@saasicat/cli 0.18.1 → 0.21.0

package/dist/index.js

@@ -53,7 +53,7 @@ var CliContextService = class {
     const fromEnv = process.env[this.config.adminEmailEnvVar] ?? "";
     const email = (asFlag ?? fromEnv).trim().toLowerCase();
     if (!email) {
-      throw new CliError("NO_IDENTITY", `Keine Admin-Identit\xE4t gesetzt. Bitte $${this.config.adminEmailEnvVar} setzen oder --as <email> \xFCbergeben.`, 2);
+      throw new CliError("NO_IDENTITY", `No admin identity set. Please set $${this.config.adminEmailEnvVar} or pass --as <email>.`, 2);
     }
     const host = os.hostname();
     return {
@@ -72,10 +72,10 @@ var CliContextService = class {
   async ensureSuperAdmin(identity) {
     const user = await this.users.findByEmail(identity.email);
     if (!user || user.deletedAt || !user.isActive) {
-      throw new CliError("USER_NOT_FOUND", `SUPER_ADMIN-User ${identity.email} nicht gefunden oder inaktiv.`, 2);
+      throw new CliError("USER_NOT_FOUND", `SUPER_ADMIN-User ${identity.email} not found or inactive.`, 2);
     }
     if (user.platformRole !== "SUPER_ADMIN") {
-      throw new CliError("NOT_SUPER_ADMIN", `User ${identity.email} hat Rolle ${user.platformRole} \u2014 nur SUPER_ADMIN darf das CLI nutzen.`, 2);
+      throw new CliError("NOT_SUPER_ADMIN", `User ${identity.email} has role ${user.platformRole} \u2014 only SUPER_ADMIN may use this CLI.`, 2);
     }
     return user;
   }
@@ -94,7 +94,7 @@ var CliContextService = class {
     }
     const enabled = await this.mfa.isEnabled(userId);
     if (!enabled) {
-      throw new CliError("MFA_NOT_SET_UP", "MFA ist nicht konfiguriert. Bitte zuerst 'admin mfa-setup' ausf\xFChren.", 3);
+      throw new CliError("MFA_NOT_SET_UP", "MFA is not configured. Run 'admin mfa-setup' first.", 3);
     }
     const code = await this.prompt("TOTP-Code: ");
     const ok2 = await this.mfa.verify({
@@ -102,7 +102,7 @@ var CliContextService = class {
       code
     });
     if (!ok2) {
-      throw new CliError("MFA_FAILED", "TOTP-Code ung\xFCltig.", 3);
+      throw new CliError("MFA_FAILED", "Invalid TOTP code.", 3);
     }
   }
   // ---------------------------------------------------------------------
@@ -111,9 +111,9 @@ var CliContextService = class {
   async ensureProductionConfirmation(opts = {}) {
     if (!this.config.isProductionEnvironment()) return;
     if (opts.yes) return;
-    const answer = await this.prompt("Tippe production zur Best\xE4tigung: ");
+    const answer = await this.prompt("Type production to confirm: ");
     if (answer.trim().toLowerCase() !== "production") {
-      throw new CliError("PRODUCTION_CONFIRM_ABORTED", "Production-Confirmation abgebrochen.", 1);
+      throw new CliError("PRODUCTION_CONFIRM_ABORTED", "Production confirmation aborted.", 1);
     }
   }
   // ---------------------------------------------------------------------
@@ -141,7 +141,7 @@ var CliContextService = class {
   // ---------------------------------------------------------------------
   table(rows) {
     if (rows.length === 0) {
-      console.log("\u2014 keine Eintr\xE4ge \u2014");
+      console.log("\u2014 no entries \u2014");
       return;
     }
     console.table(rows);
@@ -223,9 +223,9 @@ var MfaSetupFlow = class {
     const user = await this.ctx.ensureSuperAdmin(identity);
     const alreadyEnabled = await this.mfa.isEnabled(user.id);
     if (alreadyEnabled && !options.force) {
-      const answer = await this.ctx.prompt("MFA ist bereits konfiguriert. Tippe `yes`, um das Secret zu \xFCberschreiben: ");
+      const answer = await this.ctx.prompt("MFA is already configured. Type `yes` to overwrite the secret: ");
       if (answer.trim().toLowerCase() !== "yes") {
-        throw new CliError("MFA_SETUP_ABORTED", "Re-Setup nicht best\xE4tigt \u2014 bestehendes Secret bleibt aktiv.", 1);
+        throw new CliError("MFA_SETUP_ABORTED", "Re-setup not confirmed \u2014 the existing secret stays active.", 1);
       }
     }
     const setup = await this.mfa.setup(user.id, user.email, options.issuer);
@@ -253,15 +253,15 @@ var MfaSetupFlow = class {
    */
   formatSetupResult(result) {
     return [
-      `MFA-Setup f\xFCr ${result.userEmail} abgeschlossen.`,
+      `MFA setup for ${result.userEmail} completed.`,
       "",
       `Secret (Base32):  ${result.secret}`,
       `otpauth-URI:      ${result.otpauthUri}`,
       "",
-      "Bitte den otpauth-URI in den Authenticator (Google Authenticator,",
-      "1Password, \u2026) importieren oder als QR-Code in einem QR-Generator",
-      "rendern. Danach mit dem ersten TOTP-Code testen, dass der Login",
-      "funktioniert \u2014 sonst kommst du nicht mehr ans CLI."
+      "Import the otpauth URI into your authenticator (Google Authenticator,",
+      "1Password, \u2026), or render it as a QR code in a QR generator",
+      ". Then verify with the first TOTP code that login",
+      "works \u2014 otherwise you will lock yourself out of the CLI."
     ].join("\n");
   }
 };
@@ -333,16 +333,16 @@ var WhoAmIFlow = class {
   }
   formatResult(r) {
     const lines = [
-      `Identit\xE4t:        ${r.email}`,
+      `Identity:         ${r.email}`,
       `Host:             ${r.host}`,
       `Actor-Tag:        ${r.actor}`,
-      `User-ID:          ${r.userId ?? "\u2014 (User nicht gefunden)"}`,
-      `Plattform-Rolle:  ${r.isSuperAdmin ? "SUPER_ADMIN \u2713" : "\u2014 (kein SUPER_ADMIN!)"}`,
-      `MFA konfiguriert: ${r.mfaEnabled ? "\u2713" : "\u2717 \u2014 bitte `admin mfa-setup` ausf\xFChren"}`,
+      `User ID:          ${r.userId ?? "\u2014 (user not found)"}`,
+      `Platform role:    ${r.isSuperAdmin ? "SUPER_ADMIN \u2713" : "\u2014 (not a SUPER_ADMIN!)"}`,
+      `MFA configured:   ${r.mfaEnabled ? "\u2713" : "\u2717 \u2014 run `admin mfa-setup`"}`,
       `Environment:      ${r.isProduction ? "PRODUCTION" : "non-production"}`
     ];
     if (r.mfaSkipActive) {
-      lines.push("\u26A0  MFA-Bypass aktiv (SKIP-Env-Var gesetzt, non-prod)");
+      lines.push("\u26A0  MFA bypass active (SKIP env var set, non-prod)");
     }
     return lines.join("\n");
   }
@@ -478,7 +478,7 @@ var DoctorFlow = class {
   }
   formatReport(report) {
     const lines = [
-      `Doctor-Check (Gesamtstatus: ${report.overall.toUpperCase()})`,
+      `Doctor check (overall status: ${report.overall.toUpperCase()})`,
       ""
     ];
     for (const c of report.checks) {
@@ -551,62 +551,62 @@ __name(allCapabilities, "allCapabilities");
 var DEFAULT_MANIFEST_CHECKS = [
   {
     id: "manifest.schema-version",
-    label: "schemaVersion ist 1",
-    run: /* @__PURE__ */ __name((m) => m.schemaVersion === 1 ? ok("schemaVersion=1") : err(`Unerwartete schemaVersion ${m.schemaVersion}`), "run")
+    label: "schemaVersion is 1",
+    run: /* @__PURE__ */ __name((m) => m.schemaVersion === 1 ? ok("schemaVersion=1") : err(`Unexpected schemaVersion ${m.schemaVersion}`), "run")
   },
   {
     id: "manifest.hash-format",
-    label: "manifestHash folgt sha256-<base64url>-Pattern",
+    label: "manifestHash follows the sha256-<base64url> pattern",
     run: /* @__PURE__ */ __name((m) => {
       const hash = m.build?.manifestHash;
-      if (!hash) return err("manifestHash fehlt");
-      return /^sha256-[A-Za-z0-9_-]+$/.test(hash) ? ok(hash) : err(`manifestHash hat falsches Format: ${hash}`);
+      if (!hash) return err("manifestHash is missing");
+      return /^sha256-[A-Za-z0-9_-]+$/.test(hash) ? ok(hash) : err(`manifestHash has the wrong format: ${hash}`);
     }, "run")
   },
   {
     id: "manifest.project-page-component-keys",
-    label: "ProjectPage.componentKey-Format (lowercase-hyphenated ODER namespace.dot)",
+    label: "ProjectPage.componentKey format (lowercase-hyphenated OR namespace.dot)",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const p of allProjectPages(m)) {
         if (!COMPONENT_KEY_PATTERN.test(p.componentKey)) bad.push(p.componentKey);
       }
-      return bad.length === 0 ? ok(`${allProjectPages(m).length} ProjectPage(s) ok`) : err(`${bad.length} componentKey(s) verletzen das Pattern`, bad);
+      return bad.length === 0 ? ok(`${allProjectPages(m).length} ProjectPage(s) ok`) : err(`${bad.length} componentKey(s) violate the pattern`, bad);
     }, "run")
   },
   {
     id: "manifest.tenant-action-keys",
-    label: "TenantAction.actionKey-Format (domain.action \u2014 SPEC \xA74.2.1)",
+    label: "TenantAction.actionKey format (domain.action \u2014 SPEC \xA74.2.1)",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const a of allTenantActions(m)) {
         if (!TENANT_ACTION_KEY_PATTERN.test(a.actionKey)) bad.push(a.actionKey);
       }
-      return bad.length === 0 ? ok("alle actionKeys folgen domain.action") : err(`${bad.length} actionKey(s) verletzen das Pattern`, bad);
+      return bad.length === 0 ? ok("every actionKey follows domain.action") : err(`${bad.length} actionKey(s) violate the pattern`, bad);
     }, "run")
   },
   {
     id: "manifest.audit-action-keys",
-    label: "AuditAction.key-Format (SCREAMING_SNAKE_CASE)",
+    label: "AuditAction.key format (SCREAMING_SNAKE_CASE)",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const a of allAuditActions(m)) {
         if (!ACTION_KEY_PATTERN.test(a.key)) bad.push(a.key);
       }
-      return bad.length === 0 ? ok("alle AuditAction.keys SCREAMING_SNAKE_CASE") : err(`${bad.length} AuditAction.key(s) verletzen das Pattern`, bad);
+      return bad.length === 0 ? ok("every AuditAction.key is SCREAMING_SNAKE_CASE") : err(`${bad.length} AuditAction.key(s) violate the pattern`, bad);
     }, "run")
   },
   {
     id: "manifest.capabilities-pattern",
-    label: "Capability-Pattern <domain>.<action> (SPEC \xA74.2.1)",
+    label: "Capability pattern <domain>.<action> (SPEC \xA74.2.1)",
     run: /* @__PURE__ */ __name((m) => {
       const bad = allCapabilities(m).filter((c) => !CAPABILITY_PATTERN.test(c));
-      return bad.length === 0 ? ok(`${allCapabilities(m).length} Capabilities ok`) : err(`${bad.length} Capability/-ies verletzen das Pattern`, bad);
+      return bad.length === 0 ? ok(`${allCapabilities(m).length} Capabilities ok`) : err(`${bad.length} Capability/-ies violate the pattern`, bad);
     }, "run")
   },
   {
     id: "manifest.required-capabilities-known",
-    label: "requiredCapability-Referenzen existieren in capabilities-Map",
+    label: "requiredCapability references resolve against the capabilities map",
     run: /* @__PURE__ */ __name((m) => {
       const known = new Set(allCapabilities(m));
       const bad = [];
@@ -617,23 +617,23 @@ var DEFAULT_MANIFEST_CHECKS = [
       for (const k of allKpiCards(m)) visit(k.requiredCapability, k.id);
       for (const a of allTenantActions(m)) visit(a.requiredCapability, a.id);
       for (const c of allTenantColumns(m)) visit(c.requiredCapability, c.key);
-      return bad.length === 0 ? ok("alle requiredCapability-Refs aufgel\xF6st") : err(`${bad.length} unbekannte Capability-Ref(s)`, bad);
+      return bad.length === 0 ? ok("every requiredCapability ref resolves") : err(`${bad.length} unknown capability ref(s)`, bad);
     }, "run")
   },
   {
     id: "manifest.route-prefix",
-    label: "ProjectPage.route beginnt mit /admin",
+    label: "ProjectPage.route starts with /admin",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const p of allProjectPages(m)) {
         if (!p.route.startsWith(ROUTE_PREFIX)) bad.push(p.route);
       }
-      return bad.length === 0 ? ok("alle ProjectPage-Routes unter /admin") : err(`${bad.length} Route(s) ohne /admin-Prefix`, bad);
+      return bad.length === 0 ? ok("every ProjectPage route is under /admin") : err(`${bad.length} route(s) without the /admin prefix`, bad);
     }, "run")
   },
   {
     id: "manifest.kpi-slot-priority",
-    label: "KpiCard.slotPriority (falls gesetzt) ist endliche Zahl",
+    label: "KpiCard.slotPriority (if set) is a finite number",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const k of allKpiCards(m)) {
@@ -641,12 +641,12 @@ var DEFAULT_MANIFEST_CHECKS = [
           bad.push(k.id);
         }
       }
-      return bad.length === 0 ? ok("alle slotPriority-Werte endlich") : err(`${bad.length} KpiCard(s) mit ung\xFCltiger slotPriority`, bad);
+      return bad.length === 0 ? ok("every slotPriority value is finite") : err(`${bad.length} KpiCard(s) with an invalid slotPriority`, bad);
     }, "run")
   },
   {
     id: "manifest.unique-project-page-ids",
-    label: "ProjectPage.id ist unique",
+    label: "ProjectPage.id is unique",
     run: /* @__PURE__ */ __name((m) => {
       const seen = /* @__PURE__ */ new Map();
       for (const p of allProjectPages(m)) {
@@ -655,12 +655,12 @@ var DEFAULT_MANIFEST_CHECKS = [
       const dups = [
         ...seen.entries()
       ].filter(([, n]) => n > 1).map(([k]) => k);
-      return dups.length === 0 ? ok("alle ProjectPage.id eindeutig") : err(`${dups.length} doppelte ProjectPage.id`, dups);
+      return dups.length === 0 ? ok("every ProjectPage.id is unique") : err(`${dups.length} duplicate ProjectPage.id(s)`, dups);
     }, "run")
   },
   {
     id: "manifest.unique-action-keys",
-    label: "actionKeys sind je Namespace (TenantAction / AuditAction) eindeutig",
+    label: "actionKeys are unique per namespace (TenantAction / AuditAction)",
     run: /* @__PURE__ */ __name((m) => {
       const dups = [];
       const tenantSeen = /* @__PURE__ */ new Map();
@@ -677,21 +677,21 @@ var DEFAULT_MANIFEST_CHECKS = [
       for (const [k, n] of auditSeen) {
         if (n > 1) dups.push(`AuditAction:${k}`);
       }
-      return dups.length === 0 ? ok("alle actionKeys je Namespace eindeutig") : err(`${dups.length} doppelte actionKey(s)`, dups);
+      return dups.length === 0 ? ok("every actionKey is unique per namespace") : err(`${dups.length} duplicate actionKey(s)`, dups);
     }, "run")
   },
   {
     id: "manifest.tenant-columns-batchable",
-    label: "TenantColumns haben endpoint-Pfad f\xFCr Batch-Fetch",
+    label: "tenant columns carry an endpoint path for batch fetching",
     run: /* @__PURE__ */ __name((m) => {
       const bad = [];
       for (const c of allTenantColumns(m)) {
         if (!c.endpoint || c.endpoint.trim().length === 0) bad.push(c.key);
         else if (c.endpoint.includes("{slug}") || c.endpoint.includes("{tenantId}")) {
-          bad.push(`${c.key} (per-Tenant statt batch)`);
+          bad.push(`${c.key} (per-tenant instead of batch)`);
         }
       }
-      return bad.length === 0 ? ok("alle TenantColumns batch-f\xE4hig") : err(`${bad.length} TenantColumn(s) verletzen Batch-Pflicht`, bad);
+      return bad.length === 0 ? ok("every tenant column supports batch fetching") : err(`${bad.length} TenantColumn(s) violate the batch requirement`, bad);
     }, "run")
   }
 ];
@@ -737,7 +737,7 @@ var ManifestCliFlow = class {
   hash() {
     const m = this.access.getManifest();
     const h = m.build?.manifestHash;
-    if (!h) throw new Error("manifestHash fehlt im Manifest \u2014 Boot-Zeit-Bug?");
+    if (!h) throw new Error("manifestHash is missing from the manifest \u2014 a boot-time bug?");
     return h;
   }
   /**
@@ -751,19 +751,19 @@ var ManifestCliFlow = class {
     if (m.schemaVersion !== 1) {
       return {
         ok: false,
-        reason: `Unerwartete schemaVersion ${m.schemaVersion}`
+        reason: `Unexpected schemaVersion ${m.schemaVersion}`
       };
     }
     if (!m.project?.key) {
       return {
         ok: false,
-        reason: "Kein `project.key` im Manifest"
+        reason: "No `project.key` in the manifest"
       };
     }
     if (!m.build?.manifestHash) {
       return {
         ok: false,
-        reason: "manifestHash fehlt"
+        reason: "manifestHash is missing"
       };
     }
     return {
@@ -815,7 +815,7 @@ var ManifestCliFlow = class {
           id: check.id,
           label: check.label,
           severity: "error",
-          message: `Check warf eine Exception: ${message}`
+          message: `The check threw an exception: ${message}`
         });
         overall = "error";
       }
@@ -831,7 +831,7 @@ var ManifestCliFlow = class {
   }
   formatReport(report) {
     const lines = [
-      `Manifest-Check (Gesamtstatus: ${report.overall.toUpperCase()})`,
+      `Manifest check (overall status: ${report.overall.toUpperCase()})`,
       ""
     ];
     for (const c of report.checks) {
@@ -893,7 +893,7 @@ var PlanCatalogDoctorCheck = class {
   }
   catalog;
   id = "platform.plan-catalog";
-  label = "Plan-Catalog im DI";
+  label = "Plan catalog in DI";
   constructor(catalog) {
     this.catalog = catalog;
   }
@@ -902,12 +902,12 @@ var PlanCatalogDoctorCheck = class {
     if (plans.length === 0) {
       return {
         severity: "error",
-        message: "PlanCatalog enth\xE4lt keine Pl\xE4ne \u2014 Onboarding-Pricing-Page wird leer."
+        message: "The plan catalog contains no plans \u2014 the onboarding pricing page will be empty."
       };
     }
     return {
       severity: "ok",
-      message: `${plans.length} Plan(s), ${this.catalog.features?.length ?? 0} Feature(s) geladen.`,
+      message: `${plans.length} plan(s), ${this.catalog.features?.length ?? 0} feature(s) loaded.`,
       details: {
         projectKey: this.catalog.projectKey,
         planIds: plans.map((p) => p.id)
@@ -929,7 +929,7 @@ var DiscoverySnapshotDoctorCheck = class {
   }
   snapshot;
   id = "platform.discovery-snapshot";
-  label = "Discovery-Snapshot beim Boot";
+  label = "Discovery snapshot on boot";
   constructor(snapshot) {
     this.snapshot = snapshot;
   }
@@ -938,7 +938,7 @@ var DiscoverySnapshotDoctorCheck = class {
     if (caps.length === 0) {
       return {
         severity: "warning",
-        message: "Keine Capabilities entdeckt \u2014 Decorator-tragende Module evtl. nicht in AppModule.imports[]."
+        message: "No capabilities discovered \u2014 decorator-carrying modules may be missing from AppModule.imports[]."
       };
     }
     return {
@@ -961,7 +961,7 @@ var UserPortDoctorCheck = class {
   }
   users;
   id = "platform.user-port";
-  label = "UserPort.findByEmail erreichbar";
+  label = "UserPort.findByEmail reachable";
   constructor(users) {
     this.users = users;
   }
@@ -970,12 +970,12 @@ var UserPortDoctorCheck = class {
       await this.users.findByEmail("__doctor-check__@invalid.local");
       return {
         severity: "ok",
-        message: "UserPort antwortet."
+        message: "UserPort responds."
       };
     } catch (err2) {
       return {
         severity: "error",
-        message: `UserPort wirft: ${err2 instanceof Error ? err2.message : String(err2)}`
+        message: `UserPort throws: ${err2 instanceof Error ? err2.message : String(err2)}`
       };
     }
   }
@@ -994,7 +994,7 @@ var AdminManifestDoctorCheck = class {
   }
   manifest;
   id = "platform.admin-manifest";
-  label = "AdminManifestService liefert Manifest";
+  label = "AdminManifestService returns a manifest";
   constructor(manifest) {
     this.manifest = manifest;
   }
@@ -1004,12 +1004,12 @@ var AdminManifestDoctorCheck = class {
       const pageCount = Object.keys(m.navigation?.standardPages ?? {}).length;
       return {
         severity: "ok",
-        message: `Manifest mit ${pageCount} Standard-Pages, Hash ${m.build?.manifestHash?.slice(0, 12) ?? "???"}\u2026`
+        message: `Manifest with ${pageCount} standard pages, hash ${m.build?.manifestHash?.slice(0, 12) ?? "???"}\u2026`
       };
     } catch (err2) {
       return {
         severity: "error",
-        message: `Manifest-Build wirft: ${err2 instanceof Error ? err2.message : String(err2)}`
+        message: `Manifest build throws: ${err2 instanceof Error ? err2.message : String(err2)}`
       };
     }
   }
@@ -1152,11 +1152,11 @@ function applyFragmentBlocks(schema, fragmentBlocks, options = {}) {
   const header = options.fragmentLabel ? `
 
 // ============================================================
-// Eingef\xFCgt durch \`saasicat schema apply\` aus ${options.fragmentLabel}
+// Inserted by \`saasicat schema apply\` from ${options.fragmentLabel}
 // ============================================================
 ` : `
 
-// Eingef\xFCgt durch \`saasicat schema apply\`
+// Inserted by \`saasicat schema apply\`
 `;
   const trimmedSchema = schema.endsWith("\n") ? schema : schema + "\n";
   return {
@@ -1470,7 +1470,7 @@ ManifestDumpCommand = _ts_decorate9([
   Injectable8(),
   SubCommand({
     name: "dump",
-    description: "Manifest als JSON ausgeben"
+    description: "Print the manifest as JSON"
   }),
   _ts_metadata8("design:type", Function),
   _ts_metadata8("design:paramtypes", [
@@ -1510,7 +1510,7 @@ ManifestHashCommand = _ts_decorate9([
   Injectable8(),
   SubCommand({
     name: "hash",
-    description: "manifestHash ausgeben (CI-Pinning)"
+    description: "Print the manifestHash (CI pinning)"
   }),
   _ts_metadata8("design:type", Function),
   _ts_metadata8("design:paramtypes", [
@@ -1532,7 +1532,7 @@ var ManifestValidateCommand = class extends CommandRunner {
     await this.ctx.ensureSuperAdmin(identity);
     const result = this.flow.validate();
     if (result.ok) {
-      process.stdout.write("Manifest validiert \u2713\n");
+      process.stdout.write("Manifest is valid \u2713\n");
       return;
     }
     process.stderr.write(`Manifest invalid: ${result.reason}
@@ -1557,7 +1557,7 @@ ManifestValidateCommand = _ts_decorate9([
   Injectable8(),
   SubCommand({
     name: "validate",
-    description: "Schnell-Sanity (schemaVersion + project.key + manifestHash)"
+    description: "Quick sanity check (schemaVersion + project.key + manifestHash)"
   }),
   _ts_metadata8("design:type", Function),
   _ts_metadata8("design:paramtypes", [
@@ -1600,7 +1600,7 @@ ManifestCheckCommand = _ts_decorate9([
   Injectable8(),
   SubCommand({
     name: "check",
-    description: "Alle Manifest-Checks (Exit-Code 7 bei error/Drift)"
+    description: "All manifest checks (exit code 7 on error/drift)"
   }),
   _ts_metadata8("design:type", Function),
   _ts_metadata8("design:paramtypes", [
@@ -1613,7 +1613,7 @@ var ManifestCommands = class extends CommandRunner {
     __name(this, "ManifestCommands");
   }
   async run() {
-    process.stderr.write("Bitte Sub-Command angeben: dump, hash, validate, check.\n");
+    process.stderr.write("Specify a sub-command: dump, hash, validate, check.\n");
     process.exit(2);
   }
 };
@@ -1621,7 +1621,7 @@ ManifestCommands = _ts_decorate9([
   Injectable8(),
   Command({
     name: "manifest",
-    description: "Manifest-Operations (dump, hash, validate, check)",
+    description: "Manifest operations (dump, hash, validate, check)",
     subCommands: [
       ManifestDumpCommand,
       ManifestHashCommand,
@@ -1682,7 +1682,7 @@ AdminWhoamiCommand = _ts_decorate10([
   Injectable9(),
   SubCommand2({
     name: "whoami",
-    description: "Aktive CLI-Identit\xE4t + MFA-/Production-Status"
+    description: "Active CLI identity plus MFA and production status"
   }),
   _ts_metadata9("design:type", Function),
   _ts_metadata9("design:paramtypes", [
@@ -1734,7 +1734,7 @@ _ts_decorate10([
 _ts_decorate10([
   Option2({
     flags: "--force",
-    description: "bestehendes Secret ohne R\xFCckfrage \xFCberschreiben"
+    description: "overwrite an existing secret without asking"
   }),
   _ts_metadata9("design:type", Function),
   _ts_metadata9("design:paramtypes", []),
@@ -1744,7 +1744,7 @@ AdminMfaSetupCommand = _ts_decorate10([
   Injectable9(),
   SubCommand2({
     name: "mfa-setup",
-    description: "TOTP-MFA f\xFCr den eigenen SuperAdmin einrichten"
+    description: "Set up TOTP MFA for your own super-admin account"
   }),
   _ts_param7(0, Inject7(CLI_CONTEXT_CONFIG_TOKEN)),
   _ts_metadata9("design:type", Function),
@@ -1758,7 +1758,7 @@ var AdminCommands = class extends CommandRunner2 {
     __name(this, "AdminCommands");
   }
   async run() {
-    process.stderr.write("Bitte Sub-Command angeben: whoami, mfa-setup.\n");
+    process.stderr.write("Specify a sub-command: whoami, mfa-setup.\n");
     process.exit(2);
   }
 };
@@ -1892,7 +1892,7 @@ AuditTailCommand = _ts_decorate11([
   Injectable10(),
   SubCommand3({
     name: "tail",
-    description: "Letzte Audit-Log-Eintr\xE4ge (--actor/--action/--entity/--since/--limit)"
+    description: "Most recent audit-log entries (--actor/--action/--entity/--since/--limit)"
   }),
   _ts_metadata10("design:type", Function),
   _ts_metadata10("design:paramtypes", [
@@ -1905,7 +1905,7 @@ var AuditCommands = class extends CommandRunner3 {
     __name(this, "AuditCommands");
   }
   async run() {
-    process.stderr.write("Bitte Sub-Command angeben: tail.\n");
+    process.stderr.write("Specify a sub-command: tail.\n");
     process.exit(2);
   }
 };
@@ -1969,7 +1969,7 @@ DoctorCommands = _ts_decorate12([
   Injectable11(),
   Command4({
     name: "doctor",
-    description: "Health-/Drift-Checks (Exit-Code 4 bei error)"
+    description: "Health/drift checks (exit code 4 on error)"
   }),
   _ts_metadata11("design:type", Function),
   _ts_metadata11("design:paramtypes", [
@@ -2012,7 +2012,7 @@ var DiscoveryScanCommand = class extends CommandRunner5 {
   }
   async run(_args, flags) {
     if (!this.scanner) {
-      this.fail("DiscoveryScanner nicht registriert \u2014 DiscoveryModule.forRoot() im CLI-Modul importieren.", flags);
+      this.fail("DiscoveryScanner is not registered \u2014 import DiscoveryModule.forRoot() in the CLI module.", flags);
       return;
     }
     try {
@@ -2028,10 +2028,10 @@ var DiscoveryScanCommand = class extends CommandRunner5 {
       process.stdout.write(`Discovery-Scan (${snapshot.app.key} v${snapshot.app.version}): ${snapshot.capabilities.length} Capabilities \xB7 ${snapshot.features.length} Features \xB7 ${snapshot.quotas.length} Quotas \xB7 hash ${snapshot.hash.slice(0, 19)}\u2026
 `);
       if (target) {
-        process.stdout.write(`Snapshot persistiert: ${resolvePath(target)}
+        process.stdout.write(`Snapshot persisted: ${resolvePath(target)}
 `);
       } else {
-        process.stderr.write("WARNUNG: Snapshot wurde nicht persistiert \u2014 weder snapshotPath (DiscoveryModule.forRoot) konfiguriert noch --out angegeben. Das Seed-Gate findet so keinen Snapshot.\n");
+        process.stderr.write("WARNING: the snapshot was not persisted \u2014 neither snapshotPath (DiscoveryModule.forRoot) configured nor --out given. The seed gate will find no snapshot this way.\n");
       }
     } catch (err2) {
       this.fail(err2 instanceof Error ? err2.message : String(err2), flags);
@@ -2044,7 +2044,7 @@ var DiscoveryScanCommand = class extends CommandRunner5 {
 `);
       return;
     }
-    process.stderr.write(`[discovery scan] FEHLER: ${message}
+    process.stderr.write(`[discovery scan] ERROR: ${message}
 `);
     process.exit(4);
   }
@@ -2058,7 +2058,7 @@ var DiscoveryScanCommand = class extends CommandRunner5 {
 _ts_decorate13([
   Option5({
     flags: "--out <path>",
-    description: "Snapshot zus\xE4tzlich an diesen Pfad schreiben"
+    description: "Additionally write the snapshot to this path"
   }),
   _ts_metadata12("design:type", Function),
   _ts_metadata12("design:paramtypes", [
@@ -2069,7 +2069,7 @@ _ts_decorate13([
 _ts_decorate13([
   Option5({
     flags: "--non-fatal",
-    description: "Scan-Fehler nur als Warnung melden (Exit 0) \u2014 gestufter Rollout"
+    description: "Report scan errors as a warning only (exit 0) \u2014 staged rollout"
   }),
   _ts_metadata12("design:type", Function),
   _ts_metadata12("design:paramtypes", []),
@@ -2079,7 +2079,7 @@ DiscoveryScanCommand = _ts_decorate13([
   Injectable12(),
   SubCommand4({
     name: "scan",
-    description: "Discovery-Snapshot headless erzeugen + persistieren (Seed-Gate, #23)"
+    description: "Produce and persist a discovery snapshot headlessly (seed gate, #23)"
   }),
   _ts_param8(0, Optional()),
   _ts_param8(0, Inject8(DiscoveryScanner)),
@@ -2096,7 +2096,7 @@ var DiscoveryCommands = class extends CommandRunner5 {
     __name(this, "DiscoveryCommands");
   }
   async run() {
-    process.stderr.write("Bitte Sub-Command angeben: scan.\n");
+    process.stderr.write("Specify a sub-command: scan.\n");
     process.exit(2);
   }
 };
@@ -2162,12 +2162,12 @@ var UserCommands = class extends CommandRunner6 {
       case "deactivate":
         return this.deactivate(args[1], flags, identity, me.id);
       default:
-        throw new CliError("UNKNOWN_SUBCOMMAND", `Unbekannter Subbefehl: user ${sub ?? "(leer)"}. Verf\xFCgbar: create-super-admin <email>, reassign-admin <slug>, list <slug>, reset-password <email>, deactivate <email>.`, 1);
+        throw new CliError("UNKNOWN_SUBCOMMAND", `Unknown sub-command: user ${sub ?? "(empty)"}. Available: create-super-admin <email>, reassign-admin <slug>, list <slug>, reset-password <email>, deactivate <email>.`, 1);
     }
   }
   async createSuperAdmin(email, flags, identity, meId, meEmail) {
     if (!email) {
-      throw new CliError("MISSING_ARG", "user create-super-admin <email> erwartet eine E-Mail.", 1);
+      throw new CliError("MISSING_ARG", "user create-super-admin <email> expects an email address.", 1);
     }
     await this.ctx.requireMfa(meId);
     await this.ctx.ensureProductionConfirmation({
@@ -2192,20 +2192,20 @@ var UserCommands = class extends CommandRunner6 {
         createdBy: meEmail
       }
     });
-    console.log(`\u2714 SUPER_ADMIN ${created.email} angelegt (durch ${meEmail}).`);
+    console.log(`\u2714 SUPER_ADMIN ${created.email} created (by ${meEmail}).`);
     console.log(`  User-ID: ${created.id}`);
     if (generated) {
-      console.log(`  Passwort: ${password}`);
-      console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+      console.log(`  Password: ${password}`);
+      console.log("  \u2192 Share it securely. Change it on first login.");
     }
-    console.log(`  N\xE4chster Schritt: admin mfa-setup f\xFCr ${created.email}.`);
+    console.log(`  Next step: admin mfa-setup for ${created.email}.`);
   }
   async reassignAdmin(slug, flags, identity, meId) {
     if (!slug) {
-      throw new CliError("MISSING_ARG", "user reassign-admin <tenant-slug> erwartet einen Slug.", 1);
+      throw new CliError("MISSING_ARG", "user reassign-admin <tenant-slug> expects a slug.", 1);
     }
-    if (!flags.to) throw new CliError("MISSING_FLAG", "--to=<email> ist Pflicht.", 1);
-    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    if (!flags.to) throw new CliError("MISSING_FLAG", "--to=<email> is required.", 1);
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" is required.', 1);
     await this.ctx.requireMfa(meId);
     const result = await this.users.reassignTenantAdmin(slug, flags.to.toLowerCase());
     await this.ctx.log({
@@ -2223,18 +2223,18 @@ var UserCommands = class extends CommandRunner6 {
       }
     });
     if (result.created) {
-      console.log(`\u2714 Notfall-Admin ${result.user.email} f\xFCr ${slug} angelegt.`);
+      console.log(`\u2714 Emergency admin ${result.user.email} created for ${slug}.`);
       if (result.oneTimePassword) {
-        console.log(`  Initial-Passwort: ${result.oneTimePassword}`);
-        console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+        console.log(`  Initial password: ${result.oneTimePassword}`);
+        console.log("  \u2192 Share it securely. Change it on first login.");
       }
     } else {
-      console.log(`\u2714 ${result.user.email} ist jetzt TENANT_ADMIN von ${slug}.`);
+      console.log(`\u2714 ${result.user.email} is now TENANT_ADMIN of ${slug}.`);
     }
   }
   async list(slug) {
     if (!slug) {
-      throw new CliError("MISSING_ARG", "user list <tenant-slug> erwartet einen Slug.", 1);
+      throw new CliError("MISSING_ARG", "user list <tenant-slug> expects a slug.", 1);
     }
     const rows = await this.users.listTenantUsers(slug);
     this.ctx.table(rows.map((u) => ({
@@ -2246,9 +2246,9 @@ var UserCommands = class extends CommandRunner6 {
   }
   async resetPassword(email, flags, identity, meId) {
     if (!email) {
-      throw new CliError("MISSING_ARG", "user reset-password <email> erwartet eine E-Mail.", 1);
+      throw new CliError("MISSING_ARG", "user reset-password <email> expects an email address.", 1);
     }
-    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" is required.', 1);
     const result = await this.users.triggerPasswordReset(email.toLowerCase());
     await this.ctx.log({
       identity,
@@ -2261,18 +2261,18 @@ var UserCommands = class extends CommandRunner6 {
       }
     });
     if (result.oneTimePassword) {
-      console.log(`\u2714 Einmal-Passwort f\xFCr ${result.user.email} gesetzt.`);
-      console.log(`  Passwort: ${result.oneTimePassword}`);
-      console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+      console.log(`\u2714 One-time password set for ${result.user.email}.`);
+      console.log(`  Password: ${result.oneTimePassword}`);
+      console.log("  \u2192 Share it securely. Change it on first login.");
     } else {
-      console.log(`\u2714 Passwort-Reset f\xFCr ${result.user.email} ausgel\xF6st.`);
+      console.log(`\u2714 Password reset triggered for ${result.user.email}.`);
     }
   }
   async deactivate(email, flags, identity, meId) {
     if (!email) {
-      throw new CliError("MISSING_ARG", "user deactivate <email> erwartet eine E-Mail.", 1);
+      throw new CliError("MISSING_ARG", "user deactivate <email> expects an email address.", 1);
     }
-    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" is required.', 1);
     await this.ctx.requireMfa(meId);
     await this.ctx.ensureProductionConfirmation({
       yes: flags.yes
@@ -2289,7 +2289,7 @@ var UserCommands = class extends CommandRunner6 {
         emergency: true
       }
     });
-    console.log(`\u2714 ${user.email} deaktiviert.`);
+    console.log(`\u2714 ${user.email} deactivated.`);
   }
   parseAs(val) {
     return val;
@@ -2316,7 +2316,7 @@ var UserCommands = class extends CommandRunner6 {
 _ts_decorate14([
   Option6({
     flags: "--as <email>",
-    description: "CLI-Identit\xE4t (sonst <APP>_ADMIN_EMAIL)"
+    description: "CLI identity (otherwise <APP>_ADMIN_EMAIL)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2327,7 +2327,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "--to <email>",
-    description: "Ziel-User (reassign-admin)"
+    description: "Target user (reassign-admin)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2338,7 +2338,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "--reason <text>",
-    description: "Begr\xFCndung (Audit)"
+    description: "Reason (audit)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2349,7 +2349,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "-y, --yes",
-    description: "Production-Confirmation \xFCberspringen"
+    description: "Skip the production confirmation"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", []),
@@ -2358,7 +2358,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "--first <name>",
-    description: "Vorname (create-super-admin)"
+    description: "First name (create-super-admin)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2369,7 +2369,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "--last <name>",
-    description: "Nachname (create-super-admin)"
+    description: "Last name (create-super-admin)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2380,7 +2380,7 @@ _ts_decorate14([
 _ts_decorate14([
   Option6({
     flags: "--password <pwd>",
-    description: "Passwort (create-super-admin; ohne Angabe generiert)"
+    description: "Password (create-super-admin; generated when omitted)"
   }),
   _ts_metadata13("design:type", Function),
   _ts_metadata13("design:paramtypes", [
@@ -2392,7 +2392,7 @@ UserCommands = _ts_decorate14([
   Injectable13(),
   Command6({
     name: "user",
-    description: "User-Operationen (create-super-admin, reassign-admin, list, reset-password, deactivate)"
+    description: "User operations (create-super-admin, reassign-admin, list, reset-password, deactivate)"
   }),
   _ts_param9(1, Inject9(USER_MANAGEMENT_PORT_TOKEN)),
   _ts_metadata13("design:type", Function),