@saasicat/nest 0.18.1 → 0.21.0

package/dist/admin/index.js

@@ -25,7 +25,7 @@ import {
   SuperAdminGuard,
   SuspendTenantDto,
   buildAdminStatsController
-} from "../chunk-PLJEAUFU.js";
+} from "../chunk-FYWLPYBK.js";
 import {
   AUDIT_PORT_TOKEN,
   AdminAuditService,
@@ -33,6 +33,7 @@ import {
   RLS_BYPASS_PORT_TOKEN
 } from "../chunk-E56W4U2P.js";
 import "../chunk-YSC46BGM.js";
+import "../chunk-EBJJNTW6.js";
 import "../chunk-SABTXESR.js";
 import "../chunk-SHUYVCID.js";
 export {

package/dist/billing/index.d.cts

@@ -8,10 +8,10 @@ import { c as EntitlementService } from '../aggregation-SKfXu09x.cjs';
 import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
 import { f as ContractFreezePort, g as ContractFreezeSourcePort } from '../subscription-bundles.module-DCpV-Pb5.cjs';
 export { A as AUDIT_CONTEXT_RESOLVER_TOKEN, a as AuditContextResolver, b as AuthGuardList, C as CONTRACT_FREEZE_PORT_TOKEN, c as CONTRACT_FREEZE_PROJECT_KEY_TOKEN, d as CONTRACT_FREEZE_SOURCE_PORT_TOKEN, e as ContractFreezeBundleSnapshot, D as DuePendingPlanChange, P as PENDING_PLAN_QUERY_PORT_TOKEN, h as PendingPlanQueryPort, S as SELF_SERVICE_BLOCKED_BUNDLES_TOKEN, i as SELF_SERVICE_BLOCKED_PLANS_TOKEN, j as SUBSCRIPTION_USAGE_PORT_TOKEN, k as SUBSCRIPTION_WRITE_PORT_TOKEN, l as SelfServiceBlockedBundles, m as SelfServiceBlockedPlans, n as SubscriptionBundleControllerOptions, o as SubscriptionBundleModule, p as SubscriptionBundleModuleOptions, T as TENANT_AUTH_GUARDS_TOKEN, q as TENANT_ID_RESOLVER_TOKEN, r as TRIAL_PROJECTION_PORT_TOKEN, s as TenantBillingModule, t as TenantBillingModuleOptions, u as TenantIdResolver, v as TrialProjectionInput, w as TrialProjectionPort, U as USAGE_SNAPSHOT_PORT_TOKEN, x as USER_EMAIL_RESOLVER_TOKEN, y as USER_ID_RESOLVER_TOKEN, z as UserEmailResolver, B as UserIdResolver } from '../subscription-bundles.module-DCpV-Pb5.cjs';
-export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-CG4CaFUP.cjs';
+export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-BIF-mstX.cjs';
 import { S as SubscriptionContractService } from '../subscription-contract.service--cm47ZJJ.cjs';
 import '../plan-resolution-CFCoUkrE.cjs';
-import '../service-DX8KbGXl.cjs';
+import '../service-D48clObR.cjs';
 import '../admin-audit.service-9IqXMlZm.cjs';
 
 /**
@@ -197,15 +197,19 @@ declare class FeatureGuard implements CanActivate {
     constructor(reflector: Reflector, entitlements: EntitlementService, config?: FeatureGuardConfig | null, upsellResolver?: UpsellOfferResolver | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Upsell response (#36): with a registered `UpsellOfferResolver` the 403
-     * becomes machine-readable (`FeatureNotLicensedBody`), so consumer UIs can
-     * render a purchase offer. Without a resolver the previous plain 403
-     * remains — no breaking change.
+     * Upsell response (#36): the 403 body is always the full
+     * `FeatureNotLicensedBody`, so a consumer that matches on `code` can read
+     * `featureKey`/`offers` unconditionally. Without a registered
+     * `UpsellOfferResolver` there is simply nothing to offer — `offers` is
+     * empty, the same degradation a failing resolver produces.
      *
      * Deliberately 403 + `code` field instead of 402 — rationale in
      * `@saasicat/types` upsell.types.ts (402 is reserved / inconsistently
      * supported; SPA interceptors must not treat the 403 as an auth error, the
      * distinction runs through `code`).
+     *
+     * The message must keep starting with the word `Feature` — consumers
+     * classify the response by that prefix.
      */
     private buildNotLicensedException;
     /**

package/dist/billing/index.d.ts

@@ -8,10 +8,10 @@ import { c as EntitlementService } from '../aggregation-o0LMenvl.js';
 import { P as ProviderSpec } from '../di-CcNeq9v-.js';
 import { f as ContractFreezePort, g as ContractFreezeSourcePort } from '../subscription-bundles.module-BQmoozm5.js';
 export { A as AUDIT_CONTEXT_RESOLVER_TOKEN, a as AuditContextResolver, b as AuthGuardList, C as CONTRACT_FREEZE_PORT_TOKEN, c as CONTRACT_FREEZE_PROJECT_KEY_TOKEN, d as CONTRACT_FREEZE_SOURCE_PORT_TOKEN, e as ContractFreezeBundleSnapshot, D as DuePendingPlanChange, P as PENDING_PLAN_QUERY_PORT_TOKEN, h as PendingPlanQueryPort, S as SELF_SERVICE_BLOCKED_BUNDLES_TOKEN, i as SELF_SERVICE_BLOCKED_PLANS_TOKEN, j as SUBSCRIPTION_USAGE_PORT_TOKEN, k as SUBSCRIPTION_WRITE_PORT_TOKEN, l as SelfServiceBlockedBundles, m as SelfServiceBlockedPlans, n as SubscriptionBundleControllerOptions, o as SubscriptionBundleModule, p as SubscriptionBundleModuleOptions, T as TENANT_AUTH_GUARDS_TOKEN, q as TENANT_ID_RESOLVER_TOKEN, r as TRIAL_PROJECTION_PORT_TOKEN, s as TenantBillingModule, t as TenantBillingModuleOptions, u as TenantIdResolver, v as TrialProjectionInput, w as TrialProjectionPort, U as USAGE_SNAPSHOT_PORT_TOKEN, x as USER_EMAIL_RESOLVER_TOKEN, y as USER_ID_RESOLVER_TOKEN, z as UserEmailResolver, B as UserIdResolver } from '../subscription-bundles.module-BQmoozm5.js';
-export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-BwZRnJ3q.js';
+export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-DT5UrnDX.js';
 import { S as SubscriptionContractService } from '../subscription-contract.service--cm47ZJJ.js';
 import '../plan-resolution-CFCoUkrE.js';
-import '../service-DX8KbGXl.js';
+import '../service-D48clObR.js';
 import '../admin-audit.service-9IqXMlZm.js';
 
 /**
@@ -197,15 +197,19 @@ declare class FeatureGuard implements CanActivate {
     constructor(reflector: Reflector, entitlements: EntitlementService, config?: FeatureGuardConfig | null, upsellResolver?: UpsellOfferResolver | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Upsell response (#36): with a registered `UpsellOfferResolver` the 403
-     * becomes machine-readable (`FeatureNotLicensedBody`), so consumer UIs can
-     * render a purchase offer. Without a resolver the previous plain 403
-     * remains — no breaking change.
+     * Upsell response (#36): the 403 body is always the full
+     * `FeatureNotLicensedBody`, so a consumer that matches on `code` can read
+     * `featureKey`/`offers` unconditionally. Without a registered
+     * `UpsellOfferResolver` there is simply nothing to offer — `offers` is
+     * empty, the same degradation a failing resolver produces.
      *
      * Deliberately 403 + `code` field instead of 402 — rationale in
      * `@saasicat/types` upsell.types.ts (402 is reserved / inconsistently
      * supported; SPA interceptors must not treat the 403 as an auth error, the
      * distinction runs through `code`).
+     *
+     * The message must keep starting with the word `Feature` — consumers
+     * classify the response by that prefix.
      */
     private buildNotLicensedException;
     /**

package/dist/billing/index.js

@@ -58,9 +58,9 @@ import {
   periodEndWithMinLead,
   resolveBundleCancelEffectiveAt,
   resolveBundlePriceNet
-} from "../chunk-5KH2O4SF.js";
-import "../chunk-E7AJ42AB.js";
-import "../chunk-32EMXPU2.js";
+} from "../chunk-NZLAYCEX.js";
+import "../chunk-VQQWF7MW.js";
+import "../chunk-B7NRY2LV.js";
 import {
   AUDIT_CONTEXT_RESOLVER_TOKEN,
   PENDING_PLAN_QUERY_PORT_TOKEN,
@@ -76,12 +76,12 @@ import {
   classifyPlanDiff
 } from "../chunk-WPUVJRIN.js";
 import "../chunk-E56W4U2P.js";
-import "../chunk-MDIZUVIK.js";
+import "../chunk-BSK6YBLI.js";
 import "../chunk-YSC46BGM.js";
 import {
   SUBSCRIPTION_BUNDLE_CONFIG_TOKEN,
   SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN
-} from "../chunk-EXOLOJFZ.js";
+} from "../chunk-AGOG5B77.js";
 import {
   PLAN_CATALOG_READ_SINK_TOKEN,
   PLAN_CATALOG_TOKEN,
@@ -96,8 +96,9 @@ import {
   getPlanQuota,
   isFeatureInPlan,
   isFeaturePlannedOnly
-} from "../chunk-R2QOSVAA.js";
+} from "../chunk-DQKCK7DX.js";
 import "../chunk-NYLON2VC.js";
+import "../chunk-EBJJNTW6.js";
 import "../chunk-WKVBNTYC.js";
 import "../chunk-L4KTQ6CL.js";
 import "../chunk-SABTXESR.js";

package/dist/catalog/index.js

@@ -6,8 +6,8 @@ import {
   runSeedGateFromFile,
   seedGateExitCode,
   validateSeedAgainstSnapshot
-} from "../chunk-7RRWI5LH.js";
-import "../chunk-ABB2CRAS.js";
+} from "../chunk-55QGAZRQ.js";
+import "../chunk-74SCJ4HF.js";
 import {
   ADVISORY_STRICT_MODE_CODES,
   BundlesService,
@@ -56,11 +56,11 @@ import {
   quotaApprovalSignature,
   validateBundleDraft,
   validatePlanDraft
-} from "../chunk-P3DP6GJE.js";
+} from "../chunk-GC5AKN44.js";
 import "../chunk-WPUVJRIN.js";
 import "../chunk-E56W4U2P.js";
 import "../chunk-YSC46BGM.js";
-import "../chunk-Z3FWN3HJ.js";
+import "../chunk-5ZXBXYXU.js";
 import "../chunk-WKVBNTYC.js";
 import {
   BUNDLE_REPOSITORY_TOKEN,

package/dist/checkout-offer/index.js

@@ -6,8 +6,8 @@ import {
   CreateCheckoutOfferDto,
   UpdateCheckoutOfferDto,
   buildCheckoutOfferController
-} from "../chunk-GJBXOCRZ.js";
-import "../chunk-MDIZUVIK.js";
+} from "../chunk-XTVAFJ3P.js";
+import "../chunk-BSK6YBLI.js";
 import "../chunk-YSC46BGM.js";
 import "../chunk-L4KTQ6CL.js";
 import "../chunk-SABTXESR.js";

package/dist/{chunk-RZVSKKXX.js → chunk-3DRZ5GCP.js}

@@ -1,3 +1,6 @@
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -54,7 +57,7 @@ var REGISTRATION_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/Regist
 
 // src/registration/pending-registration.service.ts
 import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Optional } from "@nestjs/common";
-import { REGISTRATION_RESUME_TTL_MINUTES } from "@saasicat/types";
+import { REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES } from "@saasicat/types";
 import { OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, REGISTRATION_STEP_BY_STATUS } from "@saasicat/types";
 
 // src/registration/pricing.ts
@@ -173,7 +176,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      this.logger.warn(`Audit-Log fehlgeschlagen (${eventType}): ${message}`);
+      this.logger.warn(`Audit log write failed (${eventType}): ${message}`);
     }
   }
   /** Public signup plan list for step 3 (frontend `usePublicPlans()`). */
@@ -183,25 +186,17 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async selectPlan(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: "INVALID_REGISTRATION_STATE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
     if (!plan) {
-      throw new BadRequestException({
-        code: "PLAN_NOT_AVAILABLE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
@@ -224,30 +219,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async startCheckout(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: "PLAN_NOT_SELECTED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     if (!pending.selectedPlanId) {
-      throw new BadRequestException({
-        code: "PLAN_NOT_SELECTED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
     if (!plan) {
-      throw new BadRequestException({
-        code: "PLAN_NOT_AVAILABLE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const session = await this.paymentProvider.createCheckoutSession({
       pendingRegistrationId: pending.id,
@@ -298,7 +283,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       rawPayload: input.rawPayload
     });
     if (!claimed) {
-      this.logger.warn(`Idempotenz: PaymentEvent ${input.eventId} bereits verarbeitet \u2014 Duplikat verworfen.`);
+      this.logger.warn(`Idempotency: payment event ${input.eventId} already processed \u2014 duplicate discarded.`);
       await this.record("PAYMENT_DUPLICATE_IGNORED", null, context, {
         eventId: input.eventId,
         sessionId: input.sessionId
@@ -348,7 +333,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       tenantId: result.tenantId,
       subscriptionId: result.subscriptionId
     });
-    this.logger.log(`Aktivierung erfolgreich: pending=${pending.id} \u2192 user=${result.userId} tenant=${result.tenantId} subscription=${result.subscriptionId}`);
+    this.logger.log(`Activation succeeded: pending=${pending.id} \u2192 user=${result.userId} tenant=${result.tenantId} subscription=${result.subscriptionId}`);
     return {
       activated: true,
       result
@@ -376,11 +361,11 @@ var PendingRegistrationService = class _PendingRegistrationService {
         await this.repo.delete(pending.id);
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        this.logger.warn(`Cleanup: PendingRegistration ${pending.id} konnte nicht geloescht werden (${message}).`);
+        this.logger.warn(`Cleanup: pending registration ${pending.id} could not be deleted (${message}).`);
       }
     }
     if (expired.length > 0) {
-      this.logger.log(`Cleanup: ${expired.length} abgelaufene PendingRegistrations geloescht.`);
+      this.logger.log(`Cleanup: ${expired.length} expired PendingRegistrations deleted.`);
     }
     return {
       deleted: expired.length,
@@ -390,7 +375,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async start(input, context) {
     const email = normalizeEmail(input.email);
     if (await this.userLookup.hasActiveUser(email)) {
-      this.logger.log(`register/start fuer aktiven Account ignoriert (${email}).`);
+      this.logger.log(`register/start ignored for an active account (${email}).`);
       await this.record("REGISTRATION_NEUTRAL_ACTIVE_USER", null, context);
       return {
         neutral: true
@@ -456,9 +441,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", null, context, {
         reason: "unknown_email"
       });
-      throw new BadRequestException({
-        code: "OTP_INVALID"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
       return {
@@ -471,43 +454,33 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "no_otp_set"
       });
-      throw new BadRequestException({
-        code: "OTP_INVALID"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.otpExpiresAt.getTime() < Date.now()) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "expired"
       });
-      throw new BadRequestException({
-        code: "OTP_EXPIRED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_EXPIRED));
     }
     const maxAttempts = resolveOtpVerifyMaxAttempts();
     if (pending.otpAttemptCount >= maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: "OTP_LOCKED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
     if (attemptCount > maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: "OTP_LOCKED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     if (!verifyOtpCode(pending.otpHash, code)) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "wrong_code"
       });
-      throw new BadRequestException({
-        code: "OTP_INVALID"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     const now = /* @__PURE__ */ new Date();
     const updated = await this.repo.update(pending.id, {
@@ -549,7 +522,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
     const windowMs = OTP_RATE_LIMIT_WINDOW_MINUTES * 60 * 1e3;
     const withinWindow = pending.lastOtpSentAt !== null && now.getTime() - pending.lastOtpSentAt.getTime() < windowMs;
     if (withinWindow && pending.otpSendCount >= OTP_RATE_LIMIT_MAX_SENDS) {
-      this.logger.warn(`OTP-Rate-Limit erreicht fuer ${pending.email} \u2014 Send wird still verworfen.`);
+      this.logger.warn(`OTP rate limit reached for ${pending.email} \u2014 send is being skipped.`);
       return;
     }
     const code = generateOtpCode();
@@ -577,7 +550,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`OTP-Mail an ${pending.email} fehlgeschlagen: ${message}`);
+      this.logger.error(`OTP email to ${pending.email} failed: ${message}`);
     }
   }
   /**
@@ -604,7 +577,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`Resume-Mail an ${pending.email} fehlgeschlagen: ${message}`);
+      this.logger.error(`Resume email to ${pending.email} failed: ${message}`);
     }
   }
   /**
@@ -618,28 +591,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async resumeWithToken(input, context) {
     if (!this.resumeTokenSigner) {
-      throw new BadRequestException({
-        code: "RESUME_NOT_CONFIGURED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED));
     }
     let decoded;
     try {
       decoded = await this.resumeTokenSigner.verify(input.token);
     } catch {
-      throw new BadRequestException({
-        code: "RESUME_TOKEN_INVALID"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     const pending = await this.repo.findById(decoded.pendingRegistrationId);
     if (!pending) {
-      throw new BadRequestException({
-        code: "RESUME_TOKEN_INVALID"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
       via: "resume_token",
@@ -667,9 +632,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
   /** Returns the (app-specific) configurator catalog. */
   async getConfiguratorCatalog() {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     return this.configuratorLookup.getCatalog();
   }
@@ -686,32 +649,22 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async saveConfiguration(input, context) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: "INVALID_REGISTRATION_STATE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === input.selection.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: "MODEL_NOT_AVAILABLE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (input.selection.appliedPromoCode && this.promoPreview) {
@@ -775,28 +728,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async previewConfigPromo(pendingRegistrationId, code) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     const config = pending.configJson;
     if (!config) {
-      throw new BadRequestException({
-        code: "CONFIG_NOT_SAVED"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === config.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: "MODEL_NOT_AVAILABLE"
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (code && this.promoPreview) {
@@ -854,7 +799,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
         return candidate;
       }
     }
-    throw new Error(`Konnte keinen freien Slug fuer "${tenantName}" finden.`);
+    throw new Error(`Could not find a free slug for "${tenantName}".`);
   }
 };
 PendingRegistrationService = _ts_decorate([
@@ -979,7 +924,7 @@ var RegistrationCleanupCron = class _RegistrationCleanupCron {
       }
     }
     if (totalDeleted > 0) {
-      this.logger.log(`PendingRegistration-Cleanup abgeschlossen: ${totalDeleted} geloescht in ${iterations} Batches.`);
+      this.logger.log(`Pending registration cleanup finished: ${totalDeleted} deleted in ${iterations} batches.`);
     }
   }
 };
@@ -1001,6 +946,7 @@ RegistrationCleanupCron = _ts_decorate2([
 
 // src/registration/ip-rate-limit.guard.ts
 import { HttpException, HttpStatus, Injectable as Injectable3 } from "@nestjs/common";
+import { REGISTRATION_ERROR_CODES as REGISTRATION_ERROR_CODES2 } from "@saasicat/types";
 function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1029,9 +975,14 @@ var BaseIpRateLimitGuard = class {
     const key = ipFingerprint(req);
     if (this.exceeded(key)) {
       throw new HttpException({
-        code: "RATE_LIMITED",
-        reason: this.options.name,
-        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        ...codedError(REGISTRATION_ERROR_CODES2.RATE_LIMITED, {
+          retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        }),
+        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3),
+        // Superseded by `code`. Note this carries the limiter name,
+        // not the code — the two emitters of RATE_LIMITED disagree
+        // on what `reason` means, which is why it is going away.
+        reason: this.options.name
       }, HttpStatus.TOO_MANY_REQUESTS);
     }
     return true;
@@ -1173,7 +1124,7 @@ _ts_decorate5([
   IsOptional(),
   IsString(),
   Matches(/^[a-z0-9-]+$/, {
-    message: "tenantSlug darf nur Kleinbuchstaben, Ziffern und Bindestriche enthalten."
+    message: "tenantSlug may only contain lower-case letters, digits and hyphens."
   }),
   MaxLength(60),
   _ts_metadata4("design:type", String)
@@ -1209,7 +1160,7 @@ _ts_decorate5([
 ], RegisterStartDto.prototype, "password", void 0);
 _ts_decorate5([
   Equals(true, {
-    message: "AGB, Datenschutzerklaerung und Auftragsverarbeitung muessen zugestimmt werden."
+    message: "The terms of service, privacy policy and data processing agreement must be accepted."
   }),
   _ts_metadata4("design:type", Boolean)
 ], RegisterStartDto.prototype, "termsAccepted", void 0);
@@ -1249,7 +1200,7 @@ _ts_decorate6([
 _ts_decorate6([
   IsString2(),
   Matches2(/^\d{6}$/, {
-    message: "OTP muss 6 Ziffern sein."
+    message: "The OTP must be 6 digits."
   }),
   _ts_metadata5("design:type", String)
 ], VerifyRegistrationOtpDto.prototype, "otp", void 0);