@saasicat/nest 0.19.0 → 0.22.0

package/dist/_entries.cjs

@@ -124,7 +124,22 @@ SuperAdminGuard = _ts_decorate([
 // src/admin/mfa.guard.ts
 var import_common3 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
+var import_types3 = require("@saasicat/types");
+
+// src/errors/coded-error.ts
 var import_types2 = require("@saasicat/types");
+function codedError(code, params) {
+  const message = (0, import_types2.formatErrorMessage)(import_types2.ERROR_MESSAGES_EN[code], params ?? {});
+  return params ? {
+    code,
+    message,
+    params
+  } : {
+    code,
+    message
+  };
+}
+__name(codedError, "codedError");
 
 // src/admin/mfa.ts
 var import_common2 = require("@nestjs/common");
@@ -272,7 +287,7 @@ var MfaGuard = class _MfaGuard {
     const user = request.user;
     if (!user) {
       throw new import_common3.UnauthorizedException({
-        code: import_types2.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        ...codedError(import_types3.AUTH_ERROR_CODES.NOT_AUTHENTICATED),
         // `reason` is superseded by `code` and will be removed.
         reason: "NOT_AUTHENTICATED"
       });
@@ -280,7 +295,7 @@ var MfaGuard = class _MfaGuard {
     const enabled = await this.mfaService.isEnabled(user.id);
     if (!enabled) {
       throw new import_common3.UnauthorizedException({
-        code: import_types2.AUTH_ERROR_CODES.MFA_NOT_SET_UP,
+        code: import_types3.AUTH_ERROR_CODES.MFA_NOT_SET_UP,
         // `reason` is superseded by `code` and will be removed.
         reason: "MFA_NOT_SET_UP",
         message: "Run the MFA setup via the CLI first."
@@ -290,7 +305,7 @@ var MfaGuard = class _MfaGuard {
     const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
     if (!code) {
       throw new import_common3.UnauthorizedException({
-        code: import_types2.AUTH_ERROR_CODES.MFA_REQUIRED,
+        code: import_types3.AUTH_ERROR_CODES.MFA_REQUIRED,
         // `reason` is superseded by `code` and will be removed.
         reason: "MFA_REQUIRED",
         message: "TOTP code required in the X-Mfa-Code header."
@@ -302,7 +317,7 @@ var MfaGuard = class _MfaGuard {
     });
     if (!valid) {
       throw new import_common3.UnauthorizedException({
-        code: import_types2.AUTH_ERROR_CODES.MFA_FAILED,
+        code: import_types3.AUTH_ERROR_CODES.MFA_FAILED,
         // `reason` is superseded by `code` and will be removed.
         reason: "MFA_FAILED",
         message: "Invalid TOTP code."
@@ -756,7 +771,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "dashboard.read"
       },
-      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // — discovery snapshot of the running backend.
       // Apps must set `discovery.read` in their manifest capabilities
       // to `true` so that the NavBuilder wires the page into the
       // sidebar; otherwise it is filtered out automatically.
@@ -764,7 +779,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "discovery.read"
       },
-      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // — Bundle editor in SuperAdmin.
       // Apps with a DB-driven catalog set `bundles.read = true`.
       bundles: {
         enabled: true,
@@ -774,7 +789,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "plans.read"
       },
-      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // — marketing catalog (locale pivot).
       // Apps that market a public catalog set
       // `marketingProjections.read = true`.
       marketingCatalog: {
@@ -1338,7 +1353,7 @@ AdminStatsModule = _ts_decorate12([
 // src/admin/admin-resources.module.ts
 var import_common14 = require("@nestjs/common");
 var import_class_validator = require("class-validator");
-var import_types3 = require("@saasicat/types");
+var import_types4 = require("@saasicat/types");
 function _ts_decorate13(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1386,7 +1401,7 @@ var AdminResourcesService = class {
     const tenant = await this.resources.getTenantDetail(slug);
     if (!tenant) {
       throw new import_common14.NotFoundException({
-        code: import_types3.BILLING_ERROR_CODES.TENANT_NOT_FOUND,
+        code: import_types4.BILLING_ERROR_CODES.TENANT_NOT_FOUND,
         message: `Tenant ${slug} not found`,
         params: {
           slug
@@ -1420,7 +1435,7 @@ var AdminResourcesService = class {
     const result = await this.resources.setTenantActive(slug, active, subscriptionStatus);
     if (!result) {
       throw new import_common14.NotFoundException({
-        code: import_types3.BILLING_ERROR_CODES.TENANT_NOT_FOUND,
+        code: import_types4.BILLING_ERROR_CODES.TENANT_NOT_FOUND,
         message: `Tenant ${slug} not found`,
         params: {
           slug
@@ -1668,8 +1683,8 @@ __export(billing_exports, {
   buildPlanCatalogFromSnapshot: () => buildPlanCatalogFromSnapshot,
   buildPlanCatalogImporterController: () => buildPlanCatalogImporterController,
   buildTenantSubscriptionBundlesController: () => buildTenantSubscriptionBundlesController,
-  classifyBundleVersionDiff: () => import_types4.classifyBundleVersionDiff,
-  classifyPlanDiff: () => import_types4.classifyPlanDiff,
+  classifyBundleVersionDiff: () => import_types5.classifyBundleVersionDiff,
+  classifyPlanDiff: () => import_types5.classifyPlanDiff,
   clearPendingPlanVersionFields: () => clearPendingPlanVersionFields,
   computeCarriedTrialEndsAt: () => computeCarriedTrialEndsAt,
   computeNextPeriod: () => computeNextPeriod,
@@ -1730,7 +1745,7 @@ function periodEndWithMinLead(startedAt, cycle, now, minLeadDays = 42) {
 __name(periodEndWithMinLead, "periodEndWithMinLead");
 
 // src/billing/version-diff.ts
-var import_types4 = require("@saasicat/types");
+var import_types5 = require("@saasicat/types");
 
 // src/billing/version-publish.ts
 var PublishValidationError = class extends Error {
@@ -1825,11 +1840,11 @@ var FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/Featu
 // src/billing/feature.guard.ts
 var import_common18 = require("@nestjs/common");
 var import_core2 = require("@nestjs/core");
-var import_types6 = require("@saasicat/types");
+var import_types7 = require("@saasicat/types");
 
 // src/entitlement/service.ts
 var import_common17 = require("@nestjs/common");
-var import_types5 = require("@saasicat/types");
+var import_types6 = require("@saasicat/types");
 
 // src/catalog/tokens.ts
 var PLAN_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanRepository");
@@ -2396,7 +2411,7 @@ var EntitlementService = class {
     const sub = await this.subscriptions.findByTenantId(tenantId);
     if (!sub) {
       throw new import_common17.NotFoundException({
-        code: import_types5.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types6.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -2497,7 +2512,7 @@ var EntitlementService = class {
       const sub = await this.subscriptions.findByTenantIdLocked(input.tenantId, tx);
       if (!sub) {
         throw new import_common17.NotFoundException({
-          code: import_types5.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+          code: import_types6.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
           message: `No subscription for tenant ${input.tenantId}`,
           params: {
             tenantId: input.tenantId
@@ -2507,7 +2522,10 @@ var EntitlementService = class {
       const limits = await this.deriveLimits(sub, now, tx);
       const max = limits.quotas[input.dimension];
       if (max === void 0) {
-        throw new Error(`Quota-Dimension "${input.dimension}" is not in the plan catalog (${this.catalog.projectKey}).`);
+        throw new import_common17.InternalServerErrorException(codedError(import_types6.BILLING_ERROR_CODES.QUOTA_DIMENSION_UNKNOWN, {
+          dimension: input.dimension,
+          projectKey: this.catalog.projectKey
+        }));
       }
       const used = await input.currentUsage(tx, input.tenantId);
       if (max !== -1 && used + delta > max) {
@@ -2521,7 +2539,7 @@ var EntitlementService = class {
   // ---------------------------------------------------------------------
   /**
    * Plan fallback for TRIAL/PENDING_SALES: returns the PlanVersion active
-   * as of `asOf` (SPEC_V2 §4.2). If the repo does not implement
+   * as of `asOf`. If the repo does not implement
    * `findActive`, we fall back to `findLatestLive` (backward compat for
    * adapters without `validFrom` columns).
    */
@@ -2530,7 +2548,7 @@ var EntitlementService = class {
     if (!v) {
       const asOfDate = asOf.toISOString().slice(0, 10);
       throw new import_common17.NotFoundException({
-        code: import_types5.BILLING_ERROR_CODES.NO_ACTIVE_PLAN_VERSION,
+        code: import_types6.BILLING_ERROR_CODES.NO_ACTIVE_PLAN_VERSION,
         message: `No plan version for ${planId} active as of ${asOfDate} \u2014 neither the validFrom window is satisfied nor is a latest-live version available.`,
         params: {
           planId,
@@ -2641,7 +2659,7 @@ var FeatureGuard = class _FeatureGuard {
     const user = request.user;
     if (!user) {
       throw new import_common18.ForbiddenException({
-        code: import_types6.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        code: import_types7.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
         message: "Not authenticated"
       });
     }
@@ -2650,7 +2668,7 @@ var FeatureGuard = class _FeatureGuard {
     const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
     if (!tenantId) {
       throw new import_common18.ForbiddenException({
-        code: import_types6.AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
+        code: import_types7.AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
         message: "No tenant assigned"
       });
     }
@@ -2663,10 +2681,11 @@ var FeatureGuard = class _FeatureGuard {
     return true;
   }
   /**
-   * Upsell response (#36): with a registered `UpsellOfferResolver` the 403
-   * becomes machine-readable (`FeatureNotLicensedBody`), so consumer UIs can
-   * render a purchase offer. Without a resolver the body carries the same
-   * `code` but no offers.
+   * Upsell response (#36): the 403 body is always the full
+   * `FeatureNotLicensedBody`, so a consumer that matches on `code` can read
+   * `featureKey`/`offers` unconditionally. Without a registered
+   * `UpsellOfferResolver` there is simply nothing to offer — `offers` is
+   * empty, the same degradation a failing resolver produces.
    *
    * Deliberately 403 + `code` field instead of 402 — rationale in
    * `@saasicat/types` upsell.types.ts (402 is reserved / inconsistently
@@ -2677,22 +2696,12 @@ var FeatureGuard = class _FeatureGuard {
    * classify the response by that prefix.
    */
   async buildNotLicensedException(required, tenantId) {
-    const message = `Feature ${required.join(" / ")} is not included in the current plan.`;
-    if (!this.upsellResolver) {
-      return new import_common18.ForbiddenException({
-        code: import_types6.FEATURE_NOT_LICENSED,
-        message,
-        params: {
-          featureKeys: required
-        }
-      });
-    }
     const body = {
-      code: import_types6.FEATURE_NOT_LICENSED,
+      code: import_types7.FEATURE_NOT_LICENSED,
       featureKey: required[0],
       featureKeys: required,
-      offers: await this.resolveOffersSafe(required, tenantId),
-      message
+      offers: this.upsellResolver ? await this.resolveOffersSafe(required, tenantId) : [],
+      message: `Feature ${required.join(" / ")} is not included in the current plan.`
     };
     return new import_common18.ForbiddenException(body);
   }
@@ -2728,7 +2737,7 @@ FeatureGuard = _ts_decorate16([
 
 // src/billing/catalog-bundle-upsell-resolver.ts
 var import_common19 = require("@nestjs/common");
-var import_types7 = require("@saasicat/types");
+var import_types8 = require("@saasicat/types");
 
 // src/billing/public-catalog.tokens.ts
 var PUBLIC_CATALOG_PROJECT_KEY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PublicCatalogProjectKey");
@@ -2798,7 +2807,7 @@ var CatalogBundleUpsellResolver = class {
     const rows = await this.catalogEntryRepo.listFeatures({
       projectKey: this.projectKey
     });
-    return (0, import_types7.collectUnsatisfiedRequires)(featureKeys, (0, import_types7.buildFeatureRequiresIndex)(rows));
+    return (0, import_types8.collectUnsatisfiedRequires)(featureKeys, (0, import_types8.buildFeatureRequiresIndex)(rows));
   }
   /** Only published-and-live AND marketed — non-marketed bundles are not an offer. */
   async listLiveMarketedBundles() {
@@ -2857,7 +2866,7 @@ __name(compareRankedOffers, "compareRankedOffers");
 // src/billing/limit-exceeded.filter.ts
 var import_common20 = require("@nestjs/common");
 var import_core3 = require("@nestjs/core");
-var import_types8 = require("@saasicat/types");
+var import_types9 = require("@saasicat/types");
 function _ts_decorate18(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -2882,10 +2891,10 @@ var LimitExceededFilter = class _LimitExceededFilter extends import_core3.BaseEx
     response.status(import_common20.HttpStatus.PAYMENT_REQUIRED).send({
       statusCode: import_common20.HttpStatus.PAYMENT_REQUIRED,
       error: "PaymentRequired",
-      code: import_types8.BILLING_ERROR_CODES.LIMIT_EXCEEDED,
+      code: import_types9.BILLING_ERROR_CODES.LIMIT_EXCEEDED,
       // Deprecated: superseded by `code`, kept until consumers have
       // migrated. Same value, only under the older field name.
-      reason: import_types8.BILLING_ERROR_CODES.LIMIT_EXCEEDED,
+      reason: import_types9.BILLING_ERROR_CODES.LIMIT_EXCEEDED,
       dimension: exception.dimension,
       used: exception.used,
       max: exception.max,
@@ -2993,7 +3002,7 @@ function _ts_param14(paramIndex, decorator) {
 }
 __name(_ts_param14, "_ts_param");
 var PLAN_CATALOG_IMPORT_SINK_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanCatalogImportSink");
-var IMPORT_CHANGE_NOTE = "Initial import from saas.yaml (SPEC_V2 \xA711.1 M6 Pack 2c)";
+var IMPORT_CHANGE_NOTE = "Initial import from saas.yaml";
 var PlanCatalogImporterService = class {
   static {
     __name(this, "PlanCatalogImporterService");
@@ -3197,7 +3206,7 @@ var FEATURE_UI_REGISTRY_TOKEN2 = /* @__PURE__ */ Symbol.for("saas-platform/Featu
 
 // src/billing/public-catalog.controller.ts
 var import_common24 = require("@nestjs/common");
-var import_types9 = require("@saasicat/types");
+var import_types10 = require("@saasicat/types");
 function _ts_decorate22(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3284,7 +3293,7 @@ var PublicCatalogController = class {
     return merged;
   }
   /**
-   * SPEC_V2 §11.1 M6 Pack 2c — public catalog endpoint for bundles
+   * — public catalog endpoint for bundles
    * (stem list with live versions). If a `MarketingProjection` with
    * `targetType=BUNDLE` + matching locale exists, it is merged in.
    */
@@ -3317,7 +3326,7 @@ var PublicCatalogController = class {
       const rows = await this.catalogEntryRepo.listFeatures({
         projectKey: this.projectKey
       });
-      return (0, import_types9.buildFeatureRequiresIndex)(rows);
+      return (0, import_types10.buildFeatureRequiresIndex)(rows);
     } catch {
       return /* @__PURE__ */ new Map();
     }
@@ -3357,7 +3366,7 @@ var PublicCatalogController = class {
       quotas: live.quotas,
       monthlyNet: live.monthlyNet,
       yearlyNet: live.yearlyNet,
-      requiresFeatures: (0, import_types9.collectUnsatisfiedRequires)(features, requiresIndex),
+      requiresFeatures: (0, import_types10.collectUnsatisfiedRequires)(features, requiresIndex),
       marketing
     };
   }
@@ -3481,7 +3490,7 @@ var PENDING_PLAN_QUERY_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/Pe
 
 // src/billing/composed-tenant-auth.guard.ts
 var import_common26 = require("@nestjs/common");
-var import_types10 = require("@saasicat/types");
+var import_types11 = require("@saasicat/types");
 function _ts_decorate24(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3510,7 +3519,7 @@ var ComposedTenantAuthGuard = class {
   async canActivate(context) {
     if (!this.guards || this.guards.length === 0) {
       throw new import_common26.ForbiddenException({
-        code: import_types10.AUTH_ERROR_CODES.AUTH_GUARDS_NOT_CONFIGURED,
+        code: import_types11.AUTH_ERROR_CODES.AUTH_GUARDS_NOT_CONFIGURED,
         message: "TenantBillingModule.forRoot.authGuards is not configured."
       });
     }
@@ -3533,7 +3542,7 @@ ComposedTenantAuthGuard = _ts_decorate24([
 
 // src/billing/tenant-admin.guard.ts
 var import_common27 = require("@nestjs/common");
-var import_types11 = require("@saasicat/types");
+var import_types12 = require("@saasicat/types");
 function _ts_decorate25(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -3553,14 +3562,14 @@ var TenantAdminGuard = class {
     const request = context.switchToHttp().getRequest();
     if (!request.user) {
       throw new import_common27.ForbiddenException({
-        code: import_types11.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        code: import_types12.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
         message: "Not authenticated"
       });
     }
     const role = request.user.platformRole ?? request.user.role;
     if (!role || !ADMIN_ROLES.has(role)) {
       throw new import_common27.ForbiddenException({
-        code: import_types11.AUTH_ERROR_CODES.TENANT_ADMIN_REQUIRED,
+        code: import_types12.AUTH_ERROR_CODES.TENANT_ADMIN_REQUIRED,
         message: "This action requires the TENANT_ADMIN role."
       });
     }
@@ -3600,7 +3609,7 @@ __name(round22, "round2");
 
 // src/billing/plan-change-preview.service.ts
 var import_common29 = require("@nestjs/common");
-var import_types12 = require("@saasicat/types");
+var import_types13 = require("@saasicat/types");
 
 // src/entitlement/index.ts
 var entitlement_exports = {};
@@ -3730,7 +3739,7 @@ var PlanChangePreviewService = class {
     const sub = await this.subscriptions.findForTenant(tenantId);
     if (!sub) {
       throw new import_common29.NotFoundException({
-        code: import_types12.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types13.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -3740,7 +3749,7 @@ var PlanChangePreviewService = class {
     const targetPlanDef = findPlan(this.catalog, targetPlan);
     if (!targetPlanDef) {
       throw new import_common29.NotFoundException({
-        code: import_types12.BILLING_ERROR_CODES.PLAN_NOT_IN_CATALOG,
+        code: import_types13.BILLING_ERROR_CODES.PLAN_NOT_IN_CATALOG,
         message: `Plan "${targetPlan}" is not in the catalog (${this.catalog.projectKey})`,
         params: {
           planKey: targetPlan,
@@ -4129,7 +4138,7 @@ function cloneJsonValue(value) {
 __name(cloneJsonValue, "cloneJsonValue");
 
 // src/subscription-contract/subscription-contract.service.ts
-var import_types13 = require("@saasicat/types");
+var import_types14 = require("@saasicat/types");
 function _ts_decorate29(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -4162,7 +4171,7 @@ var SubscriptionContractService = class {
     const row = await this.repo.findById(contractId);
     if (!row) {
       throw new import_common31.NotFoundException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_NOT_FOUND,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_NOT_FOUND,
         message: `SubscriptionContract '${contractId}' not found`,
         params: {
           contractId
@@ -4178,7 +4187,7 @@ var SubscriptionContractService = class {
     const contract = await this.repo.findActiveByTenantId(tenantId, asOf);
     if (!contract) {
       throw new import_common31.NotFoundException({
-        code: import_types13.CONTRACT_ERROR_CODES.NO_ACTIVE_SUBSCRIPTION_CONTRACT,
+        code: import_types14.CONTRACT_ERROR_CODES.NO_ACTIVE_SUBSCRIPTION_CONTRACT,
         message: `No active subscription contract for tenant ${tenantId}`,
         params: {
           tenantId,
@@ -4218,7 +4227,7 @@ var SubscriptionContractService = class {
   createDataFromOffer(offer, options) {
     if (offer.status !== "consumed") {
       throw new import_common31.ConflictException({
-        code: import_types13.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_NOT_CONSUMED,
+        code: import_types14.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_NOT_CONSUMED,
         message: `CheckoutOffer '${offer.id}' must be consumed before the contract is created`,
         params: {
           offerId: offer.id,
@@ -4257,7 +4266,7 @@ var SubscriptionContractService = class {
     const source = offer.lineItems ?? [];
     if (source.length === 0) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_LINE_ITEMS_REQUIRED,
+        code: import_types14.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_LINE_ITEMS_REQUIRED,
         message: "A checkout offer can yield only one contract, and only once its line items are frozen."
       });
     }
@@ -4296,7 +4305,7 @@ var SubscriptionContractService = class {
     const date = value instanceof Date ? new Date(value) : new Date(value);
     if (Number.isNaN(date.getTime())) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_INVALID_DATE,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_INVALID_DATE,
         message: `${field} must be a valid date.`,
         params: {
           field
@@ -4320,20 +4329,20 @@ var SubscriptionContractService = class {
   assertCreateData(data) {
     if (data.lineItems.length === 0) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED,
         message: "A subscription contract requires at least one line item."
       });
     }
     if (data.effectiveUntil && data.effectiveUntil <= data.effectiveFrom) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_INVALID_WINDOW,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_INVALID_WINDOW,
         message: "effectiveUntil must be after effectiveFrom."
       });
     }
     const planLineItems = data.lineItems.filter((item) => item.kind === "plan");
     if (planLineItems.length !== 1) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED,
         message: "A subscription contract requires exactly one plan base item."
       });
     }
@@ -4341,7 +4350,7 @@ var SubscriptionContractService = class {
   assertTerminable(existing, data) {
     if (existing.status === "terminated" || existing.status === "superseded") {
       throw new import_common31.ConflictException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_ALREADY_CLOSED,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_ALREADY_CLOSED,
         message: `SubscriptionContract '${existing.id}' is already closed`,
         params: {
           contractId: existing.id,
@@ -4351,7 +4360,7 @@ var SubscriptionContractService = class {
     }
     if (data.effectiveUntil <= existing.effectiveFrom) {
       throw new import_common31.UnprocessableEntityException({
-        code: import_types13.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START,
+        code: import_types14.CONTRACT_ERROR_CODES.SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START,
         message: "effectiveUntil must be after the effectiveFrom of the contract."
       });
     }
@@ -4746,11 +4755,11 @@ _ts_decorate33([
 
 // src/billing/tenant-billing.controller.ts
 var import_common36 = require("@nestjs/common");
-var import_types16 = require("@saasicat/types");
+var import_types17 = require("@saasicat/types");
 
 // src/promo/service.ts
 var import_common34 = require("@nestjs/common");
-var import_types14 = require("@saasicat/types");
+var import_types15 = require("@saasicat/types");
 
 // src/promo/tokens.ts
 var PROMO_CODE_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PromoCodeRepository");
@@ -4843,7 +4852,7 @@ var DURATION_MIN = 1;
 var DURATION_MAX = 24;
 function notRedeemable(reason) {
   return new import_common34.BadRequestException({
-    code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_NOT_REDEEMABLE,
+    code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_NOT_REDEEMABLE,
     message: `Code cannot be redeemed: ${reason}`,
     params: {
       reason
@@ -4880,7 +4889,7 @@ var PromoCodesService = class {
     const code = input.code.trim().toUpperCase();
     if (!CODE_PATTERN.test(code)) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_FORMAT_INVALID,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_FORMAT_INVALID,
         message: 'The code may only contain upper-case letters, digits, "-" and "_" (4\u201332 characters).',
         params: {
           promoCode: code,
@@ -4892,7 +4901,7 @@ var PromoCodesService = class {
     if (input.valueType === "PERCENT") {
       if (!(input.value > PERCENT_MIN_EXCLUSIVE && input.value <= PERCENT_MAX)) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_PERCENT_OUT_OF_RANGE,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_PERCENT_OUT_OF_RANGE,
           message: "The percentage must be between 0 and 100.",
           params: {
             value: input.value,
@@ -4903,7 +4912,7 @@ var PromoCodesService = class {
       }
     } else if (!(input.value > 0)) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_AMOUNT_NOT_POSITIVE,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_AMOUNT_NOT_POSITIVE,
         message: "The amount must be positive.",
         params: {
           value: input.value,
@@ -4914,7 +4923,7 @@ var PromoCodesService = class {
     if (input.durationType === "ONCE") {
       if (input.durationValue != null) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_ONE_OFF_WITH_DURATION,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_ONE_OFF_WITH_DURATION,
           message: "A one-off discount must not set a duration.",
           params: {
             durationValue: input.durationValue
@@ -4925,7 +4934,7 @@ var PromoCodesService = class {
       const v = input.durationValue;
       if (v == null || v < DURATION_MIN || v > DURATION_MAX) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_DURATION_INVALID,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_DURATION_INVALID,
           message: "Invalid duration (at most 24 months or billing periods).",
           params: {
             durationValue: v ?? null,
@@ -4937,7 +4946,7 @@ var PromoCodesService = class {
     }
     if (input.validFrom && input.validUntil && input.validFrom >= input.validUntil) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_VALIDITY_WINDOW_INVALID,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_VALIDITY_WINDOW_INVALID,
         message: "Invalid validity window.",
         params: {
           validFrom: input.validFrom.toISOString(),
@@ -4950,7 +4959,7 @@ var PromoCodesService = class {
     for (const p of plans) {
       if (blocked.includes(p)) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_PLAN_NOT_DISCOUNTABLE,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_PLAN_NOT_DISCOUNTABLE,
           message: `${p}-Plan cannot be discounted.`,
           params: {
             plan: p
@@ -4960,7 +4969,7 @@ var PromoCodesService = class {
     }
     if (input.minimumPlanAmountGross != null && input.minimumPlanAmountGross <= 0) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_MIN_AMOUNT_NOT_POSITIVE,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_MIN_AMOUNT_NOT_POSITIVE,
         message: "The minimum plan gross amount must be positive.",
         params: {
           value: input.minimumPlanAmountGross,
@@ -4972,7 +4981,7 @@ var PromoCodesService = class {
       const lowestApplicableGross = this.lowestApplicablePlanGross(plans);
       if (lowestApplicableGross != null && input.value >= lowestApplicableGross) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_WOULD_PRODUCE_ZERO_INVOICE,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_WOULD_PRODUCE_ZERO_INVOICE,
           message: "For absolute amounts the discount must stay below the lowest applicable plan price, or allowZeroInvoice must be enabled.",
           params: {
             value: input.value,
@@ -4984,7 +4993,7 @@ var PromoCodesService = class {
     const exists = await this.promoRepo.findByCode(code);
     if (exists) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_ALREADY_EXISTS,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_ALREADY_EXISTS,
         message: "The code already exists.",
         params: {
           promoCode: code
@@ -5000,17 +5009,18 @@ var PromoCodesService = class {
     const existing = await this.promoRepo.findById(id);
     if (!existing) {
       throw new import_common34.NotFoundException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
         message: "Code not found",
         params: {
-          promoCodeId: id
+          promoCodeId: id,
+          promoCode: null
         }
       });
     }
     if (input.maxRedemptions != null && existing.maxRedemptions != null) {
       if (input.maxRedemptions < existing.maxRedemptions) {
         throw new import_common34.BadRequestException({
-          code: import_types14.PROMO_ERROR_CODES.PROMO_MAX_REDEMPTIONS_LOWERED,
+          code: import_types15.PROMO_ERROR_CODES.PROMO_MAX_REDEMPTIONS_LOWERED,
           message: "maxRedemptions cannot be lowered.",
           params: {
             current: existing.maxRedemptions,
@@ -5025,7 +5035,7 @@ var PromoCodesService = class {
     const redemptions = await this.redemptionRepo.countByPromoCode(id);
     if (redemptions > 0) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_HAS_REDEMPTIONS,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_HAS_REDEMPTIONS,
         message: "The code already has redemptions \u2014 it cannot be soft-deleted. Pause it instead.",
         params: {
           promoCodeId: id,
@@ -5044,10 +5054,11 @@ var PromoCodesService = class {
     const code = await this.promoRepo.findById(id);
     if (!code || code.deletedAt) {
       throw new import_common34.NotFoundException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
         message: "Code not found",
         params: {
-          promoCodeId: id
+          promoCodeId: id,
+          promoCode: null
         }
       });
     }
@@ -5179,9 +5190,11 @@ var PromoCodesService = class {
     const promo = await this.promoRepo.findByCode(code, tx);
     if (!promo || promo.deletedAt) {
       throw new import_common34.BadRequestException({
-        code: import_types14.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
+        code: import_types15.PROMO_ERROR_CODES.PROMO_CODE_NOT_FOUND,
+        // The lookup runs on the code string, so there is no id to report.
         message: "Code not found",
         params: {
+          promoCodeId: null,
           promoCode: code
         }
       });
@@ -5189,16 +5202,16 @@ var PromoCodesService = class {
     const sub = await this.subscriptionLookup.findById(input.subscriptionId, tx);
     if (!sub) {
       throw new import_common34.NotFoundException({
-        code: import_types14.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: "Subscription not found",
         params: {
-          subscriptionId: input.subscriptionId
+          tenantId: input.tenantId
         }
       });
     }
     if (sub.tenantId !== input.tenantId) {
       throw new import_common34.BadRequestException({
-        code: import_types14.BILLING_ERROR_CODES.SUBSCRIPTION_TENANT_MISMATCH,
+        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_TENANT_MISMATCH,
         message: "Subscription does not belong to the tenant",
         params: {
           subscriptionId: sub.id,
@@ -5331,7 +5344,7 @@ PromoCodesService = _ts_decorate34([
 
 // src/billing/subscription-bundles.service.ts
 var import_common35 = require("@nestjs/common");
-var import_types15 = require("@saasicat/types");
+var import_types16 = require("@saasicat/types");
 function _ts_decorate35(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -5380,7 +5393,7 @@ var SubscriptionBundlesService = class {
     const bundleVersion = await this.bundles.findVersionById(input.bundleVersionId);
     if (!bundleVersion) {
       throw new import_common35.NotFoundException({
-        code: import_types15.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types16.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${input.bundleVersionId}' not found`,
         params: {
           bundleVersionId: input.bundleVersionId
@@ -5389,7 +5402,7 @@ var SubscriptionBundlesService = class {
     }
     if (bundleVersion.publishedAt === null) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_PUBLISHED,
+        code: import_types16.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_PUBLISHED,
         message: `BundleVersion '${input.bundleVersionId}' is not published and cannot be booked.`,
         params: {
           bundleVersionId: input.bundleVersionId
@@ -5398,7 +5411,7 @@ var SubscriptionBundlesService = class {
     }
     if (bundleVersion.supersededAt !== null) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.CATALOG_ERROR_CODES.BUNDLE_VERSION_SUPERSEDED,
+        code: import_types16.CATALOG_ERROR_CODES.BUNDLE_VERSION_SUPERSEDED,
         message: `BundleVersion '${input.bundleVersionId}' has been superseded by a newer version.`,
         params: {
           bundleVersionId: input.bundleVersionId
@@ -5407,7 +5420,7 @@ var SubscriptionBundlesService = class {
     }
     if (this.blockedBundles?.bundleKeys?.includes(bundleVersion.bundleKey)) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.BUNDLE_NOT_SELF_SERVICE,
+        code: import_types16.BILLING_ERROR_CODES.BUNDLE_NOT_SELF_SERVICE,
         message: `Bundle '${bundleVersion.bundleKey}' is only activated via a special contract. Please contact the contract manager.`,
         params: {
           bundleKey: bundleVersion.bundleKey
@@ -5417,7 +5430,7 @@ var SubscriptionBundlesService = class {
     const planIds = bundleVersion.compatibility?.planIds ?? [];
     if (planIds.length > 0 && !planIds.includes(input.currentPlanKey)) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.BUNDLE_INCOMPATIBLE_WITH_PLAN,
+        code: import_types16.BILLING_ERROR_CODES.BUNDLE_INCOMPATIBLE_WITH_PLAN,
         message: `BundleVersion '${input.bundleVersionId}' is not compatible with plan '${input.currentPlanKey}'. Allowed: [${planIds.join(", ")}].`,
         params: {
           bundleVersionId: input.bundleVersionId,
@@ -5429,7 +5442,7 @@ var SubscriptionBundlesService = class {
     const active = await this.repo.listActiveBySubscription(input.subscriptionId);
     if (active.some((b) => b.bundleVersionId === input.bundleVersionId)) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.BUNDLE_ALREADY_SUBSCRIBED,
+        code: import_types16.BILLING_ERROR_CODES.BUNDLE_ALREADY_SUBSCRIBED,
         message: `Subscription '${input.subscriptionId}' has already actively booked this bundle.`,
         params: {
           subscriptionId: input.subscriptionId
@@ -5450,7 +5463,7 @@ var SubscriptionBundlesService = class {
     const existing = await this.repo.findById(input.subscriptionBundleId);
     if (!existing) {
       throw new import_common35.NotFoundException({
-        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
+        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
         message: `SubscriptionBundle '${input.subscriptionBundleId}' not found`,
         params: {
           subscriptionBundleId: input.subscriptionBundleId
@@ -5459,7 +5472,7 @@ var SubscriptionBundlesService = class {
     }
     if (existing.canceledAt !== null) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_ALREADY_CANCELED,
+        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED,
         message: `SubscriptionBundle '${input.subscriptionBundleId}' is already cancelled.`,
         params: {
           subscriptionBundleId: input.subscriptionBundleId
@@ -5485,7 +5498,7 @@ var SubscriptionBundlesService = class {
     const existing = await this.repo.findById(subscriptionBundleId);
     if (!existing) {
       throw new import_common35.NotFoundException({
-        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
+        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
         message: `SubscriptionBundle '${subscriptionBundleId}' not found`,
         params: {
           subscriptionBundleId
@@ -5494,7 +5507,7 @@ var SubscriptionBundlesService = class {
     }
     if (existing.canceledAt === null) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_CANCELED,
+        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_CANCELLED,
         message: `SubscriptionBundle '${subscriptionBundleId}' is not cancelled.`,
         params: {
           subscriptionBundleId
@@ -5503,7 +5516,7 @@ var SubscriptionBundlesService = class {
     }
     if (existing.canceledEffectiveAt !== null && existing.canceledEffectiveAt <= /* @__PURE__ */ new Date()) {
       throw new import_common35.UnprocessableEntityException({
-        code: import_types15.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE,
+        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE,
         message: "Cancellation already in effect \u2014 book the bundle again."
       });
     }
@@ -5611,7 +5624,7 @@ var TenantBillingController = class _TenantBillingController {
     ]);
     if (!sub) {
       throw new import_common36.NotFoundException({
-        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types17.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -5666,7 +5679,7 @@ var TenantBillingController = class _TenantBillingController {
     const blockedTargets = this.blockedPlans?.asTarget ?? [];
     if (blockedTargets.includes(dto.plan)) {
       throw new import_common36.ForbiddenException({
-        code: import_types16.BILLING_ERROR_CODES.PLAN_NOT_SELF_SERVICE,
+        code: import_types17.BILLING_ERROR_CODES.PLAN_NOT_SELF_SERVICE,
         message: `${dto.plan} is not activated via self-service.`,
         params: {
           planKey: dto.plan
@@ -5676,7 +5689,7 @@ var TenantBillingController = class _TenantBillingController {
     const sub = await this.subscriptionUsage.findForTenant(tenantId);
     if (!sub) {
       throw new import_common36.NotFoundException({
-        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types17.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -5686,7 +5699,7 @@ var TenantBillingController = class _TenantBillingController {
     const blockers = await this.planPreview.assertChangeAllowed(tenantId, dto.plan, dto.billingCycle);
     if (blockers.length > 0) {
       throw new import_common36.BadRequestException({
-        code: import_types16.BILLING_ERROR_CODES.PLAN_CHANGE_BLOCKED,
+        code: import_types17.BILLING_ERROR_CODES.PLAN_CHANGE_BLOCKED,
         message: "Plan change is blocked.",
         blockers
       });
@@ -5758,7 +5771,7 @@ var TenantBillingController = class _TenantBillingController {
     const blockedTargets = this.blockedPlans?.asTarget ?? [];
     if (blockedTargets.includes(dto.plan)) {
       throw new import_common36.ForbiddenException({
-        code: import_types16.BILLING_ERROR_CODES.PLAN_NOT_SELF_SERVICE,
+        code: import_types17.BILLING_ERROR_CODES.PLAN_NOT_SELF_SERVICE,
         message: `${dto.plan} is not activated via self-service.`,
         params: {
           planKey: dto.plan
@@ -5768,7 +5781,7 @@ var TenantBillingController = class _TenantBillingController {
     const sub = await this.subscriptionUsage.findForTenant(tenantId);
     if (!sub) {
       throw new import_common36.NotFoundException({
-        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types17.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -5778,7 +5791,7 @@ var TenantBillingController = class _TenantBillingController {
     const blockers = await this.planPreview.assertChangeAllowed(tenantId, dto.plan, dto.billingCycle);
     if (blockers.length > 0) {
       throw new import_common36.BadRequestException({
-        code: import_types16.BILLING_ERROR_CODES.PLAN_CHANGE_BLOCKED,
+        code: import_types17.BILLING_ERROR_CODES.PLAN_CHANGE_BLOCKED,
         message: "Plan change during onboarding is blocked.",
         blockers
       });
@@ -5815,7 +5828,7 @@ var TenantBillingController = class _TenantBillingController {
       } catch (err) {
         const reason = err instanceof Error ? err.message : null;
         throw new import_common36.BadRequestException({
-          code: import_types16.BILLING_ERROR_CODES.ONBOARDING_CREATE_FAILED,
+          code: import_types17.BILLING_ERROR_CODES.ONBOARDING_CREATE_FAILED,
           message: reason ? `Onboarding creation failed: ${reason}` : "Onboarding creation failed",
           params: {
             reason
@@ -5898,7 +5911,7 @@ var TenantBillingController = class _TenantBillingController {
     const sub = await this.subscriptionUsage.findForTenant(tenantId);
     if (!sub) {
       throw new import_common36.NotFoundException({
-        code: import_types16.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+        code: import_types17.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
         message: `No subscription for tenant ${tenantId}`,
         params: {
           tenantId
@@ -5907,7 +5920,7 @@ var TenantBillingController = class _TenantBillingController {
     }
     if (!sub.pendingPlanVersion) {
       throw new import_common36.BadRequestException({
-        code: import_types16.BILLING_ERROR_CODES.NO_PENDING_PLAN_VERSION,
+        code: import_types17.BILLING_ERROR_CODES.NO_PENDING_PLAN_VERSION,
         message: "There is no pending plan version awaiting confirmation."
       });
     }
@@ -5955,7 +5968,7 @@ var TenantBillingController = class _TenantBillingController {
     const tenantId = resolver(req);
     if (!tenantId) {
       throw new import_common36.NotFoundException({
-        code: import_types16.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
+        code: import_types17.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
         message: "No tenant ID found on the request"
       });
     }
@@ -5966,7 +5979,7 @@ var TenantBillingController = class _TenantBillingController {
     const userId = resolver(req);
     if (!userId) {
       throw new import_common36.NotFoundException({
-        code: import_types16.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
+        code: import_types17.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
         message: "No user ID found on the request"
       });
     }
@@ -6337,7 +6350,7 @@ __name(normalizeQuotas, "normalizeQuotas");
 
 // src/billing/subscription-bundle-preview.service.ts
 var import_common39 = require("@nestjs/common");
-var import_types17 = require("@saasicat/types");
+var import_types18 = require("@saasicat/types");
 function _ts_decorate39(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -6377,7 +6390,7 @@ var SubscriptionBundlePreviewService = class {
     const bundleVersion = await this.bundles.findVersionById(input.bundleVersionId);
     if (!bundleVersion) {
       throw new import_common39.NotFoundException({
-        code: import_types17.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types18.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${input.bundleVersionId}' not found`,
         params: {
           bundleVersionId: input.bundleVersionId
@@ -6436,7 +6449,7 @@ var SubscriptionBundlePreviewService = class {
     const existing = await this.subscriptionBundles.findById(input.subscriptionBundleId);
     if (!existing || existing.subscriptionId !== ctx.subscriptionId) {
       throw new import_common39.NotFoundException({
-        code: import_types17.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
+        code: import_types18.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_NOT_FOUND,
         message: `SubscriptionBundle '${input.subscriptionBundleId}' not found`,
         params: {
           subscriptionBundleId: input.subscriptionBundleId
@@ -6446,7 +6459,7 @@ var SubscriptionBundlePreviewService = class {
     const bundleVersion = await this.bundles.findVersionById(existing.bundleVersionId);
     if (!bundleVersion) {
       throw new import_common39.NotFoundException({
-        code: import_types17.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types18.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${existing.bundleVersionId}' not found`,
         params: {
           bundleVersionId: existing.bundleVersionId
@@ -6457,7 +6470,7 @@ var SubscriptionBundlePreviewService = class {
     const warnings = [];
     if (existing.canceledAt !== null) {
       blockers.push({
-        code: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELED",
+        code: import_types18.BILLING_ERROR_CODES.SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED,
         message: "This bundle booking is already cancelled."
       });
     }
@@ -6557,12 +6570,12 @@ var SubscriptionBundlePreviewService = class {
     const entries = await this.catalogEntries.listFeatures({
       projectKey
     });
-    const requiresIndex = (0, import_types17.buildFeatureRequiresIndex)(entries);
+    const requiresIndex = (0, import_types18.buildFeatureRequiresIndex)(entries);
     const covered = /* @__PURE__ */ new Set([
       ...planFeatures,
       ...activeBundleVersions.flatMap((bv) => bv.features ?? [])
     ]);
-    return (0, import_types17.collectUnsatisfiedRequires)(bundleVersion.features ?? [], requiresIndex).filter((key) => !covered.has(key));
+    return (0, import_types18.collectUnsatisfiedRequires)(bundleVersion.features ?? [], requiresIndex).filter((key) => !covered.has(key));
   }
   /** `projectKey` lives on the bundle stem, not on the version. */
   async resolveProjectKey(bundleVersion) {
@@ -6621,7 +6634,7 @@ var import_common41 = require("@nestjs/common");
 
 // src/billing/tenant-subscription-bundles.controller.ts
 var import_common40 = require("@nestjs/common");
-var import_types18 = require("@saasicat/types");
+var import_types19 = require("@saasicat/types");
 
 // src/billing/dto/subscription-bundles.dto.ts
 var import_class_validator5 = require("class-validator");
@@ -6767,7 +6780,7 @@ function buildTenantSubscriptionBundlesController(extraGuards = []) {
       const hasCancel = Boolean(dto.subscriptionBundleId);
       if (hasAdd === hasCancel) {
         throw new import_common40.BadRequestException({
-          code: import_types18.BILLING_ERROR_CODES.BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS,
+          code: import_types19.BILLING_ERROR_CODES.BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS,
           message: "Exactly one of bundleVersionId (add preview) or subscriptionBundleId (cancel preview) must be given."
         });
       }
@@ -6809,7 +6822,7 @@ function buildTenantSubscriptionBundlesController(extraGuards = []) {
     }
     requireSubscriptionPk(sub) {
       if (!sub.id) {
-        throw new import_common40.NotFoundException("SubscriptionUsageRecord without `id` \u2014 the adapter must return the subscription primary key (see SubscriptionUsageRecord.id).");
+        throw new import_common40.NotFoundException(codedError(import_types19.BILLING_ERROR_CODES.SUBSCRIPTION_PK_MISSING));
       }
       return sub.id;
     }
@@ -6817,7 +6830,7 @@ function buildTenantSubscriptionBundlesController(extraGuards = []) {
       const tenantId = this.tenantIdResolver(req);
       if (!tenantId) {
         throw new import_common40.NotFoundException({
-          code: import_types18.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
+          code: import_types19.AUTH_ERROR_CODES.TENANT_CONTEXT_MISSING,
           message: "No tenant ID found on the request"
         });
       }
@@ -6827,7 +6840,7 @@ function buildTenantSubscriptionBundlesController(extraGuards = []) {
       const sub = await this.subscriptionUsage.findForTenant(tenantId);
       if (!sub) {
         throw new import_common40.NotFoundException({
-          code: import_types18.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
+          code: import_types19.BILLING_ERROR_CODES.SUBSCRIPTION_NOT_FOUND,
           message: `No subscription for tenant ${tenantId}`,
           params: {
             tenantId
@@ -7070,7 +7083,7 @@ __export(catalog_exports, {
 
 // src/catalog/bundles.service.ts
 var import_common43 = require("@nestjs/common");
-var import_types19 = require("@saasicat/types");
+var import_types20 = require("@saasicat/types");
 
 // src/discovery/discovery.scanner.ts
 var import_node_crypto2 = require("crypto");
@@ -7594,7 +7607,7 @@ var BundlesService = class _BundlesService {
     const bundle = await this.repo.findById(bundleId);
     if (!bundle) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
         message: `Bundle '${bundleId}' not found`,
         params: {
           bundleId
@@ -7611,7 +7624,7 @@ var BundlesService = class _BundlesService {
     const existing = await this.repo.findByKey(data.projectKey, data.bundleKey);
     if (existing) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_ALREADY_EXISTS,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_ALREADY_EXISTS,
         message: `Bundle '${data.bundleKey}' already exists in project '${data.projectKey}'`,
         params: {
           bundleKey: data.bundleKey,
@@ -7625,7 +7638,7 @@ var BundlesService = class _BundlesService {
     const existing = await this.repo.findById(bundleId);
     if (!existing) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
         message: `Bundle '${bundleId}' not found`,
         params: {
           bundleId
@@ -7638,7 +7651,7 @@ var BundlesService = class _BundlesService {
     const existing = await this.repo.findById(bundleId);
     if (!existing) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
         message: `Bundle '${bundleId}' not found`,
         params: {
           bundleId
@@ -7657,16 +7670,16 @@ var BundlesService = class _BundlesService {
     const existing = await this.repo.findVersionById(versionId);
     if (!existing) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
     if (existing.publishedAt !== null) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_ALREADY_PUBLISHED,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_ALREADY_PUBLISHED,
         message: `BundleVersion '${versionId}' is already published and cannot be discarded.`,
         params: {
           versionId
@@ -7675,7 +7688,7 @@ var BundlesService = class _BundlesService {
     }
     if (typeof this.repo.deleteDraft !== "function") {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED,
         message: "Discard is not implemented in the current repository. Implement BundleRepository.deleteDraft."
       });
     }
@@ -7691,10 +7704,10 @@ var BundlesService = class _BundlesService {
     const version = await this.repo.findVersionById(versionId);
     if (!version) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -7739,7 +7752,7 @@ var BundlesService = class _BundlesService {
     const bundle = await this.repo.findById(data.bundleId);
     if (!bundle) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_NOT_FOUND,
         message: `Bundle '${data.bundleId}' not found`,
         params: {
           bundleId: data.bundleId
@@ -7749,7 +7762,7 @@ var BundlesService = class _BundlesService {
     const existingDraft = await this.repo.findCurrentDraft(data.bundleId);
     if (existingDraft) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_DRAFT_ALREADY_EXISTS,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_DRAFT_ALREADY_EXISTS,
         message: `Bundle '${bundle.bundleKey}' already has a draft version v${existingDraft.version}; publish or discard it first`,
         params: {
           bundleKey: bundle.bundleKey,
@@ -7788,20 +7801,20 @@ var BundlesService = class _BundlesService {
     const existing = await this.repo.findVersionById(versionId);
     if (!existing) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
     const [annotated] = await this.annotateEditability([
       existing
     ]);
-    const { editable } = (0, import_types19.isVersionEditable)(annotated);
+    const { editable } = (0, import_types20.isVersionEditable)(annotated);
     if (!editable) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_EDITABLE,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_EDITABLE,
         message: `BundleVersion '${versionId}' is not editable. Only drafts and published versions are editable that are latest-in-chain, bind no subscription yet, and whose validFrom lies in the future.`,
         params: {
           versionId
@@ -7827,7 +7840,7 @@ var BundlesService = class _BundlesService {
    * Publishes a draft version atomically. Steps:
    * 1. Strict check on the draft definition (warn-only or blocking)
    * 2. Enforce validFrom requirement + ordering against the predecessor
-   *    (SPEC_V2 §4.2 + §11.1 M6 Pack 2c, analogous to PlanVersion)
+   *    (analogous to PlanVersion)
    * 3. Compute the diff against the predecessor version (latest live) →
    *    `publishedChanges` + `nonRegressive` via `classifyBundleVersionDiff`
    * 4. Call Repository.publishDraft with the diff result + validity dates
@@ -7837,16 +7850,16 @@ var BundlesService = class _BundlesService {
     const draft = await this.repo.findVersionById(versionId);
     if (!draft) {
       throw new import_common43.NotFoundException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
     if (draft.publishedAt !== null) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_ALREADY_PUBLISHED,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_ALREADY_PUBLISHED,
         message: `BundleVersion '${versionId}' is already published`,
         params: {
           versionId
@@ -7864,7 +7877,7 @@ var BundlesService = class _BundlesService {
       const explicitZero = /* @__PURE__ */ __name((v) => v !== null && v !== void 0 && Number.parseFloat(String(v)) <= 0, "explicitZero");
       if (explicitZero(draft.monthlyNet) || explicitZero(draft.yearlyNet)) {
         throw new import_common43.UnprocessableEntityException({
-          code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_ZERO_PRICE,
+          code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_ZERO_PRICE,
           message: "A bundle version cannot be published with an explicit price of 0.00 (guard against seed placeholders). For free bundles leave it null, or set allowZeroPrice.",
           monthlyNet: draft.monthlyNet,
           yearlyNet: draft.yearlyNet
@@ -7875,14 +7888,14 @@ var BundlesService = class _BundlesService {
     const validFromInput = publishMeta.validFrom ?? draft.validFrom;
     if (!validFromInput) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_REQUIRED,
-        message: "validFrom must be set when publishing (on the draft or the publish call). SPEC_V2 \xA74.2."
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_REQUIRED,
+        message: "validFrom must be set when publishing (on the draft or the publish call).."
       });
     }
     const validFrom = new Date(validFromInput);
     if (Number.isNaN(validFrom.getTime())) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_INVALID,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_INVALID,
         message: `validFrom '${validFromInput}' is not a valid date`,
         params: {
           validFrom: validFromInput
@@ -7893,7 +7906,7 @@ var BundlesService = class _BundlesService {
       const prevFrom = new Date(previous.validFrom);
       if (validFrom <= prevFrom) {
         throw new import_common43.UnprocessableEntityException({
-          code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
+          code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
           message: `validFrom (${validFrom.toISOString()}) must be strictly after the validFrom of the previous version (${previous.validFrom}).`,
           params: {
             validFrom: validFrom.toISOString(),
@@ -7907,7 +7920,7 @@ var BundlesService = class _BundlesService {
         const requiredStart = new Date(prevUntil.getTime() + dayMs);
         if (validFrom.getTime() !== requiredStart.getTime()) {
           throw new import_common43.UnprocessableEntityException({
-            code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_GAPLESS,
+            code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_GAPLESS,
             message: `The predecessor has validUntil=${previous.validUntil.slice(0, 10)} \u2014 the successor must start seamlessly on the next day (${requiredStart.toISOString().slice(0, 10)}). Received: ${validFrom.toISOString().slice(0, 10)}.`,
             params: {
               received: validFrom.toISOString().slice(0, 10)
@@ -7922,7 +7935,7 @@ var BundlesService = class _BundlesService {
     const validUntil = validUntilInput ? new Date(validUntilInput) : null;
     if (validUntil && Number.isNaN(validUntil.getTime())) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_INVALID,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_INVALID,
         message: `validUntil '${validUntilInput}' is not a valid date`,
         params: {
           validUntil: validUntilInput
@@ -7931,7 +7944,7 @@ var BundlesService = class _BundlesService {
     }
     if (validUntil && validUntil <= validFrom) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_BEFORE_FROM,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_BEFORE_FROM,
         message: `validUntil (${validUntil.toISOString()}) must be strictly after validFrom (${validFrom.toISOString()}).`,
         params: {
           validUntil: validUntil.toISOString(),
@@ -7939,7 +7952,7 @@ var BundlesService = class _BundlesService {
         }
       });
     }
-    const diff = previous ? (0, import_types4.classifyBundleVersionDiff)({
+    const diff = previous ? (0, import_types5.classifyBundleVersionDiff)({
       features: previous.features,
       quotas: previous.quotas,
       monthlyNet: previous.monthlyNet,
@@ -7955,7 +7968,7 @@ var BundlesService = class _BundlesService {
     };
     if (!diff.nonRegressive && !publishMeta.forceRegressive) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_REGRESSION,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_REGRESSION,
         message: "This bundle version is regressive (feature removed / quota lowered / price raised). Publishing requires an explicit `forceRegressive: true` (UI confirmation dialog with MFA).",
         changes: diff.changes
       });
@@ -7995,7 +8008,7 @@ var BundlesService = class _BundlesService {
     const hasHardBlockingWarning = blocking.some((w) => w.code === "BUNDLE_PLAN_KEY_UNKNOWN");
     if (this.mode === "blocking" || hasHardBlockingWarning) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.STRICT_MODE_VIOLATIONS,
+        code: import_types20.CATALOG_ERROR_CODES.STRICT_MODE_VIOLATIONS,
         message: "The strict-mode check found drift against the discovery snapshot.",
         warnings
       });
@@ -8009,7 +8022,7 @@ var BundlesService = class _BundlesService {
     if (!validFromInput) {
       if (existing.publishedAt !== null) {
         throw new import_common43.UnprocessableEntityException({
-          code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_REQUIRED,
+          code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_REQUIRED,
           message: "Published bundle versions must keep a validFrom. Set a new future date, or edit the draft before publishing."
         });
       }
@@ -8018,7 +8031,7 @@ var BundlesService = class _BundlesService {
     const validFrom = this.parseRequiredBundleDate(validFromInput, "validFrom", "BUNDLE_VERSION_VALID_FROM_INVALID");
     if (existing.publishedAt !== null && validFrom.getTime() <= Date.now()) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_FUTURE,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_FUTURE,
         message: `validFrom (${validFrom.toISOString()}) must, for a published-but-future bundle version, still lie in the future.`,
         params: {
           validFrom: validFrom.toISOString()
@@ -8027,7 +8040,7 @@ var BundlesService = class _BundlesService {
     }
     if (validUntil && validUntil <= validFrom) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_BEFORE_FROM,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_UNTIL_BEFORE_FROM,
         message: `validUntil (${validUntil.toISOString()}) must be strictly after validFrom (${validFrom.toISOString()}).`,
         params: {
           validUntil: validUntil.toISOString(),
@@ -8041,7 +8054,7 @@ var BundlesService = class _BundlesService {
     if (Number.isNaN(previousValidFrom.getTime())) return;
     if (validFrom <= previousValidFrom) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
         message: `validFrom (${validFrom.toISOString()}) must be strictly after the validFrom of the previous version (${previous.validFrom}).`,
         params: {
           validFrom: validFrom.toISOString(),
@@ -8056,7 +8069,7 @@ var BundlesService = class _BundlesService {
     const requiredStart = new Date(previousValidUntil.getTime() + dayMs);
     if (validFrom.getTime() !== requiredStart.getTime()) {
       throw new import_common43.UnprocessableEntityException({
-        code: import_types19.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_GAPLESS,
+        code: import_types20.CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_NOT_GAPLESS,
         message: `The predecessor has validUntil=${previous.validUntil.slice(0, 10)} \u2014 the successor must start seamlessly on the next day (${requiredStart.toISOString().slice(0, 10)}). Received: ${validFrom.toISOString().slice(0, 10)}.`,
         params: {
           received: validFrom.toISOString().slice(0, 10)
@@ -8080,9 +8093,10 @@ var BundlesService = class _BundlesService {
       throw new import_common43.UnprocessableEntityException({
         code,
         message: `${field} '${input}' is not a valid date`,
+        // Keyed by the field name so these params match the publish
+        // path, where the same codes carry `validFrom` / `validUntil`.
         params: {
-          field,
-          value: input
+          [field]: input
         }
       });
     }
@@ -8118,7 +8132,7 @@ BundlesService = _ts_decorate44([
 
 // src/catalog/marketing-projections.service.ts
 var import_common44 = require("@nestjs/common");
-var import_types20 = require("@saasicat/types");
+var import_types21 = require("@saasicat/types");
 function _ts_decorate45(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -8151,7 +8165,7 @@ var MarketingProjectionsService = class {
     const row = await this.repo.findById(id);
     if (!row) {
       throw new import_common44.NotFoundException({
-        code: import_types20.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
+        code: import_types21.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
         message: `MarketingProjection '${id}' not found`,
         params: {
           projectionId: id
@@ -8165,7 +8179,7 @@ var MarketingProjectionsService = class {
     const existing = await this.repo.findByTarget(data.targetType, data.targetVersionId, locale);
     if (existing) {
       throw new import_common44.ConflictException({
-        code: import_types20.CATALOG_ERROR_CODES.MARKETING_PROJECTION_ALREADY_EXISTS,
+        code: import_types21.CATALOG_ERROR_CODES.MARKETING_PROJECTION_ALREADY_EXISTS,
         message: `Marketing projection for ${data.targetType}/${data.targetVersionId}/${locale} already exists \u2014 use PATCH to edit it`,
         params: {
           targetType: data.targetType,
@@ -8183,7 +8197,7 @@ var MarketingProjectionsService = class {
     const existing = await this.repo.findById(id);
     if (!existing) {
       throw new import_common44.NotFoundException({
-        code: import_types20.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
+        code: import_types21.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
         message: `MarketingProjection '${id}' not found`,
         params: {
           projectionId: id
@@ -8196,7 +8210,7 @@ var MarketingProjectionsService = class {
     const existing = await this.repo.findById(id);
     if (!existing) {
       throw new import_common44.NotFoundException({
-        code: import_types20.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
+        code: import_types21.CATALOG_ERROR_CODES.MARKETING_PROJECTION_NOT_FOUND,
         message: `MarketingProjection '${id}' not found`,
         params: {
           projectionId: id
@@ -8217,7 +8231,7 @@ MarketingProjectionsService = _ts_decorate45([
 
 // src/catalog/catalog-entries.service.ts
 var import_common45 = require("@nestjs/common");
-var import_types21 = require("@saasicat/types");
+var import_types22 = require("@saasicat/types");
 
 // src/catalog/approval-signature.ts
 function featureApprovalSignature(featureKey, snapshot) {
@@ -8368,7 +8382,7 @@ var CatalogEntriesService = class _CatalogEntriesService {
     const existing = await this.repo.findFeature(projectKey, featureKey);
     if (!existing) {
       throw new import_common45.NotFoundException({
-        code: import_types21.CATALOG_ERROR_CODES.FEATURE_NOT_FOUND,
+        code: import_types22.CATALOG_ERROR_CODES.FEATURE_NOT_FOUND,
         message: `Feature '${featureKey}' not found in project '${projectKey}'`,
         params: {
           featureKey,
@@ -8383,7 +8397,7 @@ var CatalogEntriesService = class _CatalogEntriesService {
     const existing = await this.repo.findQuota(projectKey, quotaKey);
     if (!existing) {
       throw new import_common45.NotFoundException({
-        code: import_types21.CATALOG_ERROR_CODES.QUOTA_NOT_FOUND,
+        code: import_types22.CATALOG_ERROR_CODES.QUOTA_NOT_FOUND,
         message: `Quota '${quotaKey}' not found in project '${projectKey}'`,
         params: {
           quotaKey,
@@ -8395,7 +8409,7 @@ var CatalogEntriesService = class _CatalogEntriesService {
       const discovered = snapshot.quotas.find((q) => q.quotaKey === quotaKey);
       if (!discovered) {
         throw new import_common45.UnprocessableEntityException({
-          code: import_types21.CATALOG_ERROR_CODES.QUOTA_NOT_IN_DISCOVERY_SNAPSHOT,
+          code: import_types22.CATALOG_ERROR_CODES.QUOTA_NOT_IN_DISCOVERY_SNAPSHOT,
           message: `Quota '${quotaKey}' is not in the discovery snapshot \u2014 a quota that is not declared in code cannot be approved`,
           params: {
             quotaKey
@@ -8408,7 +8422,7 @@ var CatalogEntriesService = class _CatalogEntriesService {
   resolveReviewUpdate(existing, target, reviewedBy, signatureOf) {
     if (!REVIEW_TRANSITIONS[existing.discoveryStatus].includes(target)) {
       throw new import_common45.UnprocessableEntityException({
-        code: import_types21.CATALOG_ERROR_CODES.DISCOVERY_STATUS_TRANSITION_INVALID,
+        code: import_types22.CATALOG_ERROR_CODES.DISCOVERY_STATUS_TRANSITION_INVALID,
         message: `Transition '${existing.discoveryStatus}' \u2192 '${target}' is not allowed`,
         params: {
           from: existing.discoveryStatus,
@@ -8420,7 +8434,7 @@ var CatalogEntriesService = class _CatalogEntriesService {
       const snapshot = resolveDiscoverySnapshot(this.snapshot, this.scanner);
       if (!snapshot) {
         throw new import_common45.UnprocessableEntityException({
-          code: import_types21.CATALOG_ERROR_CODES.DISCOVERY_NOT_INITIALIZED,
+          code: import_types22.CATALOG_ERROR_CODES.DISCOVERY_NOT_INITIALIZED,
           message: "Approval requires a discovery snapshot \u2014 discovery is not initialised (#25)"
         });
       }
@@ -9122,7 +9136,7 @@ __name(buildCatalogEntriesController, "buildCatalogEntriesController");
 
 // src/catalog/promotions.service.ts
 var import_common48 = require("@nestjs/common");
-var import_types22 = require("@saasicat/types");
+var import_types23 = require("@saasicat/types");
 function _ts_decorate50(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -9157,7 +9171,7 @@ var PromotionsService = class {
     const row = await this.repo.findById(id);
     if (!row) {
       throw new import_common48.NotFoundException({
-        code: import_types22.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
+        code: import_types23.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
         message: `Promotion '${id}' not found`,
         params: {
           promotionId: id
@@ -9173,7 +9187,7 @@ var PromotionsService = class {
     const existing = await this.repo.findById(id);
     if (!existing) {
       throw new import_common48.NotFoundException({
-        code: import_types22.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
+        code: import_types23.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
         message: `Promotion '${id}' not found`,
         params: {
           promotionId: id
@@ -9186,7 +9200,7 @@ var PromotionsService = class {
     const existing = await this.repo.findById(id);
     if (!existing) {
       throw new import_common48.NotFoundException({
-        code: import_types22.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
+        code: import_types23.CATALOG_ERROR_CODES.PROMOTION_NOT_FOUND,
         message: `Promotion '${id}' not found`,
         params: {
           promotionId: id
@@ -9745,7 +9759,7 @@ __name(buildMarketingSettingsController, "buildMarketingSettingsController");
 
 // src/catalog/public-marketing-catalog.service.ts
 var import_common52 = require("@nestjs/common");
-var import_types23 = require("@saasicat/types");
+var import_types24 = require("@saasicat/types");
 function _ts_decorate56(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -9848,7 +9862,7 @@ var PublicMarketingCatalogService = class {
       });
     }
     out.sort((a, b) => b.priority - a.priority);
-    const requiresIndex = (0, import_types23.buildFeatureRequiresIndex)([
+    const requiresIndex = (0, import_types24.buildFeatureRequiresIndex)([
       ...labelMeta.features
     ].map(([featureKey, meta]) => ({
       featureKey,
@@ -9902,7 +9916,7 @@ var PublicMarketingCatalogService = class {
     const features = [
       ...bv.features ?? []
     ];
-    const requiresFeatures = (0, import_types23.collectUnsatisfiedRequires)(features, requiresIndex);
+    const requiresFeatures = (0, import_types24.collectUnsatisfiedRequires)(features, requiresIndex);
     return {
       bundleKey: bv.bundleKey,
       label: marketing?.displayLabel || bv.label,
@@ -10046,12 +10060,12 @@ var PublicMarketingCatalogService = class {
     };
   }
   resolvePromo(promotions, targetKey, targetType, locale, monthlyNet, yearlyNet, asOf) {
-    const monthlyPromo = (0, import_types23.pickActivePromo)(promotions, targetKey, locale, "monthly", asOf, targetType);
-    const yearlyPromo = (0, import_types23.pickActivePromo)(promotions, targetKey, locale, "yearly", asOf, targetType);
+    const monthlyPromo = (0, import_types24.pickActivePromo)(promotions, targetKey, locale, "monthly", asOf, targetType);
+    const yearlyPromo = (0, import_types24.pickActivePromo)(promotions, targetKey, locale, "yearly", asOf, targetType);
     const promo = monthlyPromo ?? yearlyPromo;
     if (!promo) return null;
-    const monthlyResult = (0, import_types23.applyPromo)(monthlyPromo, monthlyNet);
-    const yearlyResult = (0, import_types23.applyPromo)(yearlyPromo, yearlyNet);
+    const monthlyResult = (0, import_types24.applyPromo)(monthlyPromo, monthlyNet);
+    const yearlyResult = (0, import_types24.applyPromo)(yearlyPromo, yearlyNet);
     const i18n = promo.i18n?.[locale] ?? promo.i18n?.[DEFAULT_LOCALE] ?? {};
     return {
       type: promo.type,
@@ -10111,7 +10125,7 @@ function buildPublicMarketingCatalogController(guards, projectKey, currency, vat
       this.service = service;
     }
     /**
-     * `?lang=de|tr|en` — alias `locale` accepted (SPEC_V2 §9).
+     * `?lang=de|tr|en` — alias `locale` accepted.
      * `?asOf=YYYY-MM-DD` — preview of a future or past catalog variant.
      *   Default = today. Returns the PlanVersion whose `validFrom`/`validUntil`
      *   span `asOf` inclusively by day (the validUntil day still counts,
@@ -10158,7 +10172,7 @@ __name(parseAsOf, "parseAsOf");
 
 // src/catalog/plans.service.ts
 var import_common54 = require("@nestjs/common");
-var import_types24 = require("@saasicat/types");
+var import_types25 = require("@saasicat/types");
 function _ts_decorate58(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -10207,7 +10221,7 @@ var PlansService = class {
     const plan = await this.repo.findById(planId);
     if (!plan) {
       throw new import_common54.NotFoundException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${planId}' not found`,
         params: {
           planId
@@ -10220,7 +10234,7 @@ var PlansService = class {
     const existing = await this.repo.findByKey(data.projectKey, data.planKey);
     if (existing) {
       throw new import_common54.UnprocessableEntityException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_ALREADY_EXISTS,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_ALREADY_EXISTS,
         message: `Plan '${data.planKey}' already exists in project '${data.projectKey}'`,
         params: {
           planKey: data.planKey,
@@ -10234,7 +10248,7 @@ var PlansService = class {
     const existing = await this.repo.findById(planId);
     if (!existing) {
       throw new import_common54.NotFoundException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${planId}' not found`,
         params: {
           planId
@@ -10247,7 +10261,7 @@ var PlansService = class {
     const existing = await this.repo.findById(planId);
     if (!existing) {
       throw new import_common54.NotFoundException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${planId}' not found`,
         params: {
           planId
@@ -10272,7 +10286,7 @@ var PlansService = class {
     const existing = await this.repo.findById(planId);
     if (!existing) {
       throw new import_common54.NotFoundException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${planId}' not found`,
         params: {
           planId
@@ -10283,7 +10297,7 @@ var PlansService = class {
     await this.assertNoDrafts(existing.planKey);
     if (typeof this.repo.hardDelete !== "function") {
       throw new import_common54.UnprocessableEntityException({
-        code: import_types24.CATALOG_ERROR_CODES.PLAN_HARD_DELETE_NOT_IMPLEMENTED,
+        code: import_types25.CATALOG_ERROR_CODES.PLAN_HARD_DELETE_NOT_IMPLEMENTED,
         message: "Hard delete is not implemented in the current repository. Implement PlanRepository.hardDelete."
       });
     }
@@ -10304,7 +10318,7 @@ var PlansService = class {
     const live = published.filter((v) => v.supersededAt === null).length;
     const superseded = published.length - live;
     throw new import_common54.UnprocessableEntityException({
-      code: import_types24.CATALOG_ERROR_CODES.PLAN_HAS_PUBLISHED_VERSIONS,
+      code: import_types25.CATALOG_ERROR_CODES.PLAN_HAS_PUBLISHED_VERSIONS,
       message: `Plan '${planKey}' cannot be ${op === "hard-delete" ? "deleted" : "archived"} \u2014 it has ${published.length} published version(s) (${live} live, ${superseded} superseded). Existing subscriptions reference those versions (contract protection P1), so the plan record must be preserved.`,
       params: {
         planKey,
@@ -10321,7 +10335,7 @@ var PlansService = class {
     const drafts = versions.filter((v) => v.publishedAt === null);
     if (drafts.length === 0) return;
     throw new import_common54.UnprocessableEntityException({
-      code: import_types24.CATALOG_ERROR_CODES.PLAN_HAS_DRAFTS,
+      code: import_types25.CATALOG_ERROR_CODES.PLAN_HAS_DRAFTS,
       message: `Plan '${planKey}' still has ${drafts.length} open draft version(s). Discard them first (DELETE /admin/catalog/plan-versions/:id) or publish them.`,
       params: {
         planKey
@@ -10344,7 +10358,7 @@ PlansService = _ts_decorate58([
 
 // src/catalog/plan-versions.service.ts
 var import_common55 = require("@nestjs/common");
-var import_types25 = require("@saasicat/types");
+var import_types26 = require("@saasicat/types");
 function _ts_decorate59(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -10414,7 +10428,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const existing = await this.repo.findVersionById(versionId);
     if (!existing) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
         message: `PlanVersion '${versionId}' not found`,
         params: {
           versionId
@@ -10423,7 +10437,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.publishedAt !== null) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_ALREADY_PUBLISHED,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_ALREADY_PUBLISHED,
         message: `PlanVersion '${versionId}' is already published and cannot be discarded.`,
         params: {
           versionId
@@ -10432,7 +10446,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (typeof this.repo.deletePlanVersionDraft !== "function") {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_DISCARD_NOT_IMPLEMENTED,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_DISCARD_NOT_IMPLEMENTED,
         message: "Discard is not implemented in the current repository. Implement PlanRepository.deletePlanVersionDraft."
       });
     }
@@ -10447,7 +10461,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const plan = await this.repo.findById(planUuid);
     if (!plan) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${planUuid}' not found`,
         params: {
           planId: planUuid
@@ -10461,7 +10475,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const version = await this.repo.findVersionById(versionId);
     if (!version) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
         message: `PlanVersion '${versionId}' not found`,
         params: {
           versionId
@@ -10505,7 +10519,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const plan = await this.repo.findById(data.planId);
     if (!plan) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_NOT_FOUND,
         message: `Plan '${data.planId}' not found`,
         params: {
           planId: data.planId
@@ -10516,7 +10530,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const existingDraft = await this.repo.findCurrentDraft(planKey);
     if (existingDraft) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_DRAFT_ALREADY_EXISTS,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_DRAFT_ALREADY_EXISTS,
         message: `Plan '${planKey}' already has a draft version v${existingDraft.version}; publish or discard it first`,
         params: {
           planKey,
@@ -10548,7 +10562,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const existing = await this.repo.findVersionById(versionId);
     if (!existing) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
         message: `PlanVersion '${versionId}' not found`,
         params: {
           versionId
@@ -10558,10 +10572,10 @@ var PlanVersionsService = class _PlanVersionsService {
     const [annotated] = await this.annotateEditability([
       existing
     ]);
-    const { editable } = (0, import_types25.isVersionEditable)(annotated);
+    const { editable } = (0, import_types26.isVersionEditable)(annotated);
     if (!editable) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_EDITABLE,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_EDITABLE,
         message: `PlanVersion '${versionId}' is not editable. Only drafts and published versions are editable that are latest-in-chain, bind no subscription yet, and whose validFrom lies in the future.`,
         params: {
           versionId
@@ -10584,7 +10598,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const draft = await this.repo.findVersionById(versionId);
     if (!draft) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
         message: `PlanVersion '${versionId}' not found`,
         params: {
           versionId
@@ -10593,7 +10607,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (draft.publishedAt !== null) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_ALREADY_PUBLISHED,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_ALREADY_PUBLISHED,
         message: `PlanVersion '${versionId}' is already published`,
         params: {
           versionId
@@ -10610,7 +10624,7 @@ var PlanVersionsService = class _PlanVersionsService {
       const yearly = Number.parseFloat(String(draft.yearlyNet ?? "0"));
       if (monthly <= 0 || yearly <= 0) {
         throw new import_common55.UnprocessableEntityException({
-          code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_ZERO_PRICE,
+          code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_ZERO_PRICE,
           message: "A plan version cannot be published with a price of 0.00 (guard against seed placeholder). For deliberately free special contracts, set allowZeroPrice.",
           monthlyNet: String(draft.monthlyNet),
           yearlyNet: String(draft.yearlyNet)
@@ -10621,14 +10635,14 @@ var PlanVersionsService = class _PlanVersionsService {
     const validFromInput = publishMeta.validFrom ?? draft.validFrom;
     if (!validFromInput) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_REQUIRED,
-        message: "validFrom must be set when publishing (on the draft or the publish call). SPEC_V2 \xA74.2."
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_REQUIRED,
+        message: "validFrom must be set when publishing (on the draft or the publish call).."
       });
     }
     const validFrom = new Date(validFromInput);
     if (Number.isNaN(validFrom.getTime())) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_INVALID,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_INVALID,
         message: `validFrom '${validFromInput}' is not a valid date`,
         params: {
           validFrom: validFromInput
@@ -10639,7 +10653,7 @@ var PlanVersionsService = class _PlanVersionsService {
       const prevFrom = new Date(previous.validFrom);
       if (validFrom <= prevFrom) {
         throw new import_common55.UnprocessableEntityException({
-          code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
+          code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_NOT_AFTER_PREVIOUS,
           message: `validFrom (${validFrom.toISOString()}) must be strictly after the validFrom of the previous version (${previous.validFrom}).`,
           params: {
             validFrom: validFrom.toISOString(),
@@ -10653,7 +10667,7 @@ var PlanVersionsService = class _PlanVersionsService {
         const requiredStart = new Date(prevUntil.getTime() + dayMs);
         if (validFrom.getTime() !== requiredStart.getTime()) {
           throw new import_common55.UnprocessableEntityException({
-            code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_NOT_GAPLESS,
+            code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_FROM_NOT_GAPLESS,
             message: `The predecessor has validUntil=${previous.validUntil.slice(0, 10)} \u2014 the successor must start seamlessly on the next day (${requiredStart.toISOString().slice(0, 10)}). Received: ${validFrom.toISOString().slice(0, 10)}.`,
             params: {
               received: validFrom.toISOString().slice(0, 10)
@@ -10668,7 +10682,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const validUntil = validUntilInput ? new Date(validUntilInput) : null;
     if (validUntil && Number.isNaN(validUntil.getTime())) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_UNTIL_INVALID,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_UNTIL_INVALID,
         message: `validUntil '${validUntilInput}' is not a valid date`,
         params: {
           validUntil: validUntilInput
@@ -10677,7 +10691,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (validUntil && validUntil <= validFrom) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_UNTIL_BEFORE_FROM,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_VALID_UNTIL_BEFORE_FROM,
         message: `validUntil (${validUntil.toISOString()}) must be strictly after validFrom (${validFrom.toISOString()}).`,
         params: {
           validUntil: validUntil.toISOString(),
@@ -10693,13 +10707,13 @@ var PlanVersionsService = class _PlanVersionsService {
       monthlyNet: v.monthlyNet,
       yearlyNet: v.yearlyNet
     }), "fieldsFor");
-    const diff = previous ? (0, import_types4.classifyPlanDiff)(fieldsFor(previous), fieldsFor(draft)) : {
+    const diff = previous ? (0, import_types5.classifyPlanDiff)(fieldsFor(previous), fieldsFor(draft)) : {
       changes: [],
       nonRegressive: true
     };
     if (!diff.nonRegressive && !publishMeta.forceRegressive) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_REGRESSION,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_REGRESSION,
         message: "This plan version is regressive (feature removed / quota lowered / price raised). Publishing requires an explicit `forceRegressive: true` (UI confirmation dialog with MFA).",
         changes: diff.changes
       });
@@ -10736,7 +10750,7 @@ var PlanVersionsService = class _PlanVersionsService {
     const existing = await this.repo.findVersionById(versionId);
     if (!existing) {
       throw new import_common55.NotFoundException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_FOUND,
         message: `PlanVersion '${versionId}' not found`,
         params: {
           versionId
@@ -10745,7 +10759,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.publishedAt === null) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_LIVE,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_PUBLISHED,
         message: `PlanVersion '${versionId}' is not published and cannot be terminated.`,
         params: {
           versionId
@@ -10754,7 +10768,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.supersededAt !== null) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_VERSION_NOT_LIVE,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_VERSION_SUPERSEDED,
         message: `PlanVersion '${versionId}' has already been superseded by a newer version (supersededAt) and cannot be terminated.`,
         params: {
           versionId
@@ -10763,13 +10777,13 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (Number.isNaN(endsAt.getTime())) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_TERMINATE_INVALID_DATE,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_TERMINATE_INVALID_DATE,
         message: "endsAt is not a valid date."
       });
     }
     if (endsAt.getTime() <= Date.now()) {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_TERMINATE_DATE_NOT_FUTURE,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_TERMINATE_DATE_NOT_FUTURE,
         message: `endsAt (${endsAt.toISOString()}) must lie strictly in the future.`,
         params: {
           endsAt: endsAt.toISOString()
@@ -10778,7 +10792,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (typeof this.repo.terminate !== "function") {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.PLAN_TERMINATE_NOT_IMPLEMENTED,
+        code: import_types26.CATALOG_ERROR_CODES.PLAN_TERMINATE_NOT_IMPLEMENTED,
         message: "Terminate is not implemented in the current repository. Implement PlanRepository.terminate."
       });
     }
@@ -10797,7 +10811,7 @@ var PlanVersionsService = class _PlanVersionsService {
     if (blockingStrictModeWarnings(warnings).length === 0) return;
     if (this.mode === "blocking") {
       throw new import_common55.UnprocessableEntityException({
-        code: import_types25.CATALOG_ERROR_CODES.STRICT_MODE_VIOLATIONS,
+        code: import_types26.CATALOG_ERROR_CODES.STRICT_MODE_VIOLATIONS,
         message: "The strict-mode check found drift against the discovery snapshot.",
         warnings
       });
@@ -11139,7 +11153,7 @@ var PublishBundleVersionDto = class {
   allowZeroPrice;
   /**
    * Required on publish if the draft carries no `validFrom`
-   * (SPEC_V2 §4.2 + §11.1 M6 Pack 2c, analogous to PublishPlanVersionDto).
+   * (analogous to PublishPlanVersionDto).
    * Service strictly checks > `validFrom` of the predecessor version.
    */
   validFrom;
@@ -11925,7 +11939,7 @@ var CreatePlanVersionDraftDto = class {
   marketed;
   changeNote;
   baseVersionId;
-  /** Optional in the draft (required at publish). ISO date string. SPEC_V2 §4.2. */
+  /** Optional in the draft (required at publish). ISO date string.. */
   validFrom;
   /** Optional; null = unlimited. ISO date string. */
   validUntil;
@@ -12100,7 +12114,7 @@ var PublishPlanVersionDto = class {
   allowZeroPrice;
   /**
    * Required at publish (on the DTO or draft). The service strictly checks
-   * `validFrom > predecessor.validFrom`. SPEC_V2 §4.2.
+   * `validFrom > predecessor.validFrom`..
    */
   validFrom;
   validUntil;
@@ -12744,7 +12758,7 @@ __export(checkout_offer_exports, {
 
 // src/checkout-offer/checkout-offer.service.ts
 var import_common60 = require("@nestjs/common");
-var import_types26 = require("@saasicat/types");
+var import_types27 = require("@saasicat/types");
 
 // src/checkout-offer/tokens.ts
 var CHECKOUT_OFFER_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/CheckoutOfferRepository");
@@ -12788,7 +12802,7 @@ var CheckoutOfferService = class {
     const row = await this.repo.findById(id);
     if (!row) {
       throw new import_common60.NotFoundException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_NOT_FOUND,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_NOT_FOUND,
         message: `CheckoutOffer '${id}' not found`,
         params: {
           offerId: id
@@ -12847,18 +12861,18 @@ var CheckoutOfferService = class {
     const entries = await this.catalogEntries.listFeatures({
       projectKey: input.projectKey
     });
-    const requiresIndex = (0, import_types26.buildFeatureRequiresIndex)(entries);
+    const requiresIndex = (0, import_types27.buildFeatureRequiresIndex)(entries);
     if (requiresIndex.size === 0) return;
     const selected = /* @__PURE__ */ new Set([
       ...await this.resolvePlanFeatures(input),
       ...await this.resolveBundleFeatures(input)
     ]);
-    const missingRequires = (0, import_types26.collectUnsatisfiedRequires)([
+    const missingRequires = (0, import_types27.collectUnsatisfiedRequires)([
       ...selected
     ], requiresIndex);
     if (missingRequires.length > 0) {
       throw new import_common60.UnprocessableEntityException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED,
         message: `The selected plan does not cover all feature dependencies: [${missingRequires.join(", ")}] are missing from the plan + selected bundles.`,
         missingRequires
       });
@@ -12939,7 +12953,7 @@ var CheckoutOfferService = class {
     }
     if (violations.length > 0) {
       throw new import_common60.UnprocessableEntityException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE,
         message: "At least one bundle version from the checkout offer is no longer bookable.",
         violations
       });
@@ -12994,14 +13008,14 @@ var CheckoutOfferService = class {
     const hasPlan = lineItems.some((item) => item.kind === "plan");
     if (!hasPlan) {
       throw new import_common60.UnprocessableEntityException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED,
         message: "A checkout offer requires a frozen plan line item."
       });
     }
     const missingBundleVersionIds = input.bundleVersionIds.filter((versionId) => !lineItems.some((item) => item.kind === "bundle" && item.sourceVersionId === versionId));
     if (missingBundleVersionIds.length > 0) {
       throw new import_common60.UnprocessableEntityException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED,
         message: "Every selected bundle version requires a frozen bundle line item.",
         bundleVersionIds: missingBundleVersionIds
       });
@@ -13035,7 +13049,7 @@ var CheckoutOfferService = class {
   assertOpen(existing, action) {
     if (existing.status === "consumed") {
       throw new import_common60.ConflictException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_ALREADY_CONSUMED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_ALREADY_CONSUMED,
         message: `Checkout offer '${existing.id}' has already been consumed and cannot be ${action}`,
         params: {
           offerId: existing.id,
@@ -13045,17 +13059,18 @@ var CheckoutOfferService = class {
     }
     if (existing.status === "expired") {
       throw new import_common60.ConflictException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_EXPIRED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_EXPIRED,
         message: `Checkout offer '${existing.id}' has expired and cannot be ${action}`,
         params: {
           offerId: existing.id,
-          action
+          action,
+          validUntil: existing.validUntil ?? null
         }
       });
     }
     if (this.isExpired(existing)) {
       throw new import_common60.ConflictException({
-        code: import_types26.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_EXPIRED,
+        code: import_types27.CONTRACT_ERROR_CODES.CHECKOUT_OFFER_EXPIRED,
         message: `CheckoutOffer '${existing.id}' has expired and cannot be ${action}`,
         params: {
           offerId: existing.id,
@@ -13080,7 +13095,7 @@ var CheckoutOfferService = class {
     if (!value) return false;
     const validUntil = new Date(value).getTime();
     if (Number.isNaN(validUntil)) return true;
-    return validUntil < (0, import_types26.startOfUtcDay)(new Date(nowMs)).getTime();
+    return validUntil < (0, import_types27.startOfUtcDay)(new Date(nowMs)).getTime();
   }
 };
 CheckoutOfferService = _ts_decorate68([
@@ -13711,7 +13726,7 @@ __export(platform_exports, {
 // src/platform/saas-platform.module.ts
 var import_common79 = require("@nestjs/common");
 var import_core9 = require("@nestjs/core");
-var import_types30 = require("@saasicat/types");
+var import_types31 = require("@saasicat/types");
 
 // src/promo/module.ts
 var import_common70 = require("@nestjs/common");
@@ -13781,7 +13796,7 @@ var import_common68 = require("@nestjs/common");
 
 // src/promo/rate-limit.guard.ts
 var import_common67 = require("@nestjs/common");
-var import_types27 = require("@saasicat/types");
+var import_types28 = require("@saasicat/types");
 function _ts_decorate75(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -13793,12 +13808,15 @@ var IP_WINDOW_MS = 6e4;
 var IP_LIMIT = 20;
 var SESSION_WINDOW_MS = 60 * 6e4;
 var SESSION_LIMIT = 50;
-function rateLimited() {
+function rateLimited(windowMs) {
   return new import_common67.HttpException({
+    ...codedError(import_types28.REGISTRATION_ERROR_CODES.RATE_LIMITED, {
+      retryAfterSeconds: Math.ceil(windowMs / 1e3)
+    }),
+    retryAfterSeconds: Math.ceil(windowMs / 1e3),
     valid: false,
     // Superseded by `code` — kept until all consumers read `code`.
-    reason: "RATE_LIMITED",
-    code: import_types27.REGISTRATION_ERROR_CODES.RATE_LIMITED
+    reason: "RATE_LIMITED"
   }, import_common67.HttpStatus.TOO_MANY_REQUESTS);
 }
 __name(rateLimited, "rateLimited");
@@ -13813,10 +13831,10 @@ var PromoCodeRateLimitGuard = class {
     const ipKey = ipFingerprint(req);
     const sessionKey = req.user?.id ?? null;
     if (this.exceeded(this.ipBuckets, ipKey, IP_WINDOW_MS, IP_LIMIT)) {
-      throw rateLimited();
+      throw rateLimited(IP_WINDOW_MS);
     }
     if (sessionKey && this.exceeded(this.sessionBuckets, sessionKey, SESSION_WINDOW_MS, SESSION_LIMIT)) {
-      throw rateLimited();
+      throw rateLimited(SESSION_WINDOW_MS);
     }
     return true;
   }
@@ -14455,7 +14473,7 @@ var import_class_validator16 = require("class-validator");
 
 // src/setup/setup.service.ts
 var import_common71 = require("@nestjs/common");
-var import_types28 = require("@saasicat/types");
+var import_types29 = require("@saasicat/types");
 var import_node_crypto3 = require("crypto");
 var import_qrcode = __toESM(require("qrcode"), 1);
 
@@ -14511,9 +14529,7 @@ var SetupService = class {
     await this.assertNoSuperAdmin();
     const email = req.email.trim().toLowerCase();
     if (!email.includes("@")) {
-      throw new import_common71.BadRequestException({
-        code: import_types28.SETUP_ERROR_CODES.INVALID_EMAIL
-      });
+      throw new import_common71.BadRequestException(codedError(import_types29.SETUP_ERROR_CODES.INVALID_EMAIL));
     }
     const generated = !req.password;
     const password = req.password ?? (0, import_node_crypto3.randomBytes)(GENERATED_PASSWORD_BYTES).toString("base64url");
@@ -14524,9 +14540,9 @@ var SetupService = class {
         password
       });
     } catch (err) {
-      if ((0, import_types28.isPlatformUserExistsError)(err)) {
+      if ((0, import_types29.isPlatformUserExistsError)(err)) {
         throw new import_common71.ConflictException({
-          code: import_types28.SETUP_ERROR_CODES.EMAIL_EXISTS,
+          code: import_types29.SETUP_ERROR_CODES.EMAIL_EXISTS,
           message: err.message
         });
       }
@@ -14562,7 +14578,7 @@ var SetupService = class {
     const expected = process.env[this.config.setupTokenEnvVar]?.trim();
     if (!expected) {
       throw new import_common71.ForbiddenException({
-        code: import_types28.SETUP_ERROR_CODES.SETUP_DISABLED,
+        code: import_types29.SETUP_ERROR_CODES.SETUP_DISABLED,
         message: `${this.config.setupTokenEnvVar} is not set \u2014 setup is disabled.`,
         params: {
           envVar: this.config.setupTokenEnvVar
@@ -14570,16 +14586,12 @@ var SetupService = class {
       });
     }
     if (!token || !timingSafeEqualStr(token, expected)) {
-      throw new import_common71.UnauthorizedException({
-        code: import_types28.SETUP_ERROR_CODES.INVALID_SETUP_TOKEN
-      });
+      throw new import_common71.UnauthorizedException(codedError(import_types29.SETUP_ERROR_CODES.INVALID_SETUP_TOKEN));
     }
   }
   async assertNoSuperAdmin() {
     if (await this.users.countSuperAdmins() > 0) {
-      throw new import_common71.ConflictException({
-        code: import_types28.SETUP_ERROR_CODES.SETUP_ALREADY_DONE
-      });
+      throw new import_common71.ConflictException(codedError(import_types29.SETUP_ERROR_CODES.SETUP_ALREADY_DONE));
     }
   }
 };
@@ -14854,7 +14866,7 @@ StaticEntitlementService = _ts_decorate84([
 // src/platform/static-feature.guard.ts
 var import_common75 = require("@nestjs/common");
 var import_core7 = require("@nestjs/core");
-var import_types29 = require("@saasicat/types");
+var import_types30 = require("@saasicat/types");
 function _ts_decorate85(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -14895,7 +14907,7 @@ var StaticFeatureGuard = class {
     const user = request.user;
     if (!user) {
       throw new import_common75.ForbiddenException({
-        code: import_types29.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        code: import_types30.AUTH_ERROR_CODES.NOT_AUTHENTICATED,
         message: "Not authenticated"
       });
     }
@@ -14904,20 +14916,21 @@ var StaticFeatureGuard = class {
     const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
     if (!tenantId) {
       throw new import_common75.ForbiddenException({
-        code: import_types29.AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
+        code: import_types30.AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
         message: "No tenant assigned"
       });
     }
     const snap = await this.entitlements.snapshot(tenantId);
     const allowed = required.some((f) => snap.features.includes(f));
     if (!allowed) {
-      throw new import_common75.ForbiddenException({
-        code: import_types29.FEATURE_NOT_LICENSED,
-        message: `Feature ${required.join(" / ")} is not included in the current plan.`,
-        params: {
-          featureKeys: required
-        }
-      });
+      const body = {
+        code: import_types30.FEATURE_NOT_LICENSED,
+        featureKey: required[0],
+        featureKeys: required,
+        offers: [],
+        message: `Feature ${required.join(" / ")} is not included in the current plan.`
+      };
+      throw new import_common75.ForbiddenException(body);
     }
     return true;
   }
@@ -15195,6 +15208,7 @@ function _ts_decorate89(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate89, "_ts_decorate");
+var PLATFORM_LOGGER = new import_common79.Logger("SaaSiCat");
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
@@ -15397,7 +15411,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
         throw new Error(`SaasPlatformModule.forRoot: entitlement active or required by the standard stack, but adapters are missing: ${missing.join(", ")}`);
       }
       if (persistence) {
-        (0, import_types30.assertPersistenceCapabilities)(persistence.capabilities, {
+        (0, import_types31.assertPersistenceCapabilities)(persistence.capabilities, {
           transactions: true,
           pessimisticLocking: true
         }, "SaasPlatformModule entitlement (transactional enforceLimit)");
@@ -15659,6 +15673,11 @@ var SaasPlatformModule = class _SaasPlatformModule {
         useExisting: EnforceQuotaInterceptor
       });
       lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
+      if (options.globalFeatureGuard === false) {
+        PLATFORM_LOGGER.warn("globalFeatureGuard is off \u2014 the platform did NOT bind StaticFeatureGuard as an APP_GUARD. @RequireFeature only blocks on routes where you bound a feature guard yourself, behind your auth guard: @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path. Any annotated route without one serves unlicensed traffic.");
+      }
+    } else {
+      PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
     }
     const tenantControllers = [];
     if (options.tenantManifest) {
@@ -15853,8 +15872,8 @@ var REGISTRATION_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/Regist
 
 // src/registration/pending-registration.service.ts
 var import_common80 = require("@nestjs/common");
-var import_types31 = require("@saasicat/types");
 var import_types32 = require("@saasicat/types");
+var import_types33 = require("@saasicat/types");
 
 // src/registration/pricing.ts
 function round24(value) {
@@ -15982,28 +16001,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async selectPlan(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new import_common80.NotFoundException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new import_common80.NotFoundException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
     if (!plan) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types32.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const expiresAt = new Date(now.getTime() + import_types33.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
     const updated = await this.repo.update(pending.id, {
       status: "PLAN_SELECTED",
       currentStep: 4,
@@ -16016,37 +16027,27 @@ var PendingRegistrationService = class _PendingRegistrationService {
     return {
       pendingRegistrationId: updated.id,
       status: updated.status,
-      nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[updated.status],
+      nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[updated.status],
       selectedPlanId: updated.selectedPlanId ?? plan.id
     };
   }
   async startCheckout(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new import_common80.NotFoundException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new import_common80.NotFoundException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     if (!pending.selectedPlanId) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
     if (!plan) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const session = await this.paymentProvider.createCheckoutSession({
       pendingRegistrationId: pending.id,
@@ -16056,7 +16057,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       cancelUrl: input.cancelUrl
     });
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types32.PENDING_CHECKOUT_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const expiresAt = new Date(now.getTime() + import_types33.PENDING_CHECKOUT_TTL_DAYS * 24 * 60 * 60 * 1e3);
     const updated = await this.repo.update(pending.id, {
       status: "CHECKOUT_STARTED",
       currentStep: 4,
@@ -16071,7 +16072,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
     return {
       pendingRegistrationId: updated.id,
       status: updated.status,
-      nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[updated.status],
+      nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[updated.status],
       checkoutSessionId: session.sessionId,
       checkoutUrl: session.checkoutUrl
     };
@@ -16227,8 +16228,8 @@ var PendingRegistrationService = class _PendingRegistrationService {
     const code = generateOtpCode();
     const otpHash = hashOtpCode(code);
     const now = /* @__PURE__ */ new Date();
-    const otpExpiresAt = new Date(now.getTime() + import_types32.OTP_TTL_MINUTES * 60 * 1e3);
-    const expiresAt = new Date(now.getTime() + import_types32.PENDING_EMAIL_TTL_HOURS * 60 * 60 * 1e3);
+    const otpExpiresAt = new Date(now.getTime() + import_types33.OTP_TTL_MINUTES * 60 * 1e3);
+    const expiresAt = new Date(now.getTime() + import_types33.PENDING_EMAIL_TTL_HOURS * 60 * 60 * 1e3);
     const pending = await this.repo.create({
       tenantName: input.tenantName.trim(),
       tenantSlug: slug,
@@ -16255,14 +16256,12 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", null, context, {
         reason: "unknown_email"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
       return {
         status: pending.status,
-        nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[pending.status],
+        nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[pending.status],
         pendingRegistrationId: pending.id
       };
     }
@@ -16270,43 +16269,33 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "no_otp_set"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.otpExpiresAt.getTime() < Date.now()) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "expired"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_EXPIRED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_EXPIRED));
     }
     const maxAttempts = resolveOtpVerifyMaxAttempts();
     if (pending.otpAttemptCount >= maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
     if (attemptCount > maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     if (!verifyOtpCode(pending.otpHash, code)) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "wrong_code"
       });
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     const now = /* @__PURE__ */ new Date();
     const updated = await this.repo.update(pending.id, {
@@ -16315,12 +16304,12 @@ var PendingRegistrationService = class _PendingRegistrationService {
       emailVerifiedAt: now,
       otpHash: null,
       otpExpiresAt: null,
-      expiresAt: new Date(now.getTime() + import_types32.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3)
+      expiresAt: new Date(now.getTime() + import_types33.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3)
     });
     await this.record("OTP_VERIFIED", updated.id, context);
     return {
       status: updated.status,
-      nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[updated.status],
+      nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[updated.status],
       pendingRegistrationId: updated.id
     };
   }
@@ -16345,15 +16334,15 @@ var PendingRegistrationService = class _PendingRegistrationService {
   }
   async regenerateOtp(pending) {
     const now = /* @__PURE__ */ new Date();
-    const windowMs = import_types32.OTP_RATE_LIMIT_WINDOW_MINUTES * 60 * 1e3;
+    const windowMs = import_types33.OTP_RATE_LIMIT_WINDOW_MINUTES * 60 * 1e3;
     const withinWindow = pending.lastOtpSentAt !== null && now.getTime() - pending.lastOtpSentAt.getTime() < windowMs;
-    if (withinWindow && pending.otpSendCount >= import_types32.OTP_RATE_LIMIT_MAX_SENDS) {
+    if (withinWindow && pending.otpSendCount >= import_types33.OTP_RATE_LIMIT_MAX_SENDS) {
       this.logger.warn(`OTP rate limit reached for ${pending.email} \u2014 send is being skipped.`);
       return;
     }
     const code = generateOtpCode();
     const otpHash = hashOtpCode(code);
-    const otpExpiresAt = new Date(now.getTime() + import_types32.OTP_TTL_MINUTES * 60 * 1e3);
+    const otpExpiresAt = new Date(now.getTime() + import_types33.OTP_TTL_MINUTES * 60 * 1e3);
     const otpSendCount = withinWindow ? pending.otpSendCount + 1 : 1;
     await this.repo.update(pending.id, {
       otpHash,
@@ -16390,7 +16379,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
     }
     const token = await this.resumeTokenSigner.sign({
       pendingRegistrationId: pending.id,
-      ttlMinutes: import_types31.REGISTRATION_RESUME_TTL_MINUTES
+      ttlMinutes: import_types32.REGISTRATION_RESUME_TTL_MINUTES
     });
     const base = (this.resumeBaseUrl ?? "http://localhost").replace(/\/+$/, "");
     const url = `${base}/login?resume=${encodeURIComponent(token)}`;
@@ -16417,28 +16406,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async resumeWithToken(input, context) {
     if (!this.resumeTokenSigner) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED));
     }
     let decoded;
     try {
       decoded = await this.resumeTokenSigner.verify(input.token);
     } catch {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     const pending = await this.repo.findById(decoded.pendingRegistrationId);
     if (!pending) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
       via: "resume_token",
@@ -16447,7 +16428,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
     return {
       pendingRegistrationId: pending.id,
       status: pending.status,
-      nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[pending.status],
+      nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[pending.status],
       snapshot: toSnapshot2(pending)
     };
   }
@@ -16466,9 +16447,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
   /** Returns the (app-specific) configurator catalog. */
   async getConfiguratorCatalog() {
     if (!this.configuratorLookup) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     return this.configuratorLookup.getCatalog();
   }
@@ -16485,32 +16464,22 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async saveConfiguration(input, context) {
     if (!this.configuratorLookup) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new import_common80.NotFoundException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new import_common80.NotFoundException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === input.selection.modelId);
     if (!model) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (input.selection.appliedPromoCode && this.promoPreview) {
@@ -16542,7 +16511,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       };
     }
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types32.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const expiresAt = new Date(now.getTime() + import_types33.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
     const updated = await this.repo.update(pending.id, {
       status: "PLAN_SELECTED",
       currentStep: 4,
@@ -16561,7 +16530,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
     return {
       pendingRegistrationId: updated.id,
       status: updated.status,
-      nextStep: import_types32.REGISTRATION_STEP_BY_STATUS[updated.status],
+      nextStep: import_types33.REGISTRATION_STEP_BY_STATUS[updated.status],
       selection: input.selection,
       breakdown
     };
@@ -16574,28 +16543,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async previewConfigPromo(pendingRegistrationId, code) {
     if (!this.configuratorLookup) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(pendingRegistrationId);
     if (!pending) {
-      throw new import_common80.NotFoundException({
-        code: import_types31.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new import_common80.NotFoundException(codedError(import_types32.REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     const config = pending.configJson;
     if (!config) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === config.modelId);
     if (!model) {
-      throw new import_common80.BadRequestException({
-        code: import_types31.REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new import_common80.BadRequestException(codedError(import_types32.REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (code && this.promoPreview) {
@@ -16703,9 +16664,9 @@ function normalizeEmail(value) {
 __name(normalizeEmail, "normalizeEmail");
 function resolveOtpVerifyMaxAttempts() {
   const raw = process.env.SAAS_PLATFORM_OTP_VERIFY_MAX_ATTEMPTS;
-  if (!raw) return import_types32.OTP_VERIFY_MAX_ATTEMPTS;
+  if (!raw) return import_types33.OTP_VERIFY_MAX_ATTEMPTS;
   const parsed = Number.parseInt(raw, 10);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : import_types32.OTP_VERIFY_MAX_ATTEMPTS;
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : import_types33.OTP_VERIFY_MAX_ATTEMPTS;
 }
 __name(resolveOtpVerifyMaxAttempts, "resolveOtpVerifyMaxAttempts");
 function toSnapshot2(pending) {
@@ -16800,7 +16761,7 @@ RegistrationCleanupCron = _ts_decorate91([
 
 // src/registration/ip-rate-limit.guard.ts
 var import_common82 = require("@nestjs/common");
-var import_types33 = require("@saasicat/types");
+var import_types34 = require("@saasicat/types");
 function _ts_decorate92(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -16829,9 +16790,14 @@ var BaseIpRateLimitGuard = class {
     const key = ipFingerprint2(req);
     if (this.exceeded(key)) {
       throw new import_common82.HttpException({
-        code: import_types33.REGISTRATION_ERROR_CODES.RATE_LIMITED,
-        reason: this.options.name,
-        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        ...codedError(import_types34.REGISTRATION_ERROR_CODES.RATE_LIMITED, {
+          retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        }),
+        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3),
+        // Superseded by `code`. Note this carries the limiter name,
+        // not the code — the two emitters of RATE_LIMITED disagree
+        // on what `reason` means, which is why it is going away.
+        reason: this.options.name
       }, import_common82.HttpStatus.TOO_MANY_REQUESTS);
     }
     return true;
@@ -17254,7 +17220,7 @@ var SaveRegistrationConfigSelectionDto = class {
   billingCycle;
   appliedPromoCode;
   /**
-   * METAMODELL §17a — Bundle consistency. ID of the `CheckoutOffer` that was
+   * — Bundle consistency. ID of the `CheckoutOffer` that was
    * created on the pricing page (`<app>/register?offer=<id>`). Passed
    * through unchanged in `configJson`; the ActivationOrchestrator freezes it
    * as `packageSnapshot` when the subscription is created and sets the offer
@@ -17580,9 +17546,10 @@ __export(src_exports, {
   buildPublicMarketingCatalogController: () => buildPublicMarketingCatalogController,
   buildReplacedByIndex: () => buildReplacedByIndex,
   buildTenantSubscriptionBundlesController: () => buildTenantSubscriptionBundlesController,
-  classifyBundleVersionDiff: () => import_types4.classifyBundleVersionDiff,
-  classifyPlanDiff: () => import_types4.classifyPlanDiff,
+  classifyBundleVersionDiff: () => import_types5.classifyBundleVersionDiff,
+  classifyPlanDiff: () => import_types5.classifyPlanDiff,
   clearPendingPlanVersionFields: () => clearPendingPlanVersionFields,
+  codedError: () => codedError,
   collectSubscriptionBundleFeatures: () => collectSubscriptionBundleFeatures,
   computeBreakdown: () => computeBreakdown,
   computeCarriedTrialEndsAt: () => computeCarriedTrialEndsAt,
@@ -17674,7 +17641,7 @@ __export(testing_exports, {
 });
 
 // src/testing/fake-repositories.ts
-var import_types34 = require("@saasicat/types");
+var import_types35 = require("@saasicat/types");
 var FakeSubscriptionRepository = class {
   static {
     __name(this, "FakeSubscriptionRepository");
@@ -18393,7 +18360,7 @@ var FakePlanRepository = class {
       if (v.planId === existing.planKey) this.versions.delete(id);
     }
   }
-  // ─── Lifecycle (SPEC_V2 §11.1 M6 Pack 2a) ───
+  // ─── Lifecycle ───
   // Binding Plan ↔ PlanVersion: PlanVersion.planId === Plan.planKey
   // (soft string reference). Lifecycle methods take planKey
   // as input — the service resolves the plan UUID beforehand.
@@ -18430,7 +18397,7 @@ var FakePlanRepository = class {
   }
   async findActivePlanVersion(planKey, asOf = /* @__PURE__ */ new Date()) {
     const t = asOf.getTime();
-    const dayStart = (0, import_types34.startOfUtcDay)(asOf).getTime();
+    const dayStart = (0, import_types35.startOfUtcDay)(asOf).getTime();
     const matches = [
       ...this.versions.values()
     ].filter((v) => {