@saasicat/nest 0.2.0

package/dist/chunk-XSGU2Y2O.js

@@ -0,0 +1,1611 @@
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/registration/helpers.ts
+import { createHash, randomInt, timingSafeEqual } from "crypto";
+function generateOtpCode() {
+  return String(randomInt(1e5, 1e6));
+}
+__name(generateOtpCode, "generateOtpCode");
+function hashOtpCode(code) {
+  return createHash("sha256").update(code).digest("hex");
+}
+__name(hashOtpCode, "hashOtpCode");
+function verifyOtpCode(expectedHash, code) {
+  const actual = hashOtpCode(code);
+  if (actual.length !== expectedHash.length) {
+    return false;
+  }
+  try {
+    return timingSafeEqual(Buffer.from(actual, "hex"), Buffer.from(expectedHash, "hex"));
+  } catch {
+    return false;
+  }
+}
+__name(verifyOtpCode, "verifyOtpCode");
+function slugify(name) {
+  const transliterated = name.toLowerCase().replace(/ß/g, "ss").replace(/ä/g, "ae").replace(/ö/g, "oe").replace(/ü/g, "ue").normalize("NFKD").replace(/[̀-ͯ]/g, "");
+  const slug = transliterated.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "verein";
+}
+__name(slugify, "slugify");
+
+// src/registration/tokens.ts
+var PENDING_REGISTRATION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol("PENDING_REGISTRATION_REPOSITORY");
+var REGISTRATION_OTP_DELIVERY_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_OTP_DELIVERY");
+var USER_ACCOUNT_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("USER_ACCOUNT_LOOKUP");
+var SLUG_AVAILABILITY_CHECK_TOKEN = /* @__PURE__ */ Symbol("SLUG_AVAILABILITY_CHECK");
+var PASSWORD_HASHER_TOKEN = /* @__PURE__ */ Symbol("PASSWORD_HASHER");
+var PLAN_CATALOG_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("PLAN_CATALOG_LOOKUP");
+var PAYMENT_PROVIDER_TOKEN = /* @__PURE__ */ Symbol("PAYMENT_PROVIDER");
+var PAYMENT_EVENT_LOG_TOKEN = /* @__PURE__ */ Symbol("PAYMENT_EVENT_LOG");
+var ACTIVATION_ORCHESTRATOR_TOKEN = /* @__PURE__ */ Symbol("ACTIVATION_ORCHESTRATOR");
+var REGISTRATION_AUDIT_LOGGER_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_AUDIT_LOGGER");
+var REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_TOKEN_SIGNER");
+var REGISTRATION_RESUME_DELIVERY_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_DELIVERY");
+var REGISTRATION_RESUME_BASE_URL_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_BASE_URL");
+var REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_CONFIGURATOR_LOOKUP");
+var REGISTRATION_PROMO_PREVIEW_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_PROMO_PREVIEW");
+var REGISTRATION_BUSINESS_TYPE_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_BUSINESS_TYPE_LOOKUP");
+var REGISTRATION_CONFIG_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_CONFIG");
+
+// src/registration/pending-registration.service.ts
+import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Optional } from "@nestjs/common";
+import { REGISTRATION_RESUME_TTL_MINUTES } from "@saasicat/types";
+import { OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, REGISTRATION_STEP_BY_STATUS } from "@saasicat/types";
+
+// src/registration/pricing.ts
+function round2(value) {
+  return Math.round(value * 100) / 100;
+}
+__name(round2, "round2");
+function computeBreakdown(catalog, selection, promo) {
+  const model = catalog.models.find((m) => m.id === selection.modelId);
+  if (!model) {
+    throw new Error(`Unknown model: ${selection.modelId}`);
+  }
+  const modelMonthlyNet = round2(model.monthlyNet);
+  const effectiveQuotas = {
+    ...model.quotaBase
+  };
+  const subtotalMonthlyNet = modelMonthlyNet;
+  const factor = selection.billingCycle === "YEARLY" ? catalog.cycleDiscount : 1;
+  const subtotalNet = round2(subtotalMonthlyNet * factor);
+  const discountAmount = promo ? Math.min(round2(promo.discountAmount), subtotalNet) : 0;
+  const totalNet = Math.max(0, round2(subtotalNet - discountAmount));
+  const totalGross = round2(totalNet * (1 + catalog.vatRate / 100));
+  const yearlySavings = selection.billingCycle === "YEARLY" ? round2(subtotalMonthlyNet * 12 - subtotalMonthlyNet * catalog.cycleDiscount) : 0;
+  return {
+    cycle: selection.billingCycle,
+    effectiveQuotas,
+    modelMonthlyNet,
+    subtotalMonthlyNet,
+    subtotalNet,
+    discountAmount,
+    totalNet,
+    vatRate: catalog.vatRate,
+    totalGross,
+    yearlySavings,
+    appliedPromo: promo ? {
+      code: "",
+      label: promo.label,
+      percent: promo.percent
+    } : void 0
+  };
+}
+__name(computeBreakdown, "computeBreakdown");
+function resolveModel(catalog, modelId) {
+  const model = catalog.models.find((m) => m.id === modelId);
+  if (!model) throw new Error(`Unknown model: ${modelId}`);
+  return {
+    planId: model.planId,
+    monthlyNet: model.monthlyNet,
+    yearlyNet: model.yearlyNet
+  };
+}
+__name(resolveModel, "resolveModel");
+
+// src/registration/pending-registration.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var PendingRegistrationService = class _PendingRegistrationService {
+  static {
+    __name(this, "PendingRegistrationService");
+  }
+  repo;
+  otpDelivery;
+  userLookup;
+  slugCheck;
+  passwordHasher;
+  planCatalog;
+  paymentProvider;
+  paymentEventLog;
+  activationOrchestrator;
+  audit;
+  resumeTokenSigner;
+  resumeDelivery;
+  resumeBaseUrl;
+  configuratorLookup;
+  promoPreview;
+  businessTypeLookup;
+  logger = new Logger(_PendingRegistrationService.name);
+  constructor(repo, otpDelivery, userLookup, slugCheck, passwordHasher, planCatalog, paymentProvider, paymentEventLog, activationOrchestrator, audit, resumeTokenSigner, resumeDelivery, resumeBaseUrl, configuratorLookup, promoPreview, businessTypeLookup) {
+    this.repo = repo;
+    this.otpDelivery = otpDelivery;
+    this.userLookup = userLookup;
+    this.slugCheck = slugCheck;
+    this.passwordHasher = passwordHasher;
+    this.planCatalog = planCatalog;
+    this.paymentProvider = paymentProvider;
+    this.paymentEventLog = paymentEventLog;
+    this.activationOrchestrator = activationOrchestrator;
+    this.audit = audit;
+    this.resumeTokenSigner = resumeTokenSigner;
+    this.resumeDelivery = resumeDelivery;
+    this.resumeBaseUrl = resumeBaseUrl;
+    this.configuratorLookup = configuratorLookup;
+    this.promoPreview = promoPreview;
+    this.businessTypeLookup = businessTypeLookup;
+  }
+  async record(eventType, pendingRegistrationId, context, metadata) {
+    try {
+      await this.audit.log({
+        eventType,
+        pendingRegistrationId,
+        context,
+        metadata
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`Audit-Log fehlgeschlagen (${eventType}): ${message}`);
+    }
+  }
+  /** Public signup plan list for step 3 (frontend `usePublicPlans()`). */
+  async listPublicPlans() {
+    return this.planCatalog.listPublicSignupPlans();
+  }
+  async selectPlan(input, context) {
+    const pending = await this.repo.findById(input.pendingRegistrationId);
+    if (!pending) {
+      throw new NotFoundException({
+        code: "PENDING_REGISTRATION_NOT_FOUND"
+      });
+    }
+    if (pending.expiresAt.getTime() < Date.now()) {
+      throw new BadRequestException({
+        code: "PENDING_REGISTRATION_EXPIRED"
+      });
+    }
+    if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
+      throw new BadRequestException({
+        code: "INVALID_REGISTRATION_STATE"
+      });
+    }
+    const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
+    if (!plan) {
+      throw new BadRequestException({
+        code: "PLAN_NOT_AVAILABLE"
+      });
+    }
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const updated = await this.repo.update(pending.id, {
+      status: "PLAN_SELECTED",
+      currentStep: 4,
+      selectedPlanId: plan.id,
+      expiresAt
+    });
+    await this.record("PLAN_SELECTED", updated.id, context, {
+      planId: plan.id
+    });
+    return {
+      pendingRegistrationId: updated.id,
+      status: updated.status,
+      nextStep: REGISTRATION_STEP_BY_STATUS[updated.status],
+      selectedPlanId: updated.selectedPlanId ?? plan.id
+    };
+  }
+  async startCheckout(input, context) {
+    const pending = await this.repo.findById(input.pendingRegistrationId);
+    if (!pending) {
+      throw new NotFoundException({
+        code: "PENDING_REGISTRATION_NOT_FOUND"
+      });
+    }
+    if (pending.expiresAt.getTime() < Date.now()) {
+      throw new BadRequestException({
+        code: "PENDING_REGISTRATION_EXPIRED"
+      });
+    }
+    if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
+      throw new BadRequestException({
+        code: "PLAN_NOT_SELECTED"
+      });
+    }
+    if (!pending.selectedPlanId) {
+      throw new BadRequestException({
+        code: "PLAN_NOT_SELECTED"
+      });
+    }
+    const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
+    if (!plan) {
+      throw new BadRequestException({
+        code: "PLAN_NOT_AVAILABLE"
+      });
+    }
+    const session = await this.paymentProvider.createCheckoutSession({
+      pendingRegistrationId: pending.id,
+      planId: pending.selectedPlanId,
+      email: pending.email,
+      successUrl: input.successUrl,
+      cancelUrl: input.cancelUrl
+    });
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(now.getTime() + PENDING_CHECKOUT_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const updated = await this.repo.update(pending.id, {
+      status: "CHECKOUT_STARTED",
+      currentStep: 4,
+      checkoutSessionId: session.sessionId,
+      checkoutStartedAt: now,
+      expiresAt
+    });
+    await this.record("CHECKOUT_STARTED", updated.id, context, {
+      sessionId: session.sessionId,
+      provider: session.provider
+    });
+    return {
+      pendingRegistrationId: updated.id,
+      status: updated.status,
+      nextStep: REGISTRATION_STEP_BY_STATUS[updated.status],
+      checkoutSessionId: session.sessionId,
+      checkoutUrl: session.checkoutUrl
+    };
+  }
+  /**
+   * Processes a payment webhook idempotently:
+   *  1. `tryClaim` pins the event ID via a @unique INSERT. Duplicates are
+   *     dropped silently (`ALREADY_PROCESSED`).
+   *  2. On status `SUCCEEDED` the PendingRegistration is resolved from the
+   *     checkout session and the ActivationOrchestrator triggers the final
+   *     user+tenant+subscription creation in a single transaction.
+   *  3. After activation the PendingRegistration is deleted.
+   *
+   * On errors in step 2/3 the EventLog entry remains — provider retries then
+   * run into ALREADY_PROCESSED. Operational repair is done manually (status
+   * inspection + cleanup).
+   */
+  async handlePaymentEvent(input, context) {
+    const claimed = await this.paymentEventLog.tryClaim(input.eventId, {
+      provider: input.provider,
+      sessionId: input.sessionId,
+      status: input.status,
+      rawPayload: input.rawPayload
+    });
+    if (!claimed) {
+      this.logger.warn(`Idempotenz: PaymentEvent ${input.eventId} bereits verarbeitet \u2014 Duplikat verworfen.`);
+      await this.record("PAYMENT_DUPLICATE_IGNORED", null, context, {
+        eventId: input.eventId,
+        sessionId: input.sessionId
+      });
+      return {
+        activated: false,
+        reason: "ALREADY_PROCESSED"
+      };
+    }
+    if (input.status !== "SUCCEEDED") {
+      await this.record("PAYMENT_FAILED", null, context, {
+        eventId: input.eventId,
+        sessionId: input.sessionId
+      });
+      return {
+        activated: false,
+        reason: "PAYMENT_NOT_SUCCEEDED"
+      };
+    }
+    if (!input.sessionId) {
+      return {
+        activated: false,
+        reason: "MISSING_SESSION_ID"
+      };
+    }
+    const pending = await this.repo.findByCheckoutSession(input.sessionId);
+    if (!pending) {
+      return {
+        activated: false,
+        reason: "PENDING_REGISTRATION_NOT_FOUND"
+      };
+    }
+    if (pending.status !== "CHECKOUT_STARTED" && pending.status !== "PLAN_SELECTED") {
+      return {
+        activated: false,
+        reason: "INVALID_STATE"
+      };
+    }
+    await this.record("PAYMENT_RECEIVED", pending.id, context, {
+      eventId: input.eventId,
+      sessionId: input.sessionId
+    });
+    const result = await this.activationOrchestrator.activate(pending);
+    await this.repo.delete(pending.id);
+    await this.record("ACTIVATION_COMPLETED", pending.id, context, {
+      userId: result.userId,
+      tenantId: result.tenantId,
+      subscriptionId: result.subscriptionId
+    });
+    this.logger.log(`Aktivierung erfolgreich: pending=${pending.id} \u2192 user=${result.userId} tenant=${result.tenantId} subscription=${result.subscriptionId}`);
+    return {
+      activated: true,
+      result
+    };
+  }
+  /**
+   * Deletes all PendingRegistration records with `expiresAt < now`.
+   * Full deletion (no anonymization path) is the simpler option: the schema
+   * holds `email`, `firstName`, `lastName`, `passwordHash` as NOT NULL, and
+   * the unique email is exactly what needs to become free again after expiry.
+   *
+   * The batch `limit` guards against memory spikes on large backlogs — the
+   * caller (cron) keeps calling until `moreAvailable === false`.
+   */
+  async runCleanup(now, limit = 500) {
+    if (limit <= 0) {
+      return {
+        deleted: 0,
+        moreAvailable: false
+      };
+    }
+    const expired = await this.repo.findExpired(now, limit);
+    for (const pending of expired) {
+      try {
+        await this.repo.delete(pending.id);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        this.logger.warn(`Cleanup: PendingRegistration ${pending.id} konnte nicht geloescht werden (${message}).`);
+      }
+    }
+    if (expired.length > 0) {
+      this.logger.log(`Cleanup: ${expired.length} abgelaufene PendingRegistrations geloescht.`);
+    }
+    return {
+      deleted: expired.length,
+      moreAvailable: expired.length >= limit
+    };
+  }
+  async start(input, context) {
+    const email = normalizeEmail(input.email);
+    if (await this.userLookup.hasActiveUser(email)) {
+      this.logger.log(`register/start fuer aktiven Account ignoriert (${email}).`);
+      await this.record("REGISTRATION_NEUTRAL_ACTIVE_USER", null, context);
+      return {
+        neutral: true
+      };
+    }
+    const existing = await this.repo.findByEmail(email);
+    if (existing) {
+      if (existing.expiresAt.getTime() < Date.now()) {
+        await this.repo.delete(existing.id);
+        await this.record("REGISTRATION_NEUTRAL_EXPIRED", existing.id, context);
+      } else if (existing.status === "PENDING_EMAIL_VERIFICATION") {
+        await this.regenerateOtp(existing);
+        await this.record("REGISTRATION_NEUTRAL_REPLAY", existing.id, context, {
+          status: existing.status
+        });
+        return {
+          neutral: true
+        };
+      } else {
+        if (this.resumeTokenSigner && this.resumeDelivery) {
+          await this.sendResumeLink(existing);
+        } else {
+          await this.regenerateOtp(existing);
+        }
+        await this.record("REGISTRATION_NEUTRAL_REPLAY", existing.id, context, {
+          status: existing.status
+        });
+        return {
+          neutral: true
+        };
+      }
+    }
+    const slug = await this.resolveSlug(input.tenantName, input.tenantSlug);
+    const passwordHash = await this.passwordHasher.hash(input.password);
+    const code = generateOtpCode();
+    const otpHash = hashOtpCode(code);
+    const now = /* @__PURE__ */ new Date();
+    const otpExpiresAt = new Date(now.getTime() + OTP_TTL_MINUTES * 60 * 1e3);
+    const expiresAt = new Date(now.getTime() + PENDING_EMAIL_TTL_HOURS * 60 * 60 * 1e3);
+    const pending = await this.repo.create({
+      tenantName: input.tenantName.trim(),
+      tenantSlug: slug,
+      salutation: nullable(input.salutation),
+      firstName: input.firstName.trim(),
+      lastName: input.lastName.trim(),
+      email,
+      passwordHash,
+      locale: input.locale ?? "de",
+      otpHash,
+      otpExpiresAt,
+      expiresAt
+    });
+    await this.deliverOtp(pending, code);
+    await this.record("REGISTRATION_STARTED", pending.id, context);
+    return {
+      neutral: true
+    };
+  }
+  async verifyOtp(emailRaw, code, context) {
+    const email = normalizeEmail(emailRaw);
+    const pending = await this.repo.findByEmail(email);
+    if (!pending) {
+      await this.record("OTP_VERIFY_FAILED", null, context, {
+        reason: "unknown_email"
+      });
+      throw new BadRequestException({
+        code: "OTP_INVALID"
+      });
+    }
+    if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
+      return {
+        status: pending.status,
+        nextStep: REGISTRATION_STEP_BY_STATUS[pending.status],
+        pendingRegistrationId: pending.id
+      };
+    }
+    if (!pending.otpHash || !pending.otpExpiresAt) {
+      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
+        reason: "no_otp_set"
+      });
+      throw new BadRequestException({
+        code: "OTP_INVALID"
+      });
+    }
+    if (pending.otpExpiresAt.getTime() < Date.now()) {
+      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
+        reason: "expired"
+      });
+      throw new BadRequestException({
+        code: "OTP_EXPIRED"
+      });
+    }
+    const maxAttempts = resolveOtpVerifyMaxAttempts();
+    if (pending.otpAttemptCount >= maxAttempts) {
+      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
+        reason: "locked"
+      });
+      throw new BadRequestException({
+        code: "OTP_LOCKED"
+      });
+    }
+    const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
+    if (attemptCount > maxAttempts) {
+      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
+        reason: "locked"
+      });
+      throw new BadRequestException({
+        code: "OTP_LOCKED"
+      });
+    }
+    if (!verifyOtpCode(pending.otpHash, code)) {
+      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
+        reason: "wrong_code"
+      });
+      throw new BadRequestException({
+        code: "OTP_INVALID"
+      });
+    }
+    const now = /* @__PURE__ */ new Date();
+    const updated = await this.repo.update(pending.id, {
+      status: "EMAIL_VERIFIED",
+      currentStep: 3,
+      emailVerifiedAt: now,
+      otpHash: null,
+      otpExpiresAt: null,
+      expiresAt: new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3)
+    });
+    await this.record("OTP_VERIFIED", updated.id, context);
+    return {
+      status: updated.status,
+      nextStep: REGISTRATION_STEP_BY_STATUS[updated.status],
+      pendingRegistrationId: updated.id
+    };
+  }
+  async resendOtp(emailRaw, context) {
+    const email = normalizeEmail(emailRaw);
+    const pending = await this.repo.findByEmail(email);
+    if (!pending) {
+      return {
+        neutral: true
+      };
+    }
+    if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
+      return {
+        neutral: true
+      };
+    }
+    await this.regenerateOtp(pending);
+    await this.record("OTP_RESEND_REQUESTED", pending.id, context);
+    return {
+      neutral: true
+    };
+  }
+  async regenerateOtp(pending) {
+    const now = /* @__PURE__ */ new Date();
+    const windowMs = OTP_RATE_LIMIT_WINDOW_MINUTES * 60 * 1e3;
+    const withinWindow = pending.lastOtpSentAt !== null && now.getTime() - pending.lastOtpSentAt.getTime() < windowMs;
+    if (withinWindow && pending.otpSendCount >= OTP_RATE_LIMIT_MAX_SENDS) {
+      this.logger.warn(`OTP-Rate-Limit erreicht fuer ${pending.email} \u2014 Send wird still verworfen.`);
+      return;
+    }
+    const code = generateOtpCode();
+    const otpHash = hashOtpCode(code);
+    const otpExpiresAt = new Date(now.getTime() + OTP_TTL_MINUTES * 60 * 1e3);
+    const otpSendCount = withinWindow ? pending.otpSendCount + 1 : 1;
+    await this.repo.update(pending.id, {
+      otpHash,
+      otpExpiresAt,
+      otpSendCount,
+      lastOtpSentAt: now,
+      // New code = fresh attempt budget. Overall throughput stays capped
+      // by the send rate limit above.
+      otpAttemptCount: 0
+    });
+    await this.deliverOtp(pending, code);
+  }
+  async deliverOtp(pending, code) {
+    try {
+      await this.otpDelivery.sendVerificationOtp({
+        to: pending.email,
+        code,
+        firstName: pending.firstName,
+        locale: pending.locale
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`OTP-Mail an ${pending.email} fehlgeschlagen: ${message}`);
+    }
+  }
+  /**
+   * Creates a signed resume token (60 min TTL) and sends a magic link to the
+   * stored email. Mail send errors are logged but not escalated
+   * (account-enumeration protection).
+   */
+  async sendResumeLink(pending) {
+    if (!this.resumeTokenSigner || !this.resumeDelivery) {
+      return;
+    }
+    const token = await this.resumeTokenSigner.sign({
+      pendingRegistrationId: pending.id,
+      ttlMinutes: REGISTRATION_RESUME_TTL_MINUTES
+    });
+    const base = (this.resumeBaseUrl ?? "http://localhost").replace(/\/+$/, "");
+    const url = `${base}/login?resume=${encodeURIComponent(token)}`;
+    try {
+      await this.resumeDelivery.sendResumeEmail({
+        to: pending.email,
+        firstName: pending.firstName,
+        locale: pending.locale,
+        resumeUrl: url
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.error(`Resume-Mail an ${pending.email} fehlgeschlagen: ${message}`);
+    }
+  }
+  /**
+   * Resolves a resume token to the matching onboarding step. Called by the
+   * frontend from `/register?resume=<jwt>`. On an invalid token the method
+   * throws `RESUME_TOKEN_INVALID`.
+   *
+   * Also returns a public-safe snapshot of the PendingRegistration so the
+   * frontend can prefill completed steps with the existing data (first name /
+   * last name, organization name, plan selection ...).
+   */
+  async resumeWithToken(input, context) {
+    if (!this.resumeTokenSigner) {
+      throw new BadRequestException({
+        code: "RESUME_NOT_CONFIGURED"
+      });
+    }
+    let decoded;
+    try {
+      decoded = await this.resumeTokenSigner.verify(input.token);
+    } catch {
+      throw new BadRequestException({
+        code: "RESUME_TOKEN_INVALID"
+      });
+    }
+    const pending = await this.repo.findById(decoded.pendingRegistrationId);
+    if (!pending) {
+      throw new BadRequestException({
+        code: "RESUME_TOKEN_INVALID"
+      });
+    }
+    if (pending.expiresAt.getTime() < Date.now()) {
+      throw new BadRequestException({
+        code: "PENDING_REGISTRATION_EXPIRED"
+      });
+    }
+    await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
+      via: "resume_token",
+      status: pending.status
+    });
+    return {
+      pendingRegistrationId: pending.id,
+      status: pending.status,
+      nextStep: REGISTRATION_STEP_BY_STATUS[pending.status],
+      snapshot: toSnapshot(pending)
+    };
+  }
+  /**
+   * Signs a short-lived resume token for an existing PendingRegistration —
+   * the login endpoint uses this to send the user into the wizard with
+   * prefill after successful password verification.
+   */
+  async signResumeToken(pendingRegistrationId) {
+    if (!this.resumeTokenSigner) return null;
+    return this.resumeTokenSigner.sign({
+      pendingRegistrationId
+    });
+  }
+  /* ─── Configurator (Step 3) ────────────────────────────────────────── */
+  /** Returns the (app-specific) configurator catalog. */
+  async getConfiguratorCatalog() {
+    if (!this.configuratorLookup) {
+      throw new BadRequestException({
+        code: "CONFIGURATOR_NOT_CONFIGURED"
+      });
+    }
+    return this.configuratorLookup.getCatalog();
+  }
+  /**
+   * Saves the configurator selection (model + cycle + promo) and returns the
+   * full price breakdown.
+   *
+   * Sets:
+   *  - `status = PLAN_SELECTED`
+   *  - `currentStep = 4`
+   *  - `selectedPlanId = <planId from the chosen model>`
+   *  - `configJson` / `billingCycle` / `appliedPromoCode`
+   *  - `expiresAt = now + ONBOARDING_TTL`
+   */
+  async saveConfiguration(input, context) {
+    if (!this.configuratorLookup) {
+      throw new BadRequestException({
+        code: "CONFIGURATOR_NOT_CONFIGURED"
+      });
+    }
+    const pending = await this.repo.findById(input.pendingRegistrationId);
+    if (!pending) {
+      throw new NotFoundException({
+        code: "PENDING_REGISTRATION_NOT_FOUND"
+      });
+    }
+    if (pending.expiresAt.getTime() < Date.now()) {
+      throw new BadRequestException({
+        code: "PENDING_REGISTRATION_EXPIRED"
+      });
+    }
+    if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
+      throw new BadRequestException({
+        code: "INVALID_REGISTRATION_STATE"
+      });
+    }
+    const catalog = await this.configuratorLookup.getCatalog();
+    const model = catalog.models.find((m) => m.id === input.selection.modelId);
+    if (!model) {
+      throw new BadRequestException({
+        code: "MODEL_NOT_AVAILABLE"
+      });
+    }
+    if (input.selection.businessTypeVersionId && this.businessTypeLookup) {
+      const view = await this.businessTypeLookup.findPublishedVersion(input.selection.businessTypeVersionId);
+      if (!view) {
+        throw new BadRequestException({
+          code: "BUSINESS_TYPE_NOT_AVAILABLE"
+        });
+      }
+    }
+    let promoEval;
+    if (input.selection.appliedPromoCode && this.promoPreview) {
+      const dryRun = computeBreakdown(catalog, {
+        ...input.selection,
+        appliedPromoCode: null
+      });
+      const previewResult = await this.promoPreview.preview({
+        code: input.selection.appliedPromoCode,
+        planId: model.planId,
+        billingCycle: input.selection.billingCycle,
+        subtotalGross: dryRun.totalGross,
+        email: pending.email
+      });
+      if (previewResult.valid && previewResult.discountAmount && previewResult.percent !== void 0 && previewResult.label) {
+        promoEval = {
+          discountAmount: previewResult.discountAmount,
+          percent: previewResult.percent,
+          label: previewResult.label
+        };
+      }
+    }
+    const breakdown = computeBreakdown(catalog, input.selection, promoEval);
+    if (promoEval) {
+      breakdown.appliedPromo = {
+        code: input.selection.appliedPromoCode,
+        label: promoEval.label,
+        percent: promoEval.percent
+      };
+    }
+    const now = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(now.getTime() + PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
+    const updated = await this.repo.update(pending.id, {
+      status: "PLAN_SELECTED",
+      currentStep: 4,
+      selectedPlanId: model.planId,
+      configJson: input.selection,
+      billingCycle: input.selection.billingCycle,
+      appliedPromoCode: input.selection.appliedPromoCode ?? null,
+      expiresAt
+    });
+    await this.record("PLAN_SELECTED", updated.id, context, {
+      modelId: model.id,
+      planId: model.planId,
+      cycle: input.selection.billingCycle,
+      hasPromo: !!promoEval
+    });
+    return {
+      pendingRegistrationId: updated.id,
+      status: updated.status,
+      nextStep: REGISTRATION_STEP_BY_STATUS[updated.status],
+      selection: input.selection,
+      breakdown
+    };
+  }
+  /**
+   * Validates a promo code against the currently stored configuration and
+   * returns a new breakdown. Does NOT modify the pending — for live preview
+   * in the frontend. If `null` is passed as `code`, the promo effect is
+   * removed.
+   */
+  async previewConfigPromo(pendingRegistrationId, code) {
+    if (!this.configuratorLookup) {
+      throw new BadRequestException({
+        code: "CONFIGURATOR_NOT_CONFIGURED"
+      });
+    }
+    const pending = await this.repo.findById(pendingRegistrationId);
+    if (!pending) {
+      throw new NotFoundException({
+        code: "PENDING_REGISTRATION_NOT_FOUND"
+      });
+    }
+    const config = pending.configJson;
+    if (!config) {
+      throw new BadRequestException({
+        code: "CONFIG_NOT_SAVED"
+      });
+    }
+    const catalog = await this.configuratorLookup.getCatalog();
+    const model = catalog.models.find((m) => m.id === config.modelId);
+    if (!model) {
+      throw new BadRequestException({
+        code: "MODEL_NOT_AVAILABLE"
+      });
+    }
+    let promoEval;
+    if (code && this.promoPreview) {
+      const dryRun = computeBreakdown(catalog, {
+        ...config,
+        appliedPromoCode: null
+      });
+      const previewResult = await this.promoPreview.preview({
+        code,
+        planId: model.planId,
+        billingCycle: config.billingCycle,
+        subtotalGross: dryRun.totalGross,
+        email: pending.email
+      });
+      if (previewResult.valid && previewResult.discountAmount && previewResult.percent !== void 0 && previewResult.label) {
+        promoEval = {
+          discountAmount: previewResult.discountAmount,
+          percent: previewResult.percent,
+          label: previewResult.label
+        };
+      }
+    }
+    const breakdown = computeBreakdown(catalog, config, promoEval);
+    if (promoEval && code) {
+      breakdown.appliedPromo = {
+        code,
+        label: promoEval.label,
+        percent: promoEval.percent
+      };
+    }
+    return breakdown;
+  }
+  /**
+   * Helper for step 3 resume: the frontend needs the current breakdown when
+   * the pending already has a configuration. Pure recomputation against the
+   * catalog (without promo validation, since promos should be freshly checked
+   * anyway).
+   */
+  async getCurrentBreakdown(pendingRegistrationId) {
+    if (!this.configuratorLookup) return null;
+    const pending = await this.repo.findById(pendingRegistrationId);
+    if (!pending || !pending.configJson) return null;
+    const catalog = await this.configuratorLookup.getCatalog();
+    return computeBreakdown(catalog, pending.configJson);
+  }
+  async resolveSlug(tenantName, requested) {
+    const requestedSlug = requested?.trim().toLowerCase() ?? "";
+    const base = requestedSlug.length > 0 ? requestedSlug : slugify(tenantName);
+    if (await this.slugCheck.isSlugAvailable(base)) {
+      return base;
+    }
+    for (let i = 2; i < 1e3; i++) {
+      const candidate = `${base}-${i}`;
+      if (await this.slugCheck.isSlugAvailable(candidate)) {
+        return candidate;
+      }
+    }
+    throw new Error(`Konnte keinen freien Slug fuer "${tenantName}" finden.`);
+  }
+};
+PendingRegistrationService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(PENDING_REGISTRATION_REPOSITORY_TOKEN)),
+  _ts_param(1, Inject(REGISTRATION_OTP_DELIVERY_TOKEN)),
+  _ts_param(2, Inject(USER_ACCOUNT_LOOKUP_TOKEN)),
+  _ts_param(3, Inject(SLUG_AVAILABILITY_CHECK_TOKEN)),
+  _ts_param(4, Inject(PASSWORD_HASHER_TOKEN)),
+  _ts_param(5, Inject(PLAN_CATALOG_LOOKUP_TOKEN)),
+  _ts_param(6, Inject(PAYMENT_PROVIDER_TOKEN)),
+  _ts_param(7, Inject(PAYMENT_EVENT_LOG_TOKEN)),
+  _ts_param(8, Inject(ACTIVATION_ORCHESTRATOR_TOKEN)),
+  _ts_param(9, Inject(REGISTRATION_AUDIT_LOGGER_TOKEN)),
+  _ts_param(10, Optional()),
+  _ts_param(10, Inject(REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN)),
+  _ts_param(11, Optional()),
+  _ts_param(11, Inject(REGISTRATION_RESUME_DELIVERY_TOKEN)),
+  _ts_param(12, Optional()),
+  _ts_param(12, Inject(REGISTRATION_RESUME_BASE_URL_TOKEN)),
+  _ts_param(13, Optional()),
+  _ts_param(13, Inject(REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN)),
+  _ts_param(14, Optional()),
+  _ts_param(14, Inject(REGISTRATION_PROMO_PREVIEW_TOKEN)),
+  _ts_param(15, Optional()),
+  _ts_param(15, Inject(REGISTRATION_BUSINESS_TYPE_LOOKUP_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof PendingRegistrationRepository === "undefined" ? Object : PendingRegistrationRepository,
+    typeof RegistrationOtpDelivery === "undefined" ? Object : RegistrationOtpDelivery,
+    typeof UserAccountLookup === "undefined" ? Object : UserAccountLookup,
+    typeof SlugAvailabilityCheck === "undefined" ? Object : SlugAvailabilityCheck,
+    typeof PasswordHasher === "undefined" ? Object : PasswordHasher,
+    typeof PlanCatalogLookup === "undefined" ? Object : PlanCatalogLookup,
+    typeof PaymentProvider === "undefined" ? Object : PaymentProvider,
+    typeof PaymentEventLog === "undefined" ? Object : PaymentEventLog,
+    typeof ActivationOrchestrator === "undefined" ? Object : ActivationOrchestrator,
+    typeof RegistrationAuditLogger === "undefined" ? Object : RegistrationAuditLogger,
+    typeof RegistrationResumeTokenSigner === "undefined" ? Object : RegistrationResumeTokenSigner,
+    typeof RegistrationResumeDelivery === "undefined" ? Object : RegistrationResumeDelivery,
+    String,
+    typeof RegistrationConfiguratorLookup === "undefined" ? Object : RegistrationConfiguratorLookup,
+    typeof RegistrationPromoPreview === "undefined" ? Object : RegistrationPromoPreview,
+    typeof RegistrationBusinessTypeLookup === "undefined" ? Object : RegistrationBusinessTypeLookup
+  ])
+], PendingRegistrationService);
+function normalizeEmail(value) {
+  return value.trim().toLowerCase();
+}
+__name(normalizeEmail, "normalizeEmail");
+function resolveOtpVerifyMaxAttempts() {
+  const raw = process.env.SAAS_PLATFORM_OTP_VERIFY_MAX_ATTEMPTS;
+  if (!raw) return OTP_VERIFY_MAX_ATTEMPTS;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : OTP_VERIFY_MAX_ATTEMPTS;
+}
+__name(resolveOtpVerifyMaxAttempts, "resolveOtpVerifyMaxAttempts");
+function toSnapshot(pending) {
+  return {
+    tenantName: pending.tenantName,
+    tenantSlug: pending.tenantSlug,
+    salutation: pending.salutation,
+    firstName: pending.firstName,
+    lastName: pending.lastName,
+    email: pending.email,
+    locale: pending.locale,
+    status: pending.status,
+    currentStep: pending.currentStep,
+    emailVerifiedAt: pending.emailVerifiedAt?.toISOString() ?? null,
+    selectedPlanId: pending.selectedPlanId,
+    config: pending.configJson,
+    billingCycle: pending.billingCycle,
+    appliedPromoCode: pending.appliedPromoCode,
+    checkoutSessionId: pending.checkoutSessionId
+  };
+}
+__name(toSnapshot, "toSnapshot");
+function nullable(value) {
+  const trimmed = value?.trim();
+  return trimmed && trimmed.length > 0 ? trimmed : null;
+}
+__name(nullable, "nullable");
+
+// src/registration/cleanup.cron.ts
+import { Injectable as Injectable2, Logger as Logger2 } from "@nestjs/common";
+import { Cron, CronExpression } from "@nestjs/schedule";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var RegistrationCleanupCron = class _RegistrationCleanupCron {
+  static {
+    __name(this, "RegistrationCleanupCron");
+  }
+  service;
+  logger = new Logger2(_RegistrationCleanupCron.name);
+  constructor(service) {
+    this.service = service;
+  }
+  async runDaily() {
+    await this.runCleanup();
+  }
+  /**
+   * Public API: can be triggered manually from an admin endpoint /
+   * `/admin/registration/run-cleanup` (same pattern as
+   * `PromoCodeExpirer.run` in the consuming apps).
+   */
+  async runCleanup(now = /* @__PURE__ */ new Date(), batchSize = 500) {
+    let totalDeleted = 0;
+    let iterations = 0;
+    const MAX_ITERATIONS = 50;
+    while (iterations < MAX_ITERATIONS) {
+      const result = await this.service.runCleanup(now, batchSize);
+      totalDeleted += result.deleted;
+      iterations++;
+      if (!result.moreAvailable) {
+        break;
+      }
+    }
+    if (totalDeleted > 0) {
+      this.logger.log(`PendingRegistration-Cleanup abgeschlossen: ${totalDeleted} geloescht in ${iterations} Batches.`);
+    }
+  }
+};
+_ts_decorate2([
+  Cron("15 4 * * *", {
+    timeZone: "Europe/Berlin"
+  }),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", Promise)
+], RegistrationCleanupCron.prototype, "runDaily", null);
+RegistrationCleanupCron = _ts_decorate2([
+  Injectable2(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof PendingRegistrationService === "undefined" ? Object : PendingRegistrationService
+  ])
+], RegistrationCleanupCron);
+
+// src/registration/ip-rate-limit.guard.ts
+import { HttpException, HttpStatus, Injectable as Injectable3 } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var BaseIpRateLimitGuard = class {
+  static {
+    __name(this, "BaseIpRateLimitGuard");
+  }
+  options;
+  buckets = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+  }
+  canActivate(context) {
+    if (process.env.SAAS_PLATFORM_SKIP_RATE_LIMITS === "1" && process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    const req = context.switchToHttp().getRequest();
+    const key = ipFingerprint(req);
+    if (this.exceeded(key)) {
+      throw new HttpException({
+        code: "RATE_LIMITED",
+        reason: this.options.name,
+        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
+      }, HttpStatus.TOO_MANY_REQUESTS);
+    }
+    return true;
+  }
+  exceeded(key) {
+    const now = Date.now();
+    const bucket = this.buckets.get(key);
+    if (!bucket || now - bucket.windowStart > this.options.windowMs) {
+      this.buckets.set(key, {
+        count: 1,
+        windowStart: now
+      });
+      return false;
+    }
+    bucket.count += 1;
+    return bucket.count > this.options.limit;
+  }
+};
+BaseIpRateLimitGuard = _ts_decorate3([
+  Injectable3(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    Object
+  ])
+], BaseIpRateLimitGuard);
+function ipFingerprint(req) {
+  const fwd = req.headers["x-forwarded-for"];
+  const first = Array.isArray(fwd) ? fwd[0] : fwd?.split(",")[0]?.trim();
+  return first || req.ip || "unknown";
+}
+__name(ipFingerprint, "ipFingerprint");
+
+// src/registration/module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+var RegistrationModule = class _RegistrationModule {
+  static {
+    __name(this, "RegistrationModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      ...options.extraProviders ?? [],
+      asProvider(PENDING_REGISTRATION_REPOSITORY_TOKEN, options.pendingRegistrationRepository),
+      asProvider(REGISTRATION_OTP_DELIVERY_TOKEN, options.otpDelivery),
+      asProvider(USER_ACCOUNT_LOOKUP_TOKEN, options.userAccountLookup),
+      asProvider(SLUG_AVAILABILITY_CHECK_TOKEN, options.slugAvailabilityCheck),
+      asProvider(PASSWORD_HASHER_TOKEN, options.passwordHasher),
+      asProvider(PLAN_CATALOG_LOOKUP_TOKEN, options.planCatalogLookup),
+      asProvider(PAYMENT_PROVIDER_TOKEN, options.paymentProvider),
+      asProvider(PAYMENT_EVENT_LOG_TOKEN, options.paymentEventLog),
+      asProvider(ACTIVATION_ORCHESTRATOR_TOKEN, options.activationOrchestrator),
+      asProvider(REGISTRATION_AUDIT_LOGGER_TOKEN, options.auditLogger),
+      PendingRegistrationService
+    ];
+    if (options.resumeTokenSigner) {
+      providers.push(asProvider(REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, options.resumeTokenSigner));
+    }
+    if (options.resumeDelivery) {
+      providers.push(asProvider(REGISTRATION_RESUME_DELIVERY_TOKEN, options.resumeDelivery));
+    }
+    if (options.resumeBaseUrl !== void 0) {
+      providers.push({
+        provide: REGISTRATION_RESUME_BASE_URL_TOKEN,
+        useValue: options.resumeBaseUrl
+      });
+    }
+    if (options.configuratorLookup) {
+      providers.push(asProvider(REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, options.configuratorLookup));
+    }
+    if (options.promoPreview) {
+      providers.push(asProvider(REGISTRATION_PROMO_PREVIEW_TOKEN, options.promoPreview));
+    }
+    if (options.businessTypeLookup) {
+      providers.push(asProvider(REGISTRATION_BUSINESS_TYPE_LOOKUP_TOKEN, options.businessTypeLookup));
+    }
+    const includeCleanupCron = options.includeCleanupCron ?? true;
+    if (includeCleanupCron) {
+      providers.push(RegistrationCleanupCron);
+    }
+    return {
+      module: _RegistrationModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      providers,
+      exports: includeCleanupCron ? [
+        PendingRegistrationService,
+        RegistrationCleanupCron
+      ] : [
+        PendingRegistrationService
+      ]
+    };
+  }
+};
+RegistrationModule = _ts_decorate4([
+  Module({})
+], RegistrationModule);
+
+// src/registration/dto/register-start.dto.ts
+import { Equals, IsEmail, IsIn, IsOptional, IsString, Matches, MaxLength, MinLength } from "class-validator";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+var RegisterStartDto = class {
+  static {
+    __name(this, "RegisterStartDto");
+  }
+  /** Association/tenant name (required). */
+  tenantName;
+  /** Optional slug. If left empty, it is generated from `tenantName`. */
+  tenantSlug;
+  /** Salutation of the administrator (optional). */
+  salutation;
+  firstName;
+  lastName;
+  email;
+  password;
+  /** Terms / privacy / data processing — mandatory acceptance (must be `true`). */
+  termsAccepted;
+  locale;
+};
+_ts_decorate5([
+  IsString(),
+  MinLength(2),
+  MaxLength(120),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "tenantName", void 0);
+_ts_decorate5([
+  IsOptional(),
+  IsString(),
+  Matches(/^[a-z0-9-]+$/, {
+    message: "tenantSlug darf nur Kleinbuchstaben, Ziffern und Bindestriche enthalten."
+  }),
+  MaxLength(60),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "tenantSlug", void 0);
+_ts_decorate5([
+  IsOptional(),
+  IsString(),
+  MaxLength(40),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "salutation", void 0);
+_ts_decorate5([
+  IsString(),
+  MinLength(1),
+  MaxLength(60),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "firstName", void 0);
+_ts_decorate5([
+  IsString(),
+  MinLength(1),
+  MaxLength(60),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "lastName", void 0);
+_ts_decorate5([
+  IsEmail(),
+  MaxLength(160),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "email", void 0);
+_ts_decorate5([
+  IsString(),
+  MinLength(8),
+  MaxLength(160),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "password", void 0);
+_ts_decorate5([
+  Equals(true, {
+    message: "AGB, Datenschutzerklaerung und Auftragsverarbeitung muessen zugestimmt werden."
+  }),
+  _ts_metadata4("design:type", Boolean)
+], RegisterStartDto.prototype, "termsAccepted", void 0);
+_ts_decorate5([
+  IsOptional(),
+  IsIn([
+    "de",
+    "tr"
+  ]),
+  _ts_metadata4("design:type", String)
+], RegisterStartDto.prototype, "locale", void 0);
+
+// src/registration/dto/verify-registration-otp.dto.ts
+import { IsEmail as IsEmail2, IsString as IsString2, Matches as Matches2 } from "class-validator";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var VerifyRegistrationOtpDto = class {
+  static {
+    __name(this, "VerifyRegistrationOtpDto");
+  }
+  email;
+  otp;
+};
+_ts_decorate6([
+  IsEmail2(),
+  _ts_metadata5("design:type", String)
+], VerifyRegistrationOtpDto.prototype, "email", void 0);
+_ts_decorate6([
+  IsString2(),
+  Matches2(/^\d{6}$/, {
+    message: "OTP muss 6 Ziffern sein."
+  }),
+  _ts_metadata5("design:type", String)
+], VerifyRegistrationOtpDto.prototype, "otp", void 0);
+
+// src/registration/dto/resend-registration-otp.dto.ts
+import { IsEmail as IsEmail3 } from "class-validator";
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+var ResendRegistrationOtpDto = class {
+  static {
+    __name(this, "ResendRegistrationOtpDto");
+  }
+  email;
+};
+_ts_decorate7([
+  IsEmail3(),
+  _ts_metadata6("design:type", String)
+], ResendRegistrationOtpDto.prototype, "email", void 0);
+
+// src/registration/dto/select-plan.dto.ts
+import { IsString as IsString3, MaxLength as MaxLength2, MinLength as MinLength2 } from "class-validator";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+var SelectRegistrationPlanDto = class {
+  static {
+    __name(this, "SelectRegistrationPlanDto");
+  }
+  pendingRegistrationId;
+  planId;
+};
+_ts_decorate8([
+  IsString3(),
+  MinLength2(1),
+  MaxLength2(80),
+  _ts_metadata7("design:type", String)
+], SelectRegistrationPlanDto.prototype, "pendingRegistrationId", void 0);
+_ts_decorate8([
+  IsString3(),
+  MinLength2(1),
+  MaxLength2(40),
+  _ts_metadata7("design:type", String)
+], SelectRegistrationPlanDto.prototype, "planId", void 0);
+
+// src/registration/dto/start-checkout.dto.ts
+import { IsString as IsString4, IsUrl, MaxLength as MaxLength3, MinLength as MinLength3 } from "class-validator";
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+var StartRegistrationCheckoutDto = class {
+  static {
+    __name(this, "StartRegistrationCheckoutDto");
+  }
+  pendingRegistrationId;
+  successUrl;
+  cancelUrl;
+};
+_ts_decorate9([
+  IsString4(),
+  MinLength3(1),
+  MaxLength3(80),
+  _ts_metadata8("design:type", String)
+], StartRegistrationCheckoutDto.prototype, "pendingRegistrationId", void 0);
+_ts_decorate9([
+  IsUrl({
+    require_tld: false
+  }),
+  MaxLength3(500),
+  _ts_metadata8("design:type", String)
+], StartRegistrationCheckoutDto.prototype, "successUrl", void 0);
+_ts_decorate9([
+  IsUrl({
+    require_tld: false
+  }),
+  MaxLength3(500),
+  _ts_metadata8("design:type", String)
+], StartRegistrationCheckoutDto.prototype, "cancelUrl", void 0);
+
+// src/registration/dto/payment-webhook.dto.ts
+import { IsIn as IsIn2, IsObject, IsOptional as IsOptional2, IsString as IsString5, MaxLength as MaxLength4, MinLength as MinLength4 } from "class-validator";
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata9(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata9, "_ts_metadata");
+var PaymentWebhookDto = class {
+  static {
+    __name(this, "PaymentWebhookDto");
+  }
+  eventId;
+  sessionId;
+  provider;
+  status;
+  payload;
+};
+_ts_decorate10([
+  IsString5(),
+  MinLength4(1),
+  MaxLength4(120),
+  _ts_metadata9("design:type", String)
+], PaymentWebhookDto.prototype, "eventId", void 0);
+_ts_decorate10([
+  IsOptional2(),
+  IsString5(),
+  MaxLength4(120),
+  _ts_metadata9("design:type", String)
+], PaymentWebhookDto.prototype, "sessionId", void 0);
+_ts_decorate10([
+  IsString5(),
+  MaxLength4(40),
+  _ts_metadata9("design:type", String)
+], PaymentWebhookDto.prototype, "provider", void 0);
+_ts_decorate10([
+  IsIn2([
+    "SUCCEEDED",
+    "FAILED"
+  ]),
+  _ts_metadata9("design:type", String)
+], PaymentWebhookDto.prototype, "status", void 0);
+_ts_decorate10([
+  IsOptional2(),
+  IsObject(),
+  _ts_metadata9("design:type", typeof Record === "undefined" ? Object : Record)
+], PaymentWebhookDto.prototype, "payload", void 0);
+
+// src/registration/dto/continue-registration.dto.ts
+import { IsString as IsString6, MaxLength as MaxLength5, MinLength as MinLength5 } from "class-validator";
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata10(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata10, "_ts_metadata");
+var ContinueRegistrationDto = class {
+  static {
+    __name(this, "ContinueRegistrationDto");
+  }
+  token;
+};
+_ts_decorate11([
+  IsString6(),
+  MinLength5(10),
+  MaxLength5(2e3),
+  _ts_metadata10("design:type", String)
+], ContinueRegistrationDto.prototype, "token", void 0);
+
+// src/registration/dto/save-configuration.dto.ts
+import { IsIn as IsIn3, IsOptional as IsOptional3, IsString as IsString7, IsUUID, MaxLength as MaxLength6, MinLength as MinLength6, ValidateIf, ValidateNested } from "class-validator";
+import { Type } from "class-transformer";
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+function _ts_metadata11(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata11, "_ts_metadata");
+var SaveRegistrationConfigSelectionDto = class {
+  static {
+    __name(this, "SaveRegistrationConfigSelectionDto");
+  }
+  modelId;
+  billingCycle;
+  appliedPromoCode;
+  /**
+   * SPEC_V2 §11.1 M5.3 — optional business-type choice. UUID of a
+   * **published** BusinessTypeVersion. The service validates existence +
+   * live status against `RegistrationBusinessTypeLookup`. `null` = no
+   * choice (legacy Plan-only path).
+   */
+  businessTypeVersionId;
+  /**
+   * METAMODELL §17a — Bundle consistency. ID of the `CheckoutOffer` that was
+   * created on the pricing page (`<app>/register?offer=<id>`). Passed
+   * through unchanged in `configJson`; the ActivationOrchestrator freezes it
+   * as `packageSnapshot` when the subscription is created and sets the offer
+   * to `consumed`. `null` = direct registration without a website offer.
+   */
+  offerId;
+};
+_ts_decorate12([
+  IsString7(),
+  MinLength6(1),
+  MaxLength6(40),
+  _ts_metadata11("design:type", String)
+], SaveRegistrationConfigSelectionDto.prototype, "modelId", void 0);
+_ts_decorate12([
+  IsIn3([
+    "MONTHLY",
+    "YEARLY"
+  ]),
+  _ts_metadata11("design:type", String)
+], SaveRegistrationConfigSelectionDto.prototype, "billingCycle", void 0);
+_ts_decorate12([
+  IsOptional3(),
+  IsString7(),
+  MaxLength6(60),
+  _ts_metadata11("design:type", Object)
+], SaveRegistrationConfigSelectionDto.prototype, "appliedPromoCode", void 0);
+_ts_decorate12([
+  IsOptional3(),
+  ValidateIf((_o, value) => value !== null),
+  IsUUID(),
+  _ts_metadata11("design:type", Object)
+], SaveRegistrationConfigSelectionDto.prototype, "businessTypeVersionId", void 0);
+_ts_decorate12([
+  IsOptional3(),
+  ValidateIf((_o, value) => value !== null),
+  IsUUID(),
+  _ts_metadata11("design:type", Object)
+], SaveRegistrationConfigSelectionDto.prototype, "offerId", void 0);
+var SaveRegistrationConfigDto = class {
+  static {
+    __name(this, "SaveRegistrationConfigDto");
+  }
+  pendingRegistrationId;
+  selection;
+};
+_ts_decorate12([
+  IsString7(),
+  MinLength6(1),
+  MaxLength6(80),
+  _ts_metadata11("design:type", String)
+], SaveRegistrationConfigDto.prototype, "pendingRegistrationId", void 0);
+_ts_decorate12([
+  ValidateNested(),
+  Type(() => SaveRegistrationConfigSelectionDto),
+  _ts_metadata11("design:type", typeof SaveRegistrationConfigSelectionDto === "undefined" ? Object : SaveRegistrationConfigSelectionDto)
+], SaveRegistrationConfigDto.prototype, "selection", void 0);
+
+// src/registration/dto/preview-promo.dto.ts
+import { IsOptional as IsOptional4, IsString as IsString8, MaxLength as MaxLength7, MinLength as MinLength7 } from "class-validator";
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata12(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata12, "_ts_metadata");
+var PreviewRegistrationPromoDto = class {
+  static {
+    __name(this, "PreviewRegistrationPromoDto");
+  }
+  pendingRegistrationId;
+  code;
+};
+_ts_decorate13([
+  IsString8(),
+  MinLength7(1),
+  MaxLength7(80),
+  _ts_metadata12("design:type", String)
+], PreviewRegistrationPromoDto.prototype, "pendingRegistrationId", void 0);
+_ts_decorate13([
+  IsOptional4(),
+  IsString8(),
+  MaxLength7(60),
+  _ts_metadata12("design:type", String)
+], PreviewRegistrationPromoDto.prototype, "code", void 0);
+
+export {
+  generateOtpCode,
+  hashOtpCode,
+  verifyOtpCode,
+  slugify,
+  PENDING_REGISTRATION_REPOSITORY_TOKEN,
+  REGISTRATION_OTP_DELIVERY_TOKEN,
+  USER_ACCOUNT_LOOKUP_TOKEN,
+  SLUG_AVAILABILITY_CHECK_TOKEN,
+  PASSWORD_HASHER_TOKEN,
+  PLAN_CATALOG_LOOKUP_TOKEN,
+  PAYMENT_PROVIDER_TOKEN,
+  PAYMENT_EVENT_LOG_TOKEN,
+  ACTIVATION_ORCHESTRATOR_TOKEN,
+  REGISTRATION_AUDIT_LOGGER_TOKEN,
+  REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN,
+  REGISTRATION_RESUME_DELIVERY_TOKEN,
+  REGISTRATION_RESUME_BASE_URL_TOKEN,
+  REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN,
+  REGISTRATION_PROMO_PREVIEW_TOKEN,
+  REGISTRATION_BUSINESS_TYPE_LOOKUP_TOKEN,
+  REGISTRATION_CONFIG_TOKEN,
+  computeBreakdown,
+  resolveModel,
+  PendingRegistrationService,
+  CronExpression,
+  RegistrationCleanupCron,
+  BaseIpRateLimitGuard,
+  RegistrationModule,
+  RegisterStartDto,
+  VerifyRegistrationOtpDto,
+  ResendRegistrationOtpDto,
+  SelectRegistrationPlanDto,
+  StartRegistrationCheckoutDto,
+  PaymentWebhookDto,
+  ContinueRegistrationDto,
+  SaveRegistrationConfigSelectionDto,
+  SaveRegistrationConfigDto,
+  PreviewRegistrationPromoDto
+};