@saasicat/nest 0.2.0

package/dist/admin/index.cjs

@@ -0,0 +1,1283 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from2, except, desc) => {
+  if (from2 && typeof from2 === "object" || typeof from2 === "function") {
+    for (let key of __getOwnPropNames(from2))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from2[key], enumerable: !(desc = __getOwnPropDesc(from2, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/admin/index.ts
+var admin_exports = {};
+__export(admin_exports, {
+  ADMIN_MANIFEST_CONFIG: () => ADMIN_MANIFEST_CONFIG,
+  ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN: () => ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
+  AUDIT_PORT_TOKEN: () => AUDIT_PORT_TOKEN,
+  AUDIT_STATS_PORT_TOKEN: () => AUDIT_STATS_PORT_TOKEN,
+  AdminAuditService: () => AdminAuditService,
+  AdminBypassRlsInterceptor: () => AdminBypassRlsInterceptor,
+  AdminManifestModule: () => AdminManifestModule,
+  AdminManifestService: () => AdminManifestService,
+  AdminModule: () => AdminModule,
+  AdminPublicBootController: () => AdminPublicBootController,
+  AdminStatsController: () => AdminStatsController,
+  AdminStatsModule: () => AdminStatsModule,
+  AdminStatsService: () => AdminStatsService,
+  MFA_PORT_TOKEN: () => MFA_PORT_TOKEN,
+  MfaGuard: () => MfaGuard,
+  MfaService: () => MfaService,
+  PLATFORM_CORE_CONTRIBUTION_TOKEN: () => PLATFORM_CORE_CONTRIBUTION_TOKEN,
+  PLATFORM_CORE_MANIFEST_CONTRIBUTION: () => PLATFORM_CORE_MANIFEST_CONTRIBUTION,
+  PROMO_CODE_STATS_PORT_TOKEN: () => PROMO_CODE_STATS_PORT_TOKEN,
+  REQUIRE_MFA_KEY: () => REQUIRE_MFA_KEY,
+  RLS_BYPASS_PORT_TOKEN: () => RLS_BYPASS_PORT_TOKEN,
+  RequireMfa: () => RequireMfa,
+  SUBSCRIPTION_STATS_PORT_TOKEN: () => SUBSCRIPTION_STATS_PORT_TOKEN,
+  SuperAdminGuard: () => SuperAdminGuard
+});
+module.exports = __toCommonJS(admin_exports);
+
+// src/admin/tokens.ts
+var MFA_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/MfaPort");
+var AUDIT_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AuditPort");
+var RLS_BYPASS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/RlsBypassPort");
+
+// src/admin/super-admin.guard.ts
+var import_common = require("@nestjs/common");
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+var SuperAdminGuard = class {
+  static {
+    __name(this, "SuperAdminGuard");
+  }
+  canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    if (!request.user) throw new import_common.ForbiddenException("Nicht authentifiziert");
+    if (request.user.role !== "SUPER_ADMIN") {
+      throw new import_common.ForbiddenException("Nur SUPER_ADMIN-Rolle erlaubt");
+    }
+    return true;
+  }
+};
+SuperAdminGuard = _ts_decorate([
+  (0, import_common.Injectable)()
+], SuperAdminGuard);
+
+// src/admin/mfa.guard.ts
+var import_common3 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+
+// src/admin/mfa.ts
+var import_common2 = require("@nestjs/common");
+var import_otplib = require("otplib");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var CLOCK_DRIFT_TOLERANCE_SECONDS = 30;
+var OTPLIB_TOKEN_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "TokenError",
+  "TokenFormatError",
+  "TokenLengthError"
+]);
+function isOtplibTokenError(error) {
+  return error instanceof Error && OTPLIB_TOKEN_ERROR_NAMES.has(error.name);
+}
+__name(isOtplibTokenError, "isOtplibTokenError");
+var MfaService = class _MfaService {
+  static {
+    __name(this, "MfaService");
+  }
+  mfa;
+  logger = new import_common2.Logger(_MfaService.name);
+  constructor(mfa) {
+    this.mfa = mfa;
+  }
+  /**
+   * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+   * and returns the secret + the otpauth URI for the QR code.
+   *
+   * `issuer` and `label` shape the display in the authenticator (e.g.
+   * "DemoApp:taci@example.com").
+   */
+  async setup(userId, label, issuer) {
+    const secret = (0, import_otplib.generateSecret)();
+    const otpauthUri = (0, import_otplib.generateURI)({
+      issuer,
+      label,
+      secret
+    });
+    await this.mfa.setSecret(userId, secret);
+    return {
+      secret,
+      otpauthUri
+    };
+  }
+  /**
+   * Verifies the entered code against the stored secret,
+   * clock-drift-tolerant by ±1 time step.
+   */
+  async verify(input) {
+    const secret = await this.mfa.getSecret(input.userId);
+    if (!secret) return false;
+    try {
+      const result = await (0, import_otplib.verify)({
+        secret,
+        token: input.code.trim(),
+        epochTolerance: CLOCK_DRIFT_TOLERANCE_SECONDS
+      });
+      return result.valid;
+    } catch (error) {
+      if (isOtplibTokenError(error)) {
+        return false;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`TOTP-Verify f\xFCr User ${input.userId} unerwartet fehlgeschlagen: ${message}`);
+      return false;
+    }
+  }
+  /**
+   * Deletes a user's secret — used by `ahp admin mfa-reset`.
+   */
+  async disable(userId) {
+    await this.mfa.setSecret(userId, null);
+  }
+  /** Delegates to `MfaPort.isEnabled`. */
+  async isEnabled(userId) {
+    return this.mfa.isEnabled(userId);
+  }
+};
+MfaService = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_param(0, (0, import_common2.Inject)(MFA_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MfaPort === "undefined" ? Object : MfaPort
+  ])
+], MfaService);
+
+// src/admin/mfa.guard.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+var RequireMfa = /* @__PURE__ */ __name(() => (0, import_common3.SetMetadata)(REQUIRE_MFA_KEY, true), "RequireMfa");
+var MfaGuard = class _MfaGuard {
+  static {
+    __name(this, "MfaGuard");
+  }
+  reflector;
+  mfaService;
+  logger = new import_common3.Logger(_MfaGuard.name);
+  constructor(reflector, mfaService) {
+    this.reflector = reflector;
+    this.mfaService = mfaService;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_MFA_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required) return true;
+    if (process.env.SAAS_PLATFORM_SKIP_MFA === "1" && process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) throw new import_common3.UnauthorizedException({
+      reason: "NOT_AUTHENTICATED"
+    });
+    const enabled = await this.mfaService.isEnabled(user.id);
+    if (!enabled) {
+      throw new import_common3.UnauthorizedException({
+        reason: "MFA_NOT_SET_UP",
+        message: "Bitte zuerst MFA-Setup \xFCber das CLI ausf\xFChren."
+      });
+    }
+    const headerVal = request.headers?.["x-mfa-code"];
+    const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+    if (!code) {
+      throw new import_common3.UnauthorizedException({
+        reason: "MFA_REQUIRED",
+        message: "TOTP-Code im Header X-Mfa-Code erforderlich."
+      });
+    }
+    const valid = await this.mfaService.verify({
+      userId: user.id,
+      code: String(code)
+    });
+    if (!valid) {
+      throw new import_common3.UnauthorizedException({
+        reason: "MFA_FAILED",
+        message: "TOTP-Code ung\xFCltig."
+      });
+    }
+    return true;
+  }
+};
+MfaGuard = _ts_decorate3([
+  (0, import_common3.Injectable)(),
+  _ts_param2(0, (0, import_common3.Inject)(import_core.Reflector)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], MfaGuard);
+
+// src/admin/admin-audit.service.ts
+var os = __toESM(require("os"), 1);
+var import_common4 = require("@nestjs/common");
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var AdminAuditService = class {
+  static {
+    __name(this, "AdminAuditService");
+  }
+  audit;
+  constructor(audit) {
+    this.audit = audit;
+  }
+  async log(input) {
+    await this.audit.write({
+      actor: input.actor,
+      entity: input.entity,
+      entityId: input.entityId,
+      action: input.action,
+      changes: {
+        ...input.changes ?? {},
+        actor: this.actorTag(input.actor)
+      }
+    });
+  }
+  /**
+   * Standardized actor tag for the `changes.actor` column:
+   * `<source>:<email>:<context>`.
+   */
+  actorTag(actor) {
+    return `${actor.source}:${actor.email}:${actor.context}`;
+  }
+  /** Helper: build an AdminActor from an authenticated web request. */
+  fromWebRequest(user, sessionId) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "web",
+      context: sessionId ?? "unknown"
+    };
+  }
+  /** Helper: build an AdminActor from a CLI identity (hostname as context). */
+  fromCli(user) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "cli",
+      context: os.hostname()
+    };
+  }
+};
+AdminAuditService = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_param3(0, (0, import_common4.Inject)(AUDIT_PORT_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof AuditPort === "undefined" ? Object : AuditPort
+  ])
+], AdminAuditService);
+
+// src/admin/admin-bypass-rls.interceptor.ts
+var import_common5 = require("@nestjs/common");
+var import_rxjs = require("rxjs");
+var import_operators = require("rxjs/operators");
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var AdminBypassRlsInterceptor = class {
+  static {
+    __name(this, "AdminBypassRlsInterceptor");
+  }
+  port;
+  constructor(port) {
+    this.port = port;
+  }
+  intercept(_context, next) {
+    return (0, import_rxjs.defer)(() => (0, import_rxjs.from)(this.port.runWithBypass(async () => {
+      return next.handle();
+    })).pipe((0, import_operators.switchAll)()));
+  }
+};
+AdminBypassRlsInterceptor = _ts_decorate5([
+  (0, import_common5.Injectable)(),
+  _ts_param4(0, (0, import_common5.Inject)(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof RlsBypassPort === "undefined" ? Object : RlsBypassPort
+  ])
+], AdminBypassRlsInterceptor);
+
+// src/admin/module.ts
+var import_common6 = require("@nestjs/common");
+
+// src/core/di.ts
+function asProvider(token, impl) {
+  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
+    const factory = impl;
+    return {
+      provide: token,
+      useFactory: factory.useFactory,
+      inject: factory.inject
+    };
+  }
+  return {
+    provide: token,
+    useValue: impl
+  };
+}
+__name(asProvider, "asProvider");
+
+// src/admin/module.ts
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+var AdminModule = class _AdminModule {
+  static {
+    __name(this, "AdminModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      asProvider(MFA_PORT_TOKEN, options.mfaPort),
+      asProvider(AUDIT_PORT_TOKEN, options.auditPort),
+      asProvider(RLS_BYPASS_PORT_TOKEN, options.rlsBypassPort),
+      MfaService,
+      AdminAuditService,
+      SuperAdminGuard,
+      MfaGuard,
+      AdminBypassRlsInterceptor
+    ];
+    return {
+      module: _AdminModule,
+      global: options.global ?? false,
+      providers,
+      exports: [
+        MFA_PORT_TOKEN,
+        AUDIT_PORT_TOKEN,
+        RLS_BYPASS_PORT_TOKEN,
+        MfaService,
+        AdminAuditService,
+        SuperAdminGuard,
+        MfaGuard,
+        AdminBypassRlsInterceptor
+      ]
+    };
+  }
+};
+AdminModule = _ts_decorate6([
+  (0, import_common6.Module)({})
+], AdminModule);
+
+// src/admin/admin-manifest.config.ts
+var ADMIN_MANIFEST_CONFIG = /* @__PURE__ */ Symbol("ADMIN_MANIFEST_CONFIG");
+
+// src/admin/admin-manifest.service.ts
+var import_common7 = require("@nestjs/common");
+var import_node_crypto = require("crypto");
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var PLATFORM_CORE_CONTRIBUTION_TOKEN = /* @__PURE__ */ Symbol("PLATFORM_CORE_CONTRIBUTION");
+var AdminManifestService = class _AdminManifestService {
+  static {
+    __name(this, "AdminManifestService");
+  }
+  config;
+  logger = new import_common7.Logger(_AdminManifestService.name);
+  contributions = [];
+  cached = null;
+  constructor(config, platformCore = null) {
+    this.config = config;
+    if (platformCore) {
+      this.contributions.push(platformCore);
+    }
+  }
+  register(contribution) {
+    this.contributions.push(contribution);
+    this.cached = null;
+  }
+  getManifest() {
+    if (this.cached) return this.cached;
+    this.cached = this.build();
+    this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${this.cached.build.manifestHash.slice(0, 24)}\u2026`);
+    return this.cached;
+  }
+  rebuild() {
+    this.cached = null;
+    return this.getManifest();
+  }
+  build() {
+    const merged = this.mergeContributions(this.contributions);
+    const draft = {
+      schemaVersion: 1,
+      project: this.config.project,
+      build: {
+        ...this.config.build,
+        manifestHash: "sha256-pending"
+      },
+      planCatalogSnapshot: this.config.planCatalogSnapshot,
+      capabilities: merged.capabilities,
+      navigation: merged.navigation,
+      dashboard: merged.dashboard,
+      tenants: merged.tenants,
+      audit: merged.audit
+    };
+    return {
+      ...draft,
+      build: {
+        ...draft.build,
+        manifestHash: this.computeHash(draft)
+      }
+    };
+  }
+  mergeContributions(contributions) {
+    const capabilities = {};
+    const standardPages = {};
+    const projectPages = [];
+    const kpiCards = [];
+    const tenantColumns = [];
+    const tenantActions = [];
+    const auditActions = [];
+    for (const c of contributions) {
+      if (c.capabilities) Object.assign(capabilities, c.capabilities);
+      if (c.navigation?.standardPages) Object.assign(standardPages, c.navigation.standardPages);
+      if (c.navigation?.projectPages) projectPages.push(...c.navigation.projectPages);
+      if (c.dashboard?.kpiCards) kpiCards.push(...c.dashboard.kpiCards);
+      if (c.tenants?.columns) tenantColumns.push(...c.tenants.columns);
+      if (c.tenants?.actions) tenantActions.push(...c.tenants.actions);
+      if (c.audit?.actions) auditActions.push(...c.audit.actions);
+    }
+    kpiCards.sort((a, b) => (b.slotPriority ?? 0) - (a.slotPriority ?? 0));
+    return {
+      capabilities,
+      navigation: {
+        standardPages,
+        projectPages
+      },
+      dashboard: kpiCards.length > 0 ? {
+        kpiCards
+      } : void 0,
+      tenants: tenantColumns.length > 0 || tenantActions.length > 0 ? {
+        columns: tenantColumns,
+        actions: tenantActions
+      } : void 0,
+      audit: auditActions.length > 0 ? {
+        actions: auditActions
+      } : void 0
+    };
+  }
+  /**
+   * Deterministic SHA-256 hash over the manifest. Uses the insertion
+   * order of the object keys — so that semantically meaningful reorders (e.g.
+   * the order of the sidebar items in `navigation.standardPages`) change the
+   * hash and invalidate the browser ETag cache. The manifest's own
+   * `manifestHash` field is hidden before serialization.
+   */
+  computeHash(manifest) {
+    const canonical = stableStringify({
+      ...manifest,
+      build: {
+        ...manifest.build,
+        manifestHash: void 0
+      }
+    });
+    const digest = (0, import_node_crypto.createHash)("sha256").update(canonical).digest("base64url");
+    return `sha256-${digest}`;
+  }
+};
+AdminManifestService = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param5(0, (0, import_common7.Inject)(ADMIN_MANIFEST_CONFIG)),
+  _ts_param5(1, (0, import_common7.Optional)()),
+  _ts_param5(1, (0, import_common7.Inject)(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig,
+    Object
+  ])
+], AdminManifestService);
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (value === void 0) return "null";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(stableStringify).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0);
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+  }
+  return JSON.stringify(value);
+}
+__name(stableStringify, "stableStringify");
+
+// src/admin/admin-public-boot.controller.ts
+var import_common8 = require("@nestjs/common");
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+var AdminPublicBootController = class {
+  static {
+    __name(this, "AdminPublicBootController");
+  }
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  getBoot() {
+    return {
+      project: {
+        key: this.config.project.key,
+        displayName: this.config.project.displayName,
+        label: this.config.project.label,
+        icon: this.config.project.icon,
+        logoUrl: this.config.project.logoUrl,
+        environment: this.config.project.environment
+      }
+    };
+  }
+};
+_ts_decorate8([
+  (0, import_common8.Get)("boot"),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
+], AdminPublicBootController.prototype, "getBoot", null);
+AdminPublicBootController = _ts_decorate8([
+  (0, import_common8.Controller)("admin"),
+  _ts_param6(0, (0, import_common8.Inject)(ADMIN_MANIFEST_CONFIG)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig
+  ])
+], AdminPublicBootController);
+
+// src/admin/admin-manifest.module.ts
+var import_common9 = require("@nestjs/common");
+
+// src/admin/manifest-core.ts
+var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
+  navigation: {
+    // Key order is render order in the sidebar (within the
+    // section, see `DEFAULT_NAV_SECTIONS` in the nav-builder). The order per
+    // section is deliberately curated:
+    //   Overview: dashboard
+    //   Product catalog: discovery → bundles → businessTypes → plans →
+    //                   planVersions → marketingCatalog → promoCodes
+    //                   (promoCodes is appended by the app contributions
+    //                   and therefore lands at the end of the section)
+    //   Customers: tenants → users → pilots
+    //   System: audit
+    standardPages: {
+      dashboard: {
+        enabled: true,
+        requiredCapability: "dashboard.read"
+      },
+      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // Apps must set `discovery.read` in their manifest capabilities
+      // to `true` so that the NavBuilder wires the page into the
+      // sidebar; otherwise it is filtered out automatically.
+      discovery: {
+        enabled: true,
+        requiredCapability: "discovery.read"
+      },
+      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // Apps with a DB-driven catalog set `bundles.read = true`.
+      bundles: {
+        enabled: true,
+        requiredCapability: "bundles.read"
+      },
+      // SPEC_V2 §11.1 M3 — BusinessType editor in SuperAdmin.
+      // Apps with domain verticals set `businessTypes.read = true`.
+      businessTypes: {
+        enabled: true,
+        requiredCapability: "businessTypes.read"
+      },
+      plans: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      planVersions: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // Apps that market a public catalog set
+      // `marketingProjections.read = true`.
+      marketingCatalog: {
+        enabled: true,
+        requiredCapability: "marketingProjections.read"
+      },
+      tenants: {
+        enabled: true,
+        requiredCapability: "tenants.read"
+      },
+      users: {
+        enabled: true,
+        requiredCapability: "users.read"
+      },
+      pilots: {
+        enabled: true,
+        requiredCapability: "pilots.read"
+      },
+      // Audit log deliberately at the end — rarely needed, should
+      // not obscure the productive pages.
+      audit: {
+        enabled: true,
+        requiredCapability: "audit.read"
+      },
+      // Platform email sender (system/registration mails). Apps
+      // set `platformEmail.read = true` so that the NavBuilder wires the page
+      // in; otherwise it is filtered out automatically.
+      platformEmail: {
+        enabled: true,
+        requiredCapability: "platformEmail.read"
+      },
+      // Platform email history (audit of the sent system mails). Apps
+      // set `platformEmailHistory.read = true` so that the NavBuilder wires the
+      // page in; otherwise it is filtered out automatically.
+      platformEmailHistory: {
+        enabled: true,
+        requiredCapability: "platformEmailHistory.read"
+      }
+    }
+  },
+  tenants: {
+    actions: [
+      {
+        id: "platform.tenants.suspend",
+        label: "Mandant suspendieren",
+        actionKey: "tenants.suspend",
+        requiredCapability: "tenants.suspend",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.tenants.reactivate",
+        label: "Mandant reaktivieren",
+        actionKey: "tenants.reactivate",
+        requiredCapability: "tenants.reactivate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.impersonate",
+        label: "Impersonate",
+        actionKey: "tenants.impersonate",
+        requiredCapability: "tenants.impersonate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.export",
+        label: "DSGVO-Export",
+        actionKey: "tenants.export",
+        requiredCapability: "tenants.export",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.subscriptions.cancel",
+        label: "Subscription k\xFCndigen",
+        actionKey: "subscriptions.cancel",
+        requiredCapability: "subscriptions.cancel",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.grant",
+        label: "Pilot-Status setzen",
+        actionKey: "pilots.grant",
+        requiredCapability: "pilots.grant",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.pilots.revoke",
+        label: "Pilot-Status entziehen",
+        actionKey: "pilots.revoke",
+        requiredCapability: "pilots.revoke",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.extend",
+        label: "Pilot verl\xE4ngern",
+        actionKey: "pilots.extend",
+        requiredCapability: "pilots.extend",
+        requiresMfa: true,
+        confirmType: "date"
+      }
+    ]
+  },
+  audit: {
+    actions: [
+      {
+        key: "TENANT_SUSPEND",
+        label: "Mandant suspendiert",
+        severity: "high"
+      },
+      {
+        key: "TENANT_REACTIVATE",
+        label: "Mandant reaktiviert",
+        severity: "medium"
+      },
+      {
+        key: "TENANT_IMPERSONATE",
+        label: "Impersonation gestartet",
+        severity: "high"
+      },
+      {
+        key: "TENANT_EXPORT",
+        label: "DSGVO-Export ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_CREATE",
+        label: "Pilot-Tenant angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_GRANT",
+        label: "Pilot-Status gesetzt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_REVOKE",
+        label: "Pilot-Status entzogen",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_EXTEND",
+        label: "Pilot verl\xE4ngert",
+        severity: "low"
+      },
+      {
+        key: "PLAN_VERSION_PUBLISH",
+        label: "Plan-Version freigegeben",
+        severity: "high"
+      },
+      {
+        key: "PLAN_VERSION_TERMINATE",
+        label: "Plan-Version terminiert",
+        severity: "high"
+      },
+      {
+        key: "SUBSCRIPTION_CANCEL",
+        label: "Subscription gek\xFCndigt",
+        severity: "high"
+      },
+      {
+        key: "USER_RESET_PASSWORD",
+        label: "Passwort-Reset ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "USER_DEACTIVATE",
+        label: "User deaktiviert",
+        severity: "high"
+      },
+      {
+        key: "USER_REASSIGN_ADMIN",
+        label: "Admin-Rolle \xFCbertragen",
+        severity: "high"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_CREATE",
+        label: "Plattform-Absender angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_UPDATE",
+        label: "Plattform-Absender ge\xE4ndert",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_DELETE",
+        label: "Plattform-Absender gel\xF6scht",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_TEST",
+        label: "Plattform-Absender Test-Versand",
+        severity: "low"
+      },
+      {
+        key: "EMAIL_HISTORY_DELETE",
+        label: "Plattform-E-Mail aus Verlauf entfernt",
+        severity: "medium"
+      },
+      {
+        key: "EMAIL_HISTORY_RESEND",
+        label: "Plattform-E-Mail erneut versendet",
+        severity: "low"
+      }
+    ]
+  }
+};
+
+// src/admin/admin-manifest.module.ts
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+function asConfigProvider(impl) {
+  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
+    return {
+      provide: ADMIN_MANIFEST_CONFIG,
+      useFactory: impl.useFactory,
+      inject: impl.inject
+    };
+  }
+  return {
+    provide: ADMIN_MANIFEST_CONFIG,
+    useValue: impl
+  };
+}
+__name(asConfigProvider, "asConfigProvider");
+function buildManifestController(guards, reloadGuards) {
+  const reloadChain = [
+    ...guards,
+    ...reloadGuards
+  ];
+  let GeneratedAdminManifestController = class GeneratedAdminManifestController {
+    static {
+      __name(this, "GeneratedAdminManifestController");
+    }
+    manifest;
+    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+    // `design:paramtypes` metadata, so Nest cannot otherwise resolve the
+    // service type at the constructor.
+    constructor(manifest) {
+      this.manifest = manifest;
+    }
+    getManifest(ifNoneMatch, res) {
+      const m = this.manifest.getManifest();
+      const etag = `"${m.build.manifestHash}"`;
+      res.header("ETag", etag);
+      if (ifNoneMatch && ifNoneMatch === etag) {
+        res.status(import_common9.HttpStatus.NOT_MODIFIED);
+        return null;
+      }
+      return m;
+    }
+    reload() {
+      const m = this.manifest.rebuild();
+      return {
+        manifestHash: m.build.manifestHash,
+        reloadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  };
+  _ts_decorate9([
+    (0, import_common9.Get)("manifest"),
+    (0, import_common9.Header)("Cache-Control", "private, max-age=60, must-revalidate"),
+    _ts_param7(0, (0, import_common9.Headers)("if-none-match")),
+    _ts_param7(1, (0, import_common9.Res)({
+      passthrough: true
+    })),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      Object,
+      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
+    ]),
+    _ts_metadata7("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "getManifest", null);
+  _ts_decorate9([
+    (0, import_common9.Post)("manifest/reload"),
+    (0, import_common9.UseGuards)(...reloadChain),
+    (0, import_common9.HttpCode)(import_common9.HttpStatus.OK),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", []),
+    _ts_metadata7("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "reload", null);
+  GeneratedAdminManifestController = _ts_decorate9([
+    (0, import_common9.Controller)("admin"),
+    (0, import_common9.UseGuards)(...guards),
+    _ts_param7(0, (0, import_common9.Inject)(AdminManifestService)),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof AdminManifestService === "undefined" ? Object : AdminManifestService
+    ])
+  ], GeneratedAdminManifestController);
+  return GeneratedAdminManifestController;
+}
+__name(buildManifestController, "buildManifestController");
+var AdminManifestModule = class _AdminManifestModule {
+  static {
+    __name(this, "AdminManifestModule");
+  }
+  static forRoot(options) {
+    const includeManifestController = options.includeManifestController ?? true;
+    const registerPlatformCore = options.registerPlatformCore ?? true;
+    const controllers = [
+      AdminPublicBootController
+    ];
+    if (includeManifestController) {
+      if (options.guards === void 0) {
+        throw new Error("AdminManifestModule.forRoot: `guards` ist Pflicht, wenn `includeManifestController` aktiv ist (Default `true`). Setze `guards: [JwtAuthGuard, SuperAdminGuard]` (oder analog) \u2014 oder `guards: []`, um den Endpoint absichtlich auth-frei zu betreiben. Alternative: `includeManifestController: false` und einen eigenen Wrapping-Controller registrieren.");
+      }
+      controllers.push(buildManifestController(options.guards, options.reloadGuards ?? []));
+    }
+    const providers = [
+      asConfigProvider(options.config),
+      AdminManifestService,
+      ...options.extraProviders ?? []
+    ];
+    if (registerPlatformCore) {
+      providers.push({
+        provide: PLATFORM_CORE_CONTRIBUTION_TOKEN,
+        useValue: PLATFORM_CORE_MANIFEST_CONTRIBUTION
+      });
+    }
+    return {
+      module: _AdminManifestModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers,
+      providers,
+      exports: [
+        ADMIN_MANIFEST_CONFIG,
+        AdminManifestService
+      ]
+    };
+  }
+};
+AdminManifestModule = _ts_decorate9([
+  (0, import_common9.Module)({})
+], AdminManifestModule);
+
+// src/admin/admin-stats.tokens.ts
+var SUBSCRIPTION_STATS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionStatsPort");
+var PROMO_CODE_STATS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PromoCodeStatsPort");
+var AUDIT_STATS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AuditStatsPort");
+var ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AdminStatsAuditWindowDays");
+
+// src/admin/admin-stats.service.ts
+var import_common10 = require("@nestjs/common");
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param8(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param8, "_ts_param");
+var DAY_MS = 864e5;
+var DEFAULT_AUDIT_WINDOW_DAYS = 7;
+var AdminStatsService = class {
+  static {
+    __name(this, "AdminStatsService");
+  }
+  subscriptions;
+  promos;
+  audit;
+  auditWindowDays;
+  constructor(subscriptions, promos, audit, auditWindowDays = DEFAULT_AUDIT_WINDOW_DAYS) {
+    this.subscriptions = subscriptions;
+    this.promos = promos;
+    this.audit = audit;
+    this.auditWindowDays = auditWindowDays;
+  }
+  async getSnapshot() {
+    const since = new Date(Date.now() - this.auditWindowDays * DAY_MS);
+    const [subscriptions, promos, auditCount] = await Promise.all([
+      this.subscriptions.getStats(),
+      this.promos.getStats(),
+      this.audit.countSince(since)
+    ]);
+    return {
+      subscriptions,
+      promos,
+      audit: {
+        countLastNDays: auditCount,
+        nDays: this.auditWindowDays
+      }
+    };
+  }
+};
+AdminStatsService = _ts_decorate10([
+  (0, import_common10.Injectable)(),
+  _ts_param8(0, (0, import_common10.Inject)(SUBSCRIPTION_STATS_PORT_TOKEN)),
+  _ts_param8(1, (0, import_common10.Inject)(PROMO_CODE_STATS_PORT_TOKEN)),
+  _ts_param8(2, (0, import_common10.Inject)(AUDIT_STATS_PORT_TOKEN)),
+  _ts_param8(3, (0, import_common10.Optional)()),
+  _ts_param8(3, (0, import_common10.Inject)(ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof SubscriptionStatsPort === "undefined" ? Object : SubscriptionStatsPort,
+    typeof PromoCodeStatsPort === "undefined" ? Object : PromoCodeStatsPort,
+    typeof AuditStatsPort === "undefined" ? Object : AuditStatsPort,
+    Number
+  ])
+], AdminStatsService);
+
+// src/admin/admin-stats.controller.ts
+var import_common11 = require("@nestjs/common");
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata9(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata9, "_ts_metadata");
+function _ts_param9(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param9, "_ts_param");
+var AdminStatsController = class {
+  static {
+    __name(this, "AdminStatsController");
+  }
+  stats;
+  // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+  // `design:paramtypes` metadata, so Nest could otherwise not resolve the
+  // service type at the constructor.
+  constructor(stats) {
+    this.stats = stats;
+  }
+  async getDashboardSnapshot() {
+    return this.stats.getSnapshot();
+  }
+};
+_ts_decorate11([
+  (0, import_common11.Get)("dashboard"),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", []),
+  _ts_metadata9("design:returntype", Promise)
+], AdminStatsController.prototype, "getDashboardSnapshot", null);
+AdminStatsController = _ts_decorate11([
+  (0, import_common11.Controller)("admin/stats"),
+  (0, import_common11.UseGuards)(SuperAdminGuard),
+  _ts_param9(0, (0, import_common11.Inject)(AdminStatsService)),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    typeof AdminStatsService === "undefined" ? Object : AdminStatsService
+  ])
+], AdminStatsController);
+
+// src/admin/admin-stats.module.ts
+var import_common12 = require("@nestjs/common");
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+var AdminStatsModule = class _AdminStatsModule {
+  static {
+    __name(this, "AdminStatsModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      asProvider(SUBSCRIPTION_STATS_PORT_TOKEN, options.subscriptionStatsPort),
+      asProvider(PROMO_CODE_STATS_PORT_TOKEN, options.promoCodeStatsPort),
+      asProvider(AUDIT_STATS_PORT_TOKEN, options.auditStatsPort),
+      AdminStatsService,
+      SuperAdminGuard
+    ];
+    if (options.auditWindowDays !== void 0) {
+      providers.push({
+        provide: ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
+        useValue: options.auditWindowDays
+      });
+    }
+    if (options.extraProviders) providers.push(...options.extraProviders);
+    return {
+      module: _AdminStatsModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers: [
+        AdminStatsController
+      ],
+      providers,
+      exports: [
+        AdminStatsService,
+        SuperAdminGuard
+      ]
+    };
+  }
+};
+AdminStatsModule = _ts_decorate12([
+  (0, import_common12.Module)({})
+], AdminStatsModule);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ADMIN_MANIFEST_CONFIG,
+  ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
+  AUDIT_PORT_TOKEN,
+  AUDIT_STATS_PORT_TOKEN,
+  AdminAuditService,
+  AdminBypassRlsInterceptor,
+  AdminManifestModule,
+  AdminManifestService,
+  AdminModule,
+  AdminPublicBootController,
+  AdminStatsController,
+  AdminStatsModule,
+  AdminStatsService,
+  MFA_PORT_TOKEN,
+  MfaGuard,
+  MfaService,
+  PLATFORM_CORE_CONTRIBUTION_TOKEN,
+  PLATFORM_CORE_MANIFEST_CONTRIBUTION,
+  PROMO_CODE_STATS_PORT_TOKEN,
+  REQUIRE_MFA_KEY,
+  RLS_BYPASS_PORT_TOKEN,
+  RequireMfa,
+  SUBSCRIPTION_STATS_PORT_TOKEN,
+  SuperAdminGuard
+});