@saasicat/nest 0.2.0

package/dist/chunk-P6MYZMXQ.js

@@ -0,0 +1,951 @@
+import {
+  AUDIT_PORT_TOKEN,
+  AdminAuditService,
+  MFA_PORT_TOKEN,
+  RLS_BYPASS_PORT_TOKEN
+} from "./chunk-E56W4U2P.js";
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/admin/super-admin.guard.ts
+import { ForbiddenException, Injectable } from "@nestjs/common";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+var SuperAdminGuard = class {
+  static {
+    __name(this, "SuperAdminGuard");
+  }
+  canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    if (!request.user) throw new ForbiddenException("Nicht authentifiziert");
+    if (request.user.role !== "SUPER_ADMIN") {
+      throw new ForbiddenException("Nur SUPER_ADMIN-Rolle erlaubt");
+    }
+    return true;
+  }
+};
+SuperAdminGuard = _ts_decorate([
+  Injectable()
+], SuperAdminGuard);
+
+// src/admin/mfa.ts
+import { Inject, Injectable as Injectable2, Logger } from "@nestjs/common";
+import { generateSecret, generateURI, verify as verifyTotpCode } from "otplib";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var CLOCK_DRIFT_TOLERANCE_SECONDS = 30;
+var OTPLIB_TOKEN_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "TokenError",
+  "TokenFormatError",
+  "TokenLengthError"
+]);
+function isOtplibTokenError(error) {
+  return error instanceof Error && OTPLIB_TOKEN_ERROR_NAMES.has(error.name);
+}
+__name(isOtplibTokenError, "isOtplibTokenError");
+var MfaService = class _MfaService {
+  static {
+    __name(this, "MfaService");
+  }
+  mfa;
+  logger = new Logger(_MfaService.name);
+  constructor(mfa) {
+    this.mfa = mfa;
+  }
+  /**
+   * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+   * and returns the secret + the otpauth URI for the QR code.
+   *
+   * `issuer` and `label` shape the display in the authenticator (e.g.
+   * "DemoApp:taci@example.com").
+   */
+  async setup(userId, label, issuer) {
+    const secret = generateSecret();
+    const otpauthUri = generateURI({
+      issuer,
+      label,
+      secret
+    });
+    await this.mfa.setSecret(userId, secret);
+    return {
+      secret,
+      otpauthUri
+    };
+  }
+  /**
+   * Verifies the entered code against the stored secret,
+   * clock-drift-tolerant by ±1 time step.
+   */
+  async verify(input) {
+    const secret = await this.mfa.getSecret(input.userId);
+    if (!secret) return false;
+    try {
+      const result = await verifyTotpCode({
+        secret,
+        token: input.code.trim(),
+        epochTolerance: CLOCK_DRIFT_TOLERANCE_SECONDS
+      });
+      return result.valid;
+    } catch (error) {
+      if (isOtplibTokenError(error)) {
+        return false;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`TOTP-Verify f\xFCr User ${input.userId} unerwartet fehlgeschlagen: ${message}`);
+      return false;
+    }
+  }
+  /**
+   * Deletes a user's secret — used by `ahp admin mfa-reset`.
+   */
+  async disable(userId) {
+    await this.mfa.setSecret(userId, null);
+  }
+  /** Delegates to `MfaPort.isEnabled`. */
+  async isEnabled(userId) {
+    return this.mfa.isEnabled(userId);
+  }
+};
+MfaService = _ts_decorate2([
+  Injectable2(),
+  _ts_param(0, Inject(MFA_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MfaPort === "undefined" ? Object : MfaPort
+  ])
+], MfaService);
+
+// src/admin/mfa.guard.ts
+import { Inject as Inject2, Injectable as Injectable3, Logger as Logger2, SetMetadata, UnauthorizedException } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+var RequireMfa = /* @__PURE__ */ __name(() => SetMetadata(REQUIRE_MFA_KEY, true), "RequireMfa");
+var MfaGuard = class _MfaGuard {
+  static {
+    __name(this, "MfaGuard");
+  }
+  reflector;
+  mfaService;
+  logger = new Logger2(_MfaGuard.name);
+  constructor(reflector, mfaService) {
+    this.reflector = reflector;
+    this.mfaService = mfaService;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_MFA_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required) return true;
+    if (process.env.SAAS_PLATFORM_SKIP_MFA === "1" && process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) throw new UnauthorizedException({
+      reason: "NOT_AUTHENTICATED"
+    });
+    const enabled = await this.mfaService.isEnabled(user.id);
+    if (!enabled) {
+      throw new UnauthorizedException({
+        reason: "MFA_NOT_SET_UP",
+        message: "Bitte zuerst MFA-Setup \xFCber das CLI ausf\xFChren."
+      });
+    }
+    const headerVal = request.headers?.["x-mfa-code"];
+    const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+    if (!code) {
+      throw new UnauthorizedException({
+        reason: "MFA_REQUIRED",
+        message: "TOTP-Code im Header X-Mfa-Code erforderlich."
+      });
+    }
+    const valid = await this.mfaService.verify({
+      userId: user.id,
+      code: String(code)
+    });
+    if (!valid) {
+      throw new UnauthorizedException({
+        reason: "MFA_FAILED",
+        message: "TOTP-Code ung\xFCltig."
+      });
+    }
+    return true;
+  }
+};
+MfaGuard = _ts_decorate3([
+  Injectable3(),
+  _ts_param2(0, Inject2(Reflector)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], MfaGuard);
+
+// src/admin/admin-bypass-rls.interceptor.ts
+import { Inject as Inject3, Injectable as Injectable4 } from "@nestjs/common";
+import { defer, from } from "rxjs";
+import { switchAll } from "rxjs/operators";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var AdminBypassRlsInterceptor = class {
+  static {
+    __name(this, "AdminBypassRlsInterceptor");
+  }
+  port;
+  constructor(port) {
+    this.port = port;
+  }
+  intercept(_context, next) {
+    return defer(() => from(this.port.runWithBypass(async () => {
+      return next.handle();
+    })).pipe(switchAll()));
+  }
+};
+AdminBypassRlsInterceptor = _ts_decorate4([
+  Injectable4(),
+  _ts_param3(0, Inject3(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof RlsBypassPort === "undefined" ? Object : RlsBypassPort
+  ])
+], AdminBypassRlsInterceptor);
+
+// src/admin/module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var AdminModule = class _AdminModule {
+  static {
+    __name(this, "AdminModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      asProvider(MFA_PORT_TOKEN, options.mfaPort),
+      asProvider(AUDIT_PORT_TOKEN, options.auditPort),
+      asProvider(RLS_BYPASS_PORT_TOKEN, options.rlsBypassPort),
+      MfaService,
+      AdminAuditService,
+      SuperAdminGuard,
+      MfaGuard,
+      AdminBypassRlsInterceptor
+    ];
+    return {
+      module: _AdminModule,
+      global: options.global ?? false,
+      providers,
+      exports: [
+        MFA_PORT_TOKEN,
+        AUDIT_PORT_TOKEN,
+        RLS_BYPASS_PORT_TOKEN,
+        MfaService,
+        AdminAuditService,
+        SuperAdminGuard,
+        MfaGuard,
+        AdminBypassRlsInterceptor
+      ]
+    };
+  }
+};
+AdminModule = _ts_decorate5([
+  Module({})
+], AdminModule);
+
+// src/admin/admin-manifest.config.ts
+var ADMIN_MANIFEST_CONFIG = /* @__PURE__ */ Symbol("ADMIN_MANIFEST_CONFIG");
+
+// src/admin/admin-manifest.service.ts
+import { Inject as Inject4, Injectable as Injectable5, Logger as Logger3, Optional } from "@nestjs/common";
+import { createHash } from "crypto";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var PLATFORM_CORE_CONTRIBUTION_TOKEN = /* @__PURE__ */ Symbol("PLATFORM_CORE_CONTRIBUTION");
+var AdminManifestService = class _AdminManifestService {
+  static {
+    __name(this, "AdminManifestService");
+  }
+  config;
+  logger = new Logger3(_AdminManifestService.name);
+  contributions = [];
+  cached = null;
+  constructor(config, platformCore = null) {
+    this.config = config;
+    if (platformCore) {
+      this.contributions.push(platformCore);
+    }
+  }
+  register(contribution) {
+    this.contributions.push(contribution);
+    this.cached = null;
+  }
+  getManifest() {
+    if (this.cached) return this.cached;
+    this.cached = this.build();
+    this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${this.cached.build.manifestHash.slice(0, 24)}\u2026`);
+    return this.cached;
+  }
+  rebuild() {
+    this.cached = null;
+    return this.getManifest();
+  }
+  build() {
+    const merged = this.mergeContributions(this.contributions);
+    const draft = {
+      schemaVersion: 1,
+      project: this.config.project,
+      build: {
+        ...this.config.build,
+        manifestHash: "sha256-pending"
+      },
+      planCatalogSnapshot: this.config.planCatalogSnapshot,
+      capabilities: merged.capabilities,
+      navigation: merged.navigation,
+      dashboard: merged.dashboard,
+      tenants: merged.tenants,
+      audit: merged.audit
+    };
+    return {
+      ...draft,
+      build: {
+        ...draft.build,
+        manifestHash: this.computeHash(draft)
+      }
+    };
+  }
+  mergeContributions(contributions) {
+    const capabilities = {};
+    const standardPages = {};
+    const projectPages = [];
+    const kpiCards = [];
+    const tenantColumns = [];
+    const tenantActions = [];
+    const auditActions = [];
+    for (const c of contributions) {
+      if (c.capabilities) Object.assign(capabilities, c.capabilities);
+      if (c.navigation?.standardPages) Object.assign(standardPages, c.navigation.standardPages);
+      if (c.navigation?.projectPages) projectPages.push(...c.navigation.projectPages);
+      if (c.dashboard?.kpiCards) kpiCards.push(...c.dashboard.kpiCards);
+      if (c.tenants?.columns) tenantColumns.push(...c.tenants.columns);
+      if (c.tenants?.actions) tenantActions.push(...c.tenants.actions);
+      if (c.audit?.actions) auditActions.push(...c.audit.actions);
+    }
+    kpiCards.sort((a, b) => (b.slotPriority ?? 0) - (a.slotPriority ?? 0));
+    return {
+      capabilities,
+      navigation: {
+        standardPages,
+        projectPages
+      },
+      dashboard: kpiCards.length > 0 ? {
+        kpiCards
+      } : void 0,
+      tenants: tenantColumns.length > 0 || tenantActions.length > 0 ? {
+        columns: tenantColumns,
+        actions: tenantActions
+      } : void 0,
+      audit: auditActions.length > 0 ? {
+        actions: auditActions
+      } : void 0
+    };
+  }
+  /**
+   * Deterministic SHA-256 hash over the manifest. Uses the insertion
+   * order of the object keys — so that semantically meaningful reorders (e.g.
+   * the order of the sidebar items in `navigation.standardPages`) change the
+   * hash and invalidate the browser ETag cache. The manifest's own
+   * `manifestHash` field is hidden before serialization.
+   */
+  computeHash(manifest) {
+    const canonical = stableStringify({
+      ...manifest,
+      build: {
+        ...manifest.build,
+        manifestHash: void 0
+      }
+    });
+    const digest = createHash("sha256").update(canonical).digest("base64url");
+    return `sha256-${digest}`;
+  }
+};
+AdminManifestService = _ts_decorate6([
+  Injectable5(),
+  _ts_param4(0, Inject4(ADMIN_MANIFEST_CONFIG)),
+  _ts_param4(1, Optional()),
+  _ts_param4(1, Inject4(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig,
+    Object
+  ])
+], AdminManifestService);
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (value === void 0) return "null";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(stableStringify).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0);
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+  }
+  return JSON.stringify(value);
+}
+__name(stableStringify, "stableStringify");
+
+// src/admin/admin-public-boot.controller.ts
+import { Controller, Get, Inject as Inject5 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var AdminPublicBootController = class {
+  static {
+    __name(this, "AdminPublicBootController");
+  }
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  getBoot() {
+    return {
+      project: {
+        key: this.config.project.key,
+        displayName: this.config.project.displayName,
+        label: this.config.project.label,
+        icon: this.config.project.icon,
+        logoUrl: this.config.project.logoUrl,
+        environment: this.config.project.environment
+      }
+    };
+  }
+};
+_ts_decorate7([
+  Get("boot"),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", []),
+  _ts_metadata5("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
+], AdminPublicBootController.prototype, "getBoot", null);
+AdminPublicBootController = _ts_decorate7([
+  Controller("admin"),
+  _ts_param5(0, Inject5(ADMIN_MANIFEST_CONFIG)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig
+  ])
+], AdminPublicBootController);
+
+// src/admin/manifest-core.ts
+var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
+  navigation: {
+    // Key order is render order in the sidebar (within the
+    // section, see `DEFAULT_NAV_SECTIONS` in the nav-builder). The order per
+    // section is deliberately curated:
+    //   Overview: dashboard
+    //   Product catalog: discovery → bundles → businessTypes → plans →
+    //                   planVersions → marketingCatalog → promoCodes
+    //                   (promoCodes is appended by the app contributions
+    //                   and therefore lands at the end of the section)
+    //   Customers: tenants → users → pilots
+    //   System: audit
+    standardPages: {
+      dashboard: {
+        enabled: true,
+        requiredCapability: "dashboard.read"
+      },
+      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // Apps must set `discovery.read` in their manifest capabilities
+      // to `true` so that the NavBuilder wires the page into the
+      // sidebar; otherwise it is filtered out automatically.
+      discovery: {
+        enabled: true,
+        requiredCapability: "discovery.read"
+      },
+      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // Apps with a DB-driven catalog set `bundles.read = true`.
+      bundles: {
+        enabled: true,
+        requiredCapability: "bundles.read"
+      },
+      // SPEC_V2 §11.1 M3 — BusinessType editor in SuperAdmin.
+      // Apps with domain verticals set `businessTypes.read = true`.
+      businessTypes: {
+        enabled: true,
+        requiredCapability: "businessTypes.read"
+      },
+      plans: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      planVersions: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // Apps that market a public catalog set
+      // `marketingProjections.read = true`.
+      marketingCatalog: {
+        enabled: true,
+        requiredCapability: "marketingProjections.read"
+      },
+      tenants: {
+        enabled: true,
+        requiredCapability: "tenants.read"
+      },
+      users: {
+        enabled: true,
+        requiredCapability: "users.read"
+      },
+      pilots: {
+        enabled: true,
+        requiredCapability: "pilots.read"
+      },
+      // Audit log deliberately at the end — rarely needed, should
+      // not obscure the productive pages.
+      audit: {
+        enabled: true,
+        requiredCapability: "audit.read"
+      },
+      // Platform email sender (system/registration mails). Apps
+      // set `platformEmail.read = true` so that the NavBuilder wires the page
+      // in; otherwise it is filtered out automatically.
+      platformEmail: {
+        enabled: true,
+        requiredCapability: "platformEmail.read"
+      },
+      // Platform email history (audit of the sent system mails). Apps
+      // set `platformEmailHistory.read = true` so that the NavBuilder wires the
+      // page in; otherwise it is filtered out automatically.
+      platformEmailHistory: {
+        enabled: true,
+        requiredCapability: "platformEmailHistory.read"
+      }
+    }
+  },
+  tenants: {
+    actions: [
+      {
+        id: "platform.tenants.suspend",
+        label: "Mandant suspendieren",
+        actionKey: "tenants.suspend",
+        requiredCapability: "tenants.suspend",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.tenants.reactivate",
+        label: "Mandant reaktivieren",
+        actionKey: "tenants.reactivate",
+        requiredCapability: "tenants.reactivate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.impersonate",
+        label: "Impersonate",
+        actionKey: "tenants.impersonate",
+        requiredCapability: "tenants.impersonate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.export",
+        label: "DSGVO-Export",
+        actionKey: "tenants.export",
+        requiredCapability: "tenants.export",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.subscriptions.cancel",
+        label: "Subscription k\xFCndigen",
+        actionKey: "subscriptions.cancel",
+        requiredCapability: "subscriptions.cancel",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.grant",
+        label: "Pilot-Status setzen",
+        actionKey: "pilots.grant",
+        requiredCapability: "pilots.grant",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.pilots.revoke",
+        label: "Pilot-Status entziehen",
+        actionKey: "pilots.revoke",
+        requiredCapability: "pilots.revoke",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.extend",
+        label: "Pilot verl\xE4ngern",
+        actionKey: "pilots.extend",
+        requiredCapability: "pilots.extend",
+        requiresMfa: true,
+        confirmType: "date"
+      }
+    ]
+  },
+  audit: {
+    actions: [
+      {
+        key: "TENANT_SUSPEND",
+        label: "Mandant suspendiert",
+        severity: "high"
+      },
+      {
+        key: "TENANT_REACTIVATE",
+        label: "Mandant reaktiviert",
+        severity: "medium"
+      },
+      {
+        key: "TENANT_IMPERSONATE",
+        label: "Impersonation gestartet",
+        severity: "high"
+      },
+      {
+        key: "TENANT_EXPORT",
+        label: "DSGVO-Export ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_CREATE",
+        label: "Pilot-Tenant angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_GRANT",
+        label: "Pilot-Status gesetzt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_REVOKE",
+        label: "Pilot-Status entzogen",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_EXTEND",
+        label: "Pilot verl\xE4ngert",
+        severity: "low"
+      },
+      {
+        key: "PLAN_VERSION_PUBLISH",
+        label: "Plan-Version freigegeben",
+        severity: "high"
+      },
+      {
+        key: "PLAN_VERSION_TERMINATE",
+        label: "Plan-Version terminiert",
+        severity: "high"
+      },
+      {
+        key: "SUBSCRIPTION_CANCEL",
+        label: "Subscription gek\xFCndigt",
+        severity: "high"
+      },
+      {
+        key: "USER_RESET_PASSWORD",
+        label: "Passwort-Reset ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "USER_DEACTIVATE",
+        label: "User deaktiviert",
+        severity: "high"
+      },
+      {
+        key: "USER_REASSIGN_ADMIN",
+        label: "Admin-Rolle \xFCbertragen",
+        severity: "high"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_CREATE",
+        label: "Plattform-Absender angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_UPDATE",
+        label: "Plattform-Absender ge\xE4ndert",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_DELETE",
+        label: "Plattform-Absender gel\xF6scht",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_TEST",
+        label: "Plattform-Absender Test-Versand",
+        severity: "low"
+      },
+      {
+        key: "EMAIL_HISTORY_DELETE",
+        label: "Plattform-E-Mail aus Verlauf entfernt",
+        severity: "medium"
+      },
+      {
+        key: "EMAIL_HISTORY_RESEND",
+        label: "Plattform-E-Mail erneut versendet",
+        severity: "low"
+      }
+    ]
+  }
+};
+
+// src/admin/admin-manifest.module.ts
+import { Controller as Controller2, Get as Get2, Header, Headers, HttpCode, HttpStatus, Inject as Inject6, Module as Module2, Post, Res, UseGuards } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+function asConfigProvider(impl) {
+  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
+    return {
+      provide: ADMIN_MANIFEST_CONFIG,
+      useFactory: impl.useFactory,
+      inject: impl.inject
+    };
+  }
+  return {
+    provide: ADMIN_MANIFEST_CONFIG,
+    useValue: impl
+  };
+}
+__name(asConfigProvider, "asConfigProvider");
+function buildManifestController(guards, reloadGuards) {
+  const reloadChain = [
+    ...guards,
+    ...reloadGuards
+  ];
+  let GeneratedAdminManifestController = class GeneratedAdminManifestController {
+    static {
+      __name(this, "GeneratedAdminManifestController");
+    }
+    manifest;
+    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+    // `design:paramtypes` metadata, so Nest cannot otherwise resolve the
+    // service type at the constructor.
+    constructor(manifest) {
+      this.manifest = manifest;
+    }
+    getManifest(ifNoneMatch, res) {
+      const m = this.manifest.getManifest();
+      const etag = `"${m.build.manifestHash}"`;
+      res.header("ETag", etag);
+      if (ifNoneMatch && ifNoneMatch === etag) {
+        res.status(HttpStatus.NOT_MODIFIED);
+        return null;
+      }
+      return m;
+    }
+    reload() {
+      const m = this.manifest.rebuild();
+      return {
+        manifestHash: m.build.manifestHash,
+        reloadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  };
+  _ts_decorate8([
+    Get2("manifest"),
+    Header("Cache-Control", "private, max-age=60, must-revalidate"),
+    _ts_param6(0, Headers("if-none-match")),
+    _ts_param6(1, Res({
+      passthrough: true
+    })),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      Object,
+      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
+    ]),
+    _ts_metadata6("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "getManifest", null);
+  _ts_decorate8([
+    Post("manifest/reload"),
+    UseGuards(...reloadChain),
+    HttpCode(HttpStatus.OK),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", []),
+    _ts_metadata6("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "reload", null);
+  GeneratedAdminManifestController = _ts_decorate8([
+    Controller2("admin"),
+    UseGuards(...guards),
+    _ts_param6(0, Inject6(AdminManifestService)),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      typeof AdminManifestService === "undefined" ? Object : AdminManifestService
+    ])
+  ], GeneratedAdminManifestController);
+  return GeneratedAdminManifestController;
+}
+__name(buildManifestController, "buildManifestController");
+var AdminManifestModule = class _AdminManifestModule {
+  static {
+    __name(this, "AdminManifestModule");
+  }
+  static forRoot(options) {
+    const includeManifestController = options.includeManifestController ?? true;
+    const registerPlatformCore = options.registerPlatformCore ?? true;
+    const controllers = [
+      AdminPublicBootController
+    ];
+    if (includeManifestController) {
+      if (options.guards === void 0) {
+        throw new Error("AdminManifestModule.forRoot: `guards` ist Pflicht, wenn `includeManifestController` aktiv ist (Default `true`). Setze `guards: [JwtAuthGuard, SuperAdminGuard]` (oder analog) \u2014 oder `guards: []`, um den Endpoint absichtlich auth-frei zu betreiben. Alternative: `includeManifestController: false` und einen eigenen Wrapping-Controller registrieren.");
+      }
+      controllers.push(buildManifestController(options.guards, options.reloadGuards ?? []));
+    }
+    const providers = [
+      asConfigProvider(options.config),
+      AdminManifestService,
+      ...options.extraProviders ?? []
+    ];
+    if (registerPlatformCore) {
+      providers.push({
+        provide: PLATFORM_CORE_CONTRIBUTION_TOKEN,
+        useValue: PLATFORM_CORE_MANIFEST_CONTRIBUTION
+      });
+    }
+    return {
+      module: _AdminManifestModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers,
+      providers,
+      exports: [
+        ADMIN_MANIFEST_CONFIG,
+        AdminManifestService
+      ]
+    };
+  }
+};
+AdminManifestModule = _ts_decorate8([
+  Module2({})
+], AdminManifestModule);
+
+export {
+  SuperAdminGuard,
+  MfaService,
+  REQUIRE_MFA_KEY,
+  RequireMfa,
+  MfaGuard,
+  AdminBypassRlsInterceptor,
+  AdminModule,
+  ADMIN_MANIFEST_CONFIG,
+  PLATFORM_CORE_CONTRIBUTION_TOKEN,
+  AdminManifestService,
+  AdminPublicBootController,
+  PLATFORM_CORE_MANIFEST_CONTRIBUTION,
+  AdminManifestModule
+};