@open-mercato/core 0.6.1-develop.3260.1.dc719cac84 → 0.6.1-develop.3278.1.a4d26475e4

package/dist/modules/customer_accounts/di.js

@@ -1,15 +1,37 @@
-import { asClass } from "awilix";
+import { asClass, asFunction } from "awilix";
 import { CustomerUserService } from "@open-mercato/core/modules/customer_accounts/services/customerUserService";
 import { CustomerSessionService } from "@open-mercato/core/modules/customer_accounts/services/customerSessionService";
 import { CustomerTokenService } from "@open-mercato/core/modules/customer_accounts/services/customerTokenService";
 import { CustomerRbacService } from "@open-mercato/core/modules/customer_accounts/services/customerRbacService";
 import { CustomerInvitationService } from "@open-mercato/core/modules/customer_accounts/services/customerInvitationService";
+import { DomainMappingService } from "@open-mercato/core/modules/customer_accounts/services/domainMappingService";
+function isDomainCacheService(candidate) {
+  if (!candidate || typeof candidate !== "object") return false;
+  const c = candidate;
+  return typeof c.get === "function" && typeof c.set === "function" && typeof c.deleteByTags === "function";
+}
 function register(container) {
   container.register({ customerUserService: asClass(CustomerUserService).scoped() });
   container.register({ customerSessionService: asClass(CustomerSessionService).scoped() });
   container.register({ customerTokenService: asClass(CustomerTokenService).scoped() });
   container.register({ customerRbacService: asClass(CustomerRbacService).scoped() });
   container.register({ customerInvitationService: asClass(CustomerInvitationService).scoped() });
+  container.register({
+    domainMappingService: asFunction(
+      function domainMappingServiceFactory(em) {
+        let cacheService;
+        try {
+          if (container.hasRegistration("cache")) {
+            const candidate = container.resolve("cache");
+            if (isDomainCacheService(candidate)) cacheService = candidate;
+          }
+        } catch {
+          cacheService = void 0;
+        }
+        return new DomainMappingService(em, cacheService ? { cacheService } : void 0);
+      }
+    ).scoped()
+  });
 }
 export {
   register

package/dist/modules/customer_accounts/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/di.ts"],
-  "sourcesContent": ["import { asClass } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\n\nexport function register(container: AppContainer) {\n  container.register({ customerUserService: asClass(CustomerUserService).scoped() })\n  container.register({ customerSessionService: asClass(CustomerSessionService).scoped() })\n  container.register({ customerTokenService: asClass(CustomerTokenService).scoped() })\n  container.register({ customerRbacService: asClass(CustomerRbacService).scoped() })\n  container.register({ customerInvitationService: asClass(CustomerInvitationService).scoped() })\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAEnC,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS,EAAE,qBAAqB,QAAQ,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACjF,YAAU,SAAS,EAAE,wBAAwB,QAAQ,sBAAsB,EAAE,OAAO,EAAE,CAAC;AACvF,YAAU,SAAS,EAAE,sBAAsB,QAAQ,oBAAoB,EAAE,OAAO,EAAE,CAAC;AACnF,YAAU,SAAS,EAAE,qBAAqB,QAAQ,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACjF,YAAU,SAAS,EAAE,2BAA2B,QAAQ,yBAAyB,EAAE,OAAO,EAAE,CAAC;AAC/F;",
+  "sourcesContent": ["import { asClass, asFunction } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\ntype DomainCacheService = {\n  get: (key: string, options?: unknown) => Promise<unknown>\n  set: (key: string, value: unknown, options?: { ttl?: number; tags?: string[] }) => Promise<void>\n  deleteByTags: (tags: string[]) => Promise<number>\n}\n\nfunction isDomainCacheService(candidate: unknown): candidate is DomainCacheService {\n  if (!candidate || typeof candidate !== 'object') return false\n  const c = candidate as Record<string, unknown>\n  return typeof c.get === 'function' && typeof c.set === 'function' && typeof c.deleteByTags === 'function'\n}\n\nexport function register(container: AppContainer) {\n  container.register({ customerUserService: asClass(CustomerUserService).scoped() })\n  container.register({ customerSessionService: asClass(CustomerSessionService).scoped() })\n  container.register({ customerTokenService: asClass(CustomerTokenService).scoped() })\n  container.register({ customerRbacService: asClass(CustomerRbacService).scoped() })\n  container.register({ customerInvitationService: asClass(CustomerInvitationService).scoped() })\n  container.register({\n    domainMappingService: asFunction(\n      function domainMappingServiceFactory(em: EntityManager) {\n        // Resolve the cache lazily so registrations from `bootstrap(container)` (which runs after\n        // module DI registrars) are visible. Awilix CLASSIC mode would fail to resolve a\n        // destructured `cache` param if the key is not yet registered; using `hasRegistration`\n        // keeps construction safe for CLI/test contexts where `cache` may never be wired.\n        let cacheService: DomainCacheService | undefined\n        try {\n          if (container.hasRegistration('cache')) {\n            const candidate = container.resolve('cache')\n            if (isDomainCacheService(candidate)) cacheService = candidate\n          }\n        } catch {\n          cacheService = undefined\n        }\n        return new DomainMappingService(em, cacheService ? { cacheService } : undefined)\n      },\n    ).scoped(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS,kBAAkB;AAGpC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AAQrC,SAAS,qBAAqB,WAAqD;AACjF,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,QAAQ,cAAc,OAAO,EAAE,QAAQ,cAAc,OAAO,EAAE,iBAAiB;AACjG;AAEO,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS,EAAE,qBAAqB,QAAQ,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACjF,YAAU,SAAS,EAAE,wBAAwB,QAAQ,sBAAsB,EAAE,OAAO,EAAE,CAAC;AACvF,YAAU,SAAS,EAAE,sBAAsB,QAAQ,oBAAoB,EAAE,OAAO,EAAE,CAAC;AACnF,YAAU,SAAS,EAAE,qBAAqB,QAAQ,mBAAmB,EAAE,OAAO,EAAE,CAAC;AACjF,YAAU,SAAS,EAAE,2BAA2B,QAAQ,yBAAyB,EAAE,OAAO,EAAE,CAAC;AAC7F,YAAU,SAAS;AAAA,IACjB,sBAAsB;AAAA,MACpB,SAAS,4BAA4B,IAAmB;AAKtD,YAAI;AACJ,YAAI;AACF,cAAI,UAAU,gBAAgB,OAAO,GAAG;AACtC,kBAAM,YAAY,UAAU,QAAQ,OAAO;AAC3C,gBAAI,qBAAqB,SAAS,EAAG,gBAAe;AAAA,UACtD;AAAA,QACF,QAAQ;AACN,yBAAe;AAAA,QACjB;AACA,eAAO,IAAI,qBAAqB,IAAI,eAAe,EAAE,aAAa,IAAI,MAAS;AAAA,MACjF;AAAA,IACF,EAAE,OAAO;AAAA,EACX,CAAC;AACH;",
   "names": []
 }

package/dist/modules/customer_accounts/events.js

@@ -16,8 +16,15 @@ const events = [
   { id: "customer_accounts.role.updated", label: "Customer Role Updated", entity: "role", category: "crud", portalBroadcast: true },
   { id: "customer_accounts.role.deleted", label: "Customer Role Deleted", entity: "role", category: "crud" },
   { id: "customer_accounts.invitation.accepted", label: "Customer Invitation Accepted", category: "lifecycle", clientBroadcast: true },
-  { id: "customer_accounts.magic_link.requested", label: "Customer Magic Link Requested", category: "lifecycle" },
-  { id: "customer_accounts.password_reset.requested", label: "Customer Password Reset Requested", category: "lifecycle" }
+  { id: "customer_accounts.password_reset.requested", label: "Customer Password Reset Requested", category: "lifecycle" },
+  // Custom domain mapping lifecycle (see .ai/specs/2026-04-08-portal-custom-domain-routing.md)
+  { id: "customer_accounts.domain_mapping.created", label: "Custom Domain Registered", entity: "domain_mapping", category: "crud", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.verified", label: "Custom Domain DNS Verified", entity: "domain_mapping", category: "lifecycle", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.activated", label: "Custom Domain Active", entity: "domain_mapping", category: "lifecycle", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.dns_failed", label: "Custom Domain DNS Verification Failed", entity: "domain_mapping", category: "lifecycle", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.tls_failed", label: "Custom Domain SSL Provisioning Failed", entity: "domain_mapping", category: "lifecycle", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.deleted", label: "Custom Domain Removed", entity: "domain_mapping", category: "crud", clientBroadcast: true },
+  { id: "customer_accounts.domain_mapping.replaced", label: "Custom Domain Replaced", entity: "domain_mapping", category: "lifecycle", clientBroadcast: true }
 ];
 const eventsConfig = createModuleEvents({
   moduleId: "customer_accounts",

package/dist/modules/customer_accounts/events.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/events.ts"],
-  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\n\nconst events = [\n  { id: 'customer_accounts.user.created', label: 'Customer User Created', entity: 'user', category: 'crud', clientBroadcast: true },\n  { id: 'customer_accounts.user.updated', label: 'Customer User Updated', entity: 'user', category: 'crud', portalBroadcast: true },\n  { id: 'customer_accounts.user.deleted', label: 'Customer User Deleted', entity: 'user', category: 'crud' },\n  { id: 'customer_accounts.user.locked', label: 'Customer User Locked', entity: 'user', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.user.unlocked', label: 'Customer User Unlocked', entity: 'user', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.login.success', label: 'Customer Login Successful', category: 'lifecycle' },\n  { id: 'customer_accounts.login.failed', label: 'Customer Login Failed', category: 'lifecycle' },\n  { id: 'customer_accounts.magic_link.requested', label: 'Customer Magic Link Requested', category: 'lifecycle' },\n  { id: 'customer_accounts.email.verified', label: 'Customer Email Verified', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.password.reset_requested', label: 'Customer Password Reset Requested', category: 'lifecycle' },\n  { id: 'customer_accounts.password.reset', label: 'Customer Password Reset', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.password.changed', label: 'Customer Password Changed', category: 'lifecycle' },\n  { id: 'customer_accounts.role.created', label: 'Customer Role Created', entity: 'role', category: 'crud' },\n  { id: 'customer_accounts.role.updated', label: 'Customer Role Updated', entity: 'role', category: 'crud', portalBroadcast: true },\n  { id: 'customer_accounts.role.deleted', label: 'Customer Role Deleted', entity: 'role', category: 'crud' },\n  { id: 'customer_accounts.invitation.accepted', label: 'Customer Invitation Accepted', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.magic_link.requested', label: 'Customer Magic Link Requested', category: 'lifecycle' },\n  { id: 'customer_accounts.password_reset.requested', label: 'Customer Password Reset Requested', category: 'lifecycle' },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'customer_accounts',\n  events,\n})\n\nexport const emitCustomerAccountsEvent = eventsConfig.emit\n\nexport type CustomerAccountsEventId = typeof events[number]['id']\n\nexport default eventsConfig\n"],
-  "mappings": "AAAA,SAAS,0BAA0B;AAEnC,MAAM,SAAS;AAAA,EACb,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,iCAAiC,OAAO,wBAAwB,QAAQ,QAAQ,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACnI,EAAE,IAAI,mCAAmC,OAAO,0BAA0B,QAAQ,QAAQ,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACvI,EAAE,IAAI,mCAAmC,OAAO,6BAA6B,UAAU,YAAY;AAAA,EACnG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,UAAU,YAAY;AAAA,EAC9F,EAAE,IAAI,0CAA0C,OAAO,iCAAiC,UAAU,YAAY;AAAA,EAC9G,EAAE,IAAI,oCAAoC,OAAO,2BAA2B,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACzH,EAAE,IAAI,8CAA8C,OAAO,qCAAqC,UAAU,YAAY;AAAA,EACtH,EAAE,IAAI,oCAAoC,OAAO,2BAA2B,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACzH,EAAE,IAAI,sCAAsC,OAAO,6BAA6B,UAAU,YAAY;AAAA,EACtG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,yCAAyC,OAAO,gCAAgC,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACnI,EAAE,IAAI,0CAA0C,OAAO,iCAAiC,UAAU,YAAY;AAAA,EAC9G,EAAE,IAAI,8CAA8C,OAAO,qCAAqC,UAAU,YAAY;AACxH;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,4BAA4B,aAAa;AAItD,IAAO,iBAAQ;",
+  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\n\nconst events = [\n  { id: 'customer_accounts.user.created', label: 'Customer User Created', entity: 'user', category: 'crud', clientBroadcast: true },\n  { id: 'customer_accounts.user.updated', label: 'Customer User Updated', entity: 'user', category: 'crud', portalBroadcast: true },\n  { id: 'customer_accounts.user.deleted', label: 'Customer User Deleted', entity: 'user', category: 'crud' },\n  { id: 'customer_accounts.user.locked', label: 'Customer User Locked', entity: 'user', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.user.unlocked', label: 'Customer User Unlocked', entity: 'user', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.login.success', label: 'Customer Login Successful', category: 'lifecycle' },\n  { id: 'customer_accounts.login.failed', label: 'Customer Login Failed', category: 'lifecycle' },\n  { id: 'customer_accounts.magic_link.requested', label: 'Customer Magic Link Requested', category: 'lifecycle' },\n  { id: 'customer_accounts.email.verified', label: 'Customer Email Verified', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.password.reset_requested', label: 'Customer Password Reset Requested', category: 'lifecycle' },\n  { id: 'customer_accounts.password.reset', label: 'Customer Password Reset', category: 'lifecycle', portalBroadcast: true },\n  { id: 'customer_accounts.password.changed', label: 'Customer Password Changed', category: 'lifecycle' },\n  { id: 'customer_accounts.role.created', label: 'Customer Role Created', entity: 'role', category: 'crud' },\n  { id: 'customer_accounts.role.updated', label: 'Customer Role Updated', entity: 'role', category: 'crud', portalBroadcast: true },\n  { id: 'customer_accounts.role.deleted', label: 'Customer Role Deleted', entity: 'role', category: 'crud' },\n  { id: 'customer_accounts.invitation.accepted', label: 'Customer Invitation Accepted', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.password_reset.requested', label: 'Customer Password Reset Requested', category: 'lifecycle' },\n  // Custom domain mapping lifecycle (see .ai/specs/2026-04-08-portal-custom-domain-routing.md)\n  { id: 'customer_accounts.domain_mapping.created', label: 'Custom Domain Registered', entity: 'domain_mapping', category: 'crud', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.verified', label: 'Custom Domain DNS Verified', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.activated', label: 'Custom Domain Active', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.dns_failed', label: 'Custom Domain DNS Verification Failed', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.tls_failed', label: 'Custom Domain SSL Provisioning Failed', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.deleted', label: 'Custom Domain Removed', entity: 'domain_mapping', category: 'crud', clientBroadcast: true },\n  { id: 'customer_accounts.domain_mapping.replaced', label: 'Custom Domain Replaced', entity: 'domain_mapping', category: 'lifecycle', clientBroadcast: true },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'customer_accounts',\n  events,\n})\n\nexport const emitCustomerAccountsEvent = eventsConfig.emit\n\nexport type CustomerAccountsEventId = typeof events[number]['id']\n\nexport default eventsConfig\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AAEnC,MAAM,SAAS;AAAA,EACb,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,iCAAiC,OAAO,wBAAwB,QAAQ,QAAQ,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACnI,EAAE,IAAI,mCAAmC,OAAO,0BAA0B,QAAQ,QAAQ,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACvI,EAAE,IAAI,mCAAmC,OAAO,6BAA6B,UAAU,YAAY;AAAA,EACnG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,UAAU,YAAY;AAAA,EAC9F,EAAE,IAAI,0CAA0C,OAAO,iCAAiC,UAAU,YAAY;AAAA,EAC9G,EAAE,IAAI,oCAAoC,OAAO,2BAA2B,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACzH,EAAE,IAAI,8CAA8C,OAAO,qCAAqC,UAAU,YAAY;AAAA,EACtH,EAAE,IAAI,oCAAoC,OAAO,2BAA2B,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACzH,EAAE,IAAI,sCAAsC,OAAO,6BAA6B,UAAU,YAAY;AAAA,EACtG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EAChI,EAAE,IAAI,kCAAkC,OAAO,yBAAyB,QAAQ,QAAQ,UAAU,OAAO;AAAA,EACzG,EAAE,IAAI,yCAAyC,OAAO,gCAAgC,UAAU,aAAa,iBAAiB,KAAK;AAAA,EACnI,EAAE,IAAI,8CAA8C,OAAO,qCAAqC,UAAU,YAAY;AAAA;AAAA,EAEtH,EAAE,IAAI,4CAA4C,OAAO,4BAA4B,QAAQ,kBAAkB,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EACvJ,EAAE,IAAI,6CAA6C,OAAO,8BAA8B,QAAQ,kBAAkB,UAAU,aAAa,iBAAiB,KAAK;AAAA,EAC/J,EAAE,IAAI,8CAA8C,OAAO,wBAAwB,QAAQ,kBAAkB,UAAU,aAAa,iBAAiB,KAAK;AAAA,EAC1J,EAAE,IAAI,+CAA+C,OAAO,yCAAyC,QAAQ,kBAAkB,UAAU,aAAa,iBAAiB,KAAK;AAAA,EAC5K,EAAE,IAAI,+CAA+C,OAAO,yCAAyC,QAAQ,kBAAkB,UAAU,aAAa,iBAAiB,KAAK;AAAA,EAC5K,EAAE,IAAI,4CAA4C,OAAO,yBAAyB,QAAQ,kBAAkB,UAAU,QAAQ,iBAAiB,KAAK;AAAA,EACpJ,EAAE,IAAI,6CAA6C,OAAO,0BAA0B,QAAQ,kBAAkB,UAAU,aAAa,iBAAiB,KAAK;AAC7J;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,4BAA4B,aAAa;AAItD,IAAO,iBAAQ;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerAuthServer.js

@@ -1,13 +1,12 @@
 import { cookies } from "next/headers";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { verifyAudienceJwt } from "@open-mercato/shared/lib/auth/jwt";
 import { CUSTOMER_JWT_AUDIENCE } from "@open-mercato/core/modules/customer_accounts/services/customerSessionService";
+import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
+import { platformDomains } from "@open-mercato/core/modules/customer_accounts/lib/platformDomains";
 import { validateUserState } from "./customerAuth.js";
 async function assertSessionStillActive(sessionId) {
   try {
-    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
-      import("@open-mercato/shared/lib/di/container"),
-      import("@open-mercato/core/modules/customer_accounts/services/customerSessionService")
-    ]);
     const container = await createRequestContainer();
     const service = container.resolve("customerSessionService");
     const session = await service.findActiveSessionById(sessionId);
@@ -16,7 +15,7 @@ async function assertSessionStillActive(sessionId) {
     return false;
   }
 }
-async function getCustomerAuthFromCookies() {
+async function getCustomerAuthFromCookies(options) {
   const cookieStore = await cookies();
   const token = cookieStore.get("customer_auth_token")?.value;
   if (!token) return null;
@@ -26,11 +25,15 @@ async function getCustomerAuthFromCookies() {
     if (payload.type !== "customer") return null;
     const sid = typeof payload.sid === "string" ? payload.sid : "";
     if (!sid) return null;
+    const tenantId = String(payload.tenantId);
+    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {
+      return null;
+    }
     const stillActive = await assertSessionStillActive(sid);
     if (!stillActive) return null;
     const userState = await validateUserState(
       String(payload.sub),
-      String(payload.tenantId),
+      tenantId,
       String(payload.orgId),
       payload.iat
     );
@@ -39,7 +42,7 @@ async function getCustomerAuthFromCookies() {
       sub: String(payload.sub),
       sid,
       type: "customer",
-      tenantId: String(payload.tenantId),
+      tenantId,
       orgId: String(payload.orgId),
       email: String(payload.email || ""),
       displayName: String(payload.displayName || ""),
@@ -51,7 +54,24 @@ async function getCustomerAuthFromCookies() {
     return null;
   }
 }
+async function getCustomerAuthForHost(host) {
+  if (!host) return getCustomerAuthFromCookies();
+  try {
+    const hostname = tryNormalizeHostname(host);
+    if (!hostname) return getCustomerAuthFromCookies();
+    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies();
+    const container = await createRequestContainer();
+    const service = container.resolve("domainMappingService");
+    const resolved = await service.resolveByHostname(hostname);
+    if (!resolved || resolved.status !== "active") return null;
+    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId });
+  } catch (err) {
+    console.warn("[customer_accounts] getCustomerAuthForHost: domain resolve failed; falling back to platform cookie", err);
+    return getCustomerAuthFromCookies();
+  }
+}
 export {
+  getCustomerAuthForHost,
   getCustomerAuthFromCookies
 };
 //# sourceMappingURL=customerAuthServer.js.map

package/dist/modules/customer_accounts/lib/customerAuthServer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerAuthServer.ts"],
-  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),\n    ])\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const stillActive = await assertSessionStillActive(sid)\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      String(payload.tenantId),\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId: String(payload.tenantId),\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n"],
-  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,yBAAyB;AAClC,SAAS,6BAA6B;AACtC,SAAS,yBAAyB;AAKlC,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,uBAAuB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjF,OAAO,uCAAuC;AAAA,MAC9C,OAAO,8EAA8E;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,6BAAkE;AACtF,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,cAAc,MAAM,yBAAyB,GAAG;AACtD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,QAAQ,QAAQ;AAAA,MACvB,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,UAAU,OAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,IAC9B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(\n  options?: { expectedTenantId?: string },\n): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const tenantId = String(payload.tenantId)\n    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {\n      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication\n      // section: the host-resolved tenant is the authoritative scope; mismatched\n      // JWTs are rejected as if unauthenticated.\n      return null\n    }\n    const stillActive = await assertSessionStillActive(sid)\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      tenantId,\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\n/**\n * Convenience wrapper for custom-domain pages: resolves the host, calls\n * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.\n *\n * Use from server components rendered under custom domains.\n */\nexport async function getCustomerAuthForHost(\n  host: string | null | undefined,\n): Promise<CustomerAuthContext | null> {\n  if (!host) return getCustomerAuthFromCookies()\n\n  try {\n    const hostname = tryNormalizeHostname(host)\n    if (!hostname) return getCustomerAuthFromCookies()\n    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()\n\n    const container = await createRequestContainer()\n    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>\n    const resolved = await service.resolveByHostname(hostname)\n    if (!resolved || resolved.status !== 'active') return null\n    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })\n  } catch (err) {\n    console.warn('[customer_accounts] getCustomerAuthForHost: domain resolve failed; falling back to platform cookie', err)\n    return getCustomerAuthFromCookies()\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,6BAAqD;AAE9D,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAKlC,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,2BACpB,SACqC;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,QAAI,SAAS,oBAAoB,QAAQ,qBAAqB,UAAU;AAItE,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM,yBAAyB,GAAG;AACtD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB;AAAA,MACA,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,IAC9B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,uBACpB,MACqC;AACrC,MAAI,CAAC,KAAM,QAAO,2BAA2B;AAE7C,MAAI;AACF,UAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAI,CAAC,SAAU,QAAO,2BAA2B;AACjD,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO,2BAA2B;AAE5E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,UAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,QAAI,CAAC,YAAY,SAAS,WAAW,SAAU,QAAO;AACtD,WAAO,2BAA2B,EAAE,kBAAkB,SAAS,SAAS,CAAC;AAAA,EAC3E,SAAS,KAAK;AACZ,YAAQ,KAAK,sGAAsG,GAAG;AACtH,WAAO,2BAA2B;AAAA,EACpC;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerUrl.js

@@ -0,0 +1,48 @@
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+function platformBaseUrl() {
+  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim();
+  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, "");
+  if (process.env.NODE_ENV === "production") {
+    throw new Error(
+      "PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails."
+    );
+  }
+  return "http://localhost:3000";
+}
+function resolveContainer(container) {
+  if (container) return Promise.resolve(container);
+  return createRequestContainer();
+}
+async function urlForCustomerOrg(orgId, path, options) {
+  const safePath = path.startsWith("/") ? path : `/${path}`;
+  const container = await resolveContainer(options?.container);
+  let active = null;
+  try {
+    const service = container.resolve("domainMappingService");
+    if (service && typeof service.resolveActiveByOrg === "function") {
+      active = await service.resolveActiveByOrg(orgId);
+    }
+  } catch {
+    active = null;
+  }
+  if (active && active.hostname) {
+    return `https://${active.hostname}${safePath}`;
+  }
+  let orgSlug = null;
+  try {
+    const orgService = container.resolve("orgService");
+    if (orgService && typeof orgService.findById === "function") {
+      const org = await orgService.findById(orgId);
+      orgSlug = org?.slug ?? null;
+    }
+  } catch {
+    orgSlug = null;
+  }
+  const base = platformBaseUrl();
+  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`;
+  return `${base}${safePath}`;
+}
+export {
+  urlForCustomerOrg
+};
+//# sourceMappingURL=customerUrl.js.map

package/dist/modules/customer_accounts/lib/customerUrl.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/customerUrl.ts"],
+  "sourcesContent": ["// Build customer-portal URLs that honor the active custom domain when present.\n// All customer-facing email senders (signup welcome, magic link, password reset,\n// notification digests) MUST construct links via this helper instead of\n// hard-coding PLATFORM_PORTAL_BASE_URL \u2014 see customer_accounts/AGENTS.md.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\n\ntype DomainMappingService = {\n  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>\n}\n\ntype OrgService = {\n  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>\n}\n\nfunction platformBaseUrl(): string {\n  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()\n  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\\/+$/, '')\n  // Outbound emails (welcome, magic link, password reset) embed this URL \u2014\n  // localhost in production silently sends broken links to real customers.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',\n    )\n  }\n  return 'http://localhost:3000'\n}\n\nfunction resolveContainer(container?: AppContainer): Promise<AppContainer> {\n  if (container) return Promise.resolve(container)\n  return createRequestContainer()\n}\n\nexport async function urlForCustomerOrg(\n  orgId: string,\n  path: string,\n  options?: { container?: AppContainer },\n): Promise<string> {\n  const safePath = path.startsWith('/') ? path : `/${path}`\n  const container = await resolveContainer(options?.container)\n\n  let active: { hostname: string } | null = null\n  try {\n    const service = container.resolve('domainMappingService') as DomainMappingService\n    if (service && typeof service.resolveActiveByOrg === 'function') {\n      active = await service.resolveActiveByOrg(orgId)\n    }\n  } catch {\n    // domainMappingService not registered yet (fresh installs, tests) \u2014 fall through to platform URL.\n    active = null\n  }\n\n  if (active && active.hostname) {\n    return `https://${active.hostname}${safePath}`\n  }\n\n  let orgSlug: string | null = null\n  try {\n    const orgService = container.resolve('orgService') as OrgService | undefined\n    if (orgService && typeof orgService.findById === 'function') {\n      const org = await orgService.findById(orgId)\n      orgSlug = org?.slug ?? null\n    }\n  } catch {\n    orgSlug = null\n  }\n\n  const base = platformBaseUrl()\n  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`\n  return `${base}${safePath}`\n}\n"],
+  "mappings": "AAMA,SAAS,8BAA8B;AAUvC,SAAS,kBAA0B;AACjC,QAAM,UAAU,QAAQ,IAAI,0BAA0B,KAAK;AAC3D,MAAI,WAAW,QAAQ,SAAS,EAAG,QAAO,QAAQ,QAAQ,QAAQ,EAAE;AAGpE,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,UAAW,QAAO,QAAQ,QAAQ,SAAS;AAC/C,SAAO,uBAAuB;AAChC;AAEA,eAAsB,kBACpB,OACA,MACA,SACiB;AACjB,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACvD,QAAM,YAAY,MAAM,iBAAiB,SAAS,SAAS;AAE3D,MAAI,SAAsC;AAC1C,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAI,WAAW,OAAO,QAAQ,uBAAuB,YAAY;AAC/D,eAAS,MAAM,QAAQ,mBAAmB,KAAK;AAAA,IACjD;AAAA,EACF,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,MAAI,UAAU,OAAO,UAAU;AAC7B,WAAO,WAAW,OAAO,QAAQ,GAAG,QAAQ;AAAA,EAC9C;AAEA,MAAI,UAAyB;AAC7B,MAAI;AACF,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAI,cAAc,OAAO,WAAW,aAAa,YAAY;AAC3D,YAAM,MAAM,MAAM,WAAW,SAAS,KAAK;AAC3C,gBAAU,KAAK,QAAQ;AAAA,IACzB;AAAA,EACF,QAAQ;AACN,cAAU;AAAA,EACZ;AAEA,QAAM,OAAO,gBAAgB;AAC7B,MAAI,QAAS,QAAO,GAAG,IAAI,IAAI,OAAO,UAAU,QAAQ;AACxD,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/hostname.js

@@ -0,0 +1,55 @@
+const MAX_HOSTNAME_LENGTH = 253;
+const HOSTNAME_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+class HostnameNormalizationError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HostnameNormalizationError";
+  }
+}
+function normalizeHostname(input) {
+  if (typeof input !== "string") {
+    throw new HostnameNormalizationError("Hostname must be a string");
+  }
+  let host = input.trim().toLowerCase();
+  if (!host) throw new HostnameNormalizationError("Hostname is empty");
+  host = host.replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\?.*$/, "").replace(/#.*$/, "").replace(/:\d+$/, "");
+  if (host.endsWith(".")) host = host.slice(0, -1);
+  if (!host) throw new HostnameNormalizationError("Hostname is empty after stripping");
+  try {
+    const url = new URL(`https://${host}`);
+    host = url.hostname;
+  } catch {
+    throw new HostnameNormalizationError(`Hostname is not a valid host: ${input}`);
+  }
+  if (!host || host.length > MAX_HOSTNAME_LENGTH) {
+    throw new HostnameNormalizationError(
+      `Hostname must be between 1 and ${MAX_HOSTNAME_LENGTH} characters after normalization`
+    );
+  }
+  const labels = host.split(".");
+  if (labels.length < 2) {
+    throw new HostnameNormalizationError('Hostname must have at least two labels (e.g. "example.com")');
+  }
+  for (const label of labels) {
+    if (!HOSTNAME_LABEL.test(label)) {
+      throw new HostnameNormalizationError(`Invalid DNS label: "${label}"`);
+    }
+  }
+  if (/^\d+$/.test(labels[labels.length - 1])) {
+    throw new HostnameNormalizationError(`Hostname looks like an IP address, not a DNS name: ${input}`);
+  }
+  return host;
+}
+function tryNormalizeHostname(input) {
+  try {
+    return normalizeHostname(input);
+  } catch {
+    return null;
+  }
+}
+export {
+  HostnameNormalizationError,
+  normalizeHostname,
+  tryNormalizeHostname
+};
+//# sourceMappingURL=hostname.js.map

package/dist/modules/customer_accounts/lib/hostname.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/hostname.ts"],
+  "sourcesContent": ["// Hostname normalization for the custom-domain routing feature.\n// Single canonical form (lowercase, no trailing dot, IDN\u2192Punycode) is essential \u2014\n// the UNIQUE constraint on `domain_mappings.hostname` is meaningless without it.\n\nconst MAX_HOSTNAME_LENGTH = 253\nconst HOSTNAME_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/\n\nexport class HostnameNormalizationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'HostnameNormalizationError'\n  }\n}\n\nexport function normalizeHostname(input: string): string {\n  if (typeof input !== 'string') {\n    throw new HostnameNormalizationError('Hostname must be a string')\n  }\n\n  let host = input.trim().toLowerCase()\n  if (!host) throw new HostnameNormalizationError('Hostname is empty')\n\n  host = host\n    .replace(/^https?:\\/\\//, '')\n    .replace(/\\/.*$/, '')\n    .replace(/\\?.*$/, '')\n    .replace(/#.*$/, '')\n    .replace(/:\\d+$/, '')\n\n  if (host.endsWith('.')) host = host.slice(0, -1)\n\n  if (!host) throw new HostnameNormalizationError('Hostname is empty after stripping')\n\n  // Convert IDN (Unicode) to Punycode (ASCII) via the URL constructor \u2014 this\n  // matches what browsers and Let's Encrypt use, without depending on the\n  // deprecated `node:punycode` module or pulling in `tr46`.\n  try {\n    const url = new URL(`https://${host}`)\n    host = url.hostname\n  } catch {\n    throw new HostnameNormalizationError(`Hostname is not a valid host: ${input}`)\n  }\n\n  if (!host || host.length > MAX_HOSTNAME_LENGTH) {\n    throw new HostnameNormalizationError(\n      `Hostname must be between 1 and ${MAX_HOSTNAME_LENGTH} characters after normalization`,\n    )\n  }\n\n  const labels = host.split('.')\n  if (labels.length < 2) {\n    throw new HostnameNormalizationError('Hostname must have at least two labels (e.g. \"example.com\")')\n  }\n  for (const label of labels) {\n    if (!HOSTNAME_LABEL.test(label)) {\n      throw new HostnameNormalizationError(`Invalid DNS label: \"${label}\"`)\n    }\n  }\n  // Reject IP-address literals (e.g. \"127.0.0.1\"): a custom domain must be a\n  // registered DNS name, and a TLD is never all-numeric. This also keeps\n  // loopback/test hosts (127.0.0.1) from being mistaken for a tenant's\n  // branded domain by the routing layer.\n  if (/^\\d+$/.test(labels[labels.length - 1])) {\n    throw new HostnameNormalizationError(`Hostname looks like an IP address, not a DNS name: ${input}`)\n  }\n\n  return host\n}\n\nexport function tryNormalizeHostname(input: string): string | null {\n  try {\n    return normalizeHostname(input)\n  } catch {\n    return null\n  }\n}\n"],
+  "mappings": "AAIA,MAAM,sBAAsB;AAC5B,MAAM,iBAAiB;AAEhB,MAAM,mCAAmC,MAAM;AAAA,EACpD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,kBAAkB,OAAuB;AACvD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,2BAA2B,2BAA2B;AAAA,EAClE;AAEA,MAAI,OAAO,MAAM,KAAK,EAAE,YAAY;AACpC,MAAI,CAAC,KAAM,OAAM,IAAI,2BAA2B,mBAAmB;AAEnE,SAAO,KACJ,QAAQ,gBAAgB,EAAE,EAC1B,QAAQ,SAAS,EAAE,EACnB,QAAQ,SAAS,EAAE,EACnB,QAAQ,QAAQ,EAAE,EAClB,QAAQ,SAAS,EAAE;AAEtB,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAE/C,MAAI,CAAC,KAAM,OAAM,IAAI,2BAA2B,mCAAmC;AAKnF,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,WAAW,IAAI,EAAE;AACrC,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI,2BAA2B,iCAAiC,KAAK,EAAE;AAAA,EAC/E;AAEA,MAAI,CAAC,QAAQ,KAAK,SAAS,qBAAqB;AAC9C,UAAM,IAAI;AAAA,MACR,kCAAkC,mBAAmB;AAAA,IACvD;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,MAAI,OAAO,SAAS,GAAG;AACrB,UAAM,IAAI,2BAA2B,6DAA6D;AAAA,EACpG;AACA,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,eAAe,KAAK,KAAK,GAAG;AAC/B,YAAM,IAAI,2BAA2B,uBAAuB,KAAK,GAAG;AAAA,IACtE;AAAA,EACF;AAKA,MAAI,QAAQ,KAAK,OAAO,OAAO,SAAS,CAAC,CAAC,GAAG;AAC3C,UAAM,IAAI,2BAA2B,sDAAsD,KAAK,EAAE;AAAA,EACpG;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB,OAA8B;AACjE,MAAI;AACF,WAAO,kBAAkB,KAAK;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/platformDomains.js

@@ -0,0 +1,7 @@
+function platformDomains() {
+  return (process.env.PLATFORM_DOMAINS ?? "localhost,openmercato.com").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+export {
+  platformDomains
+};
+//# sourceMappingURL=platformDomains.js.map

package/dist/modules/customer_accounts/lib/platformDomains.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/platformDomains.ts"],
+  "sourcesContent": ["/**\n * Parse the `PLATFORM_DOMAINS` env into a normalized list of platform hostnames.\n *\n * Platform hosts are the deployment's own domains (admin app, marketing site,\n * loopback). Custom-domain routing MUST treat platform hosts as non-tenant\n * traffic, so domain registration, resolver lookups, and tenant-context\n * fallbacks all share the same view of which hosts are platform-owned.\n */\nexport function platformDomains(): string[] {\n  return (process.env.PLATFORM_DOMAINS ?? 'localhost,openmercato.com')\n    .split(',')\n    .map((s) => s.trim().toLowerCase())\n    .filter(Boolean)\n}\n"],
+  "mappings": "AAQO,SAAS,kBAA4B;AAC1C,UAAQ,QAAQ,IAAI,oBAAoB,6BACrC,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/proxyRanges.js

@@ -0,0 +1,71 @@
+const DEFAULT_CLOUDFLARE_RANGES = [
+  "173.245.48.0/20",
+  "103.21.244.0/22",
+  "103.22.200.0/22",
+  "103.31.4.0/22",
+  "141.101.64.0/18",
+  "108.162.192.0/18",
+  "190.93.240.0/20",
+  "188.114.96.0/20",
+  "197.234.240.0/22",
+  "198.41.128.0/17",
+  "162.158.0.0/15",
+  "104.16.0.0/13",
+  "104.24.0.0/14",
+  "172.64.0.0/13",
+  "131.0.72.0/22"
+];
+let cachedRanges = null;
+function parseIpv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  let result = 0;
+  for (const part of parts) {
+    if (!/^\d+$/.test(part)) return null;
+    const value = Number(part);
+    if (value < 0 || value > 255) return null;
+    result = result << 8 | value;
+  }
+  return result >>> 0;
+}
+function parseCidr(cidr) {
+  const [ip, prefixStr] = cidr.split("/");
+  if (!ip || !prefixStr) return null;
+  const prefix = Number(prefixStr);
+  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) return null;
+  const ipNum = parseIpv4(ip);
+  if (ipNum === null) return null;
+  const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
+  const network = (ipNum & mask) >>> 0;
+  return { network, mask, raw: cidr };
+}
+function loadRanges() {
+  if (cachedRanges) return cachedRanges;
+  const fromEnv = (process.env.KNOWN_PROXY_IP_RANGES ?? "").trim();
+  const list = fromEnv ? fromEnv.split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_CLOUDFLARE_RANGES;
+  cachedRanges = list.map(parseCidr).filter((v) => v !== null);
+  return cachedRanges;
+}
+function isInKnownProxyRange(ip) {
+  const ipNum = parseIpv4(ip);
+  if (ipNum === null) return false;
+  for (const range of loadRanges()) {
+    if ((ipNum & range.mask) >>> 0 === range.network) return true;
+  }
+  return false;
+}
+function detectProxy(ip) {
+  if (!isInKnownProxyRange(ip)) return null;
+  const fromEnv = process.env.KNOWN_PROXY_IP_RANGES;
+  if (!fromEnv) return "cloudflare";
+  return "unknown";
+}
+function resetProxyRangeCacheForTests() {
+  cachedRanges = null;
+}
+export {
+  detectProxy,
+  isInKnownProxyRange,
+  resetProxyRangeCacheForTests
+};
+//# sourceMappingURL=proxyRanges.js.map

package/dist/modules/customer_accounts/lib/proxyRanges.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/proxyRanges.ts"],
+  "sourcesContent": ["// CIDR matching for known reverse-proxy IP ranges (Cloudflare, Fastly, custom).\n// Used by the DNS verification fallback: if a domain's A record lands inside a\n// known proxy range we fall back to a reverse-resolve over HTTPS, because the\n// proxy hides the real origin from us.\n\nconst DEFAULT_CLOUDFLARE_RANGES = [\n  '173.245.48.0/20',\n  '103.21.244.0/22',\n  '103.22.200.0/22',\n  '103.31.4.0/22',\n  '141.101.64.0/18',\n  '108.162.192.0/18',\n  '190.93.240.0/20',\n  '188.114.96.0/20',\n  '197.234.240.0/22',\n  '198.41.128.0/17',\n  '162.158.0.0/15',\n  '104.16.0.0/13',\n  '104.24.0.0/14',\n  '172.64.0.0/13',\n  '131.0.72.0/22',\n]\n\ntype ParsedCidr = { network: number; mask: number; raw: string }\n\nlet cachedRanges: ParsedCidr[] | null = null\n\nfunction parseIpv4(ip: string): number | null {\n  const parts = ip.split('.')\n  if (parts.length !== 4) return null\n  let result = 0\n  for (const part of parts) {\n    if (!/^\\d+$/.test(part)) return null\n    const value = Number(part)\n    if (value < 0 || value > 255) return null\n    result = (result << 8) | value\n  }\n  // Force unsigned 32-bit\n  return result >>> 0\n}\n\nfunction parseCidr(cidr: string): ParsedCidr | null {\n  const [ip, prefixStr] = cidr.split('/')\n  if (!ip || !prefixStr) return null\n  const prefix = Number(prefixStr)\n  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) return null\n  const ipNum = parseIpv4(ip)\n  if (ipNum === null) return null\n  const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0\n  const network = (ipNum & mask) >>> 0\n  return { network, mask, raw: cidr }\n}\n\nfunction loadRanges(): ParsedCidr[] {\n  if (cachedRanges) return cachedRanges\n  const fromEnv = (process.env.KNOWN_PROXY_IP_RANGES ?? '').trim()\n  const list = fromEnv\n    ? fromEnv.split(',').map((s) => s.trim()).filter(Boolean)\n    : DEFAULT_CLOUDFLARE_RANGES\n  cachedRanges = list.map(parseCidr).filter((v): v is ParsedCidr => v !== null)\n  return cachedRanges\n}\n\nexport function isInKnownProxyRange(ip: string): boolean {\n  const ipNum = parseIpv4(ip)\n  if (ipNum === null) return false\n  for (const range of loadRanges()) {\n    if (((ipNum & range.mask) >>> 0) === range.network) return true\n  }\n  return false\n}\n\nexport function detectProxy(ip: string): string | null {\n  if (!isInKnownProxyRange(ip)) return null\n  // For now we only ship Cloudflare's published ranges by default. Operators\n  // using a different proxy can override KNOWN_PROXY_IP_RANGES; we still\n  // return 'unknown' for those so callers can phrase the diagnostic correctly.\n  const fromEnv = process.env.KNOWN_PROXY_IP_RANGES\n  if (!fromEnv) return 'cloudflare'\n  return 'unknown'\n}\n\nexport function resetProxyRangeCacheForTests(): void {\n  cachedRanges = null\n}\n"],
+  "mappings": "AAKA,MAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,IAAI,eAAoC;AAExC,SAAS,UAAU,IAA2B;AAC5C,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,QAAQ,KAAK,IAAI,EAAG,QAAO;AAChC,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,QAAQ,KAAK,QAAQ,IAAK,QAAO;AACrC,aAAU,UAAU,IAAK;AAAA,EAC3B;AAEA,SAAO,WAAW;AACpB;AAEA,SAAS,UAAU,MAAiC;AAClD,QAAM,CAAC,IAAI,SAAS,IAAI,KAAK,MAAM,GAAG;AACtC,MAAI,CAAC,MAAM,CAAC,UAAW,QAAO;AAC9B,QAAM,SAAS,OAAO,SAAS;AAC/B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,GAAI,QAAO;AAClE,QAAM,QAAQ,UAAU,EAAE;AAC1B,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,OAAO,WAAW,IAAI,IAAK,cAAe,KAAK,WAAa;AAClE,QAAM,WAAW,QAAQ,UAAU;AACnC,SAAO,EAAE,SAAS,MAAM,KAAK,KAAK;AACpC;AAEA,SAAS,aAA2B;AAClC,MAAI,aAAc,QAAO;AACzB,QAAM,WAAW,QAAQ,IAAI,yBAAyB,IAAI,KAAK;AAC/D,QAAM,OAAO,UACT,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IACtD;AACJ,iBAAe,KAAK,IAAI,SAAS,EAAE,OAAO,CAAC,MAAuB,MAAM,IAAI;AAC5E,SAAO;AACT;AAEO,SAAS,oBAAoB,IAAqB;AACvD,QAAM,QAAQ,UAAU,EAAE;AAC1B,MAAI,UAAU,KAAM,QAAO;AAC3B,aAAW,SAAS,WAAW,GAAG;AAChC,SAAM,QAAQ,MAAM,UAAU,MAAO,MAAM,QAAS,QAAO;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,YAAY,IAA2B;AACrD,MAAI,CAAC,oBAAoB,EAAE,EAAG,QAAO;AAIrC,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AACT;AAEO,SAAS,+BAAqC;AACnD,iBAAe;AACjB;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/rateLimiter.js

@@ -48,6 +48,12 @@ const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig("CUSTOMER
   blockDuration: 120,
   keyPrefix: "customer-magic-link-ip"
 });
+const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig("DOMAIN_RESOLVE_ALL_IP", {
+  points: 30,
+  duration: 60,
+  blockDuration: 60,
+  keyPrefix: "domain-resolve-all"
+});
 export {
   checkAuthRateLimit,
   customerLoginIpRateLimitConfig,
@@ -58,6 +64,7 @@ export {
   customerPasswordResetRateLimitConfig,
   customerSignupIpRateLimitConfig,
   customerSignupRateLimitConfig,
+  domainResolveAllIpRateLimitConfig,
   resetAuthRateLimit
 };
 //# sourceMappingURL=rateLimiter.js.map

package/dist/modules/customer_accounts/lib/rateLimiter.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/rateLimiter.ts"],
-  "sourcesContent": ["import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\n\nexport const customerLoginRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'customer-login',\n})\n\nexport const customerLoginIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'customer-login-ip',\n})\n\nexport const customerSignupRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup',\n})\n\nexport const customerSignupIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup-ip',\n})\n\nexport const customerPasswordResetRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset',\n})\n\nexport const customerPasswordResetIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset-ip',\n})\n\nexport const customerMagicLinkRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link',\n})\n\nexport const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',\n})\n\nexport { checkAuthRateLimit, resetAuthRateLimit }\n"],
-  "mappings": "AAAA,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,mCAAmC;AAErC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACxF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AAEM,MAAM,iCAAiC,4BAA4B,qBAAqB;AAAA,EAC7F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,gCAAgC,4BAA4B,mBAAmB;AAAA,EAC1F,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,kCAAkC,4BAA4B,sBAAsB;AAAA,EAC/F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,uCAAuC,4BAA4B,2BAA2B;AAAA,EACzG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,yCAAyC,4BAA4B,8BAA8B;AAAA,EAC9G,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,mCAAmC,4BAA4B,uBAAuB;AAAA,EACjG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,qCAAqC,4BAA4B,0BAA0B;AAAA,EACtG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;",
+  "sourcesContent": ["import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\n\nexport const customerLoginRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'customer-login',\n})\n\nexport const customerLoginIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'customer-login-ip',\n})\n\nexport const customerSignupRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup',\n})\n\nexport const customerSignupIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_SIGNUP_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-signup-ip',\n})\n\nexport const customerPasswordResetRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset',\n})\n\nexport const customerPasswordResetIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_PASSWORD_RESET_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-password-reset-ip',\n})\n\nexport const customerMagicLinkRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK', {\n  points: 3, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link',\n})\n\nexport const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_MAGIC_LINK_IP', {\n  points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',\n})\n\n// Bulk custom-domain warm-up endpoint (`/api/customer_accounts/domain-resolve/all`).\n// Single shared `DOMAIN_RESOLVE_SECRET` gates a payload that lists every active\n// custom-domain mapping in the deployment, so we cap requests per IP to make\n// brute-force or post-leak enumeration noisy. 30 req/min/IP comfortably covers\n// the Node middleware warm-up cadence (one call per process boot) while\n// staying well below useful enumeration throughput.\nexport const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig('DOMAIN_RESOLVE_ALL_IP', {\n  points: 30, duration: 60, blockDuration: 60, keyPrefix: 'domain-resolve-all',\n})\n\nexport { checkAuthRateLimit, resetAuthRateLimit }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,mCAAmC;AAErC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACxF,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AAEM,MAAM,iCAAiC,4BAA4B,qBAAqB;AAAA,EAC7F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,gCAAgC,4BAA4B,mBAAmB;AAAA,EAC1F,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,kCAAkC,4BAA4B,sBAAsB;AAAA,EAC/F,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,uCAAuC,4BAA4B,2BAA2B;AAAA,EACzG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,yCAAyC,4BAA4B,8BAA8B;AAAA,EAC9G,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAEM,MAAM,mCAAmC,4BAA4B,uBAAuB;AAAA,EACjG,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC1D,CAAC;AAEM,MAAM,qCAAqC,4BAA4B,0BAA0B;AAAA,EACtG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAK,WAAW;AAC3D,CAAC;AAQM,MAAM,oCAAoC,4BAA4B,yBAAyB;AAAA,EACpG,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/resolveTenantContext.js

@@ -0,0 +1,63 @@
+import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
+import { platformDomains } from "@open-mercato/core/modules/customer_accounts/lib/platformDomains";
+import { secretEqual } from "@open-mercato/core/modules/customer_accounts/lib/secretCompare";
+class TenantResolutionError extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "TenantResolutionError";
+  }
+}
+function readForcedHost(req) {
+  if (process.env.NODE_ENV !== "test") return null;
+  const expected = process.env.FORCE_HOST_SECRET;
+  if (!expected) return null;
+  if (!secretEqual(req.headers.get("x-force-host-secret"), expected)) return null;
+  const host = req.headers.get("x-force-host");
+  return host && host.length > 0 ? host : null;
+}
+async function resolveTenantContext(req, bodyTenantId, options) {
+  const rawHost = readForcedHost(req) ?? req.headers.get("host");
+  const hostname = rawHost ? tryNormalizeHostname(rawHost) : null;
+  const isPlatform = hostname ? platformDomains().includes(hostname) : true;
+  if (isPlatform) {
+    if (!bodyTenantId) {
+      throw new TenantResolutionError("tenantId is required for platform-domain logins", 400);
+    }
+    return { source: "body", tenantId: bodyTenantId, organizationId: null, hostname };
+  }
+  let service = null;
+  try {
+    if (options?.container) {
+      service = options.container.resolve("domainMappingService");
+    } else {
+      const { createRequestContainer } = await import("@open-mercato/shared/lib/di/container");
+      const container = await createRequestContainer();
+      service = container.resolve("domainMappingService");
+    }
+  } catch {
+    throw new TenantResolutionError("Custom domain routing is not available on this deployment", 503);
+  }
+  if (!hostname) throw new TenantResolutionError("Unable to determine request hostname", 400);
+  const resolved = await service.resolveByHostname(hostname);
+  if (!resolved || resolved.status !== "active") {
+    throw new TenantResolutionError("This domain is not configured for any active organization", 404);
+  }
+  if (bodyTenantId && bodyTenantId !== resolved.tenantId) {
+    throw new TenantResolutionError(
+      "tenantId in request body does not match the resolved custom domain",
+      400
+    );
+  }
+  return {
+    source: "host",
+    tenantId: resolved.tenantId,
+    organizationId: resolved.organizationId,
+    hostname
+  };
+}
+export {
+  TenantResolutionError,
+  resolveTenantContext
+};
+//# sourceMappingURL=resolveTenantContext.js.map

package/dist/modules/customer_accounts/lib/resolveTenantContext.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/resolveTenantContext.ts"],
+  "sourcesContent": ["/**\n * Resolve the tenant context for a customer-portal request.\n *\n * - Platform-domain hosts: require `tenantId` in the request body.\n * - Custom-domain hosts: resolve via `domainMappingService.resolveByHostname()`.\n *   If the body supplied a different `tenantId`, fail closed (mismatch).\n *\n * This is the single entry point used by all customer-auth routes (login,\n * signup, magic-link, password-reset) so they all behave consistently when\n * the request arrives on a tenant's branded URL.\n *\n * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5.\n */\n\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nexport class TenantResolutionError extends Error {\n  constructor(message: string, public readonly status: number) {\n    super(message)\n    this.name = 'TenantResolutionError'\n  }\n}\n\nexport type ResolvedTenantContext = {\n  source: 'body' | 'host'\n  tenantId: string\n  organizationId: string | null\n  hostname: string | null\n}\n\nfunction readForcedHost(req: Request): string | null {\n  // Test-only override. The middleware honors `X-Force-Host` only when\n  // `NODE_ENV === 'test'` AND `X-Force-Host-Secret` matches; we mirror the\n  // same check here so request-scoped helpers behave the same way under tests.\n  if (process.env.NODE_ENV !== 'test') return null\n  const expected = process.env.FORCE_HOST_SECRET\n  if (!expected) return null\n  if (!secretEqual(req.headers.get('x-force-host-secret'), expected)) return null\n  const host = req.headers.get('x-force-host')\n  return host && host.length > 0 ? host : null\n}\n\nexport async function resolveTenantContext(\n  req: Request,\n  bodyTenantId: string | null | undefined,\n  options?: { container?: AppContainer },\n): Promise<ResolvedTenantContext> {\n  const rawHost = readForcedHost(req) ?? req.headers.get('host')\n  const hostname = rawHost ? tryNormalizeHostname(rawHost) : null\n  const isPlatform = hostname ? platformDomains().includes(hostname) : true\n\n  if (isPlatform) {\n    if (!bodyTenantId) {\n      throw new TenantResolutionError('tenantId is required for platform-domain logins', 400)\n    }\n    return { source: 'body', tenantId: bodyTenantId, organizationId: null, hostname }\n  }\n\n  // Custom-domain host\n  let service: DomainMappingService | null = null\n  try {\n    if (options?.container) {\n      service = options.container.resolve('domainMappingService') as DomainMappingService\n    } else {\n      const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n      const container = await createRequestContainer()\n      service = container.resolve('domainMappingService') as DomainMappingService\n    }\n  } catch {\n    throw new TenantResolutionError('Custom domain routing is not available on this deployment', 503)\n  }\n\n  if (!hostname) throw new TenantResolutionError('Unable to determine request hostname', 400)\n  const resolved = await service.resolveByHostname(hostname)\n  if (!resolved || resolved.status !== 'active') {\n    throw new TenantResolutionError('This domain is not configured for any active organization', 404)\n  }\n\n  if (bodyTenantId && bodyTenantId !== resolved.tenantId) {\n    throw new TenantResolutionError(\n      'tenantId in request body does not match the resolved custom domain',\n      400,\n    )\n  }\n\n  return {\n    source: 'host',\n    tenantId: resolved.tenantId,\n    organizationId: resolved.organizationId,\n    hostname,\n  }\n}\n"],
+  "mappings": "AAcA,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAIrB,MAAM,8BAA8B,MAAM;AAAA,EAC/C,YAAY,SAAiC,QAAgB;AAC3D,UAAM,OAAO;AAD8B;AAE3C,SAAK,OAAO;AAAA,EACd;AACF;AASA,SAAS,eAAe,KAA6B;AAInD,MAAI,QAAQ,IAAI,aAAa,OAAQ,QAAO;AAC5C,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,qBAAqB,GAAG,QAAQ,EAAG,QAAO;AAC3E,QAAM,OAAO,IAAI,QAAQ,IAAI,cAAc;AAC3C,SAAO,QAAQ,KAAK,SAAS,IAAI,OAAO;AAC1C;AAEA,eAAsB,qBACpB,KACA,cACA,SACgC;AAChC,QAAM,UAAU,eAAe,GAAG,KAAK,IAAI,QAAQ,IAAI,MAAM;AAC7D,QAAM,WAAW,UAAU,qBAAqB,OAAO,IAAI;AAC3D,QAAM,aAAa,WAAW,gBAAgB,EAAE,SAAS,QAAQ,IAAI;AAErE,MAAI,YAAY;AACd,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,sBAAsB,mDAAmD,GAAG;AAAA,IACxF;AACA,WAAO,EAAE,QAAQ,QAAQ,UAAU,cAAc,gBAAgB,MAAM,SAAS;AAAA,EAClF;AAGA,MAAI,UAAuC;AAC3C,MAAI;AACF,QAAI,SAAS,WAAW;AACtB,gBAAU,QAAQ,UAAU,QAAQ,sBAAsB;AAAA,IAC5D,OAAO;AACL,YAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,YAAM,YAAY,MAAM,uBAAuB;AAC/C,gBAAU,UAAU,QAAQ,sBAAsB;AAAA,IACpD;AAAA,EACF,QAAQ;AACN,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,CAAC,SAAU,OAAM,IAAI,sBAAsB,wCAAwC,GAAG;AAC1F,QAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,MAAI,CAAC,YAAY,SAAS,WAAW,UAAU;AAC7C,UAAM,IAAI,sBAAsB,6DAA6D,GAAG;AAAA,EAClG;AAEA,MAAI,gBAAgB,iBAAiB,SAAS,UAAU;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/secretCompare.js

@@ -0,0 +1,13 @@
+import { timingSafeEqual } from "node:crypto";
+function secretEqual(supplied, expected) {
+  if (typeof supplied !== "string" || supplied.length === 0) return false;
+  if (typeof expected !== "string" || expected.length === 0) return false;
+  const a = Buffer.from(supplied, "utf8");
+  const b = Buffer.from(expected, "utf8");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+export {
+  secretEqual
+};
+//# sourceMappingURL=secretCompare.js.map