@saasicat/nest 0.19.0 → 0.22.0

package/dist/{chunk-LXUBCLRK.js → chunk-7X5MSAIL.js}

@@ -330,7 +330,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -364,7 +364,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -461,7 +461,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -497,7 +497,7 @@ var BundlesService = class _BundlesService {
    * Publishes a draft version atomically. Steps:
    * 1. Strict check on the draft definition (warn-only or blocking)
    * 2. Enforce validFrom requirement + ordering against the predecessor
-   *    (SPEC_V2 §4.2 + §11.1 M6 Pack 2c, analogous to PlanVersion)
+   *    (analogous to PlanVersion)
    * 3. Compute the diff against the predecessor version (latest live) →
    *    `publishedChanges` + `nonRegressive` via `classifyBundleVersionDiff`
    * 4. Call Repository.publishDraft with the diff result + validity dates
@@ -510,7 +510,7 @@ var BundlesService = class _BundlesService {
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_NOT_FOUND,
         message: `BundleVersion '${versionId}' not found`,
         params: {
-          versionId
+          bundleVersionId: versionId
         }
       });
     }
@@ -546,7 +546,7 @@ var BundlesService = class _BundlesService {
     if (!validFromInput) {
       throw new UnprocessableEntityException({
         code: CATALOG_ERROR_CODES.BUNDLE_VERSION_VALID_FROM_REQUIRED,
-        message: "validFrom must be set when publishing (on the draft or the publish call). SPEC_V2 \xA74.2."
+        message: "validFrom must be set when publishing (on the draft or the publish call).."
       });
     }
     const validFrom = new Date(validFromInput);
@@ -750,9 +750,10 @@ var BundlesService = class _BundlesService {
       throw new UnprocessableEntityException({
         code,
         message: `${field} '${input}' is not a valid date`,
+        // Keyed by the field name so these params match the publish
+        // path, where the same codes carry `validFrom` / `validUntil`.
         params: {
-          field,
-          value: input
+          [field]: input
         }
       });
     }
@@ -2775,7 +2776,7 @@ function buildPublicMarketingCatalogController(guards, projectKey, currency, vat
       this.service = service;
     }
     /**
-     * `?lang=de|tr|en` — alias `locale` accepted (SPEC_V2 §9).
+     * `?lang=de|tr|en` — alias `locale` accepted.
      * `?asOf=YYYY-MM-DD` — preview of a future or past catalog variant.
      *   Default = today. Returns the PlanVersion whose `validFrom`/`validUntil`
      *   span `asOf` inclusively by day (the validUntil day still counts,
@@ -3286,7 +3287,7 @@ var PlanVersionsService = class _PlanVersionsService {
     if (!validFromInput) {
       throw new UnprocessableEntityException4({
         code: CATALOG_ERROR_CODES6.PLAN_VERSION_VALID_FROM_REQUIRED,
-        message: "validFrom must be set when publishing (on the draft or the publish call). SPEC_V2 \xA74.2."
+        message: "validFrom must be set when publishing (on the draft or the publish call).."
       });
     }
     const validFrom = new Date(validFromInput);
@@ -3409,7 +3410,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.publishedAt === null) {
       throw new UnprocessableEntityException4({
-        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_LIVE,
+        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_PUBLISHED,
         message: `PlanVersion '${versionId}' is not published and cannot be terminated.`,
         params: {
           versionId
@@ -3418,7 +3419,7 @@ var PlanVersionsService = class _PlanVersionsService {
     }
     if (existing.supersededAt !== null) {
       throw new UnprocessableEntityException4({
-        code: CATALOG_ERROR_CODES6.PLAN_VERSION_NOT_LIVE,
+        code: CATALOG_ERROR_CODES6.PLAN_VERSION_SUPERSEDED,
         message: `PlanVersion '${versionId}' has already been superseded by a newer version (supersededAt) and cannot be terminated.`,
         params: {
           versionId
@@ -3800,7 +3801,7 @@ var PublishBundleVersionDto = class {
   allowZeroPrice;
   /**
    * Required on publish if the draft carries no `validFrom`
-   * (SPEC_V2 §4.2 + §11.1 M6 Pack 2c, analogous to PublishPlanVersionDto).
+   * (analogous to PublishPlanVersionDto).
    * Service strictly checks > `validFrom` of the predecessor version.
    */
   validFrom;
@@ -4582,7 +4583,7 @@ var CreatePlanVersionDraftDto = class {
   marketed;
   changeNote;
   baseVersionId;
-  /** Optional in the draft (required at publish). ISO date string. SPEC_V2 §4.2. */
+  /** Optional in the draft (required at publish). ISO date string.. */
   validFrom;
   /** Optional; null = unlimited. ISO date string. */
   validUntil;
@@ -4757,7 +4758,7 @@ var PublishPlanVersionDto = class {
   allowZeroPrice;
   /**
    * Required at publish (on the DTO or draft). The service strictly checks
-   * `validFrom > predecessor.validFrom`. SPEC_V2 §4.2.
+   * `validFrom > predecessor.validFrom`..
    */
   validFrom;
   validUntil;

package/dist/{chunk-AFK2IE2L.js → chunk-7ZPFQXHM.js}

@@ -6,7 +6,7 @@ import {
   ADVISORY_STRICT_MODE_CODES,
   validateBundleDraft,
   validatePlanDraft
-} from "./chunk-LXUBCLRK.js";
+} from "./chunk-7X5MSAIL.js";
 import {
   __name
 } from "./chunk-SHUYVCID.js";

package/dist/chunk-EBJJNTW6.js

@@ -0,0 +1,22 @@
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/errors/coded-error.ts
+import { ERROR_MESSAGES_EN, formatErrorMessage } from "@saasicat/types";
+function codedError(code, params) {
+  const message = formatErrorMessage(ERROR_MESSAGES_EN[code], params ?? {});
+  return params ? {
+    code,
+    message,
+    params
+  } : {
+    code,
+    message
+  };
+}
+__name(codedError, "codedError");
+
+export {
+  codedError
+};

package/dist/{chunk-6WA4X5U3.js → chunk-MJ32VNZD.js}

@@ -1,3 +1,6 @@
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -183,25 +186,17 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async selectPlan(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
     if (!plan) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
@@ -224,30 +219,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
   async startCheckout(input, context) {
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     if (!pending.selectedPlanId) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_SELECTED));
     }
     const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
     if (!plan) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PLAN_NOT_AVAILABLE));
     }
     const session = await this.paymentProvider.createCheckoutSession({
       pendingRegistrationId: pending.id,
@@ -456,9 +441,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", null, context, {
         reason: "unknown_email"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
       return {
@@ -471,43 +454,33 @@ var PendingRegistrationService = class _PendingRegistrationService {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "no_otp_set"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     if (pending.otpExpiresAt.getTime() < Date.now()) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "expired"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_EXPIRED));
     }
     const maxAttempts = resolveOtpVerifyMaxAttempts();
     if (pending.otpAttemptCount >= maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
     if (attemptCount > maxAttempts) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "locked"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_LOCKED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_LOCKED));
     }
     if (!verifyOtpCode(pending.otpHash, code)) {
       await this.record("OTP_VERIFY_FAILED", pending.id, context, {
         reason: "wrong_code"
       });
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.OTP_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.OTP_INVALID));
     }
     const now = /* @__PURE__ */ new Date();
     const updated = await this.repo.update(pending.id, {
@@ -618,28 +591,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async resumeWithToken(input, context) {
     if (!this.resumeTokenSigner) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_NOT_CONFIGURED));
     }
     let decoded;
     try {
       decoded = await this.resumeTokenSigner.verify(input.token);
     } catch {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     const pending = await this.repo.findById(decoded.pendingRegistrationId);
     if (!pending) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.RESUME_TOKEN_INVALID));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
       via: "resume_token",
@@ -667,9 +632,7 @@ var PendingRegistrationService = class _PendingRegistrationService {
   /** Returns the (app-specific) configurator catalog. */
   async getConfiguratorCatalog() {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     return this.configuratorLookup.getCatalog();
   }
@@ -686,32 +649,22 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async saveConfiguration(input, context) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(input.pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     if (pending.expiresAt.getTime() < Date.now()) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_EXPIRED));
     }
     if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.INVALID_REGISTRATION_STATE));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === input.selection.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (input.selection.appliedPromoCode && this.promoPreview) {
@@ -775,28 +728,20 @@ var PendingRegistrationService = class _PendingRegistrationService {
    */
   async previewConfigPromo(pendingRegistrationId, code) {
     if (!this.configuratorLookup) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIGURATOR_NOT_CONFIGURED));
     }
     const pending = await this.repo.findById(pendingRegistrationId);
     if (!pending) {
-      throw new NotFoundException({
-        code: REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND
-      });
+      throw new NotFoundException(codedError(REGISTRATION_ERROR_CODES.PENDING_REGISTRATION_NOT_FOUND));
     }
     const config = pending.configJson;
     if (!config) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.CONFIG_NOT_SAVED));
     }
     const catalog = await this.configuratorLookup.getCatalog();
     const model = catalog.models.find((m) => m.id === config.modelId);
     if (!model) {
-      throw new BadRequestException({
-        code: REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE
-      });
+      throw new BadRequestException(codedError(REGISTRATION_ERROR_CODES.MODEL_NOT_AVAILABLE));
     }
     let promoEval;
     if (code && this.promoPreview) {
@@ -1030,9 +975,14 @@ var BaseIpRateLimitGuard = class {
     const key = ipFingerprint(req);
     if (this.exceeded(key)) {
       throw new HttpException({
-        code: REGISTRATION_ERROR_CODES2.RATE_LIMITED,
-        reason: this.options.name,
-        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        ...codedError(REGISTRATION_ERROR_CODES2.RATE_LIMITED, {
+          retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+        }),
+        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3),
+        // Superseded by `code`. Note this carries the limiter name,
+        // not the code — the two emitters of RATE_LIMITED disagree
+        // on what `reason` means, which is why it is going away.
+        reason: this.options.name
       }, HttpStatus.TOO_MANY_REQUESTS);
     }
     return true;
@@ -1455,7 +1405,7 @@ var SaveRegistrationConfigSelectionDto = class {
   billingCycle;
   appliedPromoCode;
   /**
-   * METAMODELL §17a — Bundle consistency. ID of the `CheckoutOffer` that was
+   * — Bundle consistency. ID of the `CheckoutOffer` that was
    * created on the pricing page (`<app>/register?offer=<id>`). Passed
    * through unchanged in `configJson`; the ActivationOrchestrator freezes it
    * as `packageSnapshot` when the subscription is created and sets the offer

package/dist/{chunk-F6DCLVBB.js → chunk-NNNXXUPT.js}

@@ -5,6 +5,9 @@ import {
 import {
   SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN
 } from "./chunk-NYLON2VC.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   ENTITLEMENT_RESOLUTION_CONFIG_TOKEN,
   ENTITLEMENT_SERVICE_TOKEN,
@@ -304,7 +307,7 @@ function isLimitExceededError(err) {
 __name(isLimitExceededError, "isLimitExceededError");
 
 // src/entitlement/service.ts
-import { Inject, Injectable, NotFoundException, Optional } from "@nestjs/common";
+import { Inject, Injectable, InternalServerErrorException, NotFoundException, Optional } from "@nestjs/common";
 import { BILLING_ERROR_CODES } from "@saasicat/types";
 
 // src/billing/subscription-bundles.tokens.ts
@@ -484,7 +487,10 @@ var EntitlementService = class {
       const limits = await this.deriveLimits(sub, now, tx);
       const max = limits.quotas[input.dimension];
       if (max === void 0) {
-        throw new Error(`Quota-Dimension "${input.dimension}" is not in the plan catalog (${this.catalog.projectKey}).`);
+        throw new InternalServerErrorException(codedError(BILLING_ERROR_CODES.QUOTA_DIMENSION_UNKNOWN, {
+          dimension: input.dimension,
+          projectKey: this.catalog.projectKey
+        }));
       }
       const used = await input.currentUsage(tx, input.tenantId);
       if (max !== -1 && used + delta > max) {
@@ -498,7 +504,7 @@ var EntitlementService = class {
   // ---------------------------------------------------------------------
   /**
    * Plan fallback for TRIAL/PENDING_SALES: returns the PlanVersion active
-   * as of `asOf` (SPEC_V2 §4.2). If the repo does not implement
+   * as of `asOf`. If the repo does not implement
    * `findActive`, we fall back to `findLatestLive` (backward compat for
    * adapters without `validFrom` columns).
    */

package/dist/{chunk-7JIHG53V.js → chunk-SN5UOC43.js}

@@ -7,6 +7,9 @@ import {
 import {
   SaaSiCatPublicRoute
 } from "./chunk-YSC46BGM.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -199,7 +202,7 @@ var MfaGuard = class _MfaGuard {
     const user = request.user;
     if (!user) {
       throw new UnauthorizedException({
-        code: AUTH_ERROR_CODES2.NOT_AUTHENTICATED,
+        ...codedError(AUTH_ERROR_CODES2.NOT_AUTHENTICATED),
         // `reason` is superseded by `code` and will be removed.
         reason: "NOT_AUTHENTICATED"
       });
@@ -572,7 +575,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "dashboard.read"
       },
-      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // — discovery snapshot of the running backend.
       // Apps must set `discovery.read` in their manifest capabilities
       // to `true` so that the NavBuilder wires the page into the
       // sidebar; otherwise it is filtered out automatically.
@@ -580,7 +583,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "discovery.read"
       },
-      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // — Bundle editor in SuperAdmin.
       // Apps with a DB-driven catalog set `bundles.read = true`.
       bundles: {
         enabled: true,
@@ -590,7 +593,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "plans.read"
       },
-      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // — marketing catalog (locale pivot).
       // Apps that market a public catalog set
       // `marketingProjections.read = true`.
       marketingCatalog: {

package/dist/{chunk-KUDKD7ZG.js → chunk-UFS344JD.js}

@@ -1,6 +1,6 @@
 import {
   PromoCodesModule
-} from "./chunk-EUU3B6NB.js";
+} from "./chunk-4O6R6ARQ.js";
 import {
   AdminManifestModule,
   AdminManifestService,
@@ -9,22 +9,22 @@ import {
   AdminStatsModule,
   MfaService,
   SuperAdminGuard
-} from "./chunk-7JIHG53V.js";
+} from "./chunk-SN5UOC43.js";
 import {
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
   SubscriptionBundleModule,
   TenantBillingModule
-} from "./chunk-I77VS3YH.js";
+} from "./chunk-UO64MK3Q.js";
 import {
   SubscriptionContractModule
 } from "./chunk-B7NRY2LV.js";
 import {
   CatalogModule
-} from "./chunk-LXUBCLRK.js";
+} from "./chunk-7X5MSAIL.js";
 import {
   CheckoutOfferModule
-} from "./chunk-ORWIGSNN.js";
+} from "./chunk-XTVAFJ3P.js";
 import {
   SaaSiCatPublicRoute
 } from "./chunk-YSC46BGM.js";
@@ -34,11 +34,14 @@ import {
 import {
   EntitlementModule,
   LimitExceededError
-} from "./chunk-F6DCLVBB.js";
+} from "./chunk-NNNXXUPT.js";
 import {
   PLAN_CATALOG_TOKEN,
   PlanCatalogModule
 } from "./chunk-DQKCK7DX.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";
@@ -105,9 +108,7 @@ var SetupService = class {
     await this.assertNoSuperAdmin();
     const email = req.email.trim().toLowerCase();
     if (!email.includes("@")) {
-      throw new BadRequestException({
-        code: SETUP_ERROR_CODES.INVALID_EMAIL
-      });
+      throw new BadRequestException(codedError(SETUP_ERROR_CODES.INVALID_EMAIL));
     }
     const generated = !req.password;
     const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
@@ -164,16 +165,12 @@ var SetupService = class {
       });
     }
     if (!token || !timingSafeEqualStr(token, expected)) {
-      throw new UnauthorizedException({
-        code: SETUP_ERROR_CODES.INVALID_SETUP_TOKEN
-      });
+      throw new UnauthorizedException(codedError(SETUP_ERROR_CODES.INVALID_SETUP_TOKEN));
     }
   }
   async assertNoSuperAdmin() {
     if (await this.users.countSuperAdmins() > 0) {
-      throw new ConflictException({
-        code: SETUP_ERROR_CODES.SETUP_ALREADY_DONE
-      });
+      throw new ConflictException(codedError(SETUP_ERROR_CODES.SETUP_ALREADY_DONE));
     }
   }
 };
@@ -508,13 +505,14 @@ var StaticFeatureGuard = class {
     const snap = await this.entitlements.snapshot(tenantId);
     const allowed = required.some((f) => snap.features.includes(f));
     if (!allowed) {
-      throw new ForbiddenException2({
+      const body = {
         code: FEATURE_NOT_LICENSED,
-        message: `Feature ${required.join(" / ")} is not included in the current plan.`,
-        params: {
-          featureKeys: required
-        }
-      });
+        featureKey: required[0],
+        featureKeys: required,
+        offers: [],
+        message: `Feature ${required.join(" / ")} is not included in the current plan.`
+      };
+      throw new ForbiddenException2(body);
     }
     return true;
   }
@@ -785,7 +783,7 @@ function buildTenantManifestController(options) {
 __name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/saas-platform.module.ts
-import { Module as Module2 } from "@nestjs/common";
+import { Logger, Module as Module2 } from "@nestjs/common";
 import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
 import { assertPersistenceCapabilities } from "@saasicat/types";
 function _ts_decorate9(decorators, target, key, desc) {
@@ -795,6 +793,7 @@ function _ts_decorate9(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate9, "_ts_decorate");
+var PLATFORM_LOGGER = new Logger("SaaSiCat");
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
@@ -1259,6 +1258,11 @@ var SaasPlatformModule = class _SaasPlatformModule {
         useExisting: EnforceQuotaInterceptor
       });
       lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
+      if (options.globalFeatureGuard === false) {
+        PLATFORM_LOGGER.warn("globalFeatureGuard is off \u2014 the platform did NOT bind StaticFeatureGuard as an APP_GUARD. @RequireFeature only blocks on routes where you bound a feature guard yourself, behind your auth guard: @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path. Any annotated route without one serves unlicensed traffic.");
+      }
+    } else {
+      PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
     }
     const tenantControllers = [];
     if (options.tenantManifest) {