@saasicat/nest 0.2.0

package/dist/chunk-2VNZYRDV.js

@@ -0,0 +1,326 @@
+import {
+  PROMO_CODE_REDEMPTION_REPOSITORY_TOKEN,
+  PROMO_CODE_REPOSITORY_TOKEN,
+  PROMO_CODE_VALIDATION_LOG_REPOSITORY_TOKEN,
+  PROMO_FIRST_TIME_CUSTOMER_CHECK_TOKEN,
+  PROMO_REVENUE_DEDUCTION_AGGREGATOR_TOKEN,
+  PROMO_SERVICE_CONFIG_TOKEN,
+  PROMO_SUBSCRIPTION_LOOKUP_TOKEN,
+  PROMO_TRANSACTION_RUNNER_TOKEN,
+  PromoCodesService
+} from "./chunk-ZL4LLE2Z.js";
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/promo/expirer.ts
+import { Inject, Injectable, Logger } from "@nestjs/common";
+import { Cron, CronExpression } from "@nestjs/schedule";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var PromoCodeExpirer = class _PromoCodeExpirer {
+  static {
+    __name(this, "PromoCodeExpirer");
+  }
+  promoRepo;
+  redemptionRepo;
+  logger = new Logger(_PromoCodeExpirer.name);
+  constructor(promoRepo, redemptionRepo) {
+    this.promoRepo = promoRepo;
+    this.redemptionRepo = redemptionRepo;
+  }
+  async expirePromoCodes() {
+    const now = /* @__PURE__ */ new Date();
+    const codes = await this.promoRepo.expireDueCodes(now);
+    const redemptions = await this.redemptionRepo.expireDueRedemptions(now);
+    if (codes > 0 || redemptions > 0) {
+      this.logger.log(`PromoCodeExpirer: ${codes} Codes, ${redemptions} Redemptions abgelaufen.`);
+    }
+  }
+};
+_ts_decorate([
+  Cron(CronExpression.EVERY_DAY_AT_3AM, {
+    name: "promoCodeExpirer",
+    timeZone: "Europe/Berlin"
+  }),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", []),
+  _ts_metadata("design:returntype", Promise)
+], PromoCodeExpirer.prototype, "expirePromoCodes", null);
+PromoCodeExpirer = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(PROMO_CODE_REPOSITORY_TOKEN)),
+  _ts_param(1, Inject(PROMO_CODE_REDEMPTION_REPOSITORY_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof PromoCodeRepository === "undefined" ? Object : PromoCodeRepository,
+    typeof PromoCodeRedemptionRepository === "undefined" ? Object : PromoCodeRedemptionRepository
+  ])
+], PromoCodeExpirer);
+
+// src/promo/rate-limit.guard.ts
+import { HttpException, HttpStatus, Injectable as Injectable2 } from "@nestjs/common";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var IP_WINDOW_MS = 6e4;
+var IP_LIMIT = 20;
+var SESSION_WINDOW_MS = 60 * 6e4;
+var SESSION_LIMIT = 50;
+var PromoCodeRateLimitGuard = class {
+  static {
+    __name(this, "PromoCodeRateLimitGuard");
+  }
+  ipBuckets = /* @__PURE__ */ new Map();
+  sessionBuckets = /* @__PURE__ */ new Map();
+  canActivate(context) {
+    const req = context.switchToHttp().getRequest();
+    const ipKey = ipFingerprint(req);
+    const sessionKey = req.user?.id ?? null;
+    if (this.exceeded(this.ipBuckets, ipKey, IP_WINDOW_MS, IP_LIMIT)) {
+      throw new HttpException({
+        valid: false,
+        reason: "RATE_LIMITED"
+      }, HttpStatus.TOO_MANY_REQUESTS);
+    }
+    if (sessionKey && this.exceeded(this.sessionBuckets, sessionKey, SESSION_WINDOW_MS, SESSION_LIMIT)) {
+      throw new HttpException({
+        valid: false,
+        reason: "RATE_LIMITED"
+      }, HttpStatus.TOO_MANY_REQUESTS);
+    }
+    return true;
+  }
+  exceeded(map, key, windowMs, limit) {
+    const now = Date.now();
+    const b = map.get(key);
+    if (!b || now - b.windowStart > windowMs) {
+      map.set(key, {
+        count: 1,
+        windowStart: now
+      });
+      return false;
+    }
+    b.count += 1;
+    return b.count > limit;
+  }
+};
+PromoCodeRateLimitGuard = _ts_decorate2([
+  Injectable2()
+], PromoCodeRateLimitGuard);
+function ipFingerprint(req) {
+  const fwd = req.headers["x-forwarded-for"];
+  const first = Array.isArray(fwd) ? fwd[0] : fwd?.split(",")[0]?.trim();
+  return first || req.ip || "unknown";
+}
+__name(ipFingerprint, "ipFingerprint");
+function hashIp(req) {
+  const fp = ipFingerprint(req);
+  let h = 0;
+  for (let i = 0; i < fp.length; i++) {
+    h = h * 31 + fp.charCodeAt(i) | 0;
+  }
+  return `ip${(h >>> 0).toString(16)}`;
+}
+__name(hashIp, "hashIp");
+
+// src/promo/controller.ts
+import { Body, Controller, HttpCode, HttpStatus as HttpStatus2, Inject as Inject2, Post, Req, UseGuards } from "@nestjs/common";
+
+// src/promo/dto/promo-public.dto.ts
+import { IsEmail, IsOptional, IsString, Matches, MaxLength } from "class-validator";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var PLAN_OR_CYCLE_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+var CODE_PATTERN = /^[A-Z0-9_-]{4,32}$/i;
+var PreviewPromoCodeDto = class {
+  static {
+    __name(this, "PreviewPromoCodeDto");
+  }
+  code;
+  plan;
+  billingCycle;
+  email;
+};
+_ts_decorate3([
+  IsString(),
+  Matches(CODE_PATTERN, {
+    message: 'code muss aus A\u2013Z, 0\u20139, "-" und "_" bestehen (4\u201332 Zeichen)'
+  }),
+  _ts_metadata2("design:type", String)
+], PreviewPromoCodeDto.prototype, "code", void 0);
+_ts_decorate3([
+  IsString(),
+  Matches(PLAN_OR_CYCLE_PATTERN, {
+    message: "plan muss SCREAMING_SNAKE_CASE sein"
+  }),
+  _ts_metadata2("design:type", String)
+], PreviewPromoCodeDto.prototype, "plan", void 0);
+_ts_decorate3([
+  IsString(),
+  Matches(PLAN_OR_CYCLE_PATTERN, {
+    message: "billingCycle muss SCREAMING_SNAKE_CASE sein (z. B. MONTHLY, YEARLY)"
+  }),
+  _ts_metadata2("design:type", String)
+], PreviewPromoCodeDto.prototype, "billingCycle", void 0);
+_ts_decorate3([
+  IsOptional(),
+  IsEmail(),
+  MaxLength(254),
+  _ts_metadata2("design:type", String)
+], PreviewPromoCodeDto.prototype, "email", void 0);
+
+// src/promo/controller.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var PromoCodePublicController = class {
+  static {
+    __name(this, "PromoCodePublicController");
+  }
+  promo;
+  constructor(promo) {
+    this.promo = promo;
+  }
+  async preview(dto, req) {
+    return this.promo.preview({
+      code: dto.code,
+      planId: dto.plan,
+      billingCycle: dto.billingCycle,
+      email: dto.email,
+      ipHash: hashIp(req),
+      sessionId: req.user?.id ?? req.user?.sub
+    });
+  }
+};
+_ts_decorate4([
+  Post("preview"),
+  HttpCode(HttpStatus2.OK),
+  UseGuards(PromoCodeRateLimitGuard),
+  _ts_param2(0, Body()),
+  _ts_param2(1, Req()),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof PreviewPromoCodeDto === "undefined" ? Object : PreviewPromoCodeDto,
+    typeof RequestLike === "undefined" ? Object : RequestLike
+  ]),
+  _ts_metadata3("design:returntype", Promise)
+], PromoCodePublicController.prototype, "preview", null);
+PromoCodePublicController = _ts_decorate4([
+  Controller("billing/promo"),
+  _ts_param2(0, Inject2(PromoCodesService)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof PromoCodesService === "undefined" ? Object : PromoCodesService
+  ])
+], PromoCodePublicController);
+
+// src/promo/module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var PromoCodesModule = class _PromoCodesModule {
+  static {
+    __name(this, "PromoCodesModule");
+  }
+  static forRoot(options) {
+    const includeCron = options.includeExpirerCron ?? true;
+    const includePublic = options.includePublicController ?? true;
+    const providers = [
+      asProvider(PROMO_CODE_REPOSITORY_TOKEN, options.promoCodeRepository),
+      asProvider(PROMO_CODE_REDEMPTION_REPOSITORY_TOKEN, options.redemptionRepository),
+      asProvider(PROMO_CODE_VALIDATION_LOG_REPOSITORY_TOKEN, options.validationLogRepository),
+      asProvider(PROMO_FIRST_TIME_CUSTOMER_CHECK_TOKEN, options.firstTimeCustomerCheck),
+      asProvider(PROMO_SUBSCRIPTION_LOOKUP_TOKEN, options.subscriptionLookup),
+      asProvider(PROMO_REVENUE_DEDUCTION_AGGREGATOR_TOKEN, options.revenueAggregator),
+      asProvider(PROMO_TRANSACTION_RUNNER_TOKEN, options.transactionRunner),
+      {
+        provide: PROMO_SERVICE_CONFIG_TOKEN,
+        useValue: options.config ?? {}
+      },
+      PromoCodesService,
+      PromoCodeRateLimitGuard
+    ];
+    if (includeCron) {
+      providers.push(PromoCodeExpirer);
+    }
+    return {
+      module: _PromoCodesModule,
+      global: options.global ?? false,
+      controllers: includePublic ? [
+        PromoCodePublicController
+      ] : [],
+      providers,
+      exports: [
+        PromoCodesService,
+        PromoCodeRateLimitGuard,
+        PROMO_CODE_REPOSITORY_TOKEN,
+        PROMO_CODE_REDEMPTION_REPOSITORY_TOKEN,
+        PROMO_CODE_VALIDATION_LOG_REPOSITORY_TOKEN
+      ]
+    };
+  }
+};
+PromoCodesModule = _ts_decorate5([
+  Module({})
+], PromoCodesModule);
+
+export {
+  PromoCodeExpirer,
+  PromoCodeRateLimitGuard,
+  ipFingerprint,
+  hashIp,
+  PreviewPromoCodeDto,
+  PromoCodePublicController,
+  PromoCodesModule
+};

package/dist/chunk-7MLGHWKO.js

@@ -0,0 +1,12 @@
+// src/entitlement/tokens.ts
+var SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionRepository");
+var PLAN_VERSION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanVersionRepository");
+var TRANSACTION_RUNNER_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/TransactionRunner");
+var ENTITLEMENT_RESOLUTION_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/EntitlementResolutionConfig");
+
+export {
+  SUBSCRIPTION_REPOSITORY_TOKEN,
+  PLAN_VERSION_REPOSITORY_TOKEN,
+  TRANSACTION_RUNNER_TOKEN,
+  ENTITLEMENT_RESOLUTION_CONFIG_TOKEN
+};

package/dist/chunk-ABB2CRAS.js

@@ -0,0 +1,31 @@
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/discovery/snapshot-loader.ts
+import { existsSync, readFileSync } from "fs";
+import { resolve as resolvePath } from "path";
+var DiscoverySnapshotNotFoundError = class extends Error {
+  static {
+    __name(this, "DiscoverySnapshotNotFoundError");
+  }
+  path;
+  constructor(path) {
+    super(`Discovery-Snapshot-Datei nicht gefunden: ${path}. Booten Sie zuerst die App mit DISCOVERY_SNAPSHOT_PATH oder DiscoveryModule.forRoot({ snapshotPath: '\u2026' }), damit der Scanner die Datei beim OnApplicationBootstrap-Hook schreibt.`), this.path = path;
+    this.name = "DiscoverySnapshotNotFoundError";
+  }
+};
+function loadDiscoverySnapshotFromFile(path) {
+  const absolute = resolvePath(path);
+  if (!existsSync(absolute)) {
+    throw new DiscoverySnapshotNotFoundError(absolute);
+  }
+  const raw = readFileSync(absolute, "utf-8");
+  return JSON.parse(raw);
+}
+__name(loadDiscoverySnapshotFromFile, "loadDiscoverySnapshotFromFile");
+
+export {
+  DiscoverySnapshotNotFoundError,
+  loadDiscoverySnapshotFromFile
+};

package/dist/chunk-AJ3EPELS.js

@@ -0,0 +1,157 @@
+import {
+  DISCOVERY_APP_INFO_TOKEN,
+  DISCOVERY_SNAPSHOT_PATH_TOKEN,
+  DiscoveryScanner
+} from "./chunk-M6CZQYPY.js";
+import {
+  DISCOVERY_SNAPSHOT_TOKEN
+} from "./chunk-L4SUWH5B.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/discovery/discovery.controller.ts
+import { Controller, Get, Header, Headers, HttpStatus, Inject, Post, Res, UseGuards } from "@nestjs/common";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+function buildDiscoveryController(guards) {
+  let GeneratedDiscoveryController = class GeneratedDiscoveryController {
+    static {
+      __name(this, "GeneratedDiscoveryController");
+    }
+    scanner;
+    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+    // any `design:paramtypes` metadata, so otherwise Nest cannot resolve the
+    // service type on the constructor.
+    constructor(scanner) {
+      this.scanner = scanner;
+    }
+    getDiscovery(ifNoneMatch, res) {
+      const snapshot = this.scanner.getSnapshot();
+      const etag = `"${snapshot.hash}-${snapshot.scannedAt}"`;
+      res.header("ETag", etag);
+      if (ifNoneMatch && ifNoneMatch === etag) {
+        res.status(HttpStatus.NOT_MODIFIED);
+        return null;
+      }
+      return snapshot;
+    }
+    /**
+     * Forces a fresh code scan and returns the new snapshot.
+     * `scannedAt` is updated; the Capability/Feature/Quota data
+     * are identical within the running process (code is stable at runtime).
+     */
+    rescanDiscovery() {
+      return this.scanner.rebuildSnapshot();
+    }
+  };
+  _ts_decorate([
+    Get("discovery"),
+    Header("Cache-Control", "private, no-cache"),
+    _ts_param(0, Headers("if-none-match")),
+    _ts_param(1, Res({
+      passthrough: true
+    })),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+      Object,
+      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
+    ]),
+    _ts_metadata("design:returntype", Object)
+  ], GeneratedDiscoveryController.prototype, "getDiscovery", null);
+  _ts_decorate([
+    Post("discovery/rescan"),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", []),
+    _ts_metadata("design:returntype", typeof DiscoverySnapshot === "undefined" ? Object : DiscoverySnapshot)
+  ], GeneratedDiscoveryController.prototype, "rescanDiscovery", null);
+  GeneratedDiscoveryController = _ts_decorate([
+    Controller("admin"),
+    UseGuards(...guards),
+    _ts_param(0, Inject(DiscoveryScanner)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+      typeof DiscoveryScanner === "undefined" ? Object : DiscoveryScanner
+    ])
+  ], GeneratedDiscoveryController);
+  return GeneratedDiscoveryController;
+}
+__name(buildDiscoveryController, "buildDiscoveryController");
+
+// src/discovery/discovery.module.ts
+import { Module } from "@nestjs/common";
+import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var DiscoveryModule = class _DiscoveryModule {
+  static {
+    __name(this, "DiscoveryModule");
+  }
+  static forRoot(options) {
+    const isGlobal = options.isGlobal ?? true;
+    const controllers = [];
+    if (options.controller) {
+      controllers.push(buildDiscoveryController(options.controller.guards));
+    }
+    const providers = [
+      {
+        provide: DISCOVERY_APP_INFO_TOKEN,
+        useValue: options.app
+      },
+      {
+        provide: DISCOVERY_SNAPSHOT_PATH_TOKEN,
+        useValue: options.snapshotPath ?? null
+      },
+      DiscoveryScanner,
+      {
+        provide: DISCOVERY_SNAPSHOT_TOKEN,
+        useFactory: /* @__PURE__ */ __name((scanner) => scanner.getSnapshot(), "useFactory"),
+        inject: [
+          DiscoveryScanner
+        ]
+      }
+    ];
+    return {
+      module: _DiscoveryModule,
+      imports: [
+        NestDiscoveryModule,
+        ...options.imports ?? []
+      ],
+      controllers,
+      providers,
+      exports: [
+        DiscoveryScanner,
+        DISCOVERY_SNAPSHOT_TOKEN
+      ],
+      global: isGlobal
+    };
+  }
+};
+DiscoveryModule = _ts_decorate2([
+  Module({})
+], DiscoveryModule);
+
+export {
+  buildDiscoveryController,
+  DiscoveryModule
+};

package/dist/chunk-E56W4U2P.js

@@ -0,0 +1,90 @@
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/admin/tokens.ts
+var MFA_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/MfaPort");
+var AUDIT_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AuditPort");
+var RLS_BYPASS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/RlsBypassPort");
+
+// src/admin/admin-audit.service.ts
+import * as os from "os";
+import { Inject, Injectable } from "@nestjs/common";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var AdminAuditService = class {
+  static {
+    __name(this, "AdminAuditService");
+  }
+  audit;
+  constructor(audit) {
+    this.audit = audit;
+  }
+  async log(input) {
+    await this.audit.write({
+      actor: input.actor,
+      entity: input.entity,
+      entityId: input.entityId,
+      action: input.action,
+      changes: {
+        ...input.changes ?? {},
+        actor: this.actorTag(input.actor)
+      }
+    });
+  }
+  /**
+   * Standardized actor tag for the `changes.actor` column:
+   * `<source>:<email>:<context>`.
+   */
+  actorTag(actor) {
+    return `${actor.source}:${actor.email}:${actor.context}`;
+  }
+  /** Helper: build an AdminActor from an authenticated web request. */
+  fromWebRequest(user, sessionId) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "web",
+      context: sessionId ?? "unknown"
+    };
+  }
+  /** Helper: build an AdminActor from a CLI identity (hostname as context). */
+  fromCli(user) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "cli",
+      context: os.hostname()
+    };
+  }
+};
+AdminAuditService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(AUDIT_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof AuditPort === "undefined" ? Object : AuditPort
+  ])
+], AdminAuditService);
+
+export {
+  MFA_PORT_TOKEN,
+  AUDIT_PORT_TOKEN,
+  RLS_BYPASS_PORT_TOKEN,
+  AdminAuditService
+};

package/dist/chunk-HRU3CP57.js

@@ -0,0 +1,71 @@
+import {
+  DiscoveryScanner
+} from "./chunk-M6CZQYPY.js";
+import {
+  DEFINES_QUOTA_KEY,
+  DISCOVERY_SNAPSHOT_TOKEN,
+  ENFORCE_QUOTA_KEY,
+  IMPLEMENTS_CAPABILITY_KEY,
+  REQUIRES_CAPABILITY_KEY
+} from "./chunk-L4SUWH5B.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/discovery/decorators.ts
+import { SetMetadata } from "@nestjs/common";
+var ImplementsCapability = /* @__PURE__ */ __name((capabilityKey, options = {}) => SetMetadata(IMPLEMENTS_CAPABILITY_KEY, {
+  capabilityKey,
+  ...options
+}), "ImplementsCapability");
+var RequiresCapability = /* @__PURE__ */ __name((...capabilityKeys) => SetMetadata(REQUIRES_CAPABILITY_KEY, capabilityKeys), "RequiresCapability");
+var DefinesQuota = /* @__PURE__ */ __name((options) => SetMetadata(DEFINES_QUOTA_KEY, options), "DefinesQuota");
+var EnforceQuota = /* @__PURE__ */ __name((quotaKey, options = {}) => SetMetadata(ENFORCE_QUOTA_KEY, {
+  quotaKey,
+  incrementBy: options.incrementBy ?? 1,
+  timing: options.timing ?? "before"
+}), "EnforceQuota");
+
+// src/discovery/headless-scan.ts
+import { NestFactory } from "@nestjs/core";
+async function runHeadlessDiscoveryScan(appModule, options = {}) {
+  const exit = options.exit ?? ((code) => process.exit(code));
+  try {
+    const app = await NestFactory.createApplicationContext(appModule, {
+      logger: options.logger ?? [
+        "error",
+        "warn",
+        "log"
+      ]
+    });
+    try {
+      return resolveSnapshotFromContext(app);
+    } finally {
+      await app.close();
+    }
+  } catch (err) {
+    console.error("[discovery-scan] FEHLER:", err instanceof Error ? err.message : err);
+    return exit(4);
+  }
+}
+__name(runHeadlessDiscoveryScan, "runHeadlessDiscoveryScan");
+function resolveSnapshotFromContext(app) {
+  try {
+    return app.get(DISCOVERY_SNAPSHOT_TOKEN, {
+      strict: false
+    });
+  } catch {
+    return app.get(DiscoveryScanner, {
+      strict: false
+    }).getSnapshot();
+  }
+}
+__name(resolveSnapshotFromContext, "resolveSnapshotFromContext");
+
+export {
+  ImplementsCapability,
+  RequiresCapability,
+  DefinesQuota,
+  EnforceQuota,
+  runHeadlessDiscoveryScan
+};