@saasicat/nest 0.19.0 → 0.21.0

package/dist/admin/index.js

@@ -25,7 +25,7 @@ import {
   SuperAdminGuard,
   SuspendTenantDto,
   buildAdminStatsController
-} from "../chunk-7JIHG53V.js";
+} from "../chunk-FYWLPYBK.js";
 import {
   AUDIT_PORT_TOKEN,
   AdminAuditService,
@@ -33,6 +33,7 @@ import {
   RLS_BYPASS_PORT_TOKEN
 } from "../chunk-E56W4U2P.js";
 import "../chunk-YSC46BGM.js";
+import "../chunk-EBJJNTW6.js";
 import "../chunk-SABTXESR.js";
 import "../chunk-SHUYVCID.js";
 export {

package/dist/billing/index.d.cts

@@ -8,10 +8,10 @@ import { c as EntitlementService } from '../aggregation-SKfXu09x.cjs';
 import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
 import { f as ContractFreezePort, g as ContractFreezeSourcePort } from '../subscription-bundles.module-DCpV-Pb5.cjs';
 export { A as AUDIT_CONTEXT_RESOLVER_TOKEN, a as AuditContextResolver, b as AuthGuardList, C as CONTRACT_FREEZE_PORT_TOKEN, c as CONTRACT_FREEZE_PROJECT_KEY_TOKEN, d as CONTRACT_FREEZE_SOURCE_PORT_TOKEN, e as ContractFreezeBundleSnapshot, D as DuePendingPlanChange, P as PENDING_PLAN_QUERY_PORT_TOKEN, h as PendingPlanQueryPort, S as SELF_SERVICE_BLOCKED_BUNDLES_TOKEN, i as SELF_SERVICE_BLOCKED_PLANS_TOKEN, j as SUBSCRIPTION_USAGE_PORT_TOKEN, k as SUBSCRIPTION_WRITE_PORT_TOKEN, l as SelfServiceBlockedBundles, m as SelfServiceBlockedPlans, n as SubscriptionBundleControllerOptions, o as SubscriptionBundleModule, p as SubscriptionBundleModuleOptions, T as TENANT_AUTH_GUARDS_TOKEN, q as TENANT_ID_RESOLVER_TOKEN, r as TRIAL_PROJECTION_PORT_TOKEN, s as TenantBillingModule, t as TenantBillingModuleOptions, u as TenantIdResolver, v as TrialProjectionInput, w as TrialProjectionPort, U as USAGE_SNAPSHOT_PORT_TOKEN, x as USER_EMAIL_RESOLVER_TOKEN, y as USER_ID_RESOLVER_TOKEN, z as UserEmailResolver, B as UserIdResolver } from '../subscription-bundles.module-DCpV-Pb5.cjs';
-export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-m42YQ_Ei.cjs';
+export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-BIF-mstX.cjs';
 import { S as SubscriptionContractService } from '../subscription-contract.service--cm47ZJJ.cjs';
 import '../plan-resolution-CFCoUkrE.cjs';
-import '../service-DPZ2W1E-.cjs';
+import '../service-D48clObR.cjs';
 import '../admin-audit.service-9IqXMlZm.cjs';
 
 /**
@@ -197,10 +197,11 @@ declare class FeatureGuard implements CanActivate {
     constructor(reflector: Reflector, entitlements: EntitlementService, config?: FeatureGuardConfig | null, upsellResolver?: UpsellOfferResolver | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Upsell response (#36): with a registered `UpsellOfferResolver` the 403
-     * becomes machine-readable (`FeatureNotLicensedBody`), so consumer UIs can
-     * render a purchase offer. Without a resolver the body carries the same
-     * `code` but no offers.
+     * Upsell response (#36): the 403 body is always the full
+     * `FeatureNotLicensedBody`, so a consumer that matches on `code` can read
+     * `featureKey`/`offers` unconditionally. Without a registered
+     * `UpsellOfferResolver` there is simply nothing to offer — `offers` is
+     * empty, the same degradation a failing resolver produces.
      *
      * Deliberately 403 + `code` field instead of 402 — rationale in
      * `@saasicat/types` upsell.types.ts (402 is reserved / inconsistently

package/dist/billing/index.d.ts

@@ -8,10 +8,10 @@ import { c as EntitlementService } from '../aggregation-o0LMenvl.js';
 import { P as ProviderSpec } from '../di-CcNeq9v-.js';
 import { f as ContractFreezePort, g as ContractFreezeSourcePort } from '../subscription-bundles.module-BQmoozm5.js';
 export { A as AUDIT_CONTEXT_RESOLVER_TOKEN, a as AuditContextResolver, b as AuthGuardList, C as CONTRACT_FREEZE_PORT_TOKEN, c as CONTRACT_FREEZE_PROJECT_KEY_TOKEN, d as CONTRACT_FREEZE_SOURCE_PORT_TOKEN, e as ContractFreezeBundleSnapshot, D as DuePendingPlanChange, P as PENDING_PLAN_QUERY_PORT_TOKEN, h as PendingPlanQueryPort, S as SELF_SERVICE_BLOCKED_BUNDLES_TOKEN, i as SELF_SERVICE_BLOCKED_PLANS_TOKEN, j as SUBSCRIPTION_USAGE_PORT_TOKEN, k as SUBSCRIPTION_WRITE_PORT_TOKEN, l as SelfServiceBlockedBundles, m as SelfServiceBlockedPlans, n as SubscriptionBundleControllerOptions, o as SubscriptionBundleModule, p as SubscriptionBundleModuleOptions, T as TENANT_AUTH_GUARDS_TOKEN, q as TENANT_ID_RESOLVER_TOKEN, r as TRIAL_PROJECTION_PORT_TOKEN, s as TenantBillingModule, t as TenantBillingModuleOptions, u as TenantIdResolver, v as TrialProjectionInput, w as TrialProjectionPort, U as USAGE_SNAPSHOT_PORT_TOKEN, x as USER_EMAIL_RESOLVER_TOKEN, y as USER_ID_RESOLVER_TOKEN, z as UserEmailResolver, B as UserIdResolver } from '../subscription-bundles.module-BQmoozm5.js';
-export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-b1G1yB09.js';
+export { A as AddBundleToSubscriptionInput, B as BundlePreviewSnapshot, C as CancelBundleFromSubscriptionInput, a as CancelSubscriptionDto, b as ChangePlanDto, c as CompleteOnboardingSubscriptionDto, d as ComposedTenantAuthGuard, L as LimitsCheckRow, P as PendingPlanMaterializationService, e as PlanChangeContext, f as PlanChangePreviewDto, g as PlanChangePreviewIssue, h as PlanChangePreviewService, i as PlanChangeType, j as PlanSnapshotDto, k as PreviewPlanChangeDto, l as ProrationDto, m as ProrationInput, R as RedundantFeatureHint, S as SubscriptionBundleAddPreviewDto, n as SubscriptionBundleCancelPreviewDto, o as SubscriptionBundleConfig, p as SubscriptionBundlePreviewContext, q as SubscriptionBundlePreviewIssue, r as SubscriptionBundlePreviewService, s as SubscriptionBundlesService, T as TenantAdminGuard, t as TenantBillingController, U as UsageResponse, u as addMonths, v as computeProration, w as resolveBundleCancelEffectiveAt, x as resolveBundlePriceNet } from '../tenant-billing.controller-DT5UrnDX.js';
 import { S as SubscriptionContractService } from '../subscription-contract.service--cm47ZJJ.js';
 import '../plan-resolution-CFCoUkrE.js';
-import '../service-DPZ2W1E-.js';
+import '../service-D48clObR.js';
 import '../admin-audit.service-9IqXMlZm.js';
 
 /**
@@ -197,10 +197,11 @@ declare class FeatureGuard implements CanActivate {
     constructor(reflector: Reflector, entitlements: EntitlementService, config?: FeatureGuardConfig | null, upsellResolver?: UpsellOfferResolver | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /**
-     * Upsell response (#36): with a registered `UpsellOfferResolver` the 403
-     * becomes machine-readable (`FeatureNotLicensedBody`), so consumer UIs can
-     * render a purchase offer. Without a resolver the body carries the same
-     * `code` but no offers.
+     * Upsell response (#36): the 403 body is always the full
+     * `FeatureNotLicensedBody`, so a consumer that matches on `code` can read
+     * `featureKey`/`offers` unconditionally. Without a registered
+     * `UpsellOfferResolver` there is simply nothing to offer — `offers` is
+     * empty, the same degradation a failing resolver produces.
      *
      * Deliberately 403 + `code` field instead of 402 — rationale in
      * `@saasicat/types` upsell.types.ts (402 is reserved / inconsistently

package/dist/billing/index.js

@@ -58,8 +58,8 @@ import {
   periodEndWithMinLead,
   resolveBundleCancelEffectiveAt,
   resolveBundlePriceNet
-} from "../chunk-I77VS3YH.js";
-import "../chunk-QLJHIIOY.js";
+} from "../chunk-NZLAYCEX.js";
+import "../chunk-VQQWF7MW.js";
 import "../chunk-B7NRY2LV.js";
 import {
   AUDIT_CONTEXT_RESOLVER_TOKEN,
@@ -81,7 +81,7 @@ import "../chunk-YSC46BGM.js";
 import {
   SUBSCRIPTION_BUNDLE_CONFIG_TOKEN,
   SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN
-} from "../chunk-F6DCLVBB.js";
+} from "../chunk-AGOG5B77.js";
 import {
   PLAN_CATALOG_READ_SINK_TOKEN,
   PLAN_CATALOG_TOKEN,
@@ -98,6 +98,7 @@ import {
   isFeaturePlannedOnly
 } from "../chunk-DQKCK7DX.js";
 import "../chunk-NYLON2VC.js";
+import "../chunk-EBJJNTW6.js";
 import "../chunk-WKVBNTYC.js";
 import "../chunk-L4KTQ6CL.js";
 import "../chunk-SABTXESR.js";

package/dist/catalog/index.js

@@ -6,7 +6,7 @@ import {
   runSeedGateFromFile,
   seedGateExitCode,
   validateSeedAgainstSnapshot
-} from "../chunk-AFK2IE2L.js";
+} from "../chunk-55QGAZRQ.js";
 import "../chunk-74SCJ4HF.js";
 import {
   ADVISORY_STRICT_MODE_CODES,
@@ -56,7 +56,7 @@ import {
   quotaApprovalSignature,
   validateBundleDraft,
   validatePlanDraft
-} from "../chunk-LXUBCLRK.js";
+} from "../chunk-GC5AKN44.js";
 import "../chunk-WPUVJRIN.js";
 import "../chunk-E56W4U2P.js";
 import "../chunk-YSC46BGM.js";

package/dist/checkout-offer/index.js

@@ -6,7 +6,7 @@ import {
   CreateCheckoutOfferDto,
   UpdateCheckoutOfferDto,
   buildCheckoutOfferController
-} from "../chunk-ORWIGSNN.js";
+} from "../chunk-XTVAFJ3P.js";
 import "../chunk-BSK6YBLI.js";
 import "../chunk-YSC46BGM.js";
 import "../chunk-L4KTQ6CL.js";

package/dist/{chunk-6WA4X5U3.js → chunk-3DRZ5GCP.js}

@@ -1,3 +1,6 @@
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -183,25 +186,17 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async selectPlan(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
     if (!plan) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
@@ -224,30 +219,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async startCheckout(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     if (!pending.selectedPlanId) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
     if (!plan) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const session = await this.paymentProvider.createCheckoutSession({
       pendingRegistrationId: pending.id,
@@ -456,9 +441,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", null, context, {
         reason: "unknown_email"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
       return {
@@ -471,43 +454,33 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "no_otp_set"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.otpExpiresAt.getTime() < Date.now()) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "expired"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_EXPIRED));
     }
     const maxAttempts = resolveOtpVerifyMaxAttempts();
     if (pending.otpAttemptCount >= maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
     if (attemptCount > maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     if (!verifyOtpCode(pending.otpHash, code)) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "wrong_code"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     const now = /* @__PURE__ */ new Date();
     const updated = await this.repo.update(pending.id, {
@@ -618,28 +591,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async resumeWithToken(input, context) {
     if (!this.resumeTokenSigner) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED));
     }
     let decoded;
     try {
       decoded = await this.resumeTokenSigner.verify(input.token);
     } catch {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     const pending = await this.repo.findById(decoded.pendingRegistrationId);
     if (!pending) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
       via: "resume_token",
@@ -667,9 +632,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
   /** Returns the (app-specific) configurator catalog. */
   async getConfiguratorCatalog() {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     return this.configuratorLookup.getCatalog();
   }
@@ -686,32 +649,22 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async saveConfiguration(input, context) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === input.selection.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (input.selection.appliedPromoCode && this.promoPreview) {
@@ -775,28 +728,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async previewConfigPromo(pendingRegistrationId, code) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     const config = pending.configJson;
     if (!config) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === config.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (code && this.promoPreview) {
@@ -1030,9 +975,14 @@ var BaseIpRateLimitGuard = class {
     const key = ipFingerprint(req);
     if (this.exceeded(key)) {
       throw new HttpException({
-        code: REGISTRATION_ERROR_CODES2.RATE_LIMITED,
-        reason: this.options.name,
-        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        ...codedError(REGISTRATION_ERROR_CODES2.RATE_LIMITED, {
+          retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        }),
+        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3),
+        // Superseded by `code`. Note this carries the limiter name,
+        // not the code — the two emitters of RATE_LIMITED disagree
+        // on what `reason` means, which is why it is going away.
+        reason: this.options.name
       }, HttpStatus.TOO_MANY_REQUESTS);
     }
     return true;

package/dist/{chunk-EUU3B6NB.js → chunk-4O6R6ARQ.js}

@@ -8,13 +8,16 @@ import {
   PROMO_SUBSCRIPTION_LOOKUP_TOKEN,
   PROMO_TRANSACTION_RUNNER_TOKEN,
   PromoCodesService
-} from "./chunk-QLJHIIOY.js";
+} from "./chunk-VQQWF7MW.js";
 import {
   AdminAuditService
 } from "./chunk-E56W4U2P.js";
 import {
   SaaSiCatPublicRoute
 } from "./chunk-YSC46BGM.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -96,12 +99,15 @@ var IP_WINDOW_MS = 6e4;
 var IP_LIMIT = 20;
 var SESSION_WINDOW_MS = 60 * 6e4;
 var SESSION_LIMIT = 50;
-function rateLimited() {
+function rateLimited(windowMs) {
   return new HttpException({
+    ...codedError(REGISTRATION_ERROR_CODES.RATE_LIMITED, {
+      retryAfterSeconds: Math.ceil(windowMs / 1e3)
+    }),
+    retryAfterSeconds: Math.ceil(windowMs / 1e3),
     valid: false,
     // Superseded by `code` — kept until all consumers read `code`.
-    reason: "RATE_LIMITED",
-    code: REGISTRATION_ERROR_CODES.RATE_LIMITED
+    reason: "RATE_LIMITED"
   }, HttpStatus.TOO_MANY_REQUESTS);
 }
 __name(rateLimited, "rateLimited");
@@ -116,10 +122,10 @@ var PromoCodeRateLimitGuard = class {
     const ipKey = ipFingerprint(req);
     const sessionKey = req.user?.id ?? null;
     if (this.exceeded(this.ipBuckets, ipKey, IP_WINDOW_MS, IP_LIMIT)) {
-      throw rateLimited();
+      throw rateLimited(IP_WINDOW_MS);
     }
     if (sessionKey && this.exceeded(this.sessionBuckets, sessionKey, SESSION_WINDOW_MS, SESSION_LIMIT)) {
-      throw rateLimited();
+      throw rateLimited(SESSION_WINDOW_MS);
     }
     return true;
   }

package/dist/{chunk-AFK2IE2L.js → chunk-55QGAZRQ.js}

@@ -6,7 +6,7 @@ import {
   ADVISORY_STRICT_MODE_CODES,
   validateBundleDraft,
   validatePlanDraft
-} from "./chunk-LXUBCLRK.js";
+} from "./chunk-GC5AKN44.js";
 import {
   __name
 } from "./chunk-SHUYVCID.js";

package/dist/{chunk-F6DCLVBB.js → chunk-AGOG5B77.js}

@@ -5,6 +5,9 @@ import {
 import {
   SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN
 } from "./chunk-NYLON2VC.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   ENTITLEMENT_RESOLUTION_CONFIG_TOKEN,
   ENTITLEMENT_SERVICE_TOKEN,
@@ -304,7 +307,7 @@ function isLimitExceededError(err) {
 __name(isLimitExceededError, "isLimitExceededError");
 
 // src/entitlement/service.ts
-import { Inject, Injectable, NotFoundException, Optional } from "@nestjs/common";
+import { Inject, Injectable, InternalServerErrorException, NotFoundException, Optional } from "@nestjs/common";
 import { BILLING_ERROR_CODES } from "@saasicat/types";
 
 // src/billing/subscription-bundles.tokens.ts
@@ -484,7 +487,10 @@ var EntitlementService = class {
       const limits = await this.deriveLimits(sub, now, tx);
       const max = limits.quotas[input.dimension];
       if (max === void 0) {
-        throw new Error(`Quota-Dimension "${input.dimension}" is not in the plan catalog (${this.catalog.projectKey}).`);
+        throw new InternalServerErrorException(codedError(BILLING_ERROR_CODES.QUOTA_DIMENSION_UNKNOWN, {
+          dimension: input.dimension,
+          projectKey: this.catalog.projectKey
+        }));
       }
       const used = await input.currentUsage(tx, input.tenantId);
       if (max !== -1 && used + delta > max) {

package/dist/chunk-EBJJNTW6.js

@@ -0,0 +1,22 @@
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/errors/coded-error.ts
+import { ERROR_MESSAGES_EN, formatErrorMessage } from "@saasicat/types";
+function codedError(code, params) {
+  const message = formatErrorMessage(ERROR_MESSAGES_EN[code], params ?? {});
+  return params ? {
+    code,
+    message,
+    params
+  } : {
+    code,
+    message
+  };
+}
+__name(codedError, "codedError");
+
+export {
+  codedError
+};

package/dist/{chunk-7JIHG53V.js → chunk-FYWLPYBK.js}

@@ -7,6 +7,9 @@ import {
 import {
   SaaSiCatPublicRoute
 } from "./chunk-YSC46BGM.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -199,7 +202,7 @@ var MfaGuard = class _MfaGuard {
     const user = request.user;
     if (!user) {
       throw new UnauthorizedException({
-        code: AUTH_ERROR_CODES2.NOT_AUTHENTICATED,
+        ...codedError(AUTH_ERROR_CODES2.NOT_AUTHENTICATED),
         // `reason` is superseded by `code` and will be removed.
         reason: "NOT_AUTHENTICATED"
       });

package/dist/{chunk-LXUBCLRK.js → chunk-GC5AKN44.js}

@@ -330,7 +330,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -364,7 +364,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -461,7 +461,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -510,7 +510,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -750,9 +750,10 @@ var BundlesService = class _BundlesService {
       throw new UnprocessableEntityException({
         code,
         message: `${field} '${input}' is not a valid date`,
+        // Keyed by the field name so these params match the publish
+        // path, where the same codes carry `validFrom` / `validUntil`.
         params: {
-          field,
-          value: input
+          [field]: input
         }
       });
     }
@@ -3409,7 +3410,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.publishedAt === null) {
       throw new UnprocessableEntityException4({
-        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_LIVE,
+        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_PUBLISHED,
         message: `PlanVersion '${versionId}' is not published and cannot be terminated.`,
         params: {
           versionId
@@ -3418,7 +3419,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.supersededAt !== null) {
       throw new UnprocessableEntityException4({
-        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_LIVE,
+        code: CATALOG_ERROR_CODES6.PLAN_VERSION_SUPERSEDED,
         message: `PlanVersion '${versionId}' has already been superseded by a newer version (supersededAt) and cannot be terminated.`,
         params: {
           versionId