@saasicat/cli 1.0.0-rc.18 → 1.0.0-rc.19

package/dist/.build-stamp

@@ -1 +1 @@
-5800fd6cc355627c7191678dd59fd575d2569a6ae000b10915959a83b34ce7a3
+6d26748d12c2cc8e839f2a13b89df38079e8253fb11933454d69ef20cc6de850

package/dist/index.cjs

@@ -51,6 +51,7 @@ __export(index_exports, {
   DiscoverySnapshotDoctorCheck: () => DiscoverySnapshotDoctorCheck,
   DoctorCommands: () => DoctorCommands,
   DoctorFlow: () => DoctorFlow,
+  IssuerIdentityDoctorCheck: () => IssuerIdentityDoctorCheck,
   LIMIT_FILTER_IMPORTS: () => LIMIT_FILTER_IMPORTS,
   LIMIT_FILTER_PROVIDER: () => LIMIT_FILTER_PROVIDER,
   MANIFEST_ACCESS_PORT_TOKEN: () => MANIFEST_ACCESS_PORT_TOKEN,
@@ -1156,11 +1157,85 @@ AdminManifestDoctorCheck = _ts_decorate7([
     typeof import_nest4.AdminManifestService === "undefined" ? Object : import_nest4.AdminManifestService
   ])
 ], AdminManifestDoctorCheck);
+var IssuerIdentityDoctorCheck = class {
+  static {
+    __name(this, "IssuerIdentityDoctorCheck");
+  }
+  issuer;
+  id = "platform.issuer-identity";
+  label = "Issuer identity against the recorded one";
+  constructor(issuer) {
+    this.issuer = issuer;
+  }
+  async run() {
+    const verdict = await this.issuer.inspect();
+    if (verdict.kind === "refused") {
+      return {
+        severity: "error",
+        message: verdict.refusal,
+        // The number and the identifiers, not the rows: `DoctorReport`
+        // is serialised as JSON, and the dates on a row would come out
+        // as timestamps beside the same dates already written as days in
+        // the message above.
+        // One unknown answered once: `null` for both where the
+        // contracts could not be read, rather than a null count beside
+        // an empty list that reads as "none".
+        details: verdict.running ? {
+          runningContracts: verdict.running.total,
+          named: verdict.running.contracts.map((row) => row.id)
+        } : {
+          runningContracts: null,
+          named: null
+        }
+      };
+    }
+    if (verdict.kind === "not-compared") {
+      return {
+        severity: "warning",
+        message: `The issuer in the file is compared with nothing \u2014 ${verdict.why} \u2014 so a start that names another legal entity than the last one is not refused.`
+      };
+    }
+    const change = verdict.change;
+    switch (change.kind) {
+      case "none-named":
+        return {
+          severity: "ok",
+          message: "No issuer is named, and none was recorded."
+        };
+      case "first-naming":
+        return {
+          severity: "ok",
+          message: `'${change.identity.legalName}' is named for the first time; no contract can name another.`
+        };
+      case "corrected":
+        return {
+          severity: "ok",
+          message: `A correction of '${change.recorded.legalName}' is declared: ${change.reason}. This is what the start found; whether it has been recorded is what \`GET /admin/settings\` shows, and \`issuer.correctionOf\` may be dropped once it does.`
+        };
+      case "unchanged": {
+        const running = await this.issuer.runningContractCount();
+        const weighedAgainst = running === null ? "" : ` ${running} contract(s) are running, and their issuer copies do not follow a change.`;
+        return {
+          severity: "ok",
+          message: `'${change.identity.legalName}' is what the installation recorded.` + weighedAgainst + " Changing the legal name or a tax identifier needs `issuer.correctionOf` beside the values it replaces; the address and the contact details do not."
+        };
+      }
+    }
+  }
+};
+IssuerIdentityDoctorCheck = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof import_nest4.IssuerIdentityInspector === "undefined" ? Object : import_nest4.IssuerIdentityInspector
+  ])
+], IssuerIdentityDoctorCheck);
 var PLATFORM_DOCTOR_CHECK_PROVIDERS = [
   PlanCatalogDoctorCheck,
   DiscoverySnapshotDoctorCheck,
   UserPortDoctorCheck,
-  AdminManifestDoctorCheck
+  AdminManifestDoctorCheck,
+  IssuerIdentityDoctorCheck
 ];
 
 // src/prisma-blocks.ts
@@ -3758,6 +3833,7 @@ UserCommands = _ts_decorate14([
   DiscoverySnapshotDoctorCheck,
   DoctorCommands,
   DoctorFlow,
+  IssuerIdentityDoctorCheck,
   LIMIT_FILTER_IMPORTS,
   LIMIT_FILTER_PROVIDER,
   MANIFEST_ACCESS_PORT_TOKEN,

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { MfaService, AdminAuditService, AdminManifestService, DiscoverySnapshot, ProviderSpec, DiscoveryScanner } from '@saasicat/nest';
+import { MfaService, AdminAuditService, AdminManifestService, DiscoverySnapshot, IssuerIdentityInspector, ProviderSpec, DiscoveryScanner } from '@saasicat/nest';
 import { UserPort, PlatformUserDto, AuditQueryPort, AuditEntry, AdminManifest, ManifestAccessPort, PlanCatalog, UserManagementPort } from '@saasicat/core';
 import { Type, DynamicModule } from '@nestjs/common';
 import * as TypeScript from 'typescript';
@@ -311,6 +311,28 @@ declare class AdminManifestDoctorCheck implements DoctorCheck {
     constructor(manifest: AdminManifestService);
     run(): Promise<DoctorCheckResult>;
 }
+/**
+ * The issuer identity, and what changing it would cost.
+ *
+ * A start compares the issuer in `config/saas.yaml` with the identity the
+ * installation recorded and refuses an undeclared difference, because moving a
+ * contract to another legal entity is a transfer and not an edit of a setting.
+ * This asks the same question without acting on it and says, while nothing has
+ * moved, what a change would cost.
+ *
+ * It does NOT turn a refusal into a report where the same application also
+ * mounts the platform's boot check: that check runs at `init()`, so the CLI
+ * process carrying it is refused before any command runs — with the same
+ * message, which is the point. The `refused` branch below is for a diagnostic
+ * that runs without the hook.
+ */
+declare class IssuerIdentityDoctorCheck implements DoctorCheck {
+    private readonly issuer;
+    readonly id = "platform.issuer-identity";
+    readonly label = "Issuer identity against the recorded one";
+    constructor(issuer: IssuerIdentityInspector);
+    run(): Promise<DoctorCheckResult>;
+}
 /**
  * Default list that consumers can spread in `CliContextModule.forRoot({ doctorChecks })`:
  *
@@ -1226,15 +1248,18 @@ interface CliContextModuleOptions {
      * — `<app> doctor` runs but returns no content. Consumers register
      * project-specific checks.
      *
-     * Note: if `defaultDoctorChecks: true`, the 4 platform standard checks
-     * (PlanCatalog/Discovery/UserPort/AdminManifest) are registered **in
-     * addition** to this list.
+     * Note: if `defaultDoctorChecks: true`, the platform's own checks —
+     * `PLATFORM_DOCTOR_CHECK_PROVIDERS` — are registered **in addition** to
+     * this list. They are named there rather than here: a second list of them
+     * in prose is the copy that goes stale.
      */
     doctorChecks?: ProviderSpec<DoctorCheck[]>;
     /**
-     * Default `false`. If `true`, the platform registers the four standard
-     * checks from `PLATFORM_DOCTOR_CHECK_PROVIDERS` in addition to
-     * `doctorChecks`. Recommended for all apps that take `<app> doctor` seriously.
+     * Default `false`. If `true`, the platform registers the checks from
+     * `PLATFORM_DOCTOR_CHECK_PROVIDERS` in addition to `doctorChecks`. They
+     * resolve what `SaaSiCatModule` provides, so an application that wires the
+     * platform's modules by hand registers the ones it can serve instead.
+     * Recommended for all apps that take `<app> doctor` seriously.
      */
     defaultDoctorChecks?: boolean;
     /**
@@ -1402,4 +1427,4 @@ declare class UserCommands extends CommandRunner {
     parsePassword(val: string): string;
 }
 
-export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, CONSTRAINTS_MARKER, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, type ConstraintsOutcome, type ConstraintsReport, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, type DbCatalogOccurrence, type DbCatalogResult, type DbCatalogShape, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type EnableFkResult, type FieldMismatch, type FieldMismatchReason, type FieldSignature, type FkModelNames, type FkPointer, type FragmentBlocks, type InitOptions, type InitPlan, LIMIT_FILTER_IMPORTS, LIMIT_FILTER_PROVIDER, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, type ManifestRewriteOptions, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, type ModuleResolutionVerdict, type MoveTable, type MovedSetting, type MovedSettingOccurrence, type MovedSettingsResult, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, type PatchAppModuleOptions, type PatchOptionsFromPlan, type PatchResult, PlanCatalogDoctorCheck, type PlannedFile, type ProjectKeyResult, type QuotaProviderFile, type QuotaSpec, type RenameResult, type RenameTable, type RewriteResult, SCANNED_FOR_DB_CATALOG, SCANNED_FOR_MOVED_SETTINGS, SETTINGS_THAT_MOVED, type SchemaCheckReport, type TenantCascade, UI_VUE_SPECIFIER, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WHERE_DB_CATALOG_GOES, WHERE_IT_GOES, WhoAmIFlow, type WhoAmIResult, type WrittenSetting, appKeyPattern, appendConstraints, applyFragmentBlocks, applyTokens, assertModelsExist, assertValidAppKey, assertValidQuotaKey, blankStringLiterals, blockBodyLines, breaksContract, buildImportMap, checkSchema, constraintsFor, describeDbCatalogOccurrence, enableFkPointers, extractBlockNames, extractBlocks, extractEnumBlocks, extractEnumNames, extractFragmentBlocks, extractModelBlocks, extractModelNames, findDbCatalogBlocks, findFkPointers, findMovedSettings, foreignKeyOf, hasBackRelation, hasConstraints, isNoLongerPublic, isOneToOne, judgeModuleResolution, kebabCase, migrationCreatedBy, minimumQuotasPerPlan, modelsKeptPastTheTenant, namedImports, parseBlockAttributes, parseEnumValues, parseFields, parseQuota, parseSchema, pascalCase, patchAppModule, patchOptionsFor, planInit, quotaKeyPattern, readEffectiveModuleResolution, relationNameOf, removeProjectKey, reportConstraints, rewriteImports, rewriteManifest, rewriteNames, rewriteSubpath, settingsWrittenTo, stripLineComment, structuralOnly, tablesAddressedBy };
+export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, CONSTRAINTS_MARKER, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, type ConstraintsOutcome, type ConstraintsReport, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, type DbCatalogOccurrence, type DbCatalogResult, type DbCatalogShape, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type EnableFkResult, type FieldMismatch, type FieldMismatchReason, type FieldSignature, type FkModelNames, type FkPointer, type FragmentBlocks, type InitOptions, type InitPlan, IssuerIdentityDoctorCheck, LIMIT_FILTER_IMPORTS, LIMIT_FILTER_PROVIDER, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, type ManifestRewriteOptions, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, type ModuleResolutionVerdict, type MoveTable, type MovedSetting, type MovedSettingOccurrence, type MovedSettingsResult, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, type PatchAppModuleOptions, type PatchOptionsFromPlan, type PatchResult, PlanCatalogDoctorCheck, type PlannedFile, type ProjectKeyResult, type QuotaProviderFile, type QuotaSpec, type RenameResult, type RenameTable, type RewriteResult, SCANNED_FOR_DB_CATALOG, SCANNED_FOR_MOVED_SETTINGS, SETTINGS_THAT_MOVED, type SchemaCheckReport, type TenantCascade, UI_VUE_SPECIFIER, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WHERE_DB_CATALOG_GOES, WHERE_IT_GOES, WhoAmIFlow, type WhoAmIResult, type WrittenSetting, appKeyPattern, appendConstraints, applyFragmentBlocks, applyTokens, assertModelsExist, assertValidAppKey, assertValidQuotaKey, blankStringLiterals, blockBodyLines, breaksContract, buildImportMap, checkSchema, constraintsFor, describeDbCatalogOccurrence, enableFkPointers, extractBlockNames, extractBlocks, extractEnumBlocks, extractEnumNames, extractFragmentBlocks, extractModelBlocks, extractModelNames, findDbCatalogBlocks, findFkPointers, findMovedSettings, foreignKeyOf, hasBackRelation, hasConstraints, isNoLongerPublic, isOneToOne, judgeModuleResolution, kebabCase, migrationCreatedBy, minimumQuotasPerPlan, modelsKeptPastTheTenant, namedImports, parseBlockAttributes, parseEnumValues, parseFields, parseQuota, parseSchema, pascalCase, patchAppModule, patchOptionsFor, planInit, quotaKeyPattern, readEffectiveModuleResolution, relationNameOf, removeProjectKey, reportConstraints, rewriteImports, rewriteManifest, rewriteNames, rewriteSubpath, settingsWrittenTo, stripLineComment, structuralOnly, tablesAddressedBy };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { MfaService, AdminAuditService, AdminManifestService, DiscoverySnapshot, ProviderSpec, DiscoveryScanner } from '@saasicat/nest';
+import { MfaService, AdminAuditService, AdminManifestService, DiscoverySnapshot, IssuerIdentityInspector, ProviderSpec, DiscoveryScanner } from '@saasicat/nest';
 import { UserPort, PlatformUserDto, AuditQueryPort, AuditEntry, AdminManifest, ManifestAccessPort, PlanCatalog, UserManagementPort } from '@saasicat/core';
 import { Type, DynamicModule } from '@nestjs/common';
 import * as TypeScript from 'typescript';
@@ -311,6 +311,28 @@ declare class AdminManifestDoctorCheck implements DoctorCheck {
     constructor(manifest: AdminManifestService);
     run(): Promise<DoctorCheckResult>;
 }
+/**
+ * The issuer identity, and what changing it would cost.
+ *
+ * A start compares the issuer in `config/saas.yaml` with the identity the
+ * installation recorded and refuses an undeclared difference, because moving a
+ * contract to another legal entity is a transfer and not an edit of a setting.
+ * This asks the same question without acting on it and says, while nothing has
+ * moved, what a change would cost.
+ *
+ * It does NOT turn a refusal into a report where the same application also
+ * mounts the platform's boot check: that check runs at `init()`, so the CLI
+ * process carrying it is refused before any command runs — with the same
+ * message, which is the point. The `refused` branch below is for a diagnostic
+ * that runs without the hook.
+ */
+declare class IssuerIdentityDoctorCheck implements DoctorCheck {
+    private readonly issuer;
+    readonly id = "platform.issuer-identity";
+    readonly label = "Issuer identity against the recorded one";
+    constructor(issuer: IssuerIdentityInspector);
+    run(): Promise<DoctorCheckResult>;
+}
 /**
  * Default list that consumers can spread in `CliContextModule.forRoot({ doctorChecks })`:
  *
@@ -1226,15 +1248,18 @@ interface CliContextModuleOptions {
      * — `<app> doctor` runs but returns no content. Consumers register
      * project-specific checks.
      *
-     * Note: if `defaultDoctorChecks: true`, the 4 platform standard checks
-     * (PlanCatalog/Discovery/UserPort/AdminManifest) are registered **in
-     * addition** to this list.
+     * Note: if `defaultDoctorChecks: true`, the platform's own checks —
+     * `PLATFORM_DOCTOR_CHECK_PROVIDERS` — are registered **in addition** to
+     * this list. They are named there rather than here: a second list of them
+     * in prose is the copy that goes stale.
      */
     doctorChecks?: ProviderSpec<DoctorCheck[]>;
     /**
-     * Default `false`. If `true`, the platform registers the four standard
-     * checks from `PLATFORM_DOCTOR_CHECK_PROVIDERS` in addition to
-     * `doctorChecks`. Recommended for all apps that take `<app> doctor` seriously.
+     * Default `false`. If `true`, the platform registers the checks from
+     * `PLATFORM_DOCTOR_CHECK_PROVIDERS` in addition to `doctorChecks`. They
+     * resolve what `SaaSiCatModule` provides, so an application that wires the
+     * platform's modules by hand registers the ones it can serve instead.
+     * Recommended for all apps that take `<app> doctor` seriously.
      */
     defaultDoctorChecks?: boolean;
     /**
@@ -1402,4 +1427,4 @@ declare class UserCommands extends CommandRunner {
     parsePassword(val: string): string;
 }
 
-export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, CONSTRAINTS_MARKER, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, type ConstraintsOutcome, type ConstraintsReport, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, type DbCatalogOccurrence, type DbCatalogResult, type DbCatalogShape, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type EnableFkResult, type FieldMismatch, type FieldMismatchReason, type FieldSignature, type FkModelNames, type FkPointer, type FragmentBlocks, type InitOptions, type InitPlan, LIMIT_FILTER_IMPORTS, LIMIT_FILTER_PROVIDER, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, type ManifestRewriteOptions, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, type ModuleResolutionVerdict, type MoveTable, type MovedSetting, type MovedSettingOccurrence, type MovedSettingsResult, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, type PatchAppModuleOptions, type PatchOptionsFromPlan, type PatchResult, PlanCatalogDoctorCheck, type PlannedFile, type ProjectKeyResult, type QuotaProviderFile, type QuotaSpec, type RenameResult, type RenameTable, type RewriteResult, SCANNED_FOR_DB_CATALOG, SCANNED_FOR_MOVED_SETTINGS, SETTINGS_THAT_MOVED, type SchemaCheckReport, type TenantCascade, UI_VUE_SPECIFIER, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WHERE_DB_CATALOG_GOES, WHERE_IT_GOES, WhoAmIFlow, type WhoAmIResult, type WrittenSetting, appKeyPattern, appendConstraints, applyFragmentBlocks, applyTokens, assertModelsExist, assertValidAppKey, assertValidQuotaKey, blankStringLiterals, blockBodyLines, breaksContract, buildImportMap, checkSchema, constraintsFor, describeDbCatalogOccurrence, enableFkPointers, extractBlockNames, extractBlocks, extractEnumBlocks, extractEnumNames, extractFragmentBlocks, extractModelBlocks, extractModelNames, findDbCatalogBlocks, findFkPointers, findMovedSettings, foreignKeyOf, hasBackRelation, hasConstraints, isNoLongerPublic, isOneToOne, judgeModuleResolution, kebabCase, migrationCreatedBy, minimumQuotasPerPlan, modelsKeptPastTheTenant, namedImports, parseBlockAttributes, parseEnumValues, parseFields, parseQuota, parseSchema, pascalCase, patchAppModule, patchOptionsFor, planInit, quotaKeyPattern, readEffectiveModuleResolution, relationNameOf, removeProjectKey, reportConstraints, rewriteImports, rewriteManifest, rewriteNames, rewriteSubpath, settingsWrittenTo, stripLineComment, structuralOnly, tablesAddressedBy };
+export { AUDIT_QUERY_PORT_TOKEN, AdminCommands, AdminManifestDoctorCheck, AdminMfaSetupCommand, AdminWhoamiCommand, type ApplyResult, AuditCommands, AuditTailCommand, AuditTailFlow, type AuditTailOptions, type BlockAttributeKind, type BlockAttributes, CLI_CONTEXT_CONFIG_TOKEN, CONSTRAINTS_MARKER, type CheckSeverity, type CliContextConfig, CliContextModule, type CliContextModuleOptions, CliContextService, CliError, type CliIdentity, type ConstraintsOutcome, type ConstraintsReport, DEFAULT_MANIFEST_CHECKS, DOCTOR_CHECKS_TOKEN, type DbCatalogOccurrence, type DbCatalogResult, type DbCatalogShape, DiscoveryCommands, DiscoveryScanCommand, DiscoverySnapshotDoctorCheck, type DoctorCheck, type DoctorCheckResult, DoctorCommands, DoctorFlow, type DoctorReport, type EnableFkResult, type FieldMismatch, type FieldMismatchReason, type FieldSignature, type FkModelNames, type FkPointer, type FragmentBlocks, type InitOptions, type InitPlan, IssuerIdentityDoctorCheck, LIMIT_FILTER_IMPORTS, LIMIT_FILTER_PROVIDER, MANIFEST_ACCESS_PORT_TOKEN, MANIFEST_CHECKS_TOKEN, type ManifestCheck, ManifestCheckCommand, type ManifestCheckReport, type ManifestCheckResult, ManifestCliFlow, ManifestCommands, type ManifestDiff, ManifestDumpCommand, ManifestHashCommand, type ManifestRewriteOptions, ManifestValidateCommand, MfaSetupFlow, type MfaSetupOptions, type MfaSetupResult, type MissingBlockAttribute, type MissingEnumValue, type MissingField, type ModuleResolutionVerdict, type MoveTable, type MovedSetting, type MovedSettingOccurrence, type MovedSettingsResult, PLATFORM_DOCTOR_CHECK_PROVIDERS, type ParsedSchema, type PatchAppModuleOptions, type PatchOptionsFromPlan, type PatchResult, PlanCatalogDoctorCheck, type PlannedFile, type ProjectKeyResult, type QuotaProviderFile, type QuotaSpec, type RenameResult, type RenameTable, type RewriteResult, SCANNED_FOR_DB_CATALOG, SCANNED_FOR_MOVED_SETTINGS, SETTINGS_THAT_MOVED, type SchemaCheckReport, type TenantCascade, UI_VUE_SPECIFIER, USER_MANAGEMENT_PORT_TOKEN, USER_PORT_TOKEN, UserCommands, UserPortDoctorCheck, WHERE_DB_CATALOG_GOES, WHERE_IT_GOES, WhoAmIFlow, type WhoAmIResult, type WrittenSetting, appKeyPattern, appendConstraints, applyFragmentBlocks, applyTokens, assertModelsExist, assertValidAppKey, assertValidQuotaKey, blankStringLiterals, blockBodyLines, breaksContract, buildImportMap, checkSchema, constraintsFor, describeDbCatalogOccurrence, enableFkPointers, extractBlockNames, extractBlocks, extractEnumBlocks, extractEnumNames, extractFragmentBlocks, extractModelBlocks, extractModelNames, findDbCatalogBlocks, findFkPointers, findMovedSettings, foreignKeyOf, hasBackRelation, hasConstraints, isNoLongerPublic, isOneToOne, judgeModuleResolution, kebabCase, migrationCreatedBy, minimumQuotasPerPlan, modelsKeptPastTheTenant, namedImports, parseBlockAttributes, parseEnumValues, parseFields, parseQuota, parseSchema, pascalCase, patchAppModule, patchOptionsFor, planInit, quotaKeyPattern, readEffectiveModuleResolution, relationNameOf, removeProjectKey, reportConstraints, rewriteImports, rewriteManifest, rewriteNames, rewriteSubpath, settingsWrittenTo, stripLineComment, structuralOnly, tablesAddressedBy };

package/dist/index.js

@@ -869,7 +869,7 @@ __name(collectComponentKeys, "collectComponentKeys");
 
 // src/default-doctor-checks.ts
 import { Inject as Inject6, Injectable as Injectable7 } from "@nestjs/common";
-import { AdminManifestService, DISCOVERY_SNAPSHOT_TOKEN, PLAN_CATALOG_TOKEN } from "@saasicat/nest";
+import { AdminManifestService, DISCOVERY_SNAPSHOT_TOKEN, IssuerIdentityInspector, PLAN_CATALOG_TOKEN } from "@saasicat/nest";
 function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1021,11 +1021,85 @@ AdminManifestDoctorCheck = _ts_decorate7([
     typeof AdminManifestService === "undefined" ? Object : AdminManifestService
   ])
 ], AdminManifestDoctorCheck);
+var IssuerIdentityDoctorCheck = class {
+  static {
+    __name(this, "IssuerIdentityDoctorCheck");
+  }
+  issuer;
+  id = "platform.issuer-identity";
+  label = "Issuer identity against the recorded one";
+  constructor(issuer) {
+    this.issuer = issuer;
+  }
+  async run() {
+    const verdict = await this.issuer.inspect();
+    if (verdict.kind === "refused") {
+      return {
+        severity: "error",
+        message: verdict.refusal,
+        // The number and the identifiers, not the rows: `DoctorReport`
+        // is serialised as JSON, and the dates on a row would come out
+        // as timestamps beside the same dates already written as days in
+        // the message above.
+        // One unknown answered once: `null` for both where the
+        // contracts could not be read, rather than a null count beside
+        // an empty list that reads as "none".
+        details: verdict.running ? {
+          runningContracts: verdict.running.total,
+          named: verdict.running.contracts.map((row) => row.id)
+        } : {
+          runningContracts: null,
+          named: null
+        }
+      };
+    }
+    if (verdict.kind === "not-compared") {
+      return {
+        severity: "warning",
+        message: `The issuer in the file is compared with nothing \u2014 ${verdict.why} \u2014 so a start that names another legal entity than the last one is not refused.`
+      };
+    }
+    const change = verdict.change;
+    switch (change.kind) {
+      case "none-named":
+        return {
+          severity: "ok",
+          message: "No issuer is named, and none was recorded."
+        };
+      case "first-naming":
+        return {
+          severity: "ok",
+          message: `'${change.identity.legalName}' is named for the first time; no contract can name another.`
+        };
+      case "corrected":
+        return {
+          severity: "ok",
+          message: `A correction of '${change.recorded.legalName}' is declared: ${change.reason}. This is what the start found; whether it has been recorded is what \`GET /admin/settings\` shows, and \`issuer.correctionOf\` may be dropped once it does.`
+        };
+      case "unchanged": {
+        const running = await this.issuer.runningContractCount();
+        const weighedAgainst = running === null ? "" : ` ${running} contract(s) are running, and their issuer copies do not follow a change.`;
+        return {
+          severity: "ok",
+          message: `'${change.identity.legalName}' is what the installation recorded.` + weighedAgainst + " Changing the legal name or a tax identifier needs `issuer.correctionOf` beside the values it replaces; the address and the contact details do not."
+        };
+      }
+    }
+  }
+};
+IssuerIdentityDoctorCheck = _ts_decorate7([
+  Injectable7(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof IssuerIdentityInspector === "undefined" ? Object : IssuerIdentityInspector
+  ])
+], IssuerIdentityDoctorCheck);
 var PLATFORM_DOCTOR_CHECK_PROVIDERS = [
   PlanCatalogDoctorCheck,
   DiscoverySnapshotDoctorCheck,
   UserPortDoctorCheck,
-  AdminManifestDoctorCheck
+  AdminManifestDoctorCheck,
+  IssuerIdentityDoctorCheck
 ];
 
 // src/prisma-blocks.ts
@@ -3622,6 +3696,7 @@ export {
   DiscoverySnapshotDoctorCheck,
   DoctorCommands,
   DoctorFlow,
+  IssuerIdentityDoctorCheck,
   LIMIT_FILTER_IMPORTS,
   LIMIT_FILTER_PROVIDER,
   MANIFEST_ACCESS_PORT_TOKEN,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saasicat/cli",
-  "version": "1.0.0-rc.18",
+  "version": "1.0.0-rc.19",
   "description": "CLI helpers for SaaS platform consumers. Provides CliContextService (identity, MFA, production confirm, audit tag).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "qrcode-terminal": "^0.12.0",
-    "@saasicat/nest": "^1.0.0-rc.18",
-    "@saasicat/spec": "^1.0.0-rc.18",
-    "@saasicat/core": "^1.0.0-rc.18"
+    "@saasicat/nest": "^1.0.0-rc.19",
+    "@saasicat/spec": "^1.0.0-rc.19",
+    "@saasicat/core": "^1.0.0-rc.19"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",