@saasicat/cli 0.2.0

package/dist/index.cjs

@@ -0,0 +1,2284 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AUDIT_QUERY_PORT_TOKEN: () => AUDIT_QUERY_PORT_TOKEN,
+  AdminCommands: () => AdminCommands,
+  AdminManifestDoctorCheck: () => AdminManifestDoctorCheck,
+  AdminMfaSetupCommand: () => AdminMfaSetupCommand,
+  AdminWhoamiCommand: () => AdminWhoamiCommand,
+  AuditCommands: () => AuditCommands,
+  AuditTailCommand: () => AuditTailCommand,
+  AuditTailFlow: () => AuditTailFlow,
+  CLI_CONTEXT_CONFIG_TOKEN: () => CLI_CONTEXT_CONFIG_TOKEN,
+  CliContextModule: () => CliContextModule,
+  CliContextService: () => CliContextService,
+  CliError: () => CliError,
+  DEFAULT_MANIFEST_CHECKS: () => DEFAULT_MANIFEST_CHECKS,
+  DOCTOR_CHECKS_TOKEN: () => DOCTOR_CHECKS_TOKEN,
+  DiscoveryCommands: () => DiscoveryCommands,
+  DiscoveryScanCommand: () => DiscoveryScanCommand,
+  DiscoverySnapshotDoctorCheck: () => DiscoverySnapshotDoctorCheck,
+  DoctorCommands: () => DoctorCommands,
+  DoctorFlow: () => DoctorFlow,
+  MANIFEST_ACCESS_PORT_TOKEN: () => MANIFEST_ACCESS_PORT_TOKEN,
+  MANIFEST_CHECKS_TOKEN: () => MANIFEST_CHECKS_TOKEN,
+  ManifestCheckCommand: () => ManifestCheckCommand,
+  ManifestCliFlow: () => ManifestCliFlow,
+  ManifestCommands: () => ManifestCommands,
+  ManifestDumpCommand: () => ManifestDumpCommand,
+  ManifestHashCommand: () => ManifestHashCommand,
+  ManifestValidateCommand: () => ManifestValidateCommand,
+  MfaSetupFlow: () => MfaSetupFlow,
+  PLATFORM_DOCTOR_CHECK_PROVIDERS: () => PLATFORM_DOCTOR_CHECK_PROVIDERS,
+  PlanCatalogDoctorCheck: () => PlanCatalogDoctorCheck,
+  USER_MANAGEMENT_PORT_TOKEN: () => USER_MANAGEMENT_PORT_TOKEN,
+  USER_PORT_TOKEN: () => USER_PORT_TOKEN,
+  UserCommands: () => UserCommands,
+  UserPortDoctorCheck: () => UserPortDoctorCheck,
+  WhoAmIFlow: () => WhoAmIFlow,
+  applyFragmentBlocks: () => applyFragmentBlocks,
+  extractModelBlocks: () => extractModelBlocks,
+  extractModelNames: () => extractModelNames
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/tokens.ts
+var CLI_CONTEXT_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/Config");
+var USER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/UserPort");
+var USER_MANAGEMENT_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/UserManagementPort");
+var AUDIT_QUERY_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/AuditQueryPort");
+var DOCTOR_CHECKS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/DoctorChecks");
+var MANIFEST_ACCESS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/ManifestAccessPort");
+var MANIFEST_CHECKS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-cli/ManifestChecks");
+
+// src/cli-context.service.ts
+var os = __toESM(require("os"), 1);
+var readline = __toESM(require("readline"), 1);
+var import_common = require("@nestjs/common");
+var import_nest = require("@saasicat/nest");
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var CliContextService = class {
+  static {
+    __name(this, "CliContextService");
+  }
+  config;
+  users;
+  mfa;
+  audit;
+  constructor(config, users, mfa, audit) {
+    this.config = config;
+    this.users = users;
+    this.mfa = mfa;
+    this.audit = audit;
+  }
+  // ---------------------------------------------------------------------
+  // §1 Identity
+  // ---------------------------------------------------------------------
+  resolveIdentity(asFlag) {
+    const fromEnv = process.env[this.config.adminEmailEnvVar] ?? "";
+    const email = (asFlag ?? fromEnv).trim().toLowerCase();
+    if (!email) {
+      throw new CliError("NO_IDENTITY", `Keine Admin-Identit\xE4t gesetzt. Bitte $${this.config.adminEmailEnvVar} setzen oder --as <email> \xFCbergeben.`, 2);
+    }
+    const host = os.hostname();
+    return {
+      email,
+      host,
+      actor: `cli:${email}:${host}`
+    };
+  }
+  /**
+   * Loads + validates the user for a CLI identity:
+   *   - user exists + active
+   *   - user has platform role SUPER_ADMIN
+   *
+   * Throws `CliError(NOT_SUPER_ADMIN, exit=2)` otherwise.
+   */
+  async ensureSuperAdmin(identity) {
+    const user = await this.users.findByEmail(identity.email);
+    if (!user || user.deletedAt || !user.isActive) {
+      throw new CliError("USER_NOT_FOUND", `SUPER_ADMIN-User ${identity.email} nicht gefunden oder inaktiv.`, 2);
+    }
+    if (user.platformRole !== "SUPER_ADMIN") {
+      throw new CliError("NOT_SUPER_ADMIN", `User ${identity.email} hat Rolle ${user.platformRole} \u2014 nur SUPER_ADMIN darf das CLI nutzen.`, 2);
+    }
+    return user;
+  }
+  // ---------------------------------------------------------------------
+  // §2 MFA — mandatory TOTP
+  // ---------------------------------------------------------------------
+  /**
+   * Prompts the user for a TOTP code and verifies it against the stored
+   * secret (via the platform `MfaService` → `MfaPort`).
+   *
+   * Bypass: `process.env[mfaSkipEnvVar] === '1'` AND `!isProductionEnvironment()`.
+   */
+  async requireMfa(userId) {
+    if (process.env[this.config.mfaSkipEnvVar] === "1" && !this.config.isProductionEnvironment()) {
+      return;
+    }
+    const enabled = await this.mfa.isEnabled(userId);
+    if (!enabled) {
+      throw new CliError("MFA_NOT_SET_UP", "MFA ist nicht konfiguriert. Bitte zuerst 'admin mfa-setup' ausf\xFChren.", 3);
+    }
+    const code = await this.prompt("TOTP-Code: ");
+    const ok2 = await this.mfa.verify({
+      userId,
+      code
+    });
+    if (!ok2) {
+      throw new CliError("MFA_FAILED", "TOTP-Code ung\xFCltig.", 3);
+    }
+  }
+  // ---------------------------------------------------------------------
+  // §3 Production confirmation
+  // ---------------------------------------------------------------------
+  async ensureProductionConfirmation(opts = {}) {
+    if (!this.config.isProductionEnvironment()) return;
+    if (opts.yes) return;
+    const answer = await this.prompt("Tippe production zur Best\xE4tigung: ");
+    if (answer.trim().toLowerCase() !== "production") {
+      throw new CliError("PRODUCTION_CONFIRM_ABORTED", "Production-Confirmation abgebrochen.", 1);
+    }
+  }
+  // ---------------------------------------------------------------------
+  // §5 Audit
+  // ---------------------------------------------------------------------
+  /**
+   * Writes an audit-log entry with the CLI actor tag. Wrapper over
+   * `AdminAuditService.log` with automatic `fromCli` construction.
+   */
+  async log(input) {
+    const actor = this.audit.fromCli({
+      id: input.userId,
+      email: input.identity.email
+    });
+    await this.audit.log({
+      actor,
+      entity: input.entity,
+      entityId: input.entityId,
+      action: input.action,
+      changes: input.changes
+    });
+  }
+  // ---------------------------------------------------------------------
+  // Output helpers (§4)
+  // ---------------------------------------------------------------------
+  table(rows) {
+    if (rows.length === 0) {
+      console.log("\u2014 keine Eintr\xE4ge \u2014");
+      return;
+    }
+    console.table(rows);
+  }
+  /**
+   * Reads a line from stdin. Override hook for tests: set
+   * `process.env.SAAS_PLATFORM_CLI_PROMPT_REPLY` to a reply, then
+   * the method succeeds without interaction.
+   */
+  async prompt(question) {
+    const testReply = process.env.SAAS_PLATFORM_CLI_PROMPT_REPLY;
+    if (testReply !== void 0) return testReply;
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    return new Promise((resolve) => {
+      rl.question(question, (answer) => {
+        rl.close();
+        resolve(answer);
+      });
+    });
+  }
+};
+CliContextService = _ts_decorate([
+  (0, import_common.Injectable)(),
+  _ts_param(0, (0, import_common.Inject)(CLI_CONTEXT_CONFIG_TOKEN)),
+  _ts_param(1, (0, import_common.Inject)(USER_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof CliContextConfig === "undefined" ? Object : CliContextConfig,
+    typeof UserPort === "undefined" ? Object : UserPort,
+    typeof import_nest.MfaService === "undefined" ? Object : import_nest.MfaService,
+    typeof import_nest.AdminAuditService === "undefined" ? Object : import_nest.AdminAuditService
+  ])
+], CliContextService);
+var CliError = class extends Error {
+  static {
+    __name(this, "CliError");
+  }
+  code;
+  exitCode;
+  constructor(code, message, exitCode) {
+    super(message), this.code = code, this.exitCode = exitCode;
+    this.name = "CliError";
+  }
+};
+
+// src/mfa-setup-flow.ts
+var import_common2 = require("@nestjs/common");
+var import_nest2 = require("@saasicat/nest");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var MfaSetupFlow = class {
+  static {
+    __name(this, "MfaSetupFlow");
+  }
+  ctx;
+  mfa;
+  constructor(ctx, mfa) {
+    this.ctx = ctx;
+    this.mfa = mfa;
+  }
+  /**
+   * Runs the full setup flow. Throws `CliError` subclasses on
+   * auth/identity/confirmation errors.
+   */
+  async run(options) {
+    const identity = this.ctx.resolveIdentity(options.asFlag);
+    const user = await this.ctx.ensureSuperAdmin(identity);
+    const alreadyEnabled = await this.mfa.isEnabled(user.id);
+    if (alreadyEnabled && !options.force) {
+      const answer = await this.ctx.prompt("MFA ist bereits konfiguriert. Tippe `yes`, um das Secret zu \xFCberschreiben: ");
+      if (answer.trim().toLowerCase() !== "yes") {
+        throw new CliError("MFA_SETUP_ABORTED", "Re-Setup nicht best\xE4tigt \u2014 bestehendes Secret bleibt aktiv.", 1);
+      }
+    }
+    const setup = await this.mfa.setup(user.id, user.email, options.issuer);
+    await this.ctx.log({
+      identity,
+      userId: user.id,
+      entity: "User",
+      entityId: user.id,
+      action: alreadyEnabled ? "MFA_SETUP_RESET" : "MFA_SETUP_COMPLETED",
+      changes: {
+        issuer: options.issuer
+      }
+    });
+    return {
+      secret: setup.secret,
+      otpauthUri: setup.otpauthUri,
+      userId: user.id,
+      userEmail: user.email
+    };
+  }
+  /**
+   * Helper: returns a human-readable output block with secret + otpauthUri
+   * for `console.log` in the consumer command. Consumers may prepend their
+   * own QR-code renderer (e.g. `qrcode-terminal`).
+   */
+  formatSetupResult(result) {
+    return [
+      `MFA-Setup f\xFCr ${result.userEmail} abgeschlossen.`,
+      "",
+      `Secret (Base32):  ${result.secret}`,
+      `otpauth-URI:      ${result.otpauthUri}`,
+      "",
+      "Bitte den otpauth-URI in den Authenticator (Google Authenticator,",
+      "1Password, \u2026) importieren oder als QR-Code in einem QR-Generator",
+      "rendern. Danach mit dem ersten TOTP-Code testen, dass der Login",
+      "funktioniert \u2014 sonst kommst du nicht mehr ans CLI."
+    ].join("\n");
+  }
+};
+MfaSetupFlow = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof import_nest2.MfaService === "undefined" ? Object : import_nest2.MfaService
+  ])
+], MfaSetupFlow);
+
+// src/whoami-flow.ts
+var import_common3 = require("@nestjs/common");
+var import_nest3 = require("@saasicat/nest");
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var WhoAmIFlow = class {
+  static {
+    __name(this, "WhoAmIFlow");
+  }
+  config;
+  ctx;
+  mfa;
+  constructor(config, ctx, mfa) {
+    this.config = config;
+    this.ctx = ctx;
+    this.mfa = mfa;
+  }
+  async run(asFlag) {
+    const identity = this.ctx.resolveIdentity(asFlag);
+    const isProduction = this.config.isProductionEnvironment();
+    const mfaSkipActive = !isProduction && process.env[this.config.mfaSkipEnvVar] === "1";
+    let userId = null;
+    let isSuperAdmin = false;
+    let mfaEnabled = false;
+    try {
+      const user = await this.ctx.ensureSuperAdmin(identity);
+      userId = user.id;
+      isSuperAdmin = true;
+      mfaEnabled = await this.mfa.isEnabled(user.id);
+    } catch {
+    }
+    return {
+      email: identity.email,
+      host: identity.host,
+      actor: identity.actor,
+      userId,
+      isSuperAdmin,
+      mfaEnabled,
+      isProduction,
+      mfaSkipActive
+    };
+  }
+  formatResult(r) {
+    const lines = [
+      `Identit\xE4t:        ${r.email}`,
+      `Host:             ${r.host}`,
+      `Actor-Tag:        ${r.actor}`,
+      `User-ID:          ${r.userId ?? "\u2014 (User nicht gefunden)"}`,
+      `Plattform-Rolle:  ${r.isSuperAdmin ? "SUPER_ADMIN \u2713" : "\u2014 (kein SUPER_ADMIN!)"}`,
+      `MFA konfiguriert: ${r.mfaEnabled ? "\u2713" : "\u2717 \u2014 bitte `admin mfa-setup` ausf\xFChren"}`,
+      `Environment:      ${r.isProduction ? "PRODUCTION" : "non-production"}`
+    ];
+    if (r.mfaSkipActive) {
+      lines.push("\u26A0  MFA-Bypass aktiv (SKIP-Env-Var gesetzt, non-prod)");
+    }
+    return lines.join("\n");
+  }
+};
+WhoAmIFlow = _ts_decorate3([
+  (0, import_common3.Injectable)(),
+  _ts_param2(0, (0, import_common3.Inject)(CLI_CONTEXT_CONFIG_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof CliContextConfig === "undefined" ? Object : CliContextConfig,
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof import_nest3.MfaService === "undefined" ? Object : import_nest3.MfaService
+  ])
+], WhoAmIFlow);
+
+// src/audit-tail-flow.ts
+var import_common4 = require("@nestjs/common");
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var AuditTailFlow = class {
+  static {
+    __name(this, "AuditTailFlow");
+  }
+  auditQuery;
+  constructor(auditQuery) {
+    this.auditQuery = auditQuery;
+  }
+  async run(options = {}) {
+    const filter = {};
+    if (options.actor) filter.actorTag = options.actor;
+    if (options.action) filter.action = options.action;
+    if (options.entity) filter.entity = options.entity;
+    if (options.since) filter.from = options.since;
+    if (options.limit) filter.pageSize = options.limit;
+    return this.auditQuery.list(filter);
+  }
+  /** Format the result as an ASCII table for `console.table`. */
+  formatRows(entries) {
+    return entries.map((e) => ({
+      createdAt: e.createdAt,
+      actor: e.actorTag ?? "\u2014",
+      entity: e.entity,
+      entityId: this.truncate(e.entityId, 12),
+      action: e.action
+    }));
+  }
+  truncate(s, maxLen) {
+    return s.length > maxLen ? s.slice(0, maxLen - 1) + "\u2026" : s;
+  }
+};
+AuditTailFlow = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_param3(0, (0, import_common4.Inject)(AUDIT_QUERY_PORT_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof AuditQueryPort === "undefined" ? Object : AuditQueryPort
+  ])
+], AuditTailFlow);
+
+// src/doctor-flow.ts
+var import_common5 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var DoctorFlow = class {
+  static {
+    __name(this, "DoctorFlow");
+  }
+  checks;
+  constructor(checks) {
+    this.checks = checks;
+  }
+  async run() {
+    const results = [];
+    let overall = "ok";
+    for (const check of this.checks) {
+      try {
+        const r = await check.run();
+        results.push({
+          id: check.id,
+          label: check.label,
+          ...r
+        });
+        overall = aggregateSeverity(overall, r.severity);
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        results.push({
+          id: check.id,
+          label: check.label,
+          severity: "error",
+          message: `Check threw an exception: ${message}`
+        });
+        overall = "error";
+      }
+    }
+    return {
+      overall,
+      checks: results
+    };
+  }
+  /** Returns the appropriate CLI exit code: 0 for `ok`/`warning`, 4 for `error`. */
+  exitCodeFor(report) {
+    return report.overall === "error" ? 4 : 0;
+  }
+  formatReport(report) {
+    const lines = [
+      `Doctor-Check (Gesamtstatus: ${report.overall.toUpperCase()})`,
+      ""
+    ];
+    for (const c of report.checks) {
+      const icon = c.severity === "ok" ? "\u2713" : c.severity === "warning" ? "\u26A0" : "\u2717";
+      lines.push(`  ${icon}  ${c.label}: ${c.message}`);
+    }
+    return lines.join("\n");
+  }
+};
+DoctorFlow = _ts_decorate5([
+  (0, import_common5.Injectable)(),
+  _ts_param4(0, (0, import_common5.Inject)(DOCTOR_CHECKS_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    Array
+  ])
+], DoctorFlow);
+function aggregateSeverity(a, b) {
+  if (a === "error" || b === "error") return "error";
+  if (a === "warning" || b === "warning") return "warning";
+  return "ok";
+}
+__name(aggregateSeverity, "aggregateSeverity");
+
+// src/manifest-checks.ts
+var COMPONENT_KEY_PATTERN = /^[a-z][a-z0-9]*([.-][a-z0-9]+)+$/;
+var ACTION_KEY_PATTERN = /^[A-Z][A-Z0-9_]+$/;
+var TENANT_ACTION_KEY_PATTERN = /^[a-z][a-zA-Z0-9_]*(\.[a-z][a-zA-Z0-9_]*)+$/;
+var CAPABILITY_PATTERN = /^[a-z][a-zA-Z0-9_]*(\.[a-z][a-zA-Z0-9_]*)+$/;
+var ROUTE_PREFIX = "/admin";
+function ok(message) {
+  return {
+    severity: "ok",
+    message
+  };
+}
+__name(ok, "ok");
+function err(message, paths) {
+  return {
+    severity: "error",
+    message,
+    paths
+  };
+}
+__name(err, "err");
+function allProjectPages(m) {
+  return m.navigation?.projectPages ?? [];
+}
+__name(allProjectPages, "allProjectPages");
+function allKpiCards(m) {
+  return m.dashboard?.kpiCards ?? [];
+}
+__name(allKpiCards, "allKpiCards");
+function allTenantActions(m) {
+  return m.tenants?.actions ?? [];
+}
+__name(allTenantActions, "allTenantActions");
+function allTenantColumns(m) {
+  return m.tenants?.columns ?? [];
+}
+__name(allTenantColumns, "allTenantColumns");
+function allAuditActions(m) {
+  return m.audit?.actions ?? [];
+}
+__name(allAuditActions, "allAuditActions");
+function allCapabilities(m) {
+  return Object.keys(m.capabilities ?? {});
+}
+__name(allCapabilities, "allCapabilities");
+var DEFAULT_MANIFEST_CHECKS = [
+  {
+    id: "manifest.schema-version",
+    label: "schemaVersion ist 1",
+    run: /* @__PURE__ */ __name((m) => m.schemaVersion === 1 ? ok("schemaVersion=1") : err(`Unerwartete schemaVersion ${m.schemaVersion}`), "run")
+  },
+  {
+    id: "manifest.hash-format",
+    label: "manifestHash folgt sha256-<base64url>-Pattern",
+    run: /* @__PURE__ */ __name((m) => {
+      const hash = m.build?.manifestHash;
+      if (!hash) return err("manifestHash fehlt");
+      return /^sha256-[A-Za-z0-9_-]+$/.test(hash) ? ok(hash) : err(`manifestHash hat falsches Format: ${hash}`);
+    }, "run")
+  },
+  {
+    id: "manifest.project-page-component-keys",
+    label: "ProjectPage.componentKey-Format (lowercase-hyphenated ODER namespace.dot)",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const p of allProjectPages(m)) {
+        if (!COMPONENT_KEY_PATTERN.test(p.componentKey)) bad.push(p.componentKey);
+      }
+      return bad.length === 0 ? ok(`${allProjectPages(m).length} ProjectPage(s) ok`) : err(`${bad.length} componentKey(s) verletzen das Pattern`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.tenant-action-keys",
+    label: "TenantAction.actionKey-Format (domain.action \u2014 SPEC \xA74.2.1)",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const a of allTenantActions(m)) {
+        if (!TENANT_ACTION_KEY_PATTERN.test(a.actionKey)) bad.push(a.actionKey);
+      }
+      return bad.length === 0 ? ok("alle actionKeys folgen domain.action") : err(`${bad.length} actionKey(s) verletzen das Pattern`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.audit-action-keys",
+    label: "AuditAction.key-Format (SCREAMING_SNAKE_CASE)",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const a of allAuditActions(m)) {
+        if (!ACTION_KEY_PATTERN.test(a.key)) bad.push(a.key);
+      }
+      return bad.length === 0 ? ok("alle AuditAction.keys SCREAMING_SNAKE_CASE") : err(`${bad.length} AuditAction.key(s) verletzen das Pattern`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.capabilities-pattern",
+    label: "Capability-Pattern <domain>.<action> (SPEC \xA74.2.1)",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = allCapabilities(m).filter((c) => !CAPABILITY_PATTERN.test(c));
+      return bad.length === 0 ? ok(`${allCapabilities(m).length} Capabilities ok`) : err(`${bad.length} Capability/-ies verletzen das Pattern`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.required-capabilities-known",
+    label: "requiredCapability-Referenzen existieren in capabilities-Map",
+    run: /* @__PURE__ */ __name((m) => {
+      const known = new Set(allCapabilities(m));
+      const bad = [];
+      const visit = /* @__PURE__ */ __name((cap, ctx) => {
+        if (cap && !known.has(cap)) bad.push(`${ctx ?? "?"}: ${cap}`);
+      }, "visit");
+      for (const p of allProjectPages(m)) visit(p.requiredCapability, p.id);
+      for (const k of allKpiCards(m)) visit(k.requiredCapability, k.id);
+      for (const a of allTenantActions(m)) visit(a.requiredCapability, a.id);
+      for (const c of allTenantColumns(m)) visit(c.requiredCapability, c.key);
+      return bad.length === 0 ? ok("alle requiredCapability-Refs aufgel\xF6st") : err(`${bad.length} unbekannte Capability-Ref(s)`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.route-prefix",
+    label: "ProjectPage.route beginnt mit /admin",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const p of allProjectPages(m)) {
+        if (!p.route.startsWith(ROUTE_PREFIX)) bad.push(p.route);
+      }
+      return bad.length === 0 ? ok("alle ProjectPage-Routes unter /admin") : err(`${bad.length} Route(s) ohne /admin-Prefix`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.kpi-slot-priority",
+    label: "KpiCard.slotPriority (falls gesetzt) ist endliche Zahl",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const k of allKpiCards(m)) {
+        if (k.slotPriority !== void 0 && !Number.isFinite(k.slotPriority)) {
+          bad.push(k.id);
+        }
+      }
+      return bad.length === 0 ? ok("alle slotPriority-Werte endlich") : err(`${bad.length} KpiCard(s) mit ung\xFCltiger slotPriority`, bad);
+    }, "run")
+  },
+  {
+    id: "manifest.unique-project-page-ids",
+    label: "ProjectPage.id ist unique",
+    run: /* @__PURE__ */ __name((m) => {
+      const seen = /* @__PURE__ */ new Map();
+      for (const p of allProjectPages(m)) {
+        seen.set(p.id, (seen.get(p.id) ?? 0) + 1);
+      }
+      const dups = [
+        ...seen.entries()
+      ].filter(([, n]) => n > 1).map(([k]) => k);
+      return dups.length === 0 ? ok("alle ProjectPage.id eindeutig") : err(`${dups.length} doppelte ProjectPage.id`, dups);
+    }, "run")
+  },
+  {
+    id: "manifest.unique-action-keys",
+    label: "actionKeys sind je Namespace (TenantAction / AuditAction) eindeutig",
+    run: /* @__PURE__ */ __name((m) => {
+      const dups = [];
+      const tenantSeen = /* @__PURE__ */ new Map();
+      for (const a of allTenantActions(m)) {
+        tenantSeen.set(a.actionKey, (tenantSeen.get(a.actionKey) ?? 0) + 1);
+      }
+      for (const [k, n] of tenantSeen) {
+        if (n > 1) dups.push(`TenantAction:${k}`);
+      }
+      const auditSeen = /* @__PURE__ */ new Map();
+      for (const a of allAuditActions(m)) {
+        auditSeen.set(a.key, (auditSeen.get(a.key) ?? 0) + 1);
+      }
+      for (const [k, n] of auditSeen) {
+        if (n > 1) dups.push(`AuditAction:${k}`);
+      }
+      return dups.length === 0 ? ok("alle actionKeys je Namespace eindeutig") : err(`${dups.length} doppelte actionKey(s)`, dups);
+    }, "run")
+  },
+  {
+    id: "manifest.tenant-columns-batchable",
+    label: "TenantColumns haben endpoint-Pfad f\xFCr Batch-Fetch",
+    run: /* @__PURE__ */ __name((m) => {
+      const bad = [];
+      for (const c of allTenantColumns(m)) {
+        if (!c.endpoint || c.endpoint.trim().length === 0) bad.push(c.key);
+        else if (c.endpoint.includes("{slug}") || c.endpoint.includes("{tenantId}")) {
+          bad.push(`${c.key} (per-Tenant statt batch)`);
+        }
+      }
+      return bad.length === 0 ? ok("alle TenantColumns batch-f\xE4hig") : err(`${bad.length} TenantColumn(s) verletzen Batch-Pflicht`, bad);
+    }, "run")
+  }
+];
+
+// src/manifest-cli-flow.ts
+var import_common6 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var ManifestCliFlow = class {
+  static {
+    __name(this, "ManifestCliFlow");
+  }
+  access;
+  checks;
+  constructor(access, checks) {
+    this.access = access;
+    this.checks = checks;
+  }
+  /** `<app> manifest dump` — JSON output of the current manifest. */
+  dump() {
+    return this.access.getManifest();
+  }
+  /**
+   * `<app> manifest hash` — canonical manifestHash value. Returns
+   * the value from `build.manifestHash`. Consumers can pin this in CI
+   * (`expected-hash.txt`) and check for drift.
+   */
+  hash() {
+    const m = this.access.getManifest();
+    const h = m.build?.manifestHash;
+    if (!h) throw new Error("manifestHash fehlt im Manifest \u2014 Boot-Zeit-Bug?");
+    return h;
+  }
+  /**
+   * `<app> manifest validate` — returns `true` when all structures
+   * are present. Deeper schema validation runs separately via Ajv with
+   * `@saasicat/spec/schemas/admin-manifest.schema.json`;
+   * this helper provides the quick diagnostic without the Ajv cost.
+   */
+  validate() {
+    const m = this.access.getManifest();
+    if (m.schemaVersion !== 1) {
+      return {
+        ok: false,
+        reason: `Unerwartete schemaVersion ${m.schemaVersion}`
+      };
+    }
+    if (!m.project?.key) {
+      return {
+        ok: false,
+        reason: "Kein `project.key` im Manifest"
+      };
+    }
+    if (!m.build?.manifestHash) {
+      return {
+        ok: false,
+        reason: "manifestHash fehlt"
+      };
+    }
+    return {
+      ok: true
+    };
+  }
+  /**
+   * `<app> manifest diff <expected.json>` — flat diff over the two
+   * manifest hashes plus list differences for top-level fields. Returns
+   * `null` when the manifests are identical.
+   */
+  diff(expected) {
+    const current = this.access.getManifest();
+    if (current.build?.manifestHash === expected.build?.manifestHash) return null;
+    const currentKeys = collectComponentKeys(current);
+    const expectedKeys = collectComponentKeys(expected);
+    return {
+      currentHash: current.build?.manifestHash ?? null,
+      expectedHash: expected.build?.manifestHash ?? null,
+      componentKeysAdded: [
+        ...currentKeys
+      ].filter((k) => !expectedKeys.has(k)).sort(),
+      componentKeysRemoved: [
+        ...expectedKeys
+      ].filter((k) => !currentKeys.has(k)).sort()
+    };
+  }
+  /**
+   * `<app> manifest check` — runs all registered manifest checks.
+   * Aggregates severity (ok/warning/error) into `overall`. The consumer
+   * maps `error` to exit code 7 (drift) per `cli-conventions.md` §6.
+   */
+  async runChecks() {
+    const manifest = this.access.getManifest();
+    const checks = [];
+    let overall = "ok";
+    for (const check of this.checks) {
+      try {
+        const r = check.run(manifest);
+        checks.push({
+          id: check.id,
+          label: check.label,
+          ...r
+        });
+        overall = aggregate(overall, r.severity);
+      } catch (err2) {
+        const message = err2 instanceof Error ? err2.message : String(err2);
+        checks.push({
+          id: check.id,
+          label: check.label,
+          severity: "error",
+          message: `Check warf eine Exception: ${message}`
+        });
+        overall = "error";
+      }
+    }
+    return {
+      overall,
+      checks
+    };
+  }
+  /** Returns the appropriate CLI exit code: 0 for `ok`/`warning`, 7 for `error` (drift). */
+  exitCodeFor(report) {
+    return report.overall === "error" ? 7 : 0;
+  }
+  formatReport(report) {
+    const lines = [
+      `Manifest-Check (Gesamtstatus: ${report.overall.toUpperCase()})`,
+      ""
+    ];
+    for (const c of report.checks) {
+      const icon = c.severity === "ok" ? "\u2713" : c.severity === "warning" ? "\u26A0" : "\u2717";
+      lines.push(`  ${icon}  ${c.label}: ${c.message}`);
+      if (c.paths && c.paths.length > 0) {
+        for (const p of c.paths) lines.push(`         \xB7 ${p}`);
+      }
+    }
+    return lines.join("\n");
+  }
+};
+ManifestCliFlow = _ts_decorate6([
+  (0, import_common6.Injectable)(),
+  _ts_param5(0, (0, import_common6.Inject)(MANIFEST_ACCESS_PORT_TOKEN)),
+  _ts_param5(1, (0, import_common6.Inject)(MANIFEST_CHECKS_TOKEN)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof ManifestAccessPort === "undefined" ? Object : ManifestAccessPort,
+    Array
+  ])
+], ManifestCliFlow);
+function aggregate(a, b) {
+  if (a === "error" || b === "error") return "error";
+  if (a === "warning" || b === "warning") return "warning";
+  return "ok";
+}
+__name(aggregate, "aggregate");
+function collectComponentKeys(m) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const p of m.navigation?.projectPages ?? []) keys.add(p.componentKey);
+  return keys;
+}
+__name(collectComponentKeys, "collectComponentKeys");
+
+// src/default-doctor-checks.ts
+var import_common7 = require("@nestjs/common");
+var import_nest4 = require("@saasicat/nest");
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+var PlanCatalogDoctorCheck = class {
+  static {
+    __name(this, "PlanCatalogDoctorCheck");
+  }
+  catalog;
+  id = "platform.plan-catalog";
+  label = "Plan-Catalog im DI";
+  constructor(catalog) {
+    this.catalog = catalog;
+  }
+  async run() {
+    const plans = this.catalog?.plans ?? [];
+    if (plans.length === 0) {
+      return {
+        severity: "error",
+        message: "PlanCatalog enth\xE4lt keine Pl\xE4ne \u2014 Onboarding-Pricing-Page wird leer."
+      };
+    }
+    return {
+      severity: "ok",
+      message: `${plans.length} Plan(s), ${this.catalog.features?.length ?? 0} Feature(s) geladen.`,
+      details: {
+        projectKey: this.catalog.projectKey,
+        planIds: plans.map((p) => p.id)
+      }
+    };
+  }
+};
+PlanCatalogDoctorCheck = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param6(0, (0, import_common7.Inject)(import_nest4.PLAN_CATALOG_TOKEN)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof PlanCatalog === "undefined" ? Object : PlanCatalog
+  ])
+], PlanCatalogDoctorCheck);
+var DiscoverySnapshotDoctorCheck = class {
+  static {
+    __name(this, "DiscoverySnapshotDoctorCheck");
+  }
+  snapshot;
+  id = "platform.discovery-snapshot";
+  label = "Discovery-Snapshot beim Boot";
+  constructor(snapshot) {
+    this.snapshot = snapshot;
+  }
+  async run() {
+    const caps = this.snapshot?.capabilities ?? [];
+    if (caps.length === 0) {
+      return {
+        severity: "warning",
+        message: "Keine Capabilities entdeckt \u2014 Decorator-tragende Module evtl. nicht in AppModule.imports[]."
+      };
+    }
+    return {
+      severity: "ok",
+      message: `${caps.length} Capabilities, ${this.snapshot.features?.length ?? 0} Features, ${this.snapshot.quotas?.length ?? 0} Quotas.`
+    };
+  }
+};
+DiscoverySnapshotDoctorCheck = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param6(0, (0, import_common7.Inject)(import_nest4.DISCOVERY_SNAPSHOT_TOKEN)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof DiscoverySnapshot === "undefined" ? Object : DiscoverySnapshot
+  ])
+], DiscoverySnapshotDoctorCheck);
+var UserPortDoctorCheck = class {
+  static {
+    __name(this, "UserPortDoctorCheck");
+  }
+  users;
+  id = "platform.user-port";
+  label = "UserPort.findByEmail erreichbar";
+  constructor(users) {
+    this.users = users;
+  }
+  async run() {
+    try {
+      await this.users.findByEmail("__doctor-check__@invalid.local");
+      return {
+        severity: "ok",
+        message: "UserPort antwortet."
+      };
+    } catch (err2) {
+      return {
+        severity: "error",
+        message: `UserPort wirft: ${err2 instanceof Error ? err2.message : String(err2)}`
+      };
+    }
+  }
+};
+UserPortDoctorCheck = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param6(0, (0, import_common7.Inject)(USER_PORT_TOKEN)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof UserPort === "undefined" ? Object : UserPort
+  ])
+], UserPortDoctorCheck);
+var AdminManifestDoctorCheck = class {
+  static {
+    __name(this, "AdminManifestDoctorCheck");
+  }
+  manifest;
+  id = "platform.admin-manifest";
+  label = "AdminManifestService liefert Manifest";
+  constructor(manifest) {
+    this.manifest = manifest;
+  }
+  async run() {
+    try {
+      const m = this.manifest.getManifest();
+      const pageCount = Object.keys(m.navigation?.standardPages ?? {}).length;
+      return {
+        severity: "ok",
+        message: `Manifest mit ${pageCount} Standard-Pages, Hash ${m.build?.manifestHash?.slice(0, 12) ?? "???"}\u2026`
+      };
+    } catch (err2) {
+      return {
+        severity: "error",
+        message: `Manifest-Build wirft: ${err2 instanceof Error ? err2.message : String(err2)}`
+      };
+    }
+  }
+};
+AdminManifestDoctorCheck = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof import_nest4.AdminManifestService === "undefined" ? Object : import_nest4.AdminManifestService
+  ])
+], AdminManifestDoctorCheck);
+var PLATFORM_DOCTOR_CHECK_PROVIDERS = [
+  PlanCatalogDoctorCheck,
+  DiscoverySnapshotDoctorCheck,
+  UserPortDoctorCheck,
+  AdminManifestDoctorCheck
+];
+
+// src/schema-apply.ts
+function stripLineComment(line) {
+  const commentStart = line.indexOf("//");
+  return commentStart === -1 ? line : line.slice(0, commentStart);
+}
+__name(stripLineComment, "stripLineComment");
+function extractModelNames(schema) {
+  const names = [];
+  const lines = schema.split("\n");
+  for (const line of lines) {
+    const stripped = stripLineComment(line).trim();
+    const match = stripped.match(/^model\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{/);
+    if (match) names.push(match[1]);
+  }
+  return names;
+}
+__name(extractModelNames, "extractModelNames");
+function extractModelBlocks(fragment) {
+  const blocks = /* @__PURE__ */ new Map();
+  const lines = fragment.split("\n");
+  let current = null;
+  for (const rawLine of lines) {
+    const stripped = stripLineComment(rawLine);
+    if (!current) {
+      const match = rawLine.match(/^\s*model\s+([A-Za-z_][A-Za-z0-9_]*)\s*\{/);
+      if (match) {
+        const openCount = (stripped.match(/\{/g) ?? []).length;
+        const closeCount = (stripped.match(/\}/g) ?? []).length;
+        current = {
+          name: match[1],
+          lines: [
+            rawLine
+          ],
+          depth: openCount - closeCount
+        };
+        if (current.depth === 0) {
+          blocks.set(current.name, current.lines.join("\n"));
+          current = null;
+        }
+      }
+      continue;
+    }
+    current.lines.push(rawLine);
+    current.depth += (stripped.match(/\{/g) ?? []).length;
+    current.depth -= (stripped.match(/\}/g) ?? []).length;
+    if (current.depth <= 0) {
+      blocks.set(current.name, current.lines.join("\n"));
+      current = null;
+    }
+  }
+  return blocks;
+}
+__name(extractModelBlocks, "extractModelBlocks");
+function applyFragmentBlocks(schema, fragmentBlocks, options = {}) {
+  const existing = new Set(extractModelNames(schema));
+  const added = [];
+  const skipped = [];
+  const additions = [];
+  for (const [name, block] of fragmentBlocks) {
+    if (existing.has(name)) {
+      skipped.push(name);
+    } else {
+      added.push(name);
+      additions.push(block);
+    }
+  }
+  if (additions.length === 0) {
+    return {
+      added,
+      skipped,
+      schema
+    };
+  }
+  const header = options.fragmentLabel ? `
+
+// ============================================================
+// Eingef\xFCgt durch \`saas-platform schema apply\` aus ${options.fragmentLabel}
+// ============================================================
+` : `
+
+// Eingef\xFCgt durch \`saas-platform schema apply\`
+`;
+  const trimmedSchema = schema.endsWith("\n") ? schema : schema + "\n";
+  return {
+    added,
+    skipped,
+    schema: trimmedSchema + header + additions.join("\n\n") + "\n"
+  };
+}
+__name(applyFragmentBlocks, "applyFragmentBlocks");
+
+// src/module.ts
+var import_common8 = require("@nestjs/common");
+var import_nest5 = require("@saasicat/nest");
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+var CliContextModule = class _CliContextModule {
+  static {
+    __name(this, "CliContextModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      {
+        provide: CLI_CONTEXT_CONFIG_TOKEN,
+        useValue: options.config
+      },
+      (0, import_nest5.asProvider)(USER_PORT_TOKEN, options.userPort),
+      CliContextService,
+      MfaSetupFlow,
+      WhoAmIFlow
+    ];
+    const exports_ = [
+      CLI_CONTEXT_CONFIG_TOKEN,
+      CliContextService,
+      MfaSetupFlow,
+      WhoAmIFlow
+    ];
+    if (options.auditQueryPort) {
+      providers.push((0, import_nest5.asProvider)(AUDIT_QUERY_PORT_TOKEN, options.auditQueryPort));
+      providers.push(AuditTailFlow);
+      exports_.push(AuditTailFlow);
+    }
+    if (options.defaultDoctorChecks) {
+      providers.push(...PLATFORM_DOCTOR_CHECK_PROVIDERS);
+      providers.push({
+        provide: DOCTOR_CHECKS_TOKEN,
+        useFactory: /* @__PURE__ */ __name((...platformChecks) => {
+          const extra = Array.isArray(options.doctorChecks) ? options.doctorChecks : [];
+          return [
+            ...platformChecks,
+            ...extra
+          ];
+        }, "useFactory"),
+        inject: PLATFORM_DOCTOR_CHECK_PROVIDERS
+      });
+    } else {
+      providers.push((0, import_nest5.asProvider)(DOCTOR_CHECKS_TOKEN, options.doctorChecks ?? []));
+    }
+    providers.push(DoctorFlow);
+    exports_.push(DoctorFlow);
+    if (options.manifestAccessPort) {
+      providers.push((0, import_nest5.asProvider)(MANIFEST_ACCESS_PORT_TOKEN, options.manifestAccessPort), (0, import_nest5.asProvider)(MANIFEST_CHECKS_TOKEN, options.manifestChecks ?? DEFAULT_MANIFEST_CHECKS), ManifestCliFlow);
+      exports_.push(ManifestCliFlow);
+    }
+    if (options.userManagementPort) {
+      providers.push((0, import_nest5.asProvider)(USER_MANAGEMENT_PORT_TOKEN, options.userManagementPort));
+      exports_.push(USER_MANAGEMENT_PORT_TOKEN);
+    }
+    return {
+      module: _CliContextModule,
+      global: options.global ?? false,
+      providers,
+      exports: exports_
+    };
+  }
+};
+CliContextModule = _ts_decorate8([
+  (0, import_common8.Module)({})
+], CliContextModule);
+
+// src/manifest.command.ts
+var import_common9 = require("@nestjs/common");
+var import_nest_commander = require("nest-commander");
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+var ManifestDumpCommand = class extends import_nest_commander.CommandRunner {
+  static {
+    __name(this, "ManifestDumpCommand");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    process.stdout.write(JSON.stringify(this.flow.dump(), null, 2) + "\n");
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate9([
+  (0, import_nest_commander.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata8("design:returntype", String)
+], ManifestDumpCommand.prototype, "parseAs", null);
+ManifestDumpCommand = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  (0, import_nest_commander.SubCommand)({
+    name: "dump",
+    description: "Manifest als JSON ausgeben"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof ManifestCliFlow === "undefined" ? Object : ManifestCliFlow
+  ])
+], ManifestDumpCommand);
+var ManifestHashCommand = class extends import_nest_commander.CommandRunner {
+  static {
+    __name(this, "ManifestHashCommand");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    process.stdout.write(this.flow.hash() + "\n");
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate9([
+  (0, import_nest_commander.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata8("design:returntype", String)
+], ManifestHashCommand.prototype, "parseAs", null);
+ManifestHashCommand = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  (0, import_nest_commander.SubCommand)({
+    name: "hash",
+    description: "manifestHash ausgeben (CI-Pinning)"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof ManifestCliFlow === "undefined" ? Object : ManifestCliFlow
+  ])
+], ManifestHashCommand);
+var ManifestValidateCommand = class extends import_nest_commander.CommandRunner {
+  static {
+    __name(this, "ManifestValidateCommand");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    const result = this.flow.validate();
+    if (result.ok) {
+      process.stdout.write("Manifest validiert \u2713\n");
+      return;
+    }
+    process.stderr.write(`Manifest invalid: ${result.reason}
+`);
+    process.exit(1);
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate9([
+  (0, import_nest_commander.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata8("design:returntype", String)
+], ManifestValidateCommand.prototype, "parseAs", null);
+ManifestValidateCommand = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  (0, import_nest_commander.SubCommand)({
+    name: "validate",
+    description: "Schnell-Sanity (schemaVersion + project.key + manifestHash)"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof ManifestCliFlow === "undefined" ? Object : ManifestCliFlow
+  ])
+], ManifestValidateCommand);
+var ManifestCheckCommand = class extends import_nest_commander.CommandRunner {
+  static {
+    __name(this, "ManifestCheckCommand");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    const report = await this.flow.runChecks();
+    process.stdout.write(this.flow.formatReport(report) + "\n");
+    const code = this.flow.exitCodeFor(report);
+    if (code !== 0) process.exit(code);
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate9([
+  (0, import_nest_commander.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata8("design:returntype", String)
+], ManifestCheckCommand.prototype, "parseAs", null);
+ManifestCheckCommand = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  (0, import_nest_commander.SubCommand)({
+    name: "check",
+    description: "Alle Manifest-Checks (Exit-Code 7 bei error/Drift)"
+  }),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof ManifestCliFlow === "undefined" ? Object : ManifestCliFlow
+  ])
+], ManifestCheckCommand);
+var ManifestCommands = class extends import_nest_commander.CommandRunner {
+  static {
+    __name(this, "ManifestCommands");
+  }
+  async run() {
+    process.stderr.write("Bitte Sub-Command angeben: dump, hash, validate, check.\n");
+    process.exit(2);
+  }
+};
+ManifestCommands = _ts_decorate9([
+  (0, import_common9.Injectable)(),
+  (0, import_nest_commander.Command)({
+    name: "manifest",
+    description: "Manifest-Operations (dump, hash, validate, check)",
+    subCommands: [
+      ManifestDumpCommand,
+      ManifestHashCommand,
+      ManifestValidateCommand,
+      ManifestCheckCommand
+    ]
+  })
+], ManifestCommands);
+
+// src/admin.command.ts
+var import_common10 = require("@nestjs/common");
+var import_nest_commander2 = require("nest-commander");
+var import_qrcode_terminal = __toESM(require("qrcode-terminal"), 1);
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata9(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata9, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+var AdminWhoamiCommand = class extends import_nest_commander2.CommandRunner {
+  static {
+    __name(this, "AdminWhoamiCommand");
+  }
+  flow;
+  constructor(flow) {
+    super(), this.flow = flow;
+  }
+  async run(_args, flags) {
+    const result = await this.flow.run(flags.as);
+    process.stdout.write(this.flow.formatResult(result) + "\n");
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate10([
+  (0, import_nest_commander2.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata9("design:returntype", String)
+], AdminWhoamiCommand.prototype, "parseAs", null);
+AdminWhoamiCommand = _ts_decorate10([
+  (0, import_common10.Injectable)(),
+  (0, import_nest_commander2.SubCommand)({
+    name: "whoami",
+    description: "Aktive CLI-Identit\xE4t + MFA-/Production-Status"
+  }),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    typeof WhoAmIFlow === "undefined" ? Object : WhoAmIFlow
+  ])
+], AdminWhoamiCommand);
+var AdminMfaSetupCommand = class extends import_nest_commander2.CommandRunner {
+  static {
+    __name(this, "AdminMfaSetupCommand");
+  }
+  config;
+  flow;
+  constructor(config, flow) {
+    super(), this.config = config, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const result = await this.flow.run({
+      asFlag: flags.as,
+      issuer: this.config.mfaIssuer ?? "SuperAdmin",
+      force: flags.force
+    });
+    await new Promise((resolve) => {
+      import_qrcode_terminal.default.generate(result.otpauthUri, {
+        small: true
+      }, (qr) => {
+        process.stdout.write("\n" + qr + "\n");
+        resolve();
+      });
+    });
+    process.stdout.write(this.flow.formatSetupResult(result) + "\n");
+  }
+  parseAs(v) {
+    return v;
+  }
+  parseForce() {
+    return true;
+  }
+};
+_ts_decorate10([
+  (0, import_nest_commander2.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata9("design:returntype", String)
+], AdminMfaSetupCommand.prototype, "parseAs", null);
+_ts_decorate10([
+  (0, import_nest_commander2.Option)({
+    flags: "--force",
+    description: "bestehendes Secret ohne R\xFCckfrage \xFCberschreiben"
+  }),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", []),
+  _ts_metadata9("design:returntype", Boolean)
+], AdminMfaSetupCommand.prototype, "parseForce", null);
+AdminMfaSetupCommand = _ts_decorate10([
+  (0, import_common10.Injectable)(),
+  (0, import_nest_commander2.SubCommand)({
+    name: "mfa-setup",
+    description: "TOTP-MFA f\xFCr den eigenen SuperAdmin einrichten"
+  }),
+  _ts_param7(0, (0, import_common10.Inject)(CLI_CONTEXT_CONFIG_TOKEN)),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    typeof CliContextConfig === "undefined" ? Object : CliContextConfig,
+    typeof MfaSetupFlow === "undefined" ? Object : MfaSetupFlow
+  ])
+], AdminMfaSetupCommand);
+var AdminCommands = class extends import_nest_commander2.CommandRunner {
+  static {
+    __name(this, "AdminCommands");
+  }
+  async run() {
+    process.stderr.write("Bitte Sub-Command angeben: whoami, mfa-setup.\n");
+    process.exit(2);
+  }
+};
+AdminCommands = _ts_decorate10([
+  (0, import_common10.Injectable)(),
+  (0, import_nest_commander2.Command)({
+    name: "admin",
+    description: "SuperAdmin-Operations (whoami, mfa-setup)",
+    subCommands: [
+      AdminWhoamiCommand,
+      AdminMfaSetupCommand
+    ]
+  })
+], AdminCommands);
+
+// src/audit.command.ts
+var import_common11 = require("@nestjs/common");
+var import_nest_commander3 = require("nest-commander");
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata10(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata10, "_ts_metadata");
+var AuditTailCommand = class extends import_nest_commander3.CommandRunner {
+  static {
+    __name(this, "AuditTailCommand");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    const entries = await this.flow.run({
+      actor: flags.actor,
+      action: flags.action,
+      entity: flags.entity,
+      since: flags.since,
+      limit: flags.limit
+    });
+    this.ctx.table(this.flow.formatRows(entries));
+  }
+  parseAs(v) {
+    return v;
+  }
+  parseActor(v) {
+    return v;
+  }
+  parseAction(v) {
+    return v;
+  }
+  parseEntity(v) {
+    return v;
+  }
+  parseSince(v) {
+    return v;
+  }
+  parseLimit(v) {
+    return Number.parseInt(v, 10);
+  }
+};
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", String)
+], AuditTailCommand.prototype, "parseAs", null);
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--actor <email>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", String)
+], AuditTailCommand.prototype, "parseActor", null);
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--action <name>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", String)
+], AuditTailCommand.prototype, "parseAction", null);
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--entity <name>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", String)
+], AuditTailCommand.prototype, "parseEntity", null);
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--since <iso-date>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", String)
+], AuditTailCommand.prototype, "parseSince", null);
+_ts_decorate11([
+  (0, import_nest_commander3.Option)({
+    flags: "--limit <n>"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata10("design:returntype", Number)
+], AuditTailCommand.prototype, "parseLimit", null);
+AuditTailCommand = _ts_decorate11([
+  (0, import_common11.Injectable)(),
+  (0, import_nest_commander3.SubCommand)({
+    name: "tail",
+    description: "Letzte Audit-Log-Eintr\xE4ge (--actor/--action/--entity/--since/--limit)"
+  }),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof AuditTailFlow === "undefined" ? Object : AuditTailFlow
+  ])
+], AuditTailCommand);
+var AuditCommands = class extends import_nest_commander3.CommandRunner {
+  static {
+    __name(this, "AuditCommands");
+  }
+  async run() {
+    process.stderr.write("Bitte Sub-Command angeben: tail.\n");
+    process.exit(2);
+  }
+};
+AuditCommands = _ts_decorate11([
+  (0, import_common11.Injectable)(),
+  (0, import_nest_commander3.Command)({
+    name: "audit",
+    description: "Audit-Log-Operations (tail)",
+    subCommands: [
+      AuditTailCommand
+    ]
+  })
+], AuditCommands);
+
+// src/doctor.command.ts
+var import_common12 = require("@nestjs/common");
+var import_nest_commander4 = require("nest-commander");
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+function _ts_metadata11(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata11, "_ts_metadata");
+var DoctorCommands = class extends import_nest_commander4.CommandRunner {
+  static {
+    __name(this, "DoctorCommands");
+  }
+  ctx;
+  flow;
+  constructor(ctx, flow) {
+    super(), this.ctx = ctx, this.flow = flow;
+  }
+  async run(_args, flags) {
+    const identity = this.ctx.resolveIdentity(flags.as);
+    await this.ctx.ensureSuperAdmin(identity);
+    const report = await this.flow.run();
+    process.stdout.write(this.flow.formatReport(report) + "\n");
+    const code = this.flow.exitCodeFor(report);
+    if (code !== 0) process.exit(code);
+  }
+  parseAs(v) {
+    return v;
+  }
+};
+_ts_decorate12([
+  (0, import_nest_commander4.Option)({
+    flags: "--as <email>"
+  }),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata11("design:returntype", String)
+], DoctorCommands.prototype, "parseAs", null);
+DoctorCommands = _ts_decorate12([
+  (0, import_common12.Injectable)(),
+  (0, import_nest_commander4.Command)({
+    name: "doctor",
+    description: "Health-/Drift-Checks (Exit-Code 4 bei error)"
+  }),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof DoctorFlow === "undefined" ? Object : DoctorFlow
+  ])
+], DoctorCommands);
+
+// src/discovery.command.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_common13 = require("@nestjs/common");
+var import_nest_commander5 = require("nest-commander");
+var import_nest6 = require("@saasicat/nest");
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata12(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata12, "_ts_metadata");
+function _ts_param8(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param8, "_ts_param");
+var DiscoveryScanCommand = class extends import_nest_commander5.CommandRunner {
+  static {
+    __name(this, "DiscoveryScanCommand");
+  }
+  scanner;
+  configuredPath;
+  constructor(scanner = null, configuredPath = null) {
+    super(), this.scanner = scanner, this.configuredPath = configuredPath;
+  }
+  async run(_args, flags) {
+    if (!this.scanner) {
+      this.fail("DiscoveryScanner nicht registriert \u2014 DiscoveryModule.forRoot() im CLI-Modul importieren.", flags);
+      return;
+    }
+    try {
+      const snapshot = this.scanner.rebuildSnapshot();
+      if (flags.out) {
+        const outPath = (0, import_node_path.resolve)(flags.out);
+        (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(outPath), {
+          recursive: true
+        });
+        (0, import_node_fs.writeFileSync)(outPath, JSON.stringify(snapshot, null, 2) + "\n", "utf-8");
+      }
+      const target = flags.out ?? this.configuredPath;
+      process.stdout.write(`Discovery-Scan (${snapshot.app.key} v${snapshot.app.version}): ${snapshot.capabilities.length} Capabilities \xB7 ${snapshot.features.length} Features \xB7 ${snapshot.quotas.length} Quotas \xB7 hash ${snapshot.hash.slice(0, 19)}\u2026
+`);
+      if (target) {
+        process.stdout.write(`Snapshot persistiert: ${(0, import_node_path.resolve)(target)}
+`);
+      } else {
+        process.stderr.write("WARNUNG: Snapshot wurde nicht persistiert \u2014 weder snapshotPath (DiscoveryModule.forRoot) konfiguriert noch --out angegeben. Das Seed-Gate findet so keinen Snapshot.\n");
+      }
+    } catch (err2) {
+      this.fail(err2 instanceof Error ? err2.message : String(err2), flags);
+    }
+  }
+  /** Exit 4 (analogous to Seed-Gate/Preflight) — only a warning with `--non-fatal`. */
+  fail(message, flags) {
+    if (flags.nonFatal) {
+      process.stderr.write(`[discovery scan] WARN (non-fatal): ${message}
+`);
+      return;
+    }
+    process.stderr.write(`[discovery scan] FEHLER: ${message}
+`);
+    process.exit(4);
+  }
+  parseOut(v) {
+    return v;
+  }
+  parseNonFatal() {
+    return true;
+  }
+};
+_ts_decorate13([
+  (0, import_nest_commander5.Option)({
+    flags: "--out <path>",
+    description: "Snapshot zus\xE4tzlich an diesen Pfad schreiben"
+  }),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata12("design:returntype", String)
+], DiscoveryScanCommand.prototype, "parseOut", null);
+_ts_decorate13([
+  (0, import_nest_commander5.Option)({
+    flags: "--non-fatal",
+    description: "Scan-Fehler nur als Warnung melden (Exit 0) \u2014 gestufter Rollout"
+  }),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", []),
+  _ts_metadata12("design:returntype", Boolean)
+], DiscoveryScanCommand.prototype, "parseNonFatal", null);
+DiscoveryScanCommand = _ts_decorate13([
+  (0, import_common13.Injectable)(),
+  (0, import_nest_commander5.SubCommand)({
+    name: "scan",
+    description: "Discovery-Snapshot headless erzeugen + persistieren (Seed-Gate, #23)"
+  }),
+  _ts_param8(0, (0, import_common13.Optional)()),
+  _ts_param8(0, (0, import_common13.Inject)(import_nest6.DiscoveryScanner)),
+  _ts_param8(1, (0, import_common13.Optional)()),
+  _ts_param8(1, (0, import_common13.Inject)(import_nest6.DISCOVERY_SNAPSHOT_PATH_TOKEN)),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
+    Object,
+    Object
+  ])
+], DiscoveryScanCommand);
+var DiscoveryCommands = class extends import_nest_commander5.CommandRunner {
+  static {
+    __name(this, "DiscoveryCommands");
+  }
+  async run() {
+    process.stderr.write("Bitte Sub-Command angeben: scan.\n");
+    process.exit(2);
+  }
+};
+DiscoveryCommands = _ts_decorate13([
+  (0, import_common13.Injectable)(),
+  (0, import_nest_commander5.Command)({
+    name: "discovery",
+    description: "Discovery-Operations (scan)",
+    subCommands: [
+      DiscoveryScanCommand
+    ]
+  })
+], DiscoveryCommands);
+
+// src/user.command.ts
+var import_common14 = require("@nestjs/common");
+var import_node_crypto = require("crypto");
+var import_nest_commander6 = require("nest-commander");
+function _ts_decorate14(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate14, "_ts_decorate");
+function _ts_metadata13(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata13, "_ts_metadata");
+function _ts_param9(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param9, "_ts_param");
+var AUDIT_ENTITY = "User";
+function generatePassword() {
+  return (0, import_node_crypto.randomBytes)(12).toString("base64url");
+}
+__name(generatePassword, "generatePassword");
+var UserCommands = class extends import_nest_commander6.CommandRunner {
+  static {
+    __name(this, "UserCommands");
+  }
+  ctx;
+  users;
+  constructor(ctx, users) {
+    super(), this.ctx = ctx, this.users = users;
+  }
+  async run(args, flags) {
+    const sub = args[0];
+    const identity = this.ctx.resolveIdentity(flags.as);
+    const me = await this.ctx.ensureSuperAdmin(identity);
+    switch (sub) {
+      case "create-super-admin":
+        return this.createSuperAdmin(args[1], flags, identity, me.id, me.email);
+      case "reassign-admin":
+        return this.reassignAdmin(args[1], flags, identity, me.id);
+      case "list":
+        return this.list(args[1]);
+      case "reset-password":
+        return this.resetPassword(args[1], flags, identity, me.id);
+      case "deactivate":
+        return this.deactivate(args[1], flags, identity, me.id);
+      default:
+        throw new CliError("UNKNOWN_SUBCOMMAND", `Unbekannter Subbefehl: user ${sub ?? "(leer)"}. Verf\xFCgbar: create-super-admin <email>, reassign-admin <slug>, list <slug>, reset-password <email>, deactivate <email>.`, 1);
+    }
+  }
+  async createSuperAdmin(email, flags, identity, meId, meEmail) {
+    if (!email) {
+      throw new CliError("MISSING_ARG", "user create-super-admin <email> erwartet eine E-Mail.", 1);
+    }
+    await this.ctx.requireMfa(meId);
+    await this.ctx.ensureProductionConfirmation({
+      yes: flags.yes
+    });
+    const generated = !flags.password;
+    const password = flags.password ?? generatePassword();
+    const created = await this.users.createSuperAdmin({
+      email: email.toLowerCase(),
+      password,
+      firstName: flags.first,
+      lastName: flags.last
+    });
+    await this.ctx.log({
+      identity,
+      userId: meId,
+      entity: AUDIT_ENTITY,
+      entityId: created.id,
+      action: "SUPER_ADMIN_CREATE",
+      changes: {
+        email: created.email,
+        createdBy: meEmail
+      }
+    });
+    console.log(`\u2714 SUPER_ADMIN ${created.email} angelegt (durch ${meEmail}).`);
+    console.log(`  User-ID: ${created.id}`);
+    if (generated) {
+      console.log(`  Passwort: ${password}`);
+      console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+    }
+    console.log(`  N\xE4chster Schritt: admin mfa-setup f\xFCr ${created.email}.`);
+  }
+  async reassignAdmin(slug, flags, identity, meId) {
+    if (!slug) {
+      throw new CliError("MISSING_ARG", "user reassign-admin <tenant-slug> erwartet einen Slug.", 1);
+    }
+    if (!flags.to) throw new CliError("MISSING_FLAG", "--to=<email> ist Pflicht.", 1);
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    await this.ctx.requireMfa(meId);
+    const result = await this.users.reassignTenantAdmin(slug, flags.to.toLowerCase());
+    await this.ctx.log({
+      identity,
+      userId: meId,
+      entity: AUDIT_ENTITY,
+      entityId: result.user.id,
+      action: result.created ? "USER_REASSIGN_ADMIN" : "USER_ROLE_CHANGE",
+      changes: {
+        tenant: slug,
+        to: "TENANT_ADMIN",
+        from: result.previousRole,
+        reason: flags.reason,
+        emergency: true
+      }
+    });
+    if (result.created) {
+      console.log(`\u2714 Notfall-Admin ${result.user.email} f\xFCr ${slug} angelegt.`);
+      if (result.oneTimePassword) {
+        console.log(`  Initial-Passwort: ${result.oneTimePassword}`);
+        console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+      }
+    } else {
+      console.log(`\u2714 ${result.user.email} ist jetzt TENANT_ADMIN von ${slug}.`);
+    }
+  }
+  async list(slug) {
+    if (!slug) {
+      throw new CliError("MISSING_ARG", "user list <tenant-slug> erwartet einen Slug.", 1);
+    }
+    const rows = await this.users.listTenantUsers(slug);
+    this.ctx.table(rows.map((u) => ({
+      email: u.email,
+      role: u.role,
+      status: u.status,
+      lastLogin: u.lastLoginAt?.slice(0, 10) ?? "\u2014"
+    })));
+  }
+  async resetPassword(email, flags, identity, meId) {
+    if (!email) {
+      throw new CliError("MISSING_ARG", "user reset-password <email> erwartet eine E-Mail.", 1);
+    }
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    const result = await this.users.triggerPasswordReset(email.toLowerCase());
+    await this.ctx.log({
+      identity,
+      userId: meId,
+      entity: AUDIT_ENTITY,
+      entityId: result.user.id,
+      action: "USER_PASSWORD_RESET_TRIGGERED",
+      changes: {
+        reason: flags.reason
+      }
+    });
+    if (result.oneTimePassword) {
+      console.log(`\u2714 Einmal-Passwort f\xFCr ${result.user.email} gesetzt.`);
+      console.log(`  Passwort: ${result.oneTimePassword}`);
+      console.log("  \u2192 Sicher \xFCbermitteln. Beim ersten Login \xE4ndern.");
+    } else {
+      console.log(`\u2714 Passwort-Reset f\xFCr ${result.user.email} ausgel\xF6st.`);
+    }
+  }
+  async deactivate(email, flags, identity, meId) {
+    if (!email) {
+      throw new CliError("MISSING_ARG", "user deactivate <email> erwartet eine E-Mail.", 1);
+    }
+    if (!flags.reason) throw new CliError("MISSING_FLAG", '--reason="\u2026" ist Pflicht.', 1);
+    await this.ctx.requireMfa(meId);
+    await this.ctx.ensureProductionConfirmation({
+      yes: flags.yes
+    });
+    const user = await this.users.deactivate(email.toLowerCase(), flags.reason);
+    await this.ctx.log({
+      identity,
+      userId: meId,
+      entity: AUDIT_ENTITY,
+      entityId: user.id,
+      action: "USER_DEACTIVATED",
+      changes: {
+        reason: flags.reason,
+        emergency: true
+      }
+    });
+    console.log(`\u2714 ${user.email} deaktiviert.`);
+  }
+  parseAs(val) {
+    return val;
+  }
+  parseTo(val) {
+    return val;
+  }
+  parseReason(val) {
+    return val;
+  }
+  parseYes() {
+    return true;
+  }
+  parseFirst(val) {
+    return val;
+  }
+  parseLast(val) {
+    return val;
+  }
+  parsePassword(val) {
+    return val;
+  }
+};
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--as <email>",
+    description: "CLI-Identit\xE4t (sonst <APP>_ADMIN_EMAIL)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parseAs", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--to <email>",
+    description: "Ziel-User (reassign-admin)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parseTo", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--reason <text>",
+    description: "Begr\xFCndung (Audit)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parseReason", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "-y, --yes",
+    description: "Production-Confirmation \xFCberspringen"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", []),
+  _ts_metadata13("design:returntype", Boolean)
+], UserCommands.prototype, "parseYes", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--first <name>",
+    description: "Vorname (create-super-admin)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parseFirst", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--last <name>",
+    description: "Nachname (create-super-admin)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parseLast", null);
+_ts_decorate14([
+  (0, import_nest_commander6.Option)({
+    flags: "--password <pwd>",
+    description: "Passwort (create-super-admin; ohne Angabe generiert)"
+  }),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    String
+  ]),
+  _ts_metadata13("design:returntype", String)
+], UserCommands.prototype, "parsePassword", null);
+UserCommands = _ts_decorate14([
+  (0, import_common14.Injectable)(),
+  (0, import_nest_commander6.Command)({
+    name: "user",
+    description: "User-Operationen (create-super-admin, reassign-admin, list, reset-password, deactivate)"
+  }),
+  _ts_param9(1, (0, import_common14.Inject)(USER_MANAGEMENT_PORT_TOKEN)),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    typeof CliContextService === "undefined" ? Object : CliContextService,
+    typeof UserManagementPort === "undefined" ? Object : UserManagementPort
+  ])
+], UserCommands);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUDIT_QUERY_PORT_TOKEN,
+  AdminCommands,
+  AdminManifestDoctorCheck,
+  AdminMfaSetupCommand,
+  AdminWhoamiCommand,
+  AuditCommands,
+  AuditTailCommand,
+  AuditTailFlow,
+  CLI_CONTEXT_CONFIG_TOKEN,
+  CliContextModule,
+  CliContextService,
+  CliError,
+  DEFAULT_MANIFEST_CHECKS,
+  DOCTOR_CHECKS_TOKEN,
+  DiscoveryCommands,
+  DiscoveryScanCommand,
+  DiscoverySnapshotDoctorCheck,
+  DoctorCommands,
+  DoctorFlow,
+  MANIFEST_ACCESS_PORT_TOKEN,
+  MANIFEST_CHECKS_TOKEN,
+  ManifestCheckCommand,
+  ManifestCliFlow,
+  ManifestCommands,
+  ManifestDumpCommand,
+  ManifestHashCommand,
+  ManifestValidateCommand,
+  MfaSetupFlow,
+  PLATFORM_DOCTOR_CHECK_PROVIDERS,
+  PlanCatalogDoctorCheck,
+  USER_MANAGEMENT_PORT_TOKEN,
+  USER_PORT_TOKEN,
+  UserCommands,
+  UserPortDoctorCheck,
+  WhoAmIFlow,
+  applyFragmentBlocks,
+  extractModelBlocks,
+  extractModelNames
+});