@saasicat/nest 0.2.0

package/dist/admin/index.d.cts

@@ -0,0 +1,225 @@
+import { CanActivate, ExecutionContext, NestInterceptor, CallHandler, DynamicModule, FactoryProvider, Type, ForwardReference, Provider } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { MfaPort, RlsBypassPort, AuditPort, ManifestContribution, AdminManifest, PublicBootResponse, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/types';
+export { A as AdminAuditService } from '../admin-audit.service-9IqXMlZm.cjs';
+import { Observable } from 'rxjs';
+import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
+import { A as AdminManifestConfig } from '../admin-manifest.config-DyrQNT7M.cjs';
+export { a as ADMIN_MANIFEST_CONFIG } from '../admin-manifest.config-DyrQNT7M.cjs';
+
+declare const MFA_PORT_TOKEN: unique symbol;
+declare const AUDIT_PORT_TOKEN: unique symbol;
+declare const RLS_BYPASS_PORT_TOKEN: unique symbol;
+
+declare class SuperAdminGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+
+interface TotpSetupResult {
+    /** Base32-encoded TOTP secret (persisted in the MfaPort). */
+    secret: string;
+    /** otpauth:// URI for the QR code generator (authenticator app). */
+    otpauthUri: string;
+}
+interface VerifyTotpInput {
+    userId: string;
+    code: string;
+}
+declare class MfaService {
+    private readonly mfa;
+    private readonly logger;
+    constructor(mfa: MfaPort);
+    /**
+     * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+     * and returns the secret + the otpauth URI for the QR code.
+     *
+     * `issuer` and `label` shape the display in the authenticator (e.g.
+     * "DemoApp:taci@example.com").
+     */
+    setup(userId: string, label: string, issuer: string): Promise<TotpSetupResult>;
+    /**
+     * Verifies the entered code against the stored secret,
+     * clock-drift-tolerant by ±1 time step.
+     */
+    verify(input: VerifyTotpInput): Promise<boolean>;
+    /**
+     * Deletes a user's secret — used by `ahp admin mfa-reset`.
+     */
+    disable(userId: string): Promise<void>;
+    /** Delegates to `MfaPort.isEnabled`. */
+    isEnabled(userId: string): Promise<boolean>;
+}
+
+declare const REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+/**
+ * Marks an endpoint as MFA-required. The frontend sends the TOTP code
+ * in the `X-Mfa-Code` header.
+ */
+declare const RequireMfa: () => MethodDecorator & ClassDecorator;
+declare class MfaGuard implements CanActivate {
+    private readonly reflector;
+    private readonly mfaService;
+    private readonly logger;
+    constructor(reflector: Reflector, mfaService: MfaService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+declare class AdminBypassRlsInterceptor implements NestInterceptor {
+    private readonly port;
+    constructor(port: RlsBypassPort);
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+
+interface AdminModuleOptions {
+    mfaPort: ProviderSpec<MfaPort>;
+    auditPort: ProviderSpec<AuditPort>;
+    rlsBypassPort: ProviderSpec<RlsBypassPort>;
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminModule {
+    static forRoot(options: AdminModuleOptions): DynamicModule;
+}
+
+/**
+ * DI token for the platform core contribution. When `AdminManifestModule` is
+ * configured with `registerPlatformCore: true` (default), the module provides
+ * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` under this token. The service
+ * registers the contribution in the constructor — before all app `register()`
+ * calls from `onModuleInit`.
+ */
+declare const PLATFORM_CORE_CONTRIBUTION_TOKEN: unique symbol;
+declare class AdminManifestService {
+    private readonly config;
+    private readonly logger;
+    private readonly contributions;
+    private cached;
+    constructor(config: AdminManifestConfig, platformCore?: ManifestContribution | null);
+    register(contribution: ManifestContribution): void;
+    getManifest(): AdminManifest;
+    rebuild(): AdminManifest;
+    private build;
+    private mergeContributions;
+    /**
+     * Deterministic SHA-256 hash over the manifest. Uses the insertion
+     * order of the object keys — so that semantically meaningful reorders (e.g.
+     * the order of the sidebar items in `navigation.standardPages`) change the
+     * hash and invalidate the browser ETag cache. The manifest's own
+     * `manifestHash` field is hidden before serialization.
+     */
+    private computeHash;
+}
+
+declare class AdminPublicBootController {
+    private readonly config;
+    constructor(config: AdminManifestConfig);
+    getBoot(): PublicBootResponse;
+}
+
+type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
+interface AdminManifestModuleOptions {
+    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
+    config: ConfigSpec;
+    /**
+     * Default `true`. Set to `false` when the consumer registers its own
+     * manifest controller with app-specific guards entirely on its own.
+     */
+    includeManifestController?: boolean;
+    /**
+     * Class-level guards for GET /admin/manifest and POST /admin/manifest/reload,
+     * when `includeManifestController === true`. REQUIRED — otherwise
+     * `forRoot()` throws at boot.
+     *
+     * Pass `[]` explicitly when the endpoint should intentionally be auth-free
+     * (e.g. CI smoke tests, public demo). This makes the choice visible in the
+     * code rather than a silent default.
+     */
+    guards?: Array<Type<CanActivate>>;
+    /**
+     * Additional guards that apply ONLY to POST /admin/manifest/reload
+     * (typically `MfaGuard`). Placed after `guards` in the chain. Must be made
+     * available by the consumer as a provider.
+     */
+    reloadGuards?: Array<Type<CanActivate>>;
+    /**
+     * Default `true`. When active, the module automatically hooks
+     * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` (StandardPage spine, generic tenant
+     * actions, platform audit action labels) into the `AdminManifestService` —
+     * before all app `register()` calls from `onModuleInit`. Consumers without
+     * a SuperAdmin need set this to `false`.
+     */
+    registerPlatformCore?: boolean;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — typically: the app module that registers the
+     * factory-inject provider (e.g. `AdminManifestConfigFactory`). Without this
+     * entry, NestJS 11.1.19 cannot resolve the `inject:[...]` of the config
+     * factory (UnknownDependenciesException for ADMIN_MANIFEST_CONFIG).
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers that are registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminManifestModule {
+    static forRoot(options: AdminManifestModuleOptions): DynamicModule;
+}
+
+declare const PLATFORM_CORE_MANIFEST_CONTRIBUTION: ManifestContribution;
+
+declare const SUBSCRIPTION_STATS_PORT_TOKEN: unique symbol;
+declare const PROMO_CODE_STATS_PORT_TOKEN: unique symbol;
+declare const AUDIT_STATS_PORT_TOKEN: unique symbol;
+/** Default audit window in days for the dashboard KPI. Override via forRoot. */
+declare const ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN: unique symbol;
+
+/**
+ * Platform stats for the SuperAdmin dashboard page.
+ *
+ * Contains subscription/promo/audit aggregates that are equally meaningful
+ * across all consuming apps. App-specific KPIs (e.g. DATEV or Bundles/Members)
+ * remain extra endpoints in the respective app.
+ */
+interface AdminStatsSnapshot {
+    subscriptions: SubscriptionStatsSnapshot;
+    promos: PromoCodeStatsSnapshot;
+    audit: AuditStatsSnapshot;
+}
+declare class AdminStatsService {
+    private readonly subscriptions;
+    private readonly promos;
+    private readonly audit;
+    private readonly auditWindowDays;
+    constructor(subscriptions: SubscriptionStatsPort, promos: PromoCodeStatsPort, audit: AuditStatsPort, auditWindowDays?: number);
+    getSnapshot(): Promise<AdminStatsSnapshot>;
+}
+
+declare class AdminStatsController {
+    private readonly stats;
+    constructor(stats: AdminStatsService);
+    getDashboardSnapshot(): Promise<AdminStatsSnapshot>;
+}
+
+interface AdminStatsModuleOptions {
+    subscriptionStatsPort: ProviderSpec<SubscriptionStatsPort>;
+    promoCodeStatsPort: ProviderSpec<PromoCodeStatsPort>;
+    auditStatsPort: ProviderSpec<AuditStatsPort>;
+    /** Audit window in days for the "last N days" KPI. Default 7. */
+    auditWindowDays?: number;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — e.g. the app module that registers the adapter classes
+     * referenced by the factory `inject` lists.
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminStatsModule {
+    static forRoot(options: AdminStatsModuleOptions): DynamicModule;
+}
+
+export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminBypassRlsInterceptor, AdminManifestConfig, AdminManifestModule, type AdminManifestModuleOptions, AdminManifestService, AdminModule, type AdminModuleOptions, AdminPublicBootController, AdminStatsController, AdminStatsModule, type AdminStatsModuleOptions, AdminStatsService, type AdminStatsSnapshot, MFA_PORT_TOKEN, MfaGuard, MfaService, PLATFORM_CORE_CONTRIBUTION_TOKEN, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, REQUIRE_MFA_KEY, RLS_BYPASS_PORT_TOKEN, RequireMfa, SUBSCRIPTION_STATS_PORT_TOKEN, SuperAdminGuard, type TotpSetupResult, type VerifyTotpInput };

package/dist/admin/index.d.ts

@@ -0,0 +1,225 @@
+import { CanActivate, ExecutionContext, NestInterceptor, CallHandler, DynamicModule, FactoryProvider, Type, ForwardReference, Provider } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { MfaPort, RlsBypassPort, AuditPort, ManifestContribution, AdminManifest, PublicBootResponse, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/types';
+export { A as AdminAuditService } from '../admin-audit.service-9IqXMlZm.js';
+import { Observable } from 'rxjs';
+import { P as ProviderSpec } from '../di-CcNeq9v-.js';
+import { A as AdminManifestConfig } from '../admin-manifest.config-DyrQNT7M.js';
+export { a as ADMIN_MANIFEST_CONFIG } from '../admin-manifest.config-DyrQNT7M.js';
+
+declare const MFA_PORT_TOKEN: unique symbol;
+declare const AUDIT_PORT_TOKEN: unique symbol;
+declare const RLS_BYPASS_PORT_TOKEN: unique symbol;
+
+declare class SuperAdminGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+
+interface TotpSetupResult {
+    /** Base32-encoded TOTP secret (persisted in the MfaPort). */
+    secret: string;
+    /** otpauth:// URI for the QR code generator (authenticator app). */
+    otpauthUri: string;
+}
+interface VerifyTotpInput {
+    userId: string;
+    code: string;
+}
+declare class MfaService {
+    private readonly mfa;
+    private readonly logger;
+    constructor(mfa: MfaPort);
+    /**
+     * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+     * and returns the secret + the otpauth URI for the QR code.
+     *
+     * `issuer` and `label` shape the display in the authenticator (e.g.
+     * "DemoApp:taci@example.com").
+     */
+    setup(userId: string, label: string, issuer: string): Promise<TotpSetupResult>;
+    /**
+     * Verifies the entered code against the stored secret,
+     * clock-drift-tolerant by ±1 time step.
+     */
+    verify(input: VerifyTotpInput): Promise<boolean>;
+    /**
+     * Deletes a user's secret — used by `ahp admin mfa-reset`.
+     */
+    disable(userId: string): Promise<void>;
+    /** Delegates to `MfaPort.isEnabled`. */
+    isEnabled(userId: string): Promise<boolean>;
+}
+
+declare const REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+/**
+ * Marks an endpoint as MFA-required. The frontend sends the TOTP code
+ * in the `X-Mfa-Code` header.
+ */
+declare const RequireMfa: () => MethodDecorator & ClassDecorator;
+declare class MfaGuard implements CanActivate {
+    private readonly reflector;
+    private readonly mfaService;
+    private readonly logger;
+    constructor(reflector: Reflector, mfaService: MfaService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+declare class AdminBypassRlsInterceptor implements NestInterceptor {
+    private readonly port;
+    constructor(port: RlsBypassPort);
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+
+interface AdminModuleOptions {
+    mfaPort: ProviderSpec<MfaPort>;
+    auditPort: ProviderSpec<AuditPort>;
+    rlsBypassPort: ProviderSpec<RlsBypassPort>;
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminModule {
+    static forRoot(options: AdminModuleOptions): DynamicModule;
+}
+
+/**
+ * DI token for the platform core contribution. When `AdminManifestModule` is
+ * configured with `registerPlatformCore: true` (default), the module provides
+ * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` under this token. The service
+ * registers the contribution in the constructor — before all app `register()`
+ * calls from `onModuleInit`.
+ */
+declare const PLATFORM_CORE_CONTRIBUTION_TOKEN: unique symbol;
+declare class AdminManifestService {
+    private readonly config;
+    private readonly logger;
+    private readonly contributions;
+    private cached;
+    constructor(config: AdminManifestConfig, platformCore?: ManifestContribution | null);
+    register(contribution: ManifestContribution): void;
+    getManifest(): AdminManifest;
+    rebuild(): AdminManifest;
+    private build;
+    private mergeContributions;
+    /**
+     * Deterministic SHA-256 hash over the manifest. Uses the insertion
+     * order of the object keys — so that semantically meaningful reorders (e.g.
+     * the order of the sidebar items in `navigation.standardPages`) change the
+     * hash and invalidate the browser ETag cache. The manifest's own
+     * `manifestHash` field is hidden before serialization.
+     */
+    private computeHash;
+}
+
+declare class AdminPublicBootController {
+    private readonly config;
+    constructor(config: AdminManifestConfig);
+    getBoot(): PublicBootResponse;
+}
+
+type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
+interface AdminManifestModuleOptions {
+    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
+    config: ConfigSpec;
+    /**
+     * Default `true`. Set to `false` when the consumer registers its own
+     * manifest controller with app-specific guards entirely on its own.
+     */
+    includeManifestController?: boolean;
+    /**
+     * Class-level guards for GET /admin/manifest and POST /admin/manifest/reload,
+     * when `includeManifestController === true`. REQUIRED — otherwise
+     * `forRoot()` throws at boot.
+     *
+     * Pass `[]` explicitly when the endpoint should intentionally be auth-free
+     * (e.g. CI smoke tests, public demo). This makes the choice visible in the
+     * code rather than a silent default.
+     */
+    guards?: Array<Type<CanActivate>>;
+    /**
+     * Additional guards that apply ONLY to POST /admin/manifest/reload
+     * (typically `MfaGuard`). Placed after `guards` in the chain. Must be made
+     * available by the consumer as a provider.
+     */
+    reloadGuards?: Array<Type<CanActivate>>;
+    /**
+     * Default `true`. When active, the module automatically hooks
+     * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` (StandardPage spine, generic tenant
+     * actions, platform audit action labels) into the `AdminManifestService` —
+     * before all app `register()` calls from `onModuleInit`. Consumers without
+     * a SuperAdmin need set this to `false`.
+     */
+    registerPlatformCore?: boolean;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — typically: the app module that registers the
+     * factory-inject provider (e.g. `AdminManifestConfigFactory`). Without this
+     * entry, NestJS 11.1.19 cannot resolve the `inject:[...]` of the config
+     * factory (UnknownDependenciesException for ADMIN_MANIFEST_CONFIG).
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers that are registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminManifestModule {
+    static forRoot(options: AdminManifestModuleOptions): DynamicModule;
+}
+
+declare const PLATFORM_CORE_MANIFEST_CONTRIBUTION: ManifestContribution;
+
+declare const SUBSCRIPTION_STATS_PORT_TOKEN: unique symbol;
+declare const PROMO_CODE_STATS_PORT_TOKEN: unique symbol;
+declare const AUDIT_STATS_PORT_TOKEN: unique symbol;
+/** Default audit window in days for the dashboard KPI. Override via forRoot. */
+declare const ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN: unique symbol;
+
+/**
+ * Platform stats for the SuperAdmin dashboard page.
+ *
+ * Contains subscription/promo/audit aggregates that are equally meaningful
+ * across all consuming apps. App-specific KPIs (e.g. DATEV or Bundles/Members)
+ * remain extra endpoints in the respective app.
+ */
+interface AdminStatsSnapshot {
+    subscriptions: SubscriptionStatsSnapshot;
+    promos: PromoCodeStatsSnapshot;
+    audit: AuditStatsSnapshot;
+}
+declare class AdminStatsService {
+    private readonly subscriptions;
+    private readonly promos;
+    private readonly audit;
+    private readonly auditWindowDays;
+    constructor(subscriptions: SubscriptionStatsPort, promos: PromoCodeStatsPort, audit: AuditStatsPort, auditWindowDays?: number);
+    getSnapshot(): Promise<AdminStatsSnapshot>;
+}
+
+declare class AdminStatsController {
+    private readonly stats;
+    constructor(stats: AdminStatsService);
+    getDashboardSnapshot(): Promise<AdminStatsSnapshot>;
+}
+
+interface AdminStatsModuleOptions {
+    subscriptionStatsPort: ProviderSpec<SubscriptionStatsPort>;
+    promoCodeStatsPort: ProviderSpec<PromoCodeStatsPort>;
+    auditStatsPort: ProviderSpec<AuditStatsPort>;
+    /** Audit window in days for the "last N days" KPI. Default 7. */
+    auditWindowDays?: number;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — e.g. the app module that registers the adapter classes
+     * referenced by the factory `inject` lists.
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminStatsModule {
+    static forRoot(options: AdminStatsModuleOptions): DynamicModule;
+}
+
+export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminBypassRlsInterceptor, AdminManifestConfig, AdminManifestModule, type AdminManifestModuleOptions, AdminManifestService, AdminModule, type AdminModuleOptions, AdminPublicBootController, AdminStatsController, AdminStatsModule, type AdminStatsModuleOptions, AdminStatsService, type AdminStatsSnapshot, MFA_PORT_TOKEN, MfaGuard, MfaService, PLATFORM_CORE_CONTRIBUTION_TOKEN, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, REQUIRE_MFA_KEY, RLS_BYPASS_PORT_TOKEN, RequireMfa, SUBSCRIPTION_STATS_PORT_TOKEN, SuperAdminGuard, type TotpSetupResult, type VerifyTotpInput };

package/dist/admin/index.js

@@ -0,0 +1,58 @@
+import {
+  ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
+  AUDIT_STATS_PORT_TOKEN,
+  AdminStatsController,
+  AdminStatsModule,
+  AdminStatsService,
+  PROMO_CODE_STATS_PORT_TOKEN,
+  SUBSCRIPTION_STATS_PORT_TOKEN
+} from "../chunk-YNEW3L63.js";
+import {
+  ADMIN_MANIFEST_CONFIG,
+  AdminBypassRlsInterceptor,
+  AdminManifestModule,
+  AdminManifestService,
+  AdminModule,
+  AdminPublicBootController,
+  MfaGuard,
+  MfaService,
+  PLATFORM_CORE_CONTRIBUTION_TOKEN,
+  PLATFORM_CORE_MANIFEST_CONTRIBUTION,
+  REQUIRE_MFA_KEY,
+  RequireMfa,
+  SuperAdminGuard
+} from "../chunk-P6MYZMXQ.js";
+import {
+  AUDIT_PORT_TOKEN,
+  AdminAuditService,
+  MFA_PORT_TOKEN,
+  RLS_BYPASS_PORT_TOKEN
+} from "../chunk-E56W4U2P.js";
+import "../chunk-SABTXESR.js";
+import "../chunk-SHUYVCID.js";
+export {
+  ADMIN_MANIFEST_CONFIG,
+  ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
+  AUDIT_PORT_TOKEN,
+  AUDIT_STATS_PORT_TOKEN,
+  AdminAuditService,
+  AdminBypassRlsInterceptor,
+  AdminManifestModule,
+  AdminManifestService,
+  AdminModule,
+  AdminPublicBootController,
+  AdminStatsController,
+  AdminStatsModule,
+  AdminStatsService,
+  MFA_PORT_TOKEN,
+  MfaGuard,
+  MfaService,
+  PLATFORM_CORE_CONTRIBUTION_TOKEN,
+  PLATFORM_CORE_MANIFEST_CONTRIBUTION,
+  PROMO_CODE_STATS_PORT_TOKEN,
+  REQUIRE_MFA_KEY,
+  RLS_BYPASS_PORT_TOKEN,
+  RequireMfa,
+  SUBSCRIPTION_STATS_PORT_TOKEN,
+  SuperAdminGuard
+};

package/dist/admin-audit.service-9IqXMlZm.d.cts

@@ -0,0 +1,30 @@
+import { AuditPort, AdminActor } from '@saasicat/types';
+
+declare class AdminAuditService {
+    private readonly audit;
+    constructor(audit: AuditPort);
+    log(input: {
+        actor: AdminActor;
+        entity: string;
+        entityId: string;
+        action: string;
+        changes?: Record<string, unknown>;
+    }): Promise<void>;
+    /**
+     * Standardized actor tag for the `changes.actor` column:
+     * `<source>:<email>:<context>`.
+     */
+    actorTag(actor: AdminActor): string;
+    /** Helper: build an AdminActor from an authenticated web request. */
+    fromWebRequest(user: {
+        id: string;
+        email: string;
+    }, sessionId?: string | null): AdminActor;
+    /** Helper: build an AdminActor from a CLI identity (hostname as context). */
+    fromCli(user: {
+        id: string;
+        email: string;
+    }): AdminActor;
+}
+
+export { AdminAuditService as A };

package/dist/admin-audit.service-9IqXMlZm.d.ts

@@ -0,0 +1,30 @@
+import { AuditPort, AdminActor } from '@saasicat/types';
+
+declare class AdminAuditService {
+    private readonly audit;
+    constructor(audit: AuditPort);
+    log(input: {
+        actor: AdminActor;
+        entity: string;
+        entityId: string;
+        action: string;
+        changes?: Record<string, unknown>;
+    }): Promise<void>;
+    /**
+     * Standardized actor tag for the `changes.actor` column:
+     * `<source>:<email>:<context>`.
+     */
+    actorTag(actor: AdminActor): string;
+    /** Helper: build an AdminActor from an authenticated web request. */
+    fromWebRequest(user: {
+        id: string;
+        email: string;
+    }, sessionId?: string | null): AdminActor;
+    /** Helper: build an AdminActor from a CLI identity (hostname as context). */
+    fromCli(user: {
+        id: string;
+        email: string;
+    }): AdminActor;
+}
+
+export { AdminAuditService as A };

package/dist/admin-manifest.config-DyrQNT7M.d.cts

@@ -0,0 +1,10 @@
+import { AdminManifest } from '@saasicat/types';
+
+declare const ADMIN_MANIFEST_CONFIG: unique symbol;
+interface AdminManifestConfig {
+    project: AdminManifest['project'];
+    build: Omit<AdminManifest['build'], 'manifestHash'>;
+    planCatalogSnapshot: AdminManifest['planCatalogSnapshot'];
+}
+
+export { type AdminManifestConfig as A, ADMIN_MANIFEST_CONFIG as a };

package/dist/admin-manifest.config-DyrQNT7M.d.ts

@@ -0,0 +1,10 @@
+import { AdminManifest } from '@saasicat/types';
+
+declare const ADMIN_MANIFEST_CONFIG: unique symbol;
+interface AdminManifestConfig {
+    project: AdminManifest['project'];
+    build: Omit<AdminManifest['build'], 'manifestHash'>;
+    planCatalogSnapshot: AdminManifest['planCatalogSnapshot'];
+}
+
+export { type AdminManifestConfig as A, ADMIN_MANIFEST_CONFIG as a };