@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3278.1.a4d26475e4

package/src/modules/customer_accounts/i18n/en.json

@@ -192,12 +192,90 @@
   "customer_accounts.admin.unverified": "No",
   "customer_accounts.admin.users": "Users",
   "customer_accounts.admin.verified": "Yes",
+  "customer_accounts.domainMapping.aRecordInstruction": "For an apex domain, add an A record for {hostname} pointing to {target}",
+  "customer_accounts.domainMapping.alreadyClaimed": "This domain is not available. Please choose a different hostname.",
+  "customer_accounts.domainMapping.autoVerify.checking": "Automatically checking every 5 minutes",
+  "customer_accounts.domainMapping.autoVerify.lastChecked": "Last checked: {time}",
+  "customer_accounts.domainMapping.autoVerify.nextCheck": "Next check in ~{minutes} minutes",
+  "customer_accounts.domainMapping.changeDomain": "Change Domain",
+  "customer_accounts.domainMapping.changeDomain.description": "Your current domain ({hostname}) will stay active until the new domain is fully set up. No downtime for your customers.",
+  "customer_accounts.domainMapping.changeDomain.replacing": "Replacing {oldHostname} — old domain stays live until this one is ready",
+  "customer_accounts.domainMapping.cnameInstruction": "Add a CNAME record for {hostname} pointing to {target} in your DNS provider",
+  "customer_accounts.domainMapping.copyTarget": "Copy",
+  "customer_accounts.domainMapping.copyTarget.copied": "Copied",
+  "customer_accounts.domainMapping.description": "Map your own domain to the customer portal",
+  "customer_accounts.domainMapping.diagnostics.detectedRecords": "Detected DNS records:",
+  "customer_accounts.domainMapping.diagnostics.noRecord": "No CNAME or A record found for {hostname}",
+  "customer_accounts.domainMapping.diagnostics.proxyDetected": "Your DNS uses a proxy ({proxy}). Either disable the proxy or configure it to forward traffic to our platform.",
+  "customer_accounts.domainMapping.diagnostics.suggestion": "Suggested fix:",
+  "customer_accounts.domainMapping.diagnostics.timeout": "DNS lookup timed out — this may be a temporary issue",
+  "customer_accounts.domainMapping.diagnostics.wrongARecordTarget": "Your A record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.diagnostics.wrongCnameTarget": "Your CNAME record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.dialog.cancel": "Cancel",
+  "customer_accounts.domainMapping.dialog.change.submit": "Start replacement",
+  "customer_accounts.domainMapping.dialog.change.title": "Change custom domain",
+  "customer_accounts.domainMapping.dialog.register.submit": "Register",
+  "customer_accounts.domainMapping.dialog.register.title": "Register custom domain",
+  "customer_accounts.domainMapping.dns.diagnostics.detected": "Detected target",
+  "customer_accounts.domainMapping.dns.diagnostics.expected": "Expected target",
+  "customer_accounts.domainMapping.dns.diagnostics.title": "DNS configuration issue",
+  "customer_accounts.domainMapping.dns.recheckButton": "Re-check DNS",
+  "customer_accounts.domainMapping.dnsProviderHelp": "Need help? See instructions for:",
+  "customer_accounts.domainMapping.dnsProviderHelp.cloudflare": "Cloudflare",
+  "customer_accounts.domainMapping.dnsProviderHelp.godaddy": "GoDaddy",
+  "customer_accounts.domainMapping.dnsProviderHelp.googleDomains": "Google Domains",
+  "customer_accounts.domainMapping.dnsProviderHelp.namecheap": "Namecheap",
+  "customer_accounts.domainMapping.dnsProviderHelp.other": "Other providers",
+  "customer_accounts.domainMapping.empty.cta": "Register Domain",
+  "customer_accounts.domainMapping.empty.description": "Connect your own domain so customers can reach the portal at a branded URL.",
+  "customer_accounts.domainMapping.empty.title": "No custom domain yet",
+  "customer_accounts.domainMapping.error.load": "Could not load custom-domain configuration",
+  "customer_accounts.domainMapping.errors.required": "Domain is required",
+  "customer_accounts.domainMapping.hostname.label": "Domain",
+  "customer_accounts.domainMapping.hostname.placeholder": "e.g., shop.yourdomain.com",
+  "customer_accounts.domainMapping.hostname.validation.invalid": "Enter a valid domain name (no protocol, path, or port)",
+  "customer_accounts.domainMapping.loading": "Loading domain configuration…",
+  "customer_accounts.domainMapping.orgSwitcher.label": "Organization",
+  "customer_accounts.domainMapping.preview": "Test Domain",
+  "customer_accounts.domainMapping.preview.description": "Opens your portal on the custom domain in a new tab to verify it's working correctly",
+  "customer_accounts.domainMapping.preview.notReady": "Domain is not yet active. Complete the setup steps first.",
+  "customer_accounts.domainMapping.propagationNote": "DNS changes can take up to 48 hours to propagate. The system checks automatically — you'll be notified when it's ready.",
+  "customer_accounts.domainMapping.registered": "Domain registered successfully",
+  "customer_accounts.domainMapping.removeConfirm": "Are you sure? Customers using this domain will no longer be able to reach your portal.",
+  "customer_accounts.domainMapping.removeConfirm.hasReplacement": "This will also cancel the pending replacement domain ({hostname}).",
+  "customer_accounts.domainMapping.removeConfirm.title": "Remove custom domain?",
+  "customer_accounts.domainMapping.removeDomain": "Remove Domain",
+  "customer_accounts.domainMapping.removed": "Domain removed",
+  "customer_accounts.domainMapping.replacement.label": "Replacement (waiting to activate)",
+  "customer_accounts.domainMapping.status.active": "Active",
+  "customer_accounts.domainMapping.status.dns_failed": "DNS issue — see details below",
+  "customer_accounts.domainMapping.status.pending": "Checking DNS...",
+  "customer_accounts.domainMapping.status.tls_failed": "SSL certificate issue — we're retrying",
+  "customer_accounts.domainMapping.status.verified": "Setting up SSL certificate...",
+  "customer_accounts.domainMapping.stepper.step1": "Register Domain",
+  "customer_accounts.domainMapping.stepper.step2": "Configure DNS",
+  "customer_accounts.domainMapping.stepper.step3": "SSL Certificate",
+  "customer_accounts.domainMapping.stepper.step4": "Live",
+  "customer_accounts.domainMapping.title": "Custom Domain",
+  "customer_accounts.domainMapping.tls.diagnostics.operatorNote": "We are retrying automatically. If this persists, contact platform support — your DNS is fine, this is on our side.",
+  "customer_accounts.domainMapping.tls.diagnostics.retryCount": "Retry attempts: {count}",
+  "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
+  "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
+  "customer_accounts.domainMapping.verifyNow": "Check Now",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",
   "customer_accounts.nav.roles": "Customer Roles",
   "customer_accounts.nav.user_detail": "User Detail",
   "customer_accounts.nav.users": "Customer Users",
+  "customer_accounts.notifications.domain_mapping.activated.body": "Your custom domain is now active and serving traffic.",
+  "customer_accounts.notifications.domain_mapping.activated.title": "Custom domain is live",
+  "customer_accounts.notifications.domain_mapping.dns_failed.body": "DNS verification failed for your custom domain. {reason}",
+  "customer_accounts.notifications.domain_mapping.dns_failed.title": "DNS verification failed",
+  "customer_accounts.notifications.domain_mapping.tls_failed.body": "SSL certificate provisioning is having trouble for your custom domain. We're retrying — no action needed yet.",
+  "customer_accounts.notifications.domain_mapping.tls_failed.title": "SSL provisioning issue",
+  "customer_accounts.notifications.domain_mapping.verified.body": "Your custom domain has been verified. SSL certificate is being provisioned.",
+  "customer_accounts.notifications.domain_mapping.verified.title": "Custom domain verified",
   "customer_accounts.notifications.user.locked.body": "Customer account was locked due to too many failed login attempts.",
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",

package/src/modules/customer_accounts/i18n/es.json

@@ -192,12 +192,90 @@
   "customer_accounts.admin.unverified": "No",
   "customer_accounts.admin.users": "Users",
   "customer_accounts.admin.verified": "Yes",
+  "customer_accounts.domainMapping.aRecordInstruction": "For an apex domain, add an A record for {hostname} pointing to {target}",
+  "customer_accounts.domainMapping.alreadyClaimed": "This domain is not available. Please choose a different hostname.",
+  "customer_accounts.domainMapping.autoVerify.checking": "Automatically checking every 5 minutes",
+  "customer_accounts.domainMapping.autoVerify.lastChecked": "Last checked: {time}",
+  "customer_accounts.domainMapping.autoVerify.nextCheck": "Next check in ~{minutes} minutes",
+  "customer_accounts.domainMapping.changeDomain": "Change Domain",
+  "customer_accounts.domainMapping.changeDomain.description": "Your current domain ({hostname}) will stay active until the new domain is fully set up. No downtime for your customers.",
+  "customer_accounts.domainMapping.changeDomain.replacing": "Replacing {oldHostname} — old domain stays live until this one is ready",
+  "customer_accounts.domainMapping.cnameInstruction": "Add a CNAME record for {hostname} pointing to {target} in your DNS provider",
+  "customer_accounts.domainMapping.copyTarget": "Copy",
+  "customer_accounts.domainMapping.copyTarget.copied": "Copied",
+  "customer_accounts.domainMapping.description": "Map your own domain to the customer portal",
+  "customer_accounts.domainMapping.diagnostics.detectedRecords": "Detected DNS records:",
+  "customer_accounts.domainMapping.diagnostics.noRecord": "No CNAME or A record found for {hostname}",
+  "customer_accounts.domainMapping.diagnostics.proxyDetected": "Your DNS uses a proxy ({proxy}). Either disable the proxy or configure it to forward traffic to our platform.",
+  "customer_accounts.domainMapping.diagnostics.suggestion": "Suggested fix:",
+  "customer_accounts.domainMapping.diagnostics.timeout": "DNS lookup timed out — this may be a temporary issue",
+  "customer_accounts.domainMapping.diagnostics.wrongARecordTarget": "Your A record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.diagnostics.wrongCnameTarget": "Your CNAME record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.dialog.cancel": "Cancel",
+  "customer_accounts.domainMapping.dialog.change.submit": "Start replacement",
+  "customer_accounts.domainMapping.dialog.change.title": "Change custom domain",
+  "customer_accounts.domainMapping.dialog.register.submit": "Register",
+  "customer_accounts.domainMapping.dialog.register.title": "Register custom domain",
+  "customer_accounts.domainMapping.dns.diagnostics.detected": "Detected target",
+  "customer_accounts.domainMapping.dns.diagnostics.expected": "Expected target",
+  "customer_accounts.domainMapping.dns.diagnostics.title": "DNS configuration issue",
+  "customer_accounts.domainMapping.dns.recheckButton": "Re-check DNS",
+  "customer_accounts.domainMapping.dnsProviderHelp": "Need help? See instructions for:",
+  "customer_accounts.domainMapping.dnsProviderHelp.cloudflare": "Cloudflare",
+  "customer_accounts.domainMapping.dnsProviderHelp.godaddy": "GoDaddy",
+  "customer_accounts.domainMapping.dnsProviderHelp.googleDomains": "Google Domains",
+  "customer_accounts.domainMapping.dnsProviderHelp.namecheap": "Namecheap",
+  "customer_accounts.domainMapping.dnsProviderHelp.other": "Other providers",
+  "customer_accounts.domainMapping.empty.cta": "Register Domain",
+  "customer_accounts.domainMapping.empty.description": "Connect your own domain so customers can reach the portal at a branded URL.",
+  "customer_accounts.domainMapping.empty.title": "No custom domain yet",
+  "customer_accounts.domainMapping.error.load": "Could not load custom-domain configuration",
+  "customer_accounts.domainMapping.errors.required": "Domain is required",
+  "customer_accounts.domainMapping.hostname.label": "Domain",
+  "customer_accounts.domainMapping.hostname.placeholder": "e.g., shop.yourdomain.com",
+  "customer_accounts.domainMapping.hostname.validation.invalid": "Enter a valid domain name (no protocol, path, or port)",
+  "customer_accounts.domainMapping.loading": "Loading domain configuration…",
+  "customer_accounts.domainMapping.orgSwitcher.label": "Organization",
+  "customer_accounts.domainMapping.preview": "Test Domain",
+  "customer_accounts.domainMapping.preview.description": "Opens your portal on the custom domain in a new tab to verify it's working correctly",
+  "customer_accounts.domainMapping.preview.notReady": "Domain is not yet active. Complete the setup steps first.",
+  "customer_accounts.domainMapping.propagationNote": "DNS changes can take up to 48 hours to propagate. The system checks automatically — you'll be notified when it's ready.",
+  "customer_accounts.domainMapping.registered": "Domain registered successfully",
+  "customer_accounts.domainMapping.removeConfirm": "Are you sure? Customers using this domain will no longer be able to reach your portal.",
+  "customer_accounts.domainMapping.removeConfirm.hasReplacement": "This will also cancel the pending replacement domain ({hostname}).",
+  "customer_accounts.domainMapping.removeConfirm.title": "Remove custom domain?",
+  "customer_accounts.domainMapping.removeDomain": "Remove Domain",
+  "customer_accounts.domainMapping.removed": "Domain removed",
+  "customer_accounts.domainMapping.replacement.label": "Replacement (waiting to activate)",
+  "customer_accounts.domainMapping.status.active": "Active",
+  "customer_accounts.domainMapping.status.dns_failed": "DNS issue — see details below",
+  "customer_accounts.domainMapping.status.pending": "Checking DNS...",
+  "customer_accounts.domainMapping.status.tls_failed": "SSL certificate issue — we're retrying",
+  "customer_accounts.domainMapping.status.verified": "Setting up SSL certificate...",
+  "customer_accounts.domainMapping.stepper.step1": "Register Domain",
+  "customer_accounts.domainMapping.stepper.step2": "Configure DNS",
+  "customer_accounts.domainMapping.stepper.step3": "SSL Certificate",
+  "customer_accounts.domainMapping.stepper.step4": "Live",
+  "customer_accounts.domainMapping.title": "Custom Domain",
+  "customer_accounts.domainMapping.tls.diagnostics.operatorNote": "We are retrying automatically. If this persists, contact platform support — your DNS is fine, this is on our side.",
+  "customer_accounts.domainMapping.tls.diagnostics.retryCount": "Retry attempts: {count}",
+  "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
+  "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
+  "customer_accounts.domainMapping.verifyNow": "Check Now",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",
   "customer_accounts.nav.roles": "Roles de clientes",
   "customer_accounts.nav.user_detail": "User Detail",
   "customer_accounts.nav.users": "Usuarios de clientes",
+  "customer_accounts.notifications.domain_mapping.activated.body": "Your custom domain is now active and serving traffic.",
+  "customer_accounts.notifications.domain_mapping.activated.title": "Custom domain is live",
+  "customer_accounts.notifications.domain_mapping.dns_failed.body": "DNS verification failed for your custom domain. {reason}",
+  "customer_accounts.notifications.domain_mapping.dns_failed.title": "DNS verification failed",
+  "customer_accounts.notifications.domain_mapping.tls_failed.body": "SSL certificate provisioning is having trouble for your custom domain. We're retrying — no action needed yet.",
+  "customer_accounts.notifications.domain_mapping.tls_failed.title": "SSL provisioning issue",
+  "customer_accounts.notifications.domain_mapping.verified.body": "Your custom domain has been verified. SSL certificate is being provisioned.",
+  "customer_accounts.notifications.domain_mapping.verified.title": "Custom domain verified",
   "customer_accounts.notifications.user.locked.body": "Customer account was locked due to too many failed login attempts.",
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",

package/src/modules/customer_accounts/i18n/pl.json

@@ -192,12 +192,90 @@
   "customer_accounts.admin.unverified": "Nie",
   "customer_accounts.admin.users": "Użytkownicy",
   "customer_accounts.admin.verified": "Tak",
+  "customer_accounts.domainMapping.aRecordInstruction": "For an apex domain, add an A record for {hostname} pointing to {target}",
+  "customer_accounts.domainMapping.alreadyClaimed": "This domain is not available. Please choose a different hostname.",
+  "customer_accounts.domainMapping.autoVerify.checking": "Automatically checking every 5 minutes",
+  "customer_accounts.domainMapping.autoVerify.lastChecked": "Last checked: {time}",
+  "customer_accounts.domainMapping.autoVerify.nextCheck": "Next check in ~{minutes} minutes",
+  "customer_accounts.domainMapping.changeDomain": "Change Domain",
+  "customer_accounts.domainMapping.changeDomain.description": "Your current domain ({hostname}) will stay active until the new domain is fully set up. No downtime for your customers.",
+  "customer_accounts.domainMapping.changeDomain.replacing": "Replacing {oldHostname} — old domain stays live until this one is ready",
+  "customer_accounts.domainMapping.cnameInstruction": "Add a CNAME record for {hostname} pointing to {target} in your DNS provider",
+  "customer_accounts.domainMapping.copyTarget": "Copy",
+  "customer_accounts.domainMapping.copyTarget.copied": "Copied",
+  "customer_accounts.domainMapping.description": "Map your own domain to the customer portal",
+  "customer_accounts.domainMapping.diagnostics.detectedRecords": "Detected DNS records:",
+  "customer_accounts.domainMapping.diagnostics.noRecord": "No CNAME or A record found for {hostname}",
+  "customer_accounts.domainMapping.diagnostics.proxyDetected": "Your DNS uses a proxy ({proxy}). Either disable the proxy or configure it to forward traffic to our platform.",
+  "customer_accounts.domainMapping.diagnostics.suggestion": "Suggested fix:",
+  "customer_accounts.domainMapping.diagnostics.timeout": "DNS lookup timed out — this may be a temporary issue",
+  "customer_accounts.domainMapping.diagnostics.wrongARecordTarget": "Your A record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.diagnostics.wrongCnameTarget": "Your CNAME record points to {detected} instead of {expected}",
+  "customer_accounts.domainMapping.dialog.cancel": "Cancel",
+  "customer_accounts.domainMapping.dialog.change.submit": "Start replacement",
+  "customer_accounts.domainMapping.dialog.change.title": "Change custom domain",
+  "customer_accounts.domainMapping.dialog.register.submit": "Register",
+  "customer_accounts.domainMapping.dialog.register.title": "Register custom domain",
+  "customer_accounts.domainMapping.dns.diagnostics.detected": "Detected target",
+  "customer_accounts.domainMapping.dns.diagnostics.expected": "Expected target",
+  "customer_accounts.domainMapping.dns.diagnostics.title": "DNS configuration issue",
+  "customer_accounts.domainMapping.dns.recheckButton": "Re-check DNS",
+  "customer_accounts.domainMapping.dnsProviderHelp": "Need help? See instructions for:",
+  "customer_accounts.domainMapping.dnsProviderHelp.cloudflare": "Cloudflare",
+  "customer_accounts.domainMapping.dnsProviderHelp.godaddy": "GoDaddy",
+  "customer_accounts.domainMapping.dnsProviderHelp.googleDomains": "Google Domains",
+  "customer_accounts.domainMapping.dnsProviderHelp.namecheap": "Namecheap",
+  "customer_accounts.domainMapping.dnsProviderHelp.other": "Other providers",
+  "customer_accounts.domainMapping.empty.cta": "Register Domain",
+  "customer_accounts.domainMapping.empty.description": "Connect your own domain so customers can reach the portal at a branded URL.",
+  "customer_accounts.domainMapping.empty.title": "No custom domain yet",
+  "customer_accounts.domainMapping.error.load": "Could not load custom-domain configuration",
+  "customer_accounts.domainMapping.errors.required": "Domain is required",
+  "customer_accounts.domainMapping.hostname.label": "Domain",
+  "customer_accounts.domainMapping.hostname.placeholder": "e.g., shop.yourdomain.com",
+  "customer_accounts.domainMapping.hostname.validation.invalid": "Enter a valid domain name (no protocol, path, or port)",
+  "customer_accounts.domainMapping.loading": "Loading domain configuration…",
+  "customer_accounts.domainMapping.orgSwitcher.label": "Organization",
+  "customer_accounts.domainMapping.preview": "Test Domain",
+  "customer_accounts.domainMapping.preview.description": "Opens your portal on the custom domain in a new tab to verify it's working correctly",
+  "customer_accounts.domainMapping.preview.notReady": "Domain is not yet active. Complete the setup steps first.",
+  "customer_accounts.domainMapping.propagationNote": "DNS changes can take up to 48 hours to propagate. The system checks automatically — you'll be notified when it's ready.",
+  "customer_accounts.domainMapping.registered": "Domain registered successfully",
+  "customer_accounts.domainMapping.removeConfirm": "Are you sure? Customers using this domain will no longer be able to reach your portal.",
+  "customer_accounts.domainMapping.removeConfirm.hasReplacement": "This will also cancel the pending replacement domain ({hostname}).",
+  "customer_accounts.domainMapping.removeConfirm.title": "Remove custom domain?",
+  "customer_accounts.domainMapping.removeDomain": "Remove Domain",
+  "customer_accounts.domainMapping.removed": "Domain removed",
+  "customer_accounts.domainMapping.replacement.label": "Replacement (waiting to activate)",
+  "customer_accounts.domainMapping.status.active": "Active",
+  "customer_accounts.domainMapping.status.dns_failed": "DNS issue — see details below",
+  "customer_accounts.domainMapping.status.pending": "Checking DNS...",
+  "customer_accounts.domainMapping.status.tls_failed": "SSL certificate issue — we're retrying",
+  "customer_accounts.domainMapping.status.verified": "Setting up SSL certificate...",
+  "customer_accounts.domainMapping.stepper.step1": "Register Domain",
+  "customer_accounts.domainMapping.stepper.step2": "Configure DNS",
+  "customer_accounts.domainMapping.stepper.step3": "SSL Certificate",
+  "customer_accounts.domainMapping.stepper.step4": "Live",
+  "customer_accounts.domainMapping.title": "Custom Domain",
+  "customer_accounts.domainMapping.tls.diagnostics.operatorNote": "We are retrying automatically. If this persists, contact platform support — your DNS is fine, this is on our side.",
+  "customer_accounts.domainMapping.tls.diagnostics.retryCount": "Retry attempts: {count}",
+  "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
+  "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
+  "customer_accounts.domainMapping.verifyNow": "Check Now",
   "customer_accounts.nav.group": "Klienci",
   "customer_accounts.nav.role_create": "Utwórz rolę",
   "customer_accounts.nav.role_detail": "Szczegóły roli",
   "customer_accounts.nav.roles": "Role klientów",
   "customer_accounts.nav.user_detail": "Szczegóły użytkownika",
   "customer_accounts.nav.users": "Użytkownicy klientów",
+  "customer_accounts.notifications.domain_mapping.activated.body": "Your custom domain is now active and serving traffic.",
+  "customer_accounts.notifications.domain_mapping.activated.title": "Custom domain is live",
+  "customer_accounts.notifications.domain_mapping.dns_failed.body": "DNS verification failed for your custom domain. {reason}",
+  "customer_accounts.notifications.domain_mapping.dns_failed.title": "DNS verification failed",
+  "customer_accounts.notifications.domain_mapping.tls_failed.body": "SSL certificate provisioning is having trouble for your custom domain. We're retrying — no action needed yet.",
+  "customer_accounts.notifications.domain_mapping.tls_failed.title": "SSL provisioning issue",
+  "customer_accounts.notifications.domain_mapping.verified.body": "Your custom domain has been verified. SSL certificate is being provisioned.",
+  "customer_accounts.notifications.domain_mapping.verified.title": "Custom domain verified",
   "customer_accounts.notifications.user.locked.body": "Customer account was locked due to too many failed login attempts.",
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",

package/src/modules/customer_accounts/lib/customerAuthServer.ts

@@ -6,8 +6,12 @@
  */
 
 import { cookies } from 'next/headers'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'
-import { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
+import { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'
 import { validateUserState } from './customerAuth'
 import type { CustomerAuthContext } from './customerAuth'
 
@@ -15,10 +19,6 @@ export type { CustomerAuthContext }
 
 async function assertSessionStillActive(sessionId: string): Promise<boolean> {
   try {
-    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
-      import('@open-mercato/shared/lib/di/container'),
-      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),
-    ])
     const container = await createRequestContainer()
     const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>
     const session = await service.findActiveSessionById(sessionId)
@@ -43,7 +43,9 @@ async function assertSessionStillActive(sessionId: string): Promise<boolean> {
  * if (!customerAuth) redirect('/login')
  * ```
  */
-export async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext | null> {
+export async function getCustomerAuthFromCookies(
+  options?: { expectedTenantId?: string },
+): Promise<CustomerAuthContext | null> {
   const cookieStore = await cookies()
   const token = cookieStore.get('customer_auth_token')?.value
   if (!token) return null
@@ -54,12 +56,19 @@ export async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext
     if (payload.type !== 'customer') return null
     const sid = typeof payload.sid === 'string' ? payload.sid : ''
     if (!sid) return null
+    const tenantId = String(payload.tenantId)
+    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {
+      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication
+      // section: the host-resolved tenant is the authoritative scope; mismatched
+      // JWTs are rejected as if unauthenticated.
+      return null
+    }
     const stillActive = await assertSessionStillActive(sid)
     if (!stillActive) return null
 
     const userState = await validateUserState(
       String(payload.sub),
-      String(payload.tenantId),
+      tenantId,
       String(payload.orgId),
       payload.iat,
     )
@@ -69,7 +78,7 @@ export async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext
       sub: String(payload.sub),
       sid,
       type: 'customer',
-      tenantId: String(payload.tenantId),
+      tenantId,
       orgId: String(payload.orgId),
       email: String(payload.email || ''),
       displayName: String(payload.displayName || ''),
@@ -82,3 +91,30 @@ export async function getCustomerAuthFromCookies(): Promise<CustomerAuthContext
     return null
   }
 }
+
+/**
+ * Convenience wrapper for custom-domain pages: resolves the host, calls
+ * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.
+ *
+ * Use from server components rendered under custom domains.
+ */
+export async function getCustomerAuthForHost(
+  host: string | null | undefined,
+): Promise<CustomerAuthContext | null> {
+  if (!host) return getCustomerAuthFromCookies()
+
+  try {
+    const hostname = tryNormalizeHostname(host)
+    if (!hostname) return getCustomerAuthFromCookies()
+    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()
+
+    const container = await createRequestContainer()
+    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>
+    const resolved = await service.resolveByHostname(hostname)
+    if (!resolved || resolved.status !== 'active') return null
+    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })
+  } catch (err) {
+    console.warn('[customer_accounts] getCustomerAuthForHost: domain resolve failed; falling back to platform cookie', err)
+    return getCustomerAuthFromCookies()
+  }
+}

package/src/modules/customer_accounts/lib/customerUrl.ts

@@ -0,0 +1,72 @@
+// Build customer-portal URLs that honor the active custom domain when present.
+// All customer-facing email senders (signup welcome, magic link, password reset,
+// notification digests) MUST construct links via this helper instead of
+// hard-coding PLATFORM_PORTAL_BASE_URL — see customer_accounts/AGENTS.md.
+
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+
+type DomainMappingService = {
+  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>
+}
+
+type OrgService = {
+  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>
+}
+
+function platformBaseUrl(): string {
+  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()
+  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, '')
+  // Outbound emails (welcome, magic link, password reset) embed this URL —
+  // localhost in production silently sends broken links to real customers.
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error(
+      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',
+    )
+  }
+  return 'http://localhost:3000'
+}
+
+function resolveContainer(container?: AppContainer): Promise<AppContainer> {
+  if (container) return Promise.resolve(container)
+  return createRequestContainer()
+}
+
+export async function urlForCustomerOrg(
+  orgId: string,
+  path: string,
+  options?: { container?: AppContainer },
+): Promise<string> {
+  const safePath = path.startsWith('/') ? path : `/${path}`
+  const container = await resolveContainer(options?.container)
+
+  let active: { hostname: string } | null = null
+  try {
+    const service = container.resolve('domainMappingService') as DomainMappingService
+    if (service && typeof service.resolveActiveByOrg === 'function') {
+      active = await service.resolveActiveByOrg(orgId)
+    }
+  } catch {
+    // domainMappingService not registered yet (fresh installs, tests) — fall through to platform URL.
+    active = null
+  }
+
+  if (active && active.hostname) {
+    return `https://${active.hostname}${safePath}`
+  }
+
+  let orgSlug: string | null = null
+  try {
+    const orgService = container.resolve('orgService') as OrgService | undefined
+    if (orgService && typeof orgService.findById === 'function') {
+      const org = await orgService.findById(orgId)
+      orgSlug = org?.slug ?? null
+    }
+  } catch {
+    orgSlug = null
+  }
+
+  const base = platformBaseUrl()
+  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`
+  return `${base}${safePath}`
+}

package/src/modules/customer_accounts/lib/hostname.ts

@@ -0,0 +1,76 @@
+// Hostname normalization for the custom-domain routing feature.
+// Single canonical form (lowercase, no trailing dot, IDN→Punycode) is essential —
+// the UNIQUE constraint on `domain_mappings.hostname` is meaningless without it.
+
+const MAX_HOSTNAME_LENGTH = 253
+const HOSTNAME_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/
+
+export class HostnameNormalizationError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'HostnameNormalizationError'
+  }
+}
+
+export function normalizeHostname(input: string): string {
+  if (typeof input !== 'string') {
+    throw new HostnameNormalizationError('Hostname must be a string')
+  }
+
+  let host = input.trim().toLowerCase()
+  if (!host) throw new HostnameNormalizationError('Hostname is empty')
+
+  host = host
+    .replace(/^https?:\/\//, '')
+    .replace(/\/.*$/, '')
+    .replace(/\?.*$/, '')
+    .replace(/#.*$/, '')
+    .replace(/:\d+$/, '')
+
+  if (host.endsWith('.')) host = host.slice(0, -1)
+
+  if (!host) throw new HostnameNormalizationError('Hostname is empty after stripping')
+
+  // Convert IDN (Unicode) to Punycode (ASCII) via the URL constructor — this
+  // matches what browsers and Let's Encrypt use, without depending on the
+  // deprecated `node:punycode` module or pulling in `tr46`.
+  try {
+    const url = new URL(`https://${host}`)
+    host = url.hostname
+  } catch {
+    throw new HostnameNormalizationError(`Hostname is not a valid host: ${input}`)
+  }
+
+  if (!host || host.length > MAX_HOSTNAME_LENGTH) {
+    throw new HostnameNormalizationError(
+      `Hostname must be between 1 and ${MAX_HOSTNAME_LENGTH} characters after normalization`,
+    )
+  }
+
+  const labels = host.split('.')
+  if (labels.length < 2) {
+    throw new HostnameNormalizationError('Hostname must have at least two labels (e.g. "example.com")')
+  }
+  for (const label of labels) {
+    if (!HOSTNAME_LABEL.test(label)) {
+      throw new HostnameNormalizationError(`Invalid DNS label: "${label}"`)
+    }
+  }
+  // Reject IP-address literals (e.g. "127.0.0.1"): a custom domain must be a
+  // registered DNS name, and a TLD is never all-numeric. This also keeps
+  // loopback/test hosts (127.0.0.1) from being mistaken for a tenant's
+  // branded domain by the routing layer.
+  if (/^\d+$/.test(labels[labels.length - 1])) {
+    throw new HostnameNormalizationError(`Hostname looks like an IP address, not a DNS name: ${input}`)
+  }
+
+  return host
+}
+
+export function tryNormalizeHostname(input: string): string | null {
+  try {
+    return normalizeHostname(input)
+  } catch {
+    return null
+  }
+}

package/src/modules/customer_accounts/lib/platformDomains.ts

@@ -0,0 +1,14 @@
+/**
+ * Parse the `PLATFORM_DOMAINS` env into a normalized list of platform hostnames.
+ *
+ * Platform hosts are the deployment's own domains (admin app, marketing site,
+ * loopback). Custom-domain routing MUST treat platform hosts as non-tenant
+ * traffic, so domain registration, resolver lookups, and tenant-context
+ * fallbacks all share the same view of which hosts are platform-owned.
+ */
+export function platformDomains(): string[] {
+  return (process.env.PLATFORM_DOMAINS ?? 'localhost,openmercato.com')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean)
+}

package/src/modules/customer_accounts/lib/proxyRanges.ts

@@ -0,0 +1,85 @@
+// CIDR matching for known reverse-proxy IP ranges (Cloudflare, Fastly, custom).
+// Used by the DNS verification fallback: if a domain's A record lands inside a
+// known proxy range we fall back to a reverse-resolve over HTTPS, because the
+// proxy hides the real origin from us.
+
+const DEFAULT_CLOUDFLARE_RANGES = [
+  '173.245.48.0/20',
+  '103.21.244.0/22',
+  '103.22.200.0/22',
+  '103.31.4.0/22',
+  '141.101.64.0/18',
+  '108.162.192.0/18',
+  '190.93.240.0/20',
+  '188.114.96.0/20',
+  '197.234.240.0/22',
+  '198.41.128.0/17',
+  '162.158.0.0/15',
+  '104.16.0.0/13',
+  '104.24.0.0/14',
+  '172.64.0.0/13',
+  '131.0.72.0/22',
+]
+
+type ParsedCidr = { network: number; mask: number; raw: string }
+
+let cachedRanges: ParsedCidr[] | null = null
+
+function parseIpv4(ip: string): number | null {
+  const parts = ip.split('.')
+  if (parts.length !== 4) return null
+  let result = 0
+  for (const part of parts) {
+    if (!/^\d+$/.test(part)) return null
+    const value = Number(part)
+    if (value < 0 || value > 255) return null
+    result = (result << 8) | value
+  }
+  // Force unsigned 32-bit
+  return result >>> 0
+}
+
+function parseCidr(cidr: string): ParsedCidr | null {
+  const [ip, prefixStr] = cidr.split('/')
+  if (!ip || !prefixStr) return null
+  const prefix = Number(prefixStr)
+  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) return null
+  const ipNum = parseIpv4(ip)
+  if (ipNum === null) return null
+  const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0
+  const network = (ipNum & mask) >>> 0
+  return { network, mask, raw: cidr }
+}
+
+function loadRanges(): ParsedCidr[] {
+  if (cachedRanges) return cachedRanges
+  const fromEnv = (process.env.KNOWN_PROXY_IP_RANGES ?? '').trim()
+  const list = fromEnv
+    ? fromEnv.split(',').map((s) => s.trim()).filter(Boolean)
+    : DEFAULT_CLOUDFLARE_RANGES
+  cachedRanges = list.map(parseCidr).filter((v): v is ParsedCidr => v !== null)
+  return cachedRanges
+}
+
+export function isInKnownProxyRange(ip: string): boolean {
+  const ipNum = parseIpv4(ip)
+  if (ipNum === null) return false
+  for (const range of loadRanges()) {
+    if (((ipNum & range.mask) >>> 0) === range.network) return true
+  }
+  return false
+}
+
+export function detectProxy(ip: string): string | null {
+  if (!isInKnownProxyRange(ip)) return null
+  // For now we only ship Cloudflare's published ranges by default. Operators
+  // using a different proxy can override KNOWN_PROXY_IP_RANGES; we still
+  // return 'unknown' for those so callers can phrase the diagnostic correctly.
+  const fromEnv = process.env.KNOWN_PROXY_IP_RANGES
+  if (!fromEnv) return 'cloudflare'
+  return 'unknown'
+}
+
+export function resetProxyRangeCacheForTests(): void {
+  cachedRanges = null
+}

package/src/modules/customer_accounts/lib/rateLimiter.ts

@@ -33,4 +33,14 @@ export const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('C
   points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',
 })
 
+// Bulk custom-domain warm-up endpoint (`/api/customer_accounts/domain-resolve/all`).
+// Single shared `DOMAIN_RESOLVE_SECRET` gates a payload that lists every active
+// custom-domain mapping in the deployment, so we cap requests per IP to make
+// brute-force or post-leak enumeration noisy. 30 req/min/IP comfortably covers
+// the Node middleware warm-up cadence (one call per process boot) while
+// staying well below useful enumeration throughput.
+export const domainResolveAllIpRateLimitConfig = readEndpointRateLimitConfig('DOMAIN_RESOLVE_ALL_IP', {
+  points: 30, duration: 60, blockDuration: 60, keyPrefix: 'domain-resolve-all',
+})
+
 export { checkAuthRateLimit, resetAuthRateLimit }