },
+      undefined,
+      { tenantId: context.tenantId, organizationId: context.organizationId },
+    )
 
     const countByCompanyId = new Map<string, number>()
     for (const user of users) {
@@ -114,4 +127,74 @@ const companyUserCountEnricher: ResponseEnricher<EntityRecord, CompanyUserCountE
   },
 }
 
-export const enrichers: ResponseEnricher[] = [personAccountStatusEnricher, companyUserCountEnricher]
+type OrgCustomDomainEnrichment = {
+  _customDomain: { hostname: string; status: DomainStatus } | null
+}
+
+const ORG_DOMAIN_FALLBACK: OrgCustomDomainEnrichment = { _customDomain: null }
+
+const ACTIVE_DOMAIN_PRIORITY: Record<DomainStatus, number> = {
+  active: 0,
+  verified: 1,
+  pending: 2,
+  tls_failed: 3,
+  dns_failed: 4,
+}
+
+function pickPrimaryDomain(records: DomainMapping[]): DomainMapping | null {
+  if (records.length === 0) return null
+  return records
+    .slice()
+    .sort(
+      (a, b) =>
+        (ACTIVE_DOMAIN_PRIORITY[a.status] ?? 99) - (ACTIVE_DOMAIN_PRIORITY[b.status] ?? 99) ||
+        (b.createdAt?.getTime?.() ?? 0) - (a.createdAt?.getTime?.() ?? 0),
+    )[0]
+}
+
+const organizationCustomDomainEnricher: ResponseEnricher<EntityRecord, OrgCustomDomainEnrichment> = {
+  id: 'customer_accounts.domain-status:directory:organization',
+  targetEntity: 'directory:organization',
+  features: ['customer_accounts.domain.manage'],
+  priority: 10,
+  timeout: 1_000,
+  critical: false,
+  fallback: ORG_DOMAIN_FALLBACK,
+
+  async enrichOne(record, context: EnricherScope) {
+    return (await this.enrichMany!([record], context))[0]
+  },
+
+  async enrichMany(records, context: EnricherScope) {
+    if (records.length === 0) return records as (EntityRecord & OrgCustomDomainEnrichment)[]
+
+    const em = context.em.fork()
+    const recordIds = records.map((r) => r.id)
+    const domains = await em.find(DomainMapping, {
+      organizationId: { $in: recordIds },
+      tenantId: context.tenantId,
+    } as never)
+
+    const byOrg = new Map<string, DomainMapping[]>()
+    for (const d of domains) {
+      const list = byOrg.get(d.organizationId) ?? []
+      list.push(d)
+      byOrg.set(d.organizationId, list)
+    }
+
+    return records.map((record) => {
+      const matches = byOrg.get(record.id) ?? []
+      const primary = pickPrimaryDomain(matches)
+      return {
+        ...record,
+        _customDomain: primary ? { hostname: primary.hostname, status: primary.status } : null,
+      }
+    })
+  },
+}
+
+export const enrichers: ResponseEnricher[] = [
+  personAccountStatusEnricher,
+  companyUserCountEnricher,
+  organizationCustomDomainEnricher,
+]

package/src/modules/customer_accounts/data/entities.ts

@@ -1,4 +1,16 @@
-import { Entity, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
+import { Check, Entity, Enum, Index, ManyToOne, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
+
+export type DomainProvider = 'traefik'
+export type DomainStatus = 'pending' | 'verified' | 'active' | 'dns_failed' | 'tls_failed'
+
+export const DOMAIN_PROVIDERS: readonly DomainProvider[] = ['traefik'] as const
+export const DOMAIN_STATUSES: readonly DomainStatus[] = [
+  'pending',
+  'verified',
+  'active',
+  'dns_failed',
+  'tls_failed',
+] as const
 
 @Entity({ tableName: 'customer_users' })
 @Unique({ properties: ['tenantId', 'emailHash'], name: 'customer_users_tenant_email_hash_uniq' })
@@ -303,3 +315,70 @@ export class CustomerUserInvitation {
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 }
+
+@Entity({ tableName: 'domain_mappings' })
+@Unique({ properties: ['hostname'], name: 'domain_mappings_hostname_unique' })
+@Index({ properties: ['organizationId'], name: 'domain_mappings_organization_id_idx' })
+@Index({ properties: ['tenantId'], name: 'domain_mappings_tenant_id_idx' })
+@Unique({
+  name: 'domain_mappings_replaces_domain_id_unique',
+  expression:
+    `create unique index "domain_mappings_replaces_domain_id_unique" on "domain_mappings" ("replaces_domain_id") where "replaces_domain_id" is not null`,
+})
+@Index({
+  name: 'domain_mappings_pending_verification_idx',
+  expression:
+    `create index "domain_mappings_pending_verification_idx" on "domain_mappings" ("status", "last_dns_check_at") where "status" in ('pending', 'dns_failed')`,
+})
+@Index({
+  name: 'domain_mappings_pending_tls_idx',
+  expression:
+    `create index "domain_mappings_pending_tls_idx" on "domain_mappings" ("status", "updated_at") where "status" in ('verified', 'tls_failed')`,
+})
+@Check({
+  name: 'domain_mappings_hostname_normalized_chk',
+  expression: `"hostname" = lower("hostname") and "hostname" not like '%.'`,
+})
+export class DomainMapping {
+  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
+  id!: string
+
+  @Property({ type: 'text' })
+  hostname!: string
+
+  @Property({ name: 'tenant_id', type: 'uuid' })
+  tenantId!: string
+
+  @Property({ name: 'organization_id', type: 'uuid' })
+  organizationId!: string
+
+  @ManyToOne(() => DomainMapping, { fieldName: 'replaces_domain_id', nullable: true })
+  replacesDomain?: DomainMapping | null
+
+  @Enum({ items: () => DOMAIN_PROVIDERS as unknown as string[], type: 'text', name: 'provider' })
+  provider: DomainProvider = 'traefik'
+
+  @Enum({ items: () => DOMAIN_STATUSES as unknown as string[], type: 'text', name: 'status' })
+  status: DomainStatus = 'pending'
+
+  @Property({ name: 'verified_at', type: Date, nullable: true })
+  verifiedAt?: Date | null
+
+  @Property({ name: 'last_dns_check_at', type: Date, nullable: true })
+  lastDnsCheckAt?: Date | null
+
+  @Property({ name: 'dns_failure_reason', type: 'text', nullable: true, length: 500 })
+  dnsFailureReason?: string | null
+
+  @Property({ name: 'tls_failure_reason', type: 'text', nullable: true, length: 500 })
+  tlsFailureReason?: string | null
+
+  @Property({ name: 'tls_retry_count', type: 'int', default: 0 })
+  tlsRetryCount: number = 0
+
+  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
+  createdAt: Date = new Date()
+
+  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date(), nullable: true })
+  updatedAt?: Date | null
+}

package/src/modules/customer_accounts/data/guards.ts

@@ -0,0 +1,155 @@
+import type { MutationGuard } from '@open-mercato/shared/lib/crud/mutation-guard-registry'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+const DOMAIN_MAPPING_ENTITY = 'customer_accounts.domain_mapping'
+const MAX_DOMAINS_PER_ORG = 2
+
+function readHostnameField(payload: Record<string, unknown> | null | undefined): string | null {
+  if (!payload || typeof payload !== 'object') return null
+  const raw = (payload as Record<string, unknown>).hostname
+  return typeof raw === 'string' ? raw : null
+}
+
+function readOrgIdField(payload: Record<string, unknown> | null | undefined): string | null {
+  if (!payload || typeof payload !== 'object') return null
+  const raw = (payload as Record<string, unknown>).organizationId ?? (payload as Record<string, unknown>).organization_id
+  return typeof raw === 'string' ? raw : null
+}
+
+const hostnameFormatGuard: MutationGuard = {
+  id: 'customer_accounts.domain_mapping.hostname-format',
+  targetEntity: DOMAIN_MAPPING_ENTITY,
+  operations: ['create'],
+  priority: 10,
+
+  async validate(input) {
+    const raw = readHostnameField(input.mutationPayload)
+    if (!raw) {
+      return { ok: false, status: 422, message: 'Hostname is required' }
+    }
+    const normalized = tryNormalizeHostname(raw)
+    if (!normalized) {
+      return {
+        ok: false,
+        status: 422,
+        message: 'Hostname is not a valid DNS name (must be at least two labels, ASCII or IDN)',
+      }
+    }
+    return {
+      ok: true,
+      modifiedPayload: { hostname: normalized },
+    }
+  },
+}
+
+const hostnameUniqueGuard: MutationGuard = {
+  id: 'customer_accounts.domain_mapping.hostname-unique',
+  targetEntity: DOMAIN_MAPPING_ENTITY,
+  operations: ['create'],
+  priority: 20,
+
+  async validate(input) {
+    const raw = readHostnameField(input.mutationPayload)
+    if (!raw) return { ok: true }
+    const hostname = tryNormalizeHostname(raw)
+    if (!hostname) return { ok: true }
+
+    const container = await createRequestContainer()
+    let service: DomainMappingService | null = null
+    try {
+      service = container.resolve('domainMappingService') as DomainMappingService
+    } catch {
+      return { ok: true }
+    }
+
+    const existing = await service.resolveByHostname(hostname)
+    if (!existing) return { ok: true }
+
+    // Intentionally tenant-agnostic message: do not disclose whether the
+    // collision is intra-tenant or cross-tenant. Distinguishing them would
+    // let any caller probe deployment-wide hostname registration.
+    const sameOrg = existing.organizationId === readOrgIdField(input.mutationPayload)
+    if (existing.tenantId !== input.tenantId || !sameOrg) {
+      return {
+        ok: false,
+        status: 409,
+        message: 'This domain is not available. Please choose a different hostname.',
+      }
+    }
+    return { ok: true }
+  },
+}
+
+const orgLimitGuard: MutationGuard = {
+  id: 'customer_accounts.domain_mapping.org-limit',
+  targetEntity: DOMAIN_MAPPING_ENTITY,
+  operations: ['create'],
+  priority: 30,
+
+  async validate(input) {
+    const orgId = readOrgIdField(input.mutationPayload) ?? input.organizationId
+    if (!orgId) {
+      return { ok: false, status: 422, message: 'Organization is required' }
+    }
+
+    const container = await createRequestContainer()
+    let service: DomainMappingService | null = null
+    try {
+      service = container.resolve('domainMappingService') as DomainMappingService
+    } catch {
+      return { ok: true }
+    }
+
+    const existing = await service.findByOrganization(orgId, { tenantId: input.tenantId })
+    if (existing.length >= MAX_DOMAINS_PER_ORG) {
+      return {
+        ok: false,
+        status: 409,
+        message: `Each organization can have at most ${MAX_DOMAINS_PER_ORG} custom domains (one active and one pending replacement). Remove an existing domain or finish the swap first.`,
+      }
+    }
+    return { ok: true }
+  },
+}
+
+// Mirrors the in-progress-lock pattern used by other modules' update/delete
+// guards: ensure the target record exists and belongs to the caller's tenant
+// before any destructive or lifecycle-changing mutation runs. Verification
+// and health-check endpoints invoke this via operation: 'update' since they
+// transition the record's lifecycle status.
+const recordScopeGuard: MutationGuard = {
+  id: 'customer_accounts.domain_mapping.record-scope',
+  targetEntity: DOMAIN_MAPPING_ENTITY,
+  operations: ['update', 'delete'],
+  priority: 10,
+
+  async validate(input) {
+    const resourceId = input.resourceId
+    if (!resourceId) {
+      return { ok: false, status: 422, message: 'Domain mapping id is required' }
+    }
+
+    const container = await createRequestContainer()
+    let service: DomainMappingService | null = null
+    try {
+      service = container.resolve('domainMappingService') as DomainMappingService
+    } catch {
+      return { ok: true }
+    }
+
+    const record = await service.findById(resourceId, { tenantId: input.tenantId })
+    if (!record) {
+      return { ok: false, status: 404, message: 'Domain mapping not found' }
+    }
+    return { ok: true }
+  },
+}
+
+export const guards: MutationGuard[] = [
+  hostnameFormatGuard,
+  hostnameUniqueGuard,
+  orgLimitGuard,
+  recordScopeGuard,
+]

package/src/modules/customer_accounts/data/validators.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { normalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
 
 const emailField = z.string().email().max(255)
 const passwordField = z.string().min(8).max(128)
@@ -126,3 +127,28 @@ export type UpdateRoleAclInput = z.infer<typeof updateRoleAclSchema>
 export type InviteUserInput = z.infer<typeof inviteUserSchema>
 export type AssignRolesInput = z.infer<typeof assignRolesSchema>
 export type AdminUpdateUserInput = z.infer<typeof adminUpdateUserSchema>
+
+// Custom domain mapping
+export const hostnameSchema = z
+  .string()
+  .min(1, 'Hostname is required')
+  .max(512, 'Hostname is too long')
+  .transform((value, ctx) => {
+    try {
+      return normalizeHostname(value)
+    } catch (err) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: err instanceof Error ? err.message : 'Invalid hostname',
+      })
+      return z.NEVER
+    }
+  })
+
+export const registerDomainSchema = z.object({
+  hostname: hostnameSchema,
+  organizationId: z.string().uuid(),
+  replacesDomainId: z.string().uuid().optional(),
+})
+
+export type RegisterDomainInput = z.infer<typeof registerDomainSchema>

package/src/modules/customer_accounts/di.ts

@@ -1,10 +1,24 @@
-import { asClass } from 'awilix'
+import { asClass, asFunction } from 'awilix'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'
 import { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
 import { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+type DomainCacheService = {
+  get: (key: string, options?: unknown) => Promise<unknown>
+  set: (key: string, value: unknown, options?: { ttl?: number; tags?: string[] }) => Promise<void>
+  deleteByTags: (tags: string[]) => Promise<number>
+}
+
+function isDomainCacheService(candidate: unknown): candidate is DomainCacheService {
+  if (!candidate || typeof candidate !== 'object') return false
+  const c = candidate as Record<string, unknown>
+  return typeof c.get === 'function' && typeof c.set === 'function' && typeof c.deleteByTags === 'function'
+}
 
 export function register(container: AppContainer) {
   container.register({ customerUserService: asClass(CustomerUserService).scoped() })
@@ -12,4 +26,24 @@ export function register(container: AppContainer) {
   container.register({ customerTokenService: asClass(CustomerTokenService).scoped() })
   container.register({ customerRbacService: asClass(CustomerRbacService).scoped() })
   container.register({ customerInvitationService: asClass(CustomerInvitationService).scoped() })
+  container.register({
+    domainMappingService: asFunction(
+      function domainMappingServiceFactory(em: EntityManager) {
+        // Resolve the cache lazily so registrations from `bootstrap(container)` (which runs after
+        // module DI registrars) are visible. Awilix CLASSIC mode would fail to resolve a
+        // destructured `cache` param if the key is not yet registered; using `hasRegistration`
+        // keeps construction safe for CLI/test contexts where `cache` may never be wired.
+        let cacheService: DomainCacheService | undefined
+        try {
+          if (container.hasRegistration('cache')) {
+            const candidate = container.resolve('cache')
+            if (isDomainCacheService(candidate)) cacheService = candidate
+          }
+        } catch {
+          cacheService = undefined
+        }
+        return new DomainMappingService(em, cacheService ? { cacheService } : undefined)
+      },
+    ).scoped(),
+  })
 }

package/src/modules/customer_accounts/events.ts

@@ -17,8 +17,15 @@ const events = [
   { id: 'customer_accounts.role.updated', label: 'Customer Role Updated', entity: 'role', category: 'crud', portalBroadcast: true },
   { id: 'customer_accounts.role.deleted', label: 'Customer Role Deleted', entity: 'role', category: 'crud' },
   { id: 'customer_accounts.invitation.accepted', label: 'Customer Invitation Accepted', category: 'lifecycle', clientBroadcast: true },
-  { id: 'customer_accounts.magic_link.requested', label: 'Customer Magic Link Requested', category: 'lifecycle' },
   { id: 'customer_accounts.password_reset.requested', label: 'Customer Password Reset Requested', category: 'lifecycle' },
+  // Custom domain mapping lifecycle (see .ai/specs/2026-04-08-portal-custom-domain-routing.md)
+  { id: 'customer_accounts.domain_mapping.created', label: 'Custom Domain Registered', entity: 'domain_mapping', category: 'crud', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.verified', label: 'Custom Domain DNS Verified', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.activated', label: 'Custom Domain Active', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.dns_failed', label: 'Custom Domain DNS Verification Failed', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.tls_failed', label: 'Custom Domain SSL Provisioning Failed', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.deleted', label: 'Custom Domain Removed', entity: 'domain_mapping', category: 'crud', clientBroadcast: true },
+  { id: 'customer_accounts.domain_mapping.replaced', label: 'Custom Domain Replaced', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },
 ] as const
 
 export const eventsConfig = createModuleEvents({

package/src/modules/customer_accounts/i18n/de.json

@@ -192,12 +192,90 @@
   "customer_accounts.admin.unverified": "No",
   "customer_accounts.admin.users": "Users",
   "customer_accounts.admin.verified": "Yes",
+  "customer_accounts.domainMapping.aRecordInstruction": "For an apex domain, add an A record for {hostname} pointing to {target}",
+  "customer_accounts.domainMapping.alreadyClaimed": "This domain is not available. Please choose a different hostname.",
+  "customer_accounts.domainMapping.autoVerify.checking": "Automatically checking every 5 minutes",
+  "customer_accounts.domainMapping.autoVerify.lastChecked": "Last checked: {time}",
+  "customer_accounts.domainMapping.autoVerify.nextCheck": "Next check in ~{minutes} minutes",
+  "customer_accounts.domainMapping.changeDomain": "Change Domain",
+  "customer_accounts.domainMapping.changeDomain.description": "Your current domain ({hostname}) will stay active until the new domain is fully set up. No downtime for your customers.",
+  "customer_accounts.domainMapping.changeDomain.replacing": "Replacing {oldHostname} — old domain stays live until this one is ready",
+  "customer_accounts.domainMapping.cnameInstruction": "Add a CNAME record for {hostname} pointing to {target} in your DNS provider",
+  "customer_accounts.domainMapping.copyTarget": "Copy",
+  "customer_accounts.domainMapping.copyTarget.copied": "Copied",
+  "customer_accounts.domainMapping.description": "Map your own domain to the customer portal",
+  "customer_accounts.domainMapping.diagnostics.detectedRecords": "Detected DNS records:",
+  "customer_accounts.domainMapping.diagnostics.noRecord": "No CNAME or A record found for {hostname}",
+  "customer_accounts.domainMapping.diagnostics.proxyDetected": "Your DNS uses a proxy ({proxy}). Either disable the proxy or configure it to forward traffic to our platform.",
+  "customer_accounts.domainMapping.diagnostics.suggestion": "Suggested fix:",
+  "customer_accounts.domainMapping.diagnostics.timeout": "DNS lookup timed out — this may be a temporary issue",
+  "customer_accounts.domainMapping.diagnostics.wrongARecordTarget": "Your A record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.diagnostics.wrongCnameTarget": "Your CNAME record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.dialog.cancel": "Cancel",
+  "customer_accounts.domainMapping.dialog.change.submit": "Start replacement",
+  "customer_accounts.domainMapping.dialog.change.title": "Change custom domain",
+  "customer_accounts.domainMapping.dialog.register.submit": "Register",
+  "customer_accounts.domainMapping.dialog.register.title": "Register custom domain",
+  "customer_accounts.domainMapping.dns.diagnostics.detected": "Detected target",
+  "customer_accounts.domainMapping.dns.diagnostics.expected": "Expected target",
+  "customer_accounts.domainMapping.dns.diagnostics.title": "DNS configuration issue",
+  "customer_accounts.domainMapping.dns.recheckButton": "Re-check DNS",
+  "customer_accounts.domainMapping.dnsProviderHelp": "Need help? See instructions for:",
+  "customer_accounts.domainMapping.dnsProviderHelp.cloudflare": "Cloudflare",
+  "customer_accounts.domainMapping.dnsProviderHelp.godaddy": "GoDaddy",
+  "customer_accounts.domainMapping.dnsProviderHelp.googleDomains": "Google Domains",
+  "customer_accounts.domainMapping.dnsProviderHelp.namecheap": "Namecheap",
+  "customer_accounts.domainMapping.dnsProviderHelp.other": "Other providers",
+  "customer_accounts.domainMapping.empty.cta": "Register Domain",
+  "customer_accounts.domainMapping.empty.description": "Connect your own domain so customers can reach the portal at a branded URL.",
+  "customer_accounts.domainMapping.empty.title": "No custom domain yet",
+  "customer_accounts.domainMapping.error.load": "Could not load custom-domain configuration",
+  "customer_accounts.domainMapping.errors.required": "Domain is required",
+  "customer_accounts.domainMapping.hostname.label": "Domain",
+  "customer_accounts.domainMapping.hostname.placeholder": "e.g., shop.yourdomain.com",
+  "customer_accounts.domainMapping.hostname.validation.invalid": "Enter a valid domain name (no protocol, path, or port)",
+  "customer_accounts.domainMapping.loading": "Loading domain configuration…",
+  "customer_accounts.domainMapping.orgSwitcher.label": "Organization",
+  "customer_accounts.domainMapping.preview": "Test Domain",
+  "customer_accounts.domainMapping.preview.description": "Opens your portal on the custom domain in a new tab to verify it's working correctly",
+  "customer_accounts.domainMapping.preview.notReady": "Domain is not yet active. Complete the setup steps first.",
+  "customer_accounts.domainMapping.propagationNote": "DNS changes can take up to 48 hours to propagate. The system checks automatically — you'll be notified when it's ready.",
+  "customer_accounts.domainMapping.registered": "Domain registered successfully",
+  "customer_accounts.domainMapping.removeConfirm": "Are you sure? Customers using this domain will no longer be able to reach your portal.",
+  "customer_accounts.domainMapping.removeConfirm.hasReplacement": "This will also cancel the pending replacement domain ({hostname}).",
+  "customer_accounts.domainMapping.removeConfirm.title": "Remove custom domain?",
+  "customer_accounts.domainMapping.removeDomain": "Remove Domain",
+  "customer_accounts.domainMapping.removed": "Domain removed",
+  "customer_accounts.domainMapping.replacement.label": "Replacement (waiting to activate)",
+  "customer_accounts.domainMapping.status.active": "Active",
+  "customer_accounts.domainMapping.status.dns_failed": "DNS issue — see details below",
+  "customer_accounts.domainMapping.status.pending": "Checking DNS...",
+  "customer_accounts.domainMapping.status.tls_failed": "SSL certificate issue — we're retrying",
+  "customer_accounts.domainMapping.status.verified": "Setting up SSL certificate...",
+  "customer_accounts.domainMapping.stepper.step1": "Register Domain",
+  "customer_accounts.domainMapping.stepper.step2": "Configure DNS",
+  "customer_accounts.domainMapping.stepper.step3": "SSL Certificate",
+  "customer_accounts.domainMapping.stepper.step4": "Live",
+  "customer_accounts.domainMapping.title": "Custom Domain",
+  "customer_accounts.domainMapping.tls.diagnostics.operatorNote": "We are retrying automatically. If this persists, contact platform support — your DNS is fine, this is on our side.",
+  "customer_accounts.domainMapping.tls.diagnostics.retryCount": "Retry attempts: {count}",
+  "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
+  "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
+  "customer_accounts.domainMapping.verifyNow": "Check Now",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",
   "customer_accounts.nav.roles": "Kundenrollen",
   "customer_accounts.nav.user_detail": "User Detail",
   "customer_accounts.nav.users": "Kundenbenutzer",
+  "customer_accounts.notifications.domain_mapping.activated.body": "Your custom domain is now active and serving traffic.",
+  "customer_accounts.notifications.domain_mapping.activated.title": "Custom domain is live",
+  "customer_accounts.notifications.domain_mapping.dns_failed.body": "DNS verification failed for your custom domain. {reason}",
+  "customer_accounts.notifications.domain_mapping.dns_failed.title": "DNS verification failed",
+  "customer_accounts.notifications.domain_mapping.tls_failed.body": "SSL certificate provisioning is having trouble for your custom domain. We're retrying — no action needed yet.",
+  "customer_accounts.notifications.domain_mapping.tls_failed.title": "SSL provisioning issue",
+  "customer_accounts.notifications.domain_mapping.verified.body": "Your custom domain has been verified. SSL certificate is being provisioned.",
+  "customer_accounts.notifications.domain_mapping.verified.title": "Custom domain verified",
   "customer_accounts.notifications.user.locked.body": "Customer account was locked due to too many failed login attempts.",
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",