@saasicat/nest 0.14.0 → 0.15.0

package/dist/{chunk-I2EKGQUG.js → chunk-YITTE646.js}

@@ -1,22 +1,33 @@
 import {
   PromoCodesModule
-} from "./chunk-IRWZC3GC.js";
+} from "./chunk-GLLCB4BP.js";
 import {
   AdminManifestModule,
   AdminManifestService,
   AdminModule,
   AdminResourcesModule,
+  AdminStatsModule,
+  MfaService,
   SuperAdminGuard
-} from "./chunk-FVT7KTUI.js";
+} from "./chunk-PLJEAUFU.js";
 import {
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
   SubscriptionBundleModule,
   TenantBillingModule
-} from "./chunk-RKVY775D.js";
+} from "./chunk-5KH2O4SF.js";
+import {
+  SubscriptionContractModule
+} from "./chunk-32EMXPU2.js";
 import {
   CatalogModule
-} from "./chunk-33TP26MR.js";
+} from "./chunk-P3DP6GJE.js";
+import {
+  CheckoutOfferModule
+} from "./chunk-GJBXOCRZ.js";
+import {
+  SaaSiCatPublicRoute
+} from "./chunk-YSC46BGM.js";
 import {
   DiscoveryModule
 } from "./chunk-V34AA7C7.js";
@@ -38,6 +49,305 @@ import {
   __name
 } from "./chunk-SHUYVCID.js";
 
+// src/setup/tokens.ts
+var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupProvisioningPort");
+var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupConfig");
+
+// src/setup/setup.service.ts
+import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import { isPlatformUserExistsError, SETUP_ERROR_CODES } from "@saasicat/types";
+import { randomBytes, timingSafeEqual } from "crypto";
+import QRCode from "qrcode";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var GENERATED_PASSWORD_BYTES = 12;
+function timingSafeEqualStr(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+__name(timingSafeEqualStr, "timingSafeEqualStr");
+var SetupService = class {
+  static {
+    __name(this, "SetupService");
+  }
+  users;
+  config;
+  mfa;
+  constructor(users, config, mfa) {
+    this.users = users;
+    this.config = config;
+    this.mfa = mfa;
+  }
+  async status() {
+    return {
+      needsSetup: await this.users.countSuperAdmins() === 0
+    };
+  }
+  async setup(req) {
+    this.assertToken(req.token);
+    await this.assertNoSuperAdmin();
+    const email = req.email.trim().toLowerCase();
+    if (!email.includes("@")) {
+      throw new BadRequestException({
+        code: SETUP_ERROR_CODES.INVALID_EMAIL
+      });
+    }
+    const generated = !req.password;
+    const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
+    let user;
+    try {
+      user = await this.users.createSuperAdmin({
+        email,
+        password
+      });
+    } catch (err) {
+      if (isPlatformUserExistsError(err)) {
+        throw new ConflictException({
+          code: SETUP_ERROR_CODES.EMAIL_EXISTS,
+          message: err.message
+        });
+      }
+      throw err;
+    }
+    const totp = await this.mfa.setup(user.id, user.email, this.config.mfaIssuer);
+    const qrDataUrl = await QRCode.toDataURL(totp.otpauthUri, {
+      width: 220,
+      margin: 1
+    });
+    return {
+      userId: user.id,
+      email: user.email,
+      otpauthUri: totp.otpauthUri,
+      qrDataUrl,
+      secret: totp.secret,
+      ...generated ? {
+        generatedPassword: password
+      } : {}
+    };
+  }
+  async confirmMfa(req) {
+    this.assertToken(req.token);
+    const ok = await this.mfa.verify({
+      userId: req.userId,
+      code: req.code
+    });
+    return {
+      ok
+    };
+  }
+  assertToken(token) {
+    const expected = process.env[this.config.setupTokenEnvVar]?.trim();
+    if (!expected) {
+      throw new ForbiddenException({
+        code: SETUP_ERROR_CODES.SETUP_DISABLED,
+        message: `${this.config.setupTokenEnvVar} ist nicht gesetzt \u2014 Setup ist deaktiviert.`
+      });
+    }
+    if (!token || !timingSafeEqualStr(token, expected)) {
+      throw new UnauthorizedException({
+        code: SETUP_ERROR_CODES.INVALID_SETUP_TOKEN
+      });
+    }
+  }
+  async assertNoSuperAdmin() {
+    if (await this.users.countSuperAdmins() > 0) {
+      throw new ConflictException({
+        code: SETUP_ERROR_CODES.SETUP_ALREADY_DONE
+      });
+    }
+  }
+};
+SetupService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(SETUP_PROVISIONING_PORT_TOKEN)),
+  _ts_param(1, Inject(SETUP_CONFIG_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof SuperAdminProvisioningPort === "undefined" ? Object : SuperAdminProvisioningPort,
+    typeof SetupConfig === "undefined" ? Object : SetupConfig,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], SetupService);
+
+// src/setup/setup.controller.ts
+import { Body, Controller, Get, Post } from "@nestjs/common";
+import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from "class-validator";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var SetupDto = class SetupDto2 {
+  static {
+    __name(this, "SetupDto");
+  }
+  token;
+  email;
+  password;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsEmail(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "email", void 0);
+_ts_decorate2([
+  IsOptional(),
+  IsString(),
+  MinLength(8),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "password", void 0);
+var SetupConfirmMfaDto = class SetupConfirmMfaDto2 {
+  static {
+    __name(this, "SetupConfirmMfaDto");
+  }
+  token;
+  userId;
+  code;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "userId", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "code", void 0);
+var SetupController = class {
+  static {
+    __name(this, "SetupController");
+  }
+  setup;
+  constructor(setup) {
+    this.setup = setup;
+  }
+  status() {
+    return this.setup.status();
+  }
+  run(dto) {
+    return this.setup.setup(dto);
+  }
+  confirm(dto) {
+    return this.setup.confirmMfa(dto);
+  }
+};
+_ts_decorate2([
+  Get("status"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "status", null);
+_ts_decorate2([
+  Post(),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupDto === "undefined" ? Object : SetupDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "run", null);
+_ts_decorate2([
+  Post("confirm-mfa"),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupConfirmMfaDto === "undefined" ? Object : SetupConfirmMfaDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "confirm", null);
+SetupController = _ts_decorate2([
+  Controller("admin/setup"),
+  SaaSiCatPublicRoute(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupService === "undefined" ? Object : SetupService
+  ])
+], SetupController);
+
+// src/setup/setup.module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var DEFAULT_SETUP_TOKEN_ENV_VAR = "SETUP_TOKEN";
+var DEFAULT_MFA_ISSUER = "SuperAdmin";
+var SetupModule = class _SetupModule {
+  static {
+    __name(this, "SetupModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _SetupModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers: [
+        SetupController
+      ],
+      providers: [
+        asProvider(SETUP_PROVISIONING_PORT_TOKEN, options.provisioningPort),
+        {
+          provide: SETUP_CONFIG_TOKEN,
+          useValue: {
+            setupTokenEnvVar: options.setupTokenEnvVar ?? DEFAULT_SETUP_TOKEN_ENV_VAR,
+            mfaIssuer: options.mfaIssuer ?? DEFAULT_MFA_ISSUER
+          }
+        },
+        SetupService,
+        ...options.extraProviders ?? []
+      ],
+      exports: [
+        SetupService
+      ]
+    };
+  }
+};
+SetupModule = _ts_decorate3([
+  Module({})
+], SetupModule);
+
 // src/platform/plan-resolver.port.ts
 var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlanResolverPort");
 var StaticPlanResolver = class {
@@ -54,24 +364,24 @@ var StaticPlanResolver = class {
 };
 
 // src/platform/static-entitlement.service.ts
-import { Inject, Injectable } from "@nestjs/common";
-function _ts_decorate(decorators, target, key, desc) {
+import { Inject as Inject2, Injectable as Injectable2 } from "@nestjs/common";
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var StaticEntitlementService = class {
   static {
     __name(this, "StaticEntitlementService");
@@ -124,37 +434,37 @@ var StaticEntitlementService = class {
     return (this.catalog.plans ?? []).find((p) => p.id === planId);
   }
 };
-StaticEntitlementService = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Inject(PLAN_CATALOG_TOKEN)),
-  _ts_param(1, Inject(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
+StaticEntitlementService = _ts_decorate4([
+  Injectable2(),
+  _ts_param3(0, Inject2(PLAN_CATALOG_TOKEN)),
+  _ts_param3(1, Inject2(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
     typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
   ])
 ], StaticEntitlementService);
 
 // src/platform/static-feature.guard.ts
-import { ForbiddenException, Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
+import { ForbiddenException as ForbiddenException2, Inject as Inject3, Injectable as Injectable3, Optional } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-function _ts_decorate2(decorators, target, key, desc) {
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param2, "_ts_param");
+__name(_ts_param4, "_ts_param");
 var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
 var StaticFeatureGuard = class {
   static {
@@ -176,27 +486,27 @@ var StaticFeatureGuard = class {
     if (!required || required.length === 0) return true;
     const request = context.switchToHttp().getRequest();
     const user = request.user;
-    if (!user) throw new ForbiddenException("Nicht authentifiziert");
+    if (!user) throw new ForbiddenException2("Nicht authentifiziert");
     const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
     if (role === "SUPER_ADMIN") return true;
     const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
-    if (!tenantId) throw new ForbiddenException("Kein Mandant zugeordnet");
+    if (!tenantId) throw new ForbiddenException2("Kein Mandant zugeordnet");
     const snap = await this.entitlements.snapshot(tenantId);
     const allowed = required.some((f) => snap.features.includes(f));
     if (!allowed) {
-      throw new ForbiddenException(`Feature ${required.join(" / ")} nicht im aktuellen Plan enthalten.`);
+      throw new ForbiddenException2(`Feature ${required.join(" / ")} nicht im aktuellen Plan enthalten.`);
     }
     return true;
   }
 };
-StaticFeatureGuard = _ts_decorate2([
-  Injectable2(),
-  _ts_param2(0, Inject2(Reflector)),
-  _ts_param2(1, Inject2(StaticEntitlementService)),
-  _ts_param2(2, Optional()),
-  _ts_param2(2, Inject2(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
+StaticFeatureGuard = _ts_decorate5([
+  Injectable3(),
+  _ts_param4(0, Inject3(Reflector)),
+  _ts_param4(1, Inject3(StaticEntitlementService)),
+  _ts_param4(2, Optional()),
+  _ts_param4(2, Inject3(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof Reflector === "undefined" ? Object : Reflector,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -204,27 +514,27 @@ StaticFeatureGuard = _ts_decorate2([
 ], StaticFeatureGuard);
 
 // src/platform/enforce-quota.interceptor.ts
-import { Inject as Inject3, Injectable as Injectable3, Optional as Optional2 } from "@nestjs/common";
+import { Inject as Inject4, Injectable as Injectable4, Optional as Optional2 } from "@nestjs/common";
 import { Reflector as Reflector2 } from "@nestjs/core";
 import { from } from "rxjs";
 import { switchMap } from "rxjs/operators";
-function _ts_decorate3(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param5, "_ts_param");
 var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/QuotaProviders");
 var EnforceQuotaInterceptor = class {
   static {
@@ -267,14 +577,14 @@ var EnforceQuotaInterceptor = class {
     }
   }
 };
-EnforceQuotaInterceptor = _ts_decorate3([
-  Injectable3(),
-  _ts_param3(0, Inject3(Reflector2)),
-  _ts_param3(1, Inject3(StaticEntitlementService)),
-  _ts_param3(2, Optional2()),
-  _ts_param3(2, Inject3(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+EnforceQuotaInterceptor = _ts_decorate6([
+  Injectable4(),
+  _ts_param5(0, Inject4(Reflector2)),
+  _ts_param5(1, Inject4(StaticEntitlementService)),
+  _ts_param5(2, Optional2()),
+  _ts_param5(2, Inject4(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof Reflector2 === "undefined" ? Object : Reflector2,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -322,18 +632,18 @@ var SubscriptionPlanResolver = class {
 };
 
 // src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable4 } from "@nestjs/common";
-function _ts_decorate4(decorators, target, key, desc) {
+import { Injectable as Injectable5 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
+__name(_ts_metadata6, "_ts_metadata");
 var TenantManifestService = class {
   static {
     __name(this, "TenantManifestService");
@@ -379,10 +689,10 @@ var TenantManifestService = class {
     };
   }
 };
-TenantManifestService = _ts_decorate4([
-  Injectable4(),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+TenantManifestService = _ts_decorate7([
+  Injectable5(),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
   ])
 ], TenantManifestService);
@@ -396,24 +706,24 @@ function isVisible(item, features) {
 __name(isVisible, "isVisible");
 
 // src/platform/tenant-manifest.controller.ts
-import { Controller, Get, Inject as Inject4, Req, UseGuards } from "@nestjs/common";
-function _ts_decorate5(decorators, target, key, desc) {
+import { Controller as Controller2, Get as Get2, Inject as Inject5, Req, UseGuards } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param6, "_ts_param");
 function buildTenantManifestController(options) {
   const path = options.path ?? "tenant/manifest";
   let GeneratedTenantManifestController = class GeneratedTenantManifestController {
@@ -432,21 +742,21 @@ function buildTenantManifestController(options) {
       return this.svc.getManifest(tenantId);
     }
   };
-  _ts_decorate5([
-    Get(),
-    _ts_param4(0, Req()),
-    _ts_metadata5("design:type", Function),
-    _ts_metadata5("design:paramtypes", [
+  _ts_decorate8([
+    Get2(),
+    _ts_param6(0, Req()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       typeof RequestWithUser === "undefined" ? Object : RequestWithUser
     ]),
-    _ts_metadata5("design:returntype", Promise)
+    _ts_metadata7("design:returntype", Promise)
   ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate5([
-    Controller(path),
+  GeneratedTenantManifestController = _ts_decorate8([
+    Controller2(path),
     UseGuards(...options.guards),
-    _ts_param4(0, Inject4(TenantManifestService)),
-    _ts_metadata5("design:type", Function),
-    _ts_metadata5("design:paramtypes", [
+    _ts_param6(0, Inject5(TenantManifestService)),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       typeof TenantManifestService === "undefined" ? Object : TenantManifestService
     ])
   ], GeneratedTenantManifestController);
@@ -455,16 +765,16 @@ function buildTenantManifestController(options) {
 __name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/saas-platform.module.ts
-import { Module } from "@nestjs/common";
+import { Module as Module2 } from "@nestjs/common";
 import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
 import { assertPersistenceCapabilities } from "@saasicat/types";
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
+__name(_ts_decorate9, "_ts_decorate");
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
@@ -578,6 +888,10 @@ var SaasPlatformModule = class _SaasPlatformModule {
     const subscriptionBundlesConfig = options.subscriptionBundles || null;
     const adminResourcesConfig = options.adminResources || null;
     const promoCodesConfig = options.promoCodes || null;
+    const setupConfig = options.setup || null;
+    const adminStatsConfig = options.adminStats || null;
+    const checkoutOfferConfig = options.checkoutOffer || null;
+    const subscriptionContractConfig = options.subscriptionContract || null;
     const requiresFullEntitlement = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
     const adapters = {
       mfa: explicit.mfa ?? persistence?.core.mfa,
@@ -612,6 +926,18 @@ var SaasPlatformModule = class _SaasPlatformModule {
     if (promoCodesConfig && (!persistence?.promo || !adapters.transactionRunner)) {
       throw new Error("SaasPlatformModule.forRoot: promoCodes requires `persistence.promo` and a transactionRunner.");
     }
+    if (setupConfig && !((setupConfig === true ? void 0 : setupConfig.provisioningPort) ?? persistence?.core.superAdminProvisioning)) {
+      throw new Error("SaasPlatformModule.forRoot: setup is enabled, but no provisioningPort is available (set `setup.provisioningPort` or `persistence.core.superAdminProvisioning`).");
+    }
+    if (adminStatsConfig && !adminStatsConfig.auditStatsPort && !persistence?.core.auditStats) {
+      throw new Error("SaasPlatformModule.forRoot: adminStats is enabled, but no auditStatsPort is available (set `adminStats.auditStatsPort` or `persistence.core.auditStats`).");
+    }
+    if (subscriptionContractConfig) {
+      const explicitRepository = subscriptionContractConfig === true ? void 0 : subscriptionContractConfig.subscriptionContractRepository;
+      if (!explicitRepository && !persistence?.entitlement?.subscriptionContractRepository) {
+        throw new Error("SaasPlatformModule.forRoot: subscriptionContract is enabled, but no repository is available (set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle).");
+      }
+    }
     if (promoCodesConfig && promoCodesConfig !== true && promoCodesConfig.includePublicController !== false && !promoCodesConfig.firstTimeCustomerCheck) {
       throw new Error("SaasPlatformModule.forRoot: public promo preview requires `firstTimeCustomerCheck`.");
     }
@@ -695,6 +1021,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
       }),
       AdminManifestModule.forRoot({
         config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
+        extraProviders: options.adminManifestExtraProviders,
         includeManifestController: options.includeManifestController,
         guards: options.controller.guards,
         reloadGuards: options.reloadGuards,
@@ -830,6 +1157,42 @@ var SaasPlatformModule = class _SaasPlatformModule {
         extraProviders
       }));
     }
+    if (setupConfig) {
+      const config = setupConfig === true ? {} : setupConfig;
+      imports.push(SetupModule.forRoot({
+        ...config,
+        provisioningPort: config.provisioningPort ?? persistence?.core.superAdminProvisioning,
+        imports: config.imports ?? options.imports
+      }));
+    }
+    if (adminStatsConfig) {
+      imports.push(AdminStatsModule.forRoot({
+        ...adminStatsConfig,
+        guards: adminStatsConfig.guards ?? [
+          ...options.controller.guards,
+          SuperAdminGuard
+        ],
+        auditStatsPort: adminStatsConfig.auditStatsPort ?? persistence?.core.auditStats,
+        imports: adminStatsConfig.imports ?? options.imports
+      }));
+    }
+    if (checkoutOfferConfig) {
+      imports.push(CheckoutOfferModule.forRoot({
+        ...checkoutOfferConfig,
+        bundleRepository: checkoutOfferConfig.bundleRepository ?? persistence?.catalog?.bundleRepository,
+        planRepository: checkoutOfferConfig.planRepository ?? persistence?.catalog?.planRepository,
+        catalogEntryRepository: checkoutOfferConfig.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
+        imports: checkoutOfferConfig.imports ?? options.imports
+      }));
+    }
+    if (subscriptionContractConfig) {
+      const config = subscriptionContractConfig === true ? {} : subscriptionContractConfig;
+      imports.push(SubscriptionContractModule.forRoot({
+        ...config,
+        subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
+        imports: config.imports ?? options.imports
+      }));
+    }
     const lightweightProviders = [];
     const lightweightExports = [];
     if (options.autoManifest !== false) {
@@ -919,17 +1282,34 @@ var SaasPlatformModule = class _SaasPlatformModule {
         ...promoCodesConfig ? [
           PromoCodesModule
         ] : [],
+        ...setupConfig ? [
+          SetupModule
+        ] : [],
+        ...adminStatsConfig ? [
+          AdminStatsModule
+        ] : [],
+        ...checkoutOfferConfig ? [
+          CheckoutOfferModule
+        ] : [],
+        ...subscriptionContractConfig ? [
+          SubscriptionContractModule
+        ] : [],
         ...lightweightExports
       ],
       global: true
     };
   }
 };
-SaasPlatformModule = _ts_decorate6([
-  Module({})
+SaasPlatformModule = _ts_decorate9([
+  Module2({})
 ], SaasPlatformModule);
 
 export {
+  SETUP_PROVISIONING_PORT_TOKEN,
+  SETUP_CONFIG_TOKEN,
+  SetupService,
+  SetupController,
+  SetupModule,
   PLAN_RESOLVER_PORT_TOKEN,
   StaticPlanResolver,
   StaticEntitlementService,