@saasicat/cli 0.26.1 → 0.27.0

package/dist/index.cjs

@@ -40,6 +40,7 @@ __export(index_exports, {
   AuditTailCommand: () => AuditTailCommand,
   AuditTailFlow: () => AuditTailFlow,
   CLI_CONTEXT_CONFIG_TOKEN: () => CLI_CONTEXT_CONFIG_TOKEN,
+  CONSTRAINTS_MARKER: () => CONSTRAINTS_MARKER,
   CliContextModule: () => CliContextModule,
   CliContextService: () => CliContextService,
   CliError: () => CliError,
@@ -50,6 +51,8 @@ __export(index_exports, {
   DiscoverySnapshotDoctorCheck: () => DiscoverySnapshotDoctorCheck,
   DoctorCommands: () => DoctorCommands,
   DoctorFlow: () => DoctorFlow,
+  LIMIT_FILTER_IMPORTS: () => LIMIT_FILTER_IMPORTS,
+  LIMIT_FILTER_PROVIDER: () => LIMIT_FILTER_PROVIDER,
   MANIFEST_ACCESS_PORT_TOKEN: () => MANIFEST_ACCESS_PORT_TOKEN,
   MANIFEST_CHECKS_TOKEN: () => MANIFEST_CHECKS_TOKEN,
   ManifestCheckCommand: () => ManifestCheckCommand,
@@ -66,21 +69,46 @@ __export(index_exports, {
   UserCommands: () => UserCommands,
   UserPortDoctorCheck: () => UserPortDoctorCheck,
   WhoAmIFlow: () => WhoAmIFlow,
+  appendConstraints: () => appendConstraints,
   applyFragmentBlocks: () => applyFragmentBlocks,
+  applyTokens: () => applyTokens,
+  assertModelsExist: () => assertModelsExist,
+  assertValidProjectKey: () => assertValidProjectKey,
+  assertValidQuotaKey: () => assertValidQuotaKey,
   blankStringLiterals: () => blankStringLiterals,
   blockBodyLines: () => blockBodyLines,
   breaksContract: () => breaksContract,
   checkSchema: () => checkSchema,
+  constraintsFor: () => constraintsFor,
+  enableFkPointers: () => enableFkPointers,
   extractBlockNames: () => extractBlockNames,
   extractBlocks: () => extractBlocks,
   extractModelBlocks: () => extractModelBlocks,
   extractModelNames: () => extractModelNames,
+  findFkPointers: () => findFkPointers,
+  foreignKeyOf: () => foreignKeyOf,
+  hasBackRelation: () => hasBackRelation,
+  hasConstraints: () => hasConstraints,
+  isOneToOne: () => isOneToOne,
+  kebabCase: () => kebabCase,
+  migrationCreatedBy: () => migrationCreatedBy,
+  minimumQuotasPerPlan: () => minimumQuotasPerPlan,
   parseBlockAttributes: () => parseBlockAttributes,
   parseEnumValues: () => parseEnumValues,
   parseFields: () => parseFields,
+  parseQuota: () => parseQuota,
   parseSchema: () => parseSchema,
+  pascalCase: () => pascalCase,
+  patchAppModule: () => patchAppModule,
+  patchOptionsFor: () => patchOptionsFor,
+  planInit: () => planInit,
+  projectKeyPattern: () => projectKeyPattern,
+  quotaKeyPattern: () => quotaKeyPattern,
+  relationNameOf: () => relationNameOf,
+  reportConstraints: () => reportConstraints,
   stripLineComment: () => stripLineComment,
-  structuralOnly: () => structuralOnly
+  structuralOnly: () => structuralOnly,
+  tablesAddressedBy: () => tablesAddressedBy
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -1155,21 +1183,21 @@ function structuralOnly(line) {
   return stripLineComment(blankStringLiterals(line));
 }
 __name(structuralOnly, "structuralOnly");
-function extractBlockNames(schema, keyword) {
+function extractBlockNames(schema2, keyword) {
   const pattern = declarationPattern(keyword);
   const names = [];
-  for (const line of schema.split("\n")) {
+  for (const line of schema2.split("\n")) {
     const match = structuralOnly(line).match(pattern);
     if (match) names.push(match[1]);
   }
   return names;
 }
 __name(extractBlockNames, "extractBlockNames");
-function extractBlocks(schema, keyword) {
+function extractBlocks(schema2, keyword) {
   const pattern = declarationPattern(keyword);
   const blocks = /* @__PURE__ */ new Map();
   let current = null;
-  for (const rawLine of schema.split("\n")) {
+  for (const rawLine of schema2.split("\n")) {
     const stripped = structuralOnly(rawLine);
     const openCount = (stripped.match(/\{/g) ?? []).length;
     const closeCount = (stripped.match(/\}/g) ?? []).length;
@@ -1204,16 +1232,16 @@ function blockBodyLines(block) {
 __name(blockBodyLines, "blockBodyLines");
 
 // src/schema-apply.ts
-function extractModelNames(schema) {
-  return extractBlockNames(schema, "model");
+function extractModelNames(schema2) {
+  return extractBlockNames(schema2, "model");
 }
 __name(extractModelNames, "extractModelNames");
 function extractModelBlocks(fragment) {
   return extractBlocks(fragment, "model");
 }
 __name(extractModelBlocks, "extractModelBlocks");
-function applyFragmentBlocks(schema, fragmentBlocks, options = {}) {
-  const existing = new Set(extractModelNames(schema));
+function applyFragmentBlocks(schema2, fragmentBlocks, options = {}) {
+  const existing = new Set(extractModelNames(schema2));
   const added = [];
   const skipped = [];
   const additions = [];
@@ -1229,7 +1257,7 @@ function applyFragmentBlocks(schema, fragmentBlocks, options = {}) {
     return {
       added,
       skipped,
-      schema
+      schema: schema2
     };
   }
   const header = options.fragmentLabel ? `
@@ -1241,7 +1269,7 @@ function applyFragmentBlocks(schema, fragmentBlocks, options = {}) {
 
 // Inserted by \`saasicat schema apply\`
 `;
-  const trimmedSchema = schema.endsWith("\n") ? schema : schema + "\n";
+  const trimmedSchema = schema2.endsWith("\n") ? schema2 : schema2 + "\n";
   return {
     added,
     skipped,
@@ -1299,15 +1327,15 @@ function parseBlockAttributes(name, block) {
   };
 }
 __name(parseBlockAttributes, "parseBlockAttributes");
-function parseSchema(schema) {
+function parseSchema(schema2) {
   const models = /* @__PURE__ */ new Map();
   const modelAttributes = /* @__PURE__ */ new Map();
-  for (const [name, block] of extractBlocks(schema, "model")) {
+  for (const [name, block] of extractBlocks(schema2, "model")) {
     models.set(name, parseFields(block));
     modelAttributes.set(name, parseBlockAttributes(name, block));
   }
   const enums = /* @__PURE__ */ new Map();
-  for (const [name, block] of extractBlocks(schema, "enum")) {
+  for (const [name, block] of extractBlocks(schema2, "enum")) {
     enums.set(name, parseEnumValues(block));
   }
   return {
@@ -1433,6 +1461,496 @@ function checkSchema(specSchema, appSchema) {
 }
 __name(checkSchema, "checkSchema");
 
+// src/migration-constraints.ts
+var CONSTRAINTS_MARKER = "-- saasicat:constraints";
+function migrationCreatedBy(before, after) {
+  const existing = new Set(before);
+  const created = after.filter((name) => /^\d{14}_/.test(name) && !existing.has(name)).sort();
+  return created.length > 0 ? created[created.length - 1] : null;
+}
+__name(migrationCreatedBy, "migrationCreatedBy");
+function hasConstraints(migrationSql) {
+  return migrationSql.includes(CONSTRAINTS_MARKER);
+}
+__name(hasConstraints, "hasConstraints");
+function tablesAddressedBy(statement) {
+  return [
+    ...statement.matchAll(/\bON\s+"?(\w+)"?|\bALTER\s+TABLE\s+"?(\w+)"?/gi)
+  ].map((m) => m[1] ?? m[2]);
+}
+__name(tablesAddressedBy, "tablesAddressedBy");
+function constraintsFor(constraintsSql, tables) {
+  const known = new Set(tables);
+  return constraintsSql.split(/\n\s*\n/).filter((block) => {
+    const addressed = tablesAddressedBy(block);
+    return addressed.length === 0 || addressed.every((table) => known.has(table));
+  }).join("\n\n").trimEnd();
+}
+__name(constraintsFor, "constraintsFor");
+function appendConstraints(migrationSql, constraintsSql) {
+  if (hasConstraints(migrationSql)) return migrationSql;
+  if (constraintsSql.trim() === "") return migrationSql;
+  const body = migrationSql.endsWith("\n") ? migrationSql : `${migrationSql}
+`;
+  return `${body}
+${CONSTRAINTS_MARKER} \u2014 appended by \`saasicat schema migrate\`.
+-- Source: @saasicat/spec/sql/constraints.postgres.sql. These are part of the
+-- canonical schema: the adapter contract tests run against a database that has
+-- them. Edit the spec, not this copy.
+${constraintsSql.trimEnd()}
+`;
+}
+__name(appendConstraints, "appendConstraints");
+function reportConstraints(outcome, context) {
+  switch (outcome) {
+    case "appended":
+      return {
+        outcome,
+        mayApply: true,
+        message: `  + appended to ${context.migration}/migration.sql`
+      };
+    case "already-present":
+      return {
+        outcome,
+        mayApply: true,
+        message: `  = ${context.migration} already carries them.`
+      };
+    case "not-applicable":
+      return {
+        outcome,
+        mayApply: true,
+        message: "  = none of them apply to the tables in this schema."
+      };
+    case "no-migration":
+      return {
+        outcome,
+        mayApply: true,
+        message: "  = Prisma created no migration \u2014 nothing to append to, and nothing new to apply."
+      };
+    case "failed":
+      return {
+        outcome,
+        mayApply: false,
+        message: `  ! Could not append them, so the migration is incomplete. Add ${context.sqlPath} to it by hand, before applying it \u2014 nothing was applied.`
+      };
+  }
+}
+__name(reportConstraints, "reportConstraints");
+
+// src/fk-pointers.ts
+var POINTER = /^(\s*)\/\/\s*(\w+)(\s+)(Tenant|User)(\??)(\s+)(@relation\(.*\))\s*$/;
+function findFkPointers(schema2) {
+  const found = [];
+  let model = "";
+  schema2.split("\n").forEach((text, line) => {
+    const opening = /^model\s+(\w+)\s*\{/.exec(text);
+    if (opening) model = opening[1];
+    const match = POINTER.exec(text);
+    if (match) found.push({
+      line,
+      target: match[4],
+      model,
+      text
+    });
+  });
+  return found;
+}
+__name(findFkPointers, "findFkPointers");
+function relationNameOf(relationAttribute) {
+  const match = /@relation\(\s*"([^"]+)"/.exec(relationAttribute);
+  return match ? match[1] : null;
+}
+__name(relationNameOf, "relationNameOf");
+function escapeForRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+__name(escapeForRegExp, "escapeForRegExp");
+function modelBody(schema2, model) {
+  const name = escapeForRegExp(model);
+  const block = new RegExp(`(^|\\n)model\\s+${name}\\s*\\{([\\s\\S]*?)\\n\\}`, "m").exec(schema2);
+  return block ? block[2] : null;
+}
+__name(modelBody, "modelBody");
+function isOneToOne(schema2, model, foreignKey) {
+  const body = modelBody(schema2, model);
+  if (!body) return false;
+  return new RegExp(`^\\s*${escapeForRegExp(foreignKey)}\\s+\\S+.*@unique`, "m").test(body);
+}
+__name(isOneToOne, "isOneToOne");
+function hasBackRelation(schema2, model, owner, relationName, singular = false) {
+  const body = modelBody(schema2, owner);
+  if (body === null) return false;
+  const name = escapeForRegExp(model);
+  const shape = singular ? `${name}\\??` : `${name}\\[\\]`;
+  const candidates = [
+    ...body.matchAll(new RegExp(`^\\s*\\w+\\s+${shape}(\\s.*)?$`, "gm"))
+  ];
+  return candidates.some((line) => relationNameOf(line[0]) === relationName);
+}
+__name(hasBackRelation, "hasBackRelation");
+function enableFkPointers(schema2, models) {
+  const lines = schema2.split("\n");
+  const enabled = [];
+  const skipped = [];
+  const needsBackRelation = [];
+  for (const pointer of findFkPointers(schema2)) {
+    const model = pointer.target === "Tenant" ? models.tenant : models.user;
+    if (!model) {
+      skipped.push({
+        line: pointer.line,
+        target: pointer.target
+      });
+      continue;
+    }
+    const match = POINTER.exec(pointer.text);
+    const relationName = relationNameOf(match[7]);
+    const foreignKey = foreignKeyOf(match[7]);
+    const singular = foreignKey !== null && isOneToOne(schema2, pointer.model, foreignKey);
+    if (!hasBackRelation(schema2, pointer.model, model, relationName, singular)) {
+      needsBackRelation.push({
+        line: pointer.line,
+        owner: model,
+        suggestion: backRelationSuggestion(pointer.model, relationName, singular)
+      });
+      continue;
+    }
+    const [, indent, field, gap1, , optional, gap2, relation] = match;
+    lines[pointer.line] = `${indent}${field}${gap1}${model}${optional}${gap2}${relation}`;
+    enabled.push({
+      line: pointer.line,
+      model
+    });
+  }
+  return {
+    schema: lines.join("\n"),
+    enabled,
+    skipped,
+    needsBackRelation
+  };
+}
+__name(enableFkPointers, "enableFkPointers");
+var lowerFirst = /* @__PURE__ */ __name((value) => value.charAt(0).toLowerCase() + value.slice(1), "lowerFirst");
+function foreignKeyOf(relationAttribute) {
+  const match = /fields:\s*\[\s*(\w+)/.exec(relationAttribute);
+  return match ? match[1] : null;
+}
+__name(foreignKeyOf, "foreignKeyOf");
+function backRelationSuggestion(model, relationName, singular) {
+  const field = singular ? lowerFirst(model) : `${lowerFirst(model)}s`;
+  const type = singular ? `${model}?` : `${model}[]`;
+  return `${field} ${type}` + (relationName ? ` @relation("${relationName}")` : "");
+}
+__name(backRelationSuggestion, "backRelationSuggestion");
+function assertModelsExist(declaredModels, models) {
+  const missing = Object.entries(models).filter(([, name]) => name && !declaredModels.includes(name)).map(([role, name]) => `--${role}-model=${name}`);
+  if (missing.length === 0) return;
+  throw new Error(`${missing.join(", ")} \u2014 no such model in this schema. It declares: ${declaredModels.slice().sort().join(", ")}.`);
+}
+__name(assertModelsExist, "assertModelsExist");
+
+// src/init/catalog-keys.ts
+var import_spec = require("@saasicat/spec");
+var schema = import_spec.planCatalogSchema;
+function required(value, what) {
+  if (value === void 0) {
+    throw new Error(`plan-catalog.schema.json declares no ${what} \u2014 @saasicat/spec and @saasicat/cli are out of step.`);
+  }
+  return value;
+}
+__name(required, "required");
+function projectKeyPattern() {
+  return new RegExp(required(schema.properties?.projectKey?.pattern, "pattern for projectKey"));
+}
+__name(projectKeyPattern, "projectKeyPattern");
+function quotaKeyPattern() {
+  const patterns = Object.keys(required(schema.$defs?.PlanDef?.properties?.quotas?.patternProperties, "quota key pattern"));
+  if (patterns.length !== 1) {
+    throw new Error(`plan-catalog.schema.json declares ${patterns.length} quota key patterns; this derivation can express one.`);
+  }
+  return new RegExp(patterns[0]);
+}
+__name(quotaKeyPattern, "quotaKeyPattern");
+function minimumQuotasPerPlan() {
+  return required(schema.$defs?.PlanDef?.properties?.quotas?.minProperties, "minProperties");
+}
+__name(minimumQuotasPerPlan, "minimumQuotasPerPlan");
+function assertValidProjectKey(projectKey) {
+  const pattern = projectKeyPattern();
+  if (pattern.test(projectKey)) return;
+  throw new Error(`--project-key=${projectKey} is not a valid project key. It has to match ${pattern.source} \u2014 lower case, starting with a letter, at least two characters. The platform validates config/saas.yaml against the same pattern at boot, so this would fail after every file was written.`);
+}
+__name(assertValidProjectKey, "assertValidProjectKey");
+function assertValidQuotaKey(quotaKey) {
+  const pattern = quotaKeyPattern();
+  if (pattern.test(quotaKey)) return;
+  throw new Error(`--quota=${quotaKey}:\u2026 is not a valid quota key. It has to match ${pattern.source} \u2014 lower camel case, no separators, so \`activeSeats\` rather than \`active-seats\` or \`active_seats\`. The plan's \`quotas\` object forbids additional properties, so the platform rejects config/saas.yaml at boot otherwise.`);
+}
+__name(assertValidQuotaKey, "assertValidQuotaKey");
+
+// src/init/plan.ts
+function parseQuota(spec) {
+  const [key, model] = spec.split(":");
+  if (!key) throw new Error(`--quota needs a key: got '${spec}'`);
+  assertValidQuotaKey(key);
+  return {
+    key,
+    model: delegateName(model ?? key)
+  };
+}
+__name(parseQuota, "parseQuota");
+var delegateName = /* @__PURE__ */ __name((model) => model.charAt(0).toLowerCase() + model.slice(1), "delegateName");
+function assertEnoughQuotas(quotas) {
+  const minimum = minimumQuotasPerPlan();
+  if (quotas.length >= minimum) return;
+  throw new Error(`init needs at least ${minimum} --quota=<key>:<Model>. Every plan in config/saas.yaml must declare one, and the platform refuses a catalogue without it \u2014 so a project generated without one cannot boot. Name what your app counts, for example --quota=notes:Note; the generated provider is where you say how to count it.`);
+}
+__name(assertEnoughQuotas, "assertEnoughQuotas");
+function pascalCase(value) {
+  return value.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+}
+__name(pascalCase, "pascalCase");
+var quotaFileName = /* @__PURE__ */ __name((key) => `${key.replace(/[^A-Za-z0-9]+/g, "-").toLowerCase()}-quota.provider.ts`, "quotaFileName");
+function planInit(options) {
+  const projectKey = options.projectKey;
+  if (!projectKey) throw new Error("init needs a --project-key.");
+  assertValidProjectKey(projectKey);
+  const appLabel = options.appName ?? pascalCase(projectKey);
+  const appName = pascalCase(appLabel);
+  const apiBase = options.apiBase ?? "/api/v1/admin";
+  const quotas = (options.quotas ?? []).map(parseQuota);
+  assertEnoughQuotas(quotas);
+  const hasherClass = options.skipHasher ? null : `${appName}PasswordHasher`;
+  const featureKey = `${projectKey.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}_CORE`;
+  const shared = {
+    PROJECT_KEY: projectKey,
+    APP_NAME: appName,
+    APP_LABEL: appLabel,
+    API_BASE: apiBase,
+    FEATURE_KEY: featureKey,
+    REGISTRY_CONST: `${constantCase(projectKey)}_FEATURE_UI_REGISTRY`,
+    MANIFEST_CONST: `${constantCase(projectKey)}_MANIFEST_CONTRIBUTION`,
+    ADMIN_MODULE_CLASS: `${appName}AdminModule`,
+    HASHER_CLASS: hasherClass ?? "",
+    HASHER_FILE: hasherClass ? `${kebabCase(appName)}-password.hasher` : "",
+    STARTER_QUOTAS: renderQuotaBlock(quotas, 25),
+    PRO_QUOTAS: renderQuotaBlock(quotas, 1e3)
+  };
+  const files = [
+    {
+      path: "config/saas.yaml",
+      template: "config/saas.yaml",
+      tokens: {}
+    },
+    {
+      path: "src/saas/feature-ui-registry.ts",
+      template: "src/saas/feature-ui-registry.ts",
+      tokens: {}
+    },
+    {
+      path: "src/saas/admin-manifest.contribution.ts",
+      template: "src/saas/admin-manifest.contribution.ts",
+      tokens: {}
+    },
+    {
+      path: `src/saas/${kebabCase(appName)}-admin.module.ts`,
+      template: "src/saas/admin.module.ts",
+      tokens: {}
+    }
+  ];
+  files.push({
+    path: "src/saas/persistence.ts",
+    template: hasherClass ? "src/saas/persistence.ts" : "src/saas/persistence-without-hasher.ts",
+    tokens: {}
+  });
+  if (hasherClass) {
+    files.push({
+      path: `src/auth/${kebabCase(appName)}-password.hasher.ts`,
+      template: "src/auth/password.hasher.ts",
+      tokens: {}
+    });
+  }
+  const quotaProviders = quotas.map((quota) => ({
+    className: `${pascalCase(quota.key)}QuotaProvider`,
+    path: `src/saas/${quotaFileName(quota.key)}`
+  }));
+  for (const quota of quotas) {
+    files.push({
+      path: `src/saas/${quotaFileName(quota.key)}`,
+      template: "src/saas/quota.provider.ts",
+      tokens: {
+        QUOTA_KEY: quota.key,
+        QUOTA_LABEL: `${pascalCase(quota.key)} count`,
+        QUOTA_CLASS: `${pascalCase(quota.key)}QuotaProvider`,
+        QUOTA_MODEL: quota.model
+      }
+    });
+  }
+  return {
+    files,
+    tokens: shared,
+    quotaProviders,
+    hasherClass
+  };
+}
+__name(planInit, "planInit");
+var constantCase = /* @__PURE__ */ __name((value) => value.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase(), "constantCase");
+var kebabCase = /* @__PURE__ */ __name((value) => value.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^A-Za-z0-9]+/g, "-").toLowerCase(), "kebabCase");
+function renderQuotaBlock(quotas, limit) {
+  if (quotas.length === 0) return " {}";
+  return quotas.map((quota) => `
+          ${quota.key}: ${limit}`).join("");
+}
+__name(renderQuotaBlock, "renderQuotaBlock");
+function applyTokens(content, tokens) {
+  return content.replace(/__([A-Z_]+)__/g, (full, key) => tokens[key] === void 0 ? full : tokens[key]);
+}
+__name(applyTokens, "applyTokens");
+function patchOptionsFor(plan) {
+  const generates = /* @__PURE__ */ __name((path) => plan.files.some((file) => file.path === path), "generates");
+  return {
+    persistenceImport: generates("src/saas/persistence.ts") ? "./saas/persistence" : null,
+    adminModule: {
+      className: plan.tokens.ADMIN_MODULE_CLASS,
+      importPath: `./saas/${kebabCase(plan.tokens.APP_NAME)}-admin.module`
+    },
+    // Read off the plan, not re-derived: the file it wrote is the file the
+    // import has to name.
+    quotaProviders: plan.quotaProviders.map(({ className, path }) => ({
+      className,
+      importPath: `./${path.replace(/^src\//, "").replace(/\.ts$/, "")}`
+    })),
+    registry: {
+      constName: plan.tokens.REGISTRY_CONST,
+      importPath: "./saas/feature-ui-registry"
+    }
+  };
+}
+__name(patchOptionsFor, "patchOptionsFor");
+
+// src/init/patch-app-module.ts
+var MARKER = "SaaSiCatModule.forRoot";
+function patchAppModule(source, options) {
+  const block = renderForRootBlock(options);
+  const manualBlock = `${renderImports(options)}
+
+${block}`;
+  if (source.includes(MARKER)) {
+    return {
+      source,
+      status: "already-wired",
+      reason: "",
+      manualBlock: ""
+    };
+  }
+  const importsArray = findImportsArray(source);
+  if (!importsArray) {
+    return {
+      source,
+      status: "declined",
+      reason: "no `@Module({ imports: [ ... ] })` was found in this file, so there is nowhere to add the platform without guessing at the structure",
+      manualBlock
+    };
+  }
+  const withImports = addImportStatements(source, options);
+  const target = findImportsArray(withImports);
+  const indent = " ".repeat(target.indent + 4);
+  const entries = `${block},
+${options.adminModule.className},`;
+  const wasEmpty = /^\s*\]/.test(withImports.slice(target.openBracket + 1));
+  const trailing = wasEmpty ? " ".repeat(target.indent) : indent;
+  const inserted = `
+${indent}${entries.split("\n").join(`
+${indent}`)}
+${trailing}`;
+  return {
+    source: withImports.slice(0, target.openBracket + 1) + inserted + withImports.slice(target.openBracket + 1),
+    status: "patched",
+    reason: "",
+    manualBlock: ""
+  };
+}
+__name(patchAppModule, "patchAppModule");
+function findImportsArray(source) {
+  const decorator = source.indexOf("@Module(");
+  if (decorator === -1) return null;
+  const match = /(^|\n)([ \t]*)imports\s*:\s*\[/.exec(source.slice(decorator));
+  if (!match) return null;
+  const openBracket = decorator + match.index + match[0].length - 1;
+  return {
+    openBracket,
+    indent: match[2].length
+  };
+}
+__name(findImportsArray, "findImportsArray");
+function renderImports(options) {
+  const lines = [
+    "import { loadPlanCatalogFromFile } from '@saasicat/nest/billing';",
+    "import { SaaSiCatModule, defineSaaSiCat } from '@saasicat/nest/platform';",
+    `import { ${options.registry.constName} } from '${options.registry.importPath}';`,
+    `import { ${options.adminModule.className} } from '${options.adminModule.importPath}';`
+  ];
+  if (options.persistenceImport) {
+    lines.push(`import { persistence } from '${options.persistenceImport}';`);
+  }
+  for (const quota of options.quotaProviders) {
+    lines.push(`import { ${quota.className} } from '${quota.importPath}';`);
+  }
+  return lines.join("\n");
+}
+__name(renderImports, "renderImports");
+function addImportStatements(source, options) {
+  const lines = source.split("\n");
+  const block = renderImports(options).split("\n");
+  lines.splice(endOfLastImport(lines) + 1, 0, ...block);
+  return lines.join("\n");
+}
+__name(addImportStatements, "addImportStatements");
+function endOfLastImport(lines) {
+  let end = -1;
+  let open = false;
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!open && !/^\s*import\s/.test(line)) continue;
+    open = true;
+    if (/\bfrom\s+['"][^'"]+['"]/.test(line) || /^\s*import\s+['"][^'"]+['"]/.test(line)) {
+      end = index;
+      open = false;
+    }
+  }
+  return end;
+}
+__name(endOfLastImport, "endOfLastImport");
+function renderForRootBlock(options) {
+  const quotaList = options.quotaProviders.map((q) => q.className).join(", ");
+  return [
+    "SaaSiCatModule.forRoot(",
+    "    defineSaaSiCat({",
+    "        // Plans straight from the YAML. Apps that manage plans in the",
+    "        // SuperAdmin UI pass `dbCatalog` instead.",
+    "        planCatalog: loadPlanCatalogFromFile({ path: 'config/saas.yaml' }),",
+    "        // Your authentication guard. This does NOT compile until you",
+    "        // name one, and that is deliberate: an empty array is how the",
+    "        // platform is told an endpoint should be auth-free, so a",
+    "        // placeholder `[]` here would publish GET /admin/discovery \u2014",
+    "        // your whole capability inventory \u2014 and the manifest routes to",
+    "        // anyone who asks. Import your guard and put it in.",
+    "        controller: { guards: [YourAuthGuard] },",
+    options.persistenceImport ? "        persistence," : "        // persistence: prismaPersistence({ client: PrismaService }),",
+    "        catalog: { featureUiRegistry: " + options.registry.constName + " },",
+    "        adminResources: true,",
+    "        promoCodes: true,",
+    quotaList ? `        quotaProviders: [${quotaList}],` : "        quotaProviders: [],",
+    "    }),",
+    ")"
+  ].join("\n");
+}
+__name(renderForRootBlock, "renderForRootBlock");
+var LIMIT_FILTER_PROVIDER = "{ provide: APP_FILTER, useClass: LimitExceededFilter }";
+var LIMIT_FILTER_IMPORTS = [
+  "import { APP_FILTER } from '@nestjs/core';",
+  "import { LimitExceededFilter } from '@saasicat/nest/billing';"
+].join("\n");
+
 // src/module.ts
 var import_common8 = require("@nestjs/common");
 var import_nest5 = require("@saasicat/nest");
@@ -2495,6 +3013,7 @@ UserCommands = _ts_decorate14([
   AuditTailCommand,
   AuditTailFlow,
   CLI_CONTEXT_CONFIG_TOKEN,
+  CONSTRAINTS_MARKER,
   CliContextModule,
   CliContextService,
   CliError,
@@ -2505,6 +3024,8 @@ UserCommands = _ts_decorate14([
   DiscoverySnapshotDoctorCheck,
   DoctorCommands,
   DoctorFlow,
+  LIMIT_FILTER_IMPORTS,
+  LIMIT_FILTER_PROVIDER,
   MANIFEST_ACCESS_PORT_TOKEN,
   MANIFEST_CHECKS_TOKEN,
   ManifestCheckCommand,
@@ -2521,19 +3042,44 @@ UserCommands = _ts_decorate14([
   UserCommands,
   UserPortDoctorCheck,
   WhoAmIFlow,
+  appendConstraints,
   applyFragmentBlocks,
+  applyTokens,
+  assertModelsExist,
+  assertValidProjectKey,
+  assertValidQuotaKey,
   blankStringLiterals,
   blockBodyLines,
   breaksContract,
   checkSchema,
+  constraintsFor,
+  enableFkPointers,
   extractBlockNames,
   extractBlocks,
   extractModelBlocks,
   extractModelNames,
+  findFkPointers,
+  foreignKeyOf,
+  hasBackRelation,
+  hasConstraints,
+  isOneToOne,
+  kebabCase,
+  migrationCreatedBy,
+  minimumQuotasPerPlan,
   parseBlockAttributes,
   parseEnumValues,
   parseFields,
+  parseQuota,
   parseSchema,
+  pascalCase,
+  patchAppModule,
+  patchOptionsFor,
+  planInit,
+  projectKeyPattern,
+  quotaKeyPattern,
+  relationNameOf,
+  reportConstraints,
   stripLineComment,
-  structuralOnly
+  structuralOnly,
+  tablesAddressedBy
 });