@saasicat/nest 0.2.0

package/dist/platform/index.cjs

@@ -0,0 +1,2772 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from3, except, desc) => {
+  if (from3 && typeof from3 === "object" || typeof from3 === "function") {
+    for (let key of __getOwnPropNames(from3))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from3[key], enumerable: !(desc = __getOwnPropDesc(from3, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/platform/index.ts
+var platform_exports = {};
+__export(platform_exports, {
+  EnforceQuotaInterceptor: () => EnforceQuotaInterceptor,
+  PLAN_RESOLVER_PORT_TOKEN: () => PLAN_RESOLVER_PORT_TOKEN,
+  QUOTA_PROVIDERS_TOKEN: () => QUOTA_PROVIDERS_TOKEN,
+  STATIC_FEATURE_GUARD_CONFIG_TOKEN: () => STATIC_FEATURE_GUARD_CONFIG_TOKEN,
+  SaasPlatformModule: () => SaasPlatformModule,
+  StaticEntitlementService: () => StaticEntitlementService,
+  StaticFeatureGuard: () => StaticFeatureGuard,
+  StaticPlanResolver: () => StaticPlanResolver,
+  TenantManifestService: () => TenantManifestService,
+  buildTenantManifestController: () => buildTenantManifestController
+});
+module.exports = __toCommonJS(platform_exports);
+
+// src/platform/saas-platform.module.ts
+var import_common22 = require("@nestjs/common");
+var import_core6 = require("@nestjs/core");
+
+// src/core/di.ts
+function asProvider(token, impl) {
+  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
+    const factory = impl;
+    return {
+      provide: token,
+      useFactory: factory.useFactory,
+      inject: factory.inject
+    };
+  }
+  return {
+    provide: token,
+    useValue: impl
+  };
+}
+__name(asProvider, "asProvider");
+
+// src/admin/module.ts
+var import_common6 = require("@nestjs/common");
+
+// src/admin/admin-audit.service.ts
+var os = __toESM(require("os"), 1);
+var import_common = require("@nestjs/common");
+
+// src/admin/tokens.ts
+var MFA_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/MfaPort");
+var AUDIT_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AuditPort");
+var RLS_BYPASS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/RlsBypassPort");
+
+// src/admin/admin-audit.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var AdminAuditService = class {
+  static {
+    __name(this, "AdminAuditService");
+  }
+  audit;
+  constructor(audit) {
+    this.audit = audit;
+  }
+  async log(input) {
+    await this.audit.write({
+      actor: input.actor,
+      entity: input.entity,
+      entityId: input.entityId,
+      action: input.action,
+      changes: {
+        ...input.changes ?? {},
+        actor: this.actorTag(input.actor)
+      }
+    });
+  }
+  /**
+   * Standardized actor tag for the `changes.actor` column:
+   * `<source>:<email>:<context>`.
+   */
+  actorTag(actor) {
+    return `${actor.source}:${actor.email}:${actor.context}`;
+  }
+  /** Helper: build an AdminActor from an authenticated web request. */
+  fromWebRequest(user, sessionId) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "web",
+      context: sessionId ?? "unknown"
+    };
+  }
+  /** Helper: build an AdminActor from a CLI identity (hostname as context). */
+  fromCli(user) {
+    return {
+      userId: user.id,
+      email: user.email,
+      source: "cli",
+      context: os.hostname()
+    };
+  }
+};
+AdminAuditService = _ts_decorate([
+  (0, import_common.Injectable)(),
+  _ts_param(0, (0, import_common.Inject)(AUDIT_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof AuditPort === "undefined" ? Object : AuditPort
+  ])
+], AdminAuditService);
+
+// src/admin/admin-bypass-rls.interceptor.ts
+var import_common2 = require("@nestjs/common");
+var import_rxjs = require("rxjs");
+var import_operators = require("rxjs/operators");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var AdminBypassRlsInterceptor = class {
+  static {
+    __name(this, "AdminBypassRlsInterceptor");
+  }
+  port;
+  constructor(port) {
+    this.port = port;
+  }
+  intercept(_context, next) {
+    return (0, import_rxjs.defer)(() => (0, import_rxjs.from)(this.port.runWithBypass(async () => {
+      return next.handle();
+    })).pipe((0, import_operators.switchAll)()));
+  }
+};
+AdminBypassRlsInterceptor = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_param2(0, (0, import_common2.Inject)(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof RlsBypassPort === "undefined" ? Object : RlsBypassPort
+  ])
+], AdminBypassRlsInterceptor);
+
+// src/admin/mfa.ts
+var import_common3 = require("@nestjs/common");
+var import_otplib = require("otplib");
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var CLOCK_DRIFT_TOLERANCE_SECONDS = 30;
+var OTPLIB_TOKEN_ERROR_NAMES = /* @__PURE__ */ new Set([
+  "TokenError",
+  "TokenFormatError",
+  "TokenLengthError"
+]);
+function isOtplibTokenError(error) {
+  return error instanceof Error && OTPLIB_TOKEN_ERROR_NAMES.has(error.name);
+}
+__name(isOtplibTokenError, "isOtplibTokenError");
+var MfaService = class _MfaService {
+  static {
+    __name(this, "MfaService");
+  }
+  mfa;
+  logger = new import_common3.Logger(_MfaService.name);
+  constructor(mfa) {
+    this.mfa = mfa;
+  }
+  /**
+   * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+   * and returns the secret + the otpauth URI for the QR code.
+   *
+   * `issuer` and `label` shape the display in the authenticator (e.g.
+   * "DemoApp:taci@example.com").
+   */
+  async setup(userId, label, issuer) {
+    const secret = (0, import_otplib.generateSecret)();
+    const otpauthUri = (0, import_otplib.generateURI)({
+      issuer,
+      label,
+      secret
+    });
+    await this.mfa.setSecret(userId, secret);
+    return {
+      secret,
+      otpauthUri
+    };
+  }
+  /**
+   * Verifies the entered code against the stored secret,
+   * clock-drift-tolerant by ±1 time step.
+   */
+  async verify(input) {
+    const secret = await this.mfa.getSecret(input.userId);
+    if (!secret) return false;
+    try {
+      const result = await (0, import_otplib.verify)({
+        secret,
+        token: input.code.trim(),
+        epochTolerance: CLOCK_DRIFT_TOLERANCE_SECONDS
+      });
+      return result.valid;
+    } catch (error) {
+      if (isOtplibTokenError(error)) {
+        return false;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      this.logger.warn(`TOTP-Verify f\xFCr User ${input.userId} unerwartet fehlgeschlagen: ${message}`);
+      return false;
+    }
+  }
+  /**
+   * Deletes a user's secret — used by `ahp admin mfa-reset`.
+   */
+  async disable(userId) {
+    await this.mfa.setSecret(userId, null);
+  }
+  /** Delegates to `MfaPort.isEnabled`. */
+  async isEnabled(userId) {
+    return this.mfa.isEnabled(userId);
+  }
+};
+MfaService = _ts_decorate3([
+  (0, import_common3.Injectable)(),
+  _ts_param3(0, (0, import_common3.Inject)(MFA_PORT_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof MfaPort === "undefined" ? Object : MfaPort
+  ])
+], MfaService);
+
+// src/admin/mfa.guard.ts
+var import_common4 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+var MfaGuard = class _MfaGuard {
+  static {
+    __name(this, "MfaGuard");
+  }
+  reflector;
+  mfaService;
+  logger = new import_common4.Logger(_MfaGuard.name);
+  constructor(reflector, mfaService) {
+    this.reflector = reflector;
+    this.mfaService = mfaService;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_MFA_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required) return true;
+    if (process.env.SAAS_PLATFORM_SKIP_MFA === "1" && process.env.NODE_ENV !== "production") {
+      return true;
+    }
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) throw new import_common4.UnauthorizedException({
+      reason: "NOT_AUTHENTICATED"
+    });
+    const enabled = await this.mfaService.isEnabled(user.id);
+    if (!enabled) {
+      throw new import_common4.UnauthorizedException({
+        reason: "MFA_NOT_SET_UP",
+        message: "Bitte zuerst MFA-Setup \xFCber das CLI ausf\xFChren."
+      });
+    }
+    const headerVal = request.headers?.["x-mfa-code"];
+    const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
+    if (!code) {
+      throw new import_common4.UnauthorizedException({
+        reason: "MFA_REQUIRED",
+        message: "TOTP-Code im Header X-Mfa-Code erforderlich."
+      });
+    }
+    const valid = await this.mfaService.verify({
+      userId: user.id,
+      code: String(code)
+    });
+    if (!valid) {
+      throw new import_common4.UnauthorizedException({
+        reason: "MFA_FAILED",
+        message: "TOTP-Code ung\xFCltig."
+      });
+    }
+    return true;
+  }
+};
+MfaGuard = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_param4(0, (0, import_common4.Inject)(import_core.Reflector)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], MfaGuard);
+
+// src/admin/super-admin.guard.ts
+var import_common5 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var SuperAdminGuard = class {
+  static {
+    __name(this, "SuperAdminGuard");
+  }
+  canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    if (!request.user) throw new import_common5.ForbiddenException("Nicht authentifiziert");
+    if (request.user.role !== "SUPER_ADMIN") {
+      throw new import_common5.ForbiddenException("Nur SUPER_ADMIN-Rolle erlaubt");
+    }
+    return true;
+  }
+};
+SuperAdminGuard = _ts_decorate5([
+  (0, import_common5.Injectable)()
+], SuperAdminGuard);
+
+// src/admin/module.ts
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+var AdminModule = class _AdminModule {
+  static {
+    __name(this, "AdminModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      asProvider(MFA_PORT_TOKEN, options.mfaPort),
+      asProvider(AUDIT_PORT_TOKEN, options.auditPort),
+      asProvider(RLS_BYPASS_PORT_TOKEN, options.rlsBypassPort),
+      MfaService,
+      AdminAuditService,
+      SuperAdminGuard,
+      MfaGuard,
+      AdminBypassRlsInterceptor
+    ];
+    return {
+      module: _AdminModule,
+      global: options.global ?? false,
+      providers,
+      exports: [
+        MFA_PORT_TOKEN,
+        AUDIT_PORT_TOKEN,
+        RLS_BYPASS_PORT_TOKEN,
+        MfaService,
+        AdminAuditService,
+        SuperAdminGuard,
+        MfaGuard,
+        AdminBypassRlsInterceptor
+      ]
+    };
+  }
+};
+AdminModule = _ts_decorate6([
+  (0, import_common6.Module)({})
+], AdminModule);
+
+// src/admin/admin-manifest.module.ts
+var import_common9 = require("@nestjs/common");
+
+// src/admin/admin-manifest.config.ts
+var ADMIN_MANIFEST_CONFIG = /* @__PURE__ */ Symbol("ADMIN_MANIFEST_CONFIG");
+
+// src/admin/admin-manifest.service.ts
+var import_common7 = require("@nestjs/common");
+var import_node_crypto = require("crypto");
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var PLATFORM_CORE_CONTRIBUTION_TOKEN = /* @__PURE__ */ Symbol("PLATFORM_CORE_CONTRIBUTION");
+var AdminManifestService = class _AdminManifestService {
+  static {
+    __name(this, "AdminManifestService");
+  }
+  config;
+  logger = new import_common7.Logger(_AdminManifestService.name);
+  contributions = [];
+  cached = null;
+  constructor(config, platformCore = null) {
+    this.config = config;
+    if (platformCore) {
+      this.contributions.push(platformCore);
+    }
+  }
+  register(contribution) {
+    this.contributions.push(contribution);
+    this.cached = null;
+  }
+  getManifest() {
+    if (this.cached) return this.cached;
+    this.cached = this.build();
+    this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${this.cached.build.manifestHash.slice(0, 24)}\u2026`);
+    return this.cached;
+  }
+  rebuild() {
+    this.cached = null;
+    return this.getManifest();
+  }
+  build() {
+    const merged = this.mergeContributions(this.contributions);
+    const draft = {
+      schemaVersion: 1,
+      project: this.config.project,
+      build: {
+        ...this.config.build,
+        manifestHash: "sha256-pending"
+      },
+      planCatalogSnapshot: this.config.planCatalogSnapshot,
+      capabilities: merged.capabilities,
+      navigation: merged.navigation,
+      dashboard: merged.dashboard,
+      tenants: merged.tenants,
+      audit: merged.audit
+    };
+    return {
+      ...draft,
+      build: {
+        ...draft.build,
+        manifestHash: this.computeHash(draft)
+      }
+    };
+  }
+  mergeContributions(contributions) {
+    const capabilities = {};
+    const standardPages = {};
+    const projectPages = [];
+    const kpiCards = [];
+    const tenantColumns = [];
+    const tenantActions = [];
+    const auditActions = [];
+    for (const c of contributions) {
+      if (c.capabilities) Object.assign(capabilities, c.capabilities);
+      if (c.navigation?.standardPages) Object.assign(standardPages, c.navigation.standardPages);
+      if (c.navigation?.projectPages) projectPages.push(...c.navigation.projectPages);
+      if (c.dashboard?.kpiCards) kpiCards.push(...c.dashboard.kpiCards);
+      if (c.tenants?.columns) tenantColumns.push(...c.tenants.columns);
+      if (c.tenants?.actions) tenantActions.push(...c.tenants.actions);
+      if (c.audit?.actions) auditActions.push(...c.audit.actions);
+    }
+    kpiCards.sort((a, b) => (b.slotPriority ?? 0) - (a.slotPriority ?? 0));
+    return {
+      capabilities,
+      navigation: {
+        standardPages,
+        projectPages
+      },
+      dashboard: kpiCards.length > 0 ? {
+        kpiCards
+      } : void 0,
+      tenants: tenantColumns.length > 0 || tenantActions.length > 0 ? {
+        columns: tenantColumns,
+        actions: tenantActions
+      } : void 0,
+      audit: auditActions.length > 0 ? {
+        actions: auditActions
+      } : void 0
+    };
+  }
+  /**
+   * Deterministic SHA-256 hash over the manifest. Uses the insertion
+   * order of the object keys — so that semantically meaningful reorders (e.g.
+   * the order of the sidebar items in `navigation.standardPages`) change the
+   * hash and invalidate the browser ETag cache. The manifest's own
+   * `manifestHash` field is hidden before serialization.
+   */
+  computeHash(manifest) {
+    const canonical = stableStringify({
+      ...manifest,
+      build: {
+        ...manifest.build,
+        manifestHash: void 0
+      }
+    });
+    const digest = (0, import_node_crypto.createHash)("sha256").update(canonical).digest("base64url");
+    return `sha256-${digest}`;
+  }
+};
+AdminManifestService = _ts_decorate7([
+  (0, import_common7.Injectable)(),
+  _ts_param5(0, (0, import_common7.Inject)(ADMIN_MANIFEST_CONFIG)),
+  _ts_param5(1, (0, import_common7.Optional)()),
+  _ts_param5(1, (0, import_common7.Inject)(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig,
+    Object
+  ])
+], AdminManifestService);
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (value === void 0) return "null";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(stableStringify).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0);
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+  }
+  return JSON.stringify(value);
+}
+__name(stableStringify, "stableStringify");
+
+// src/admin/admin-public-boot.controller.ts
+var import_common8 = require("@nestjs/common");
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+var AdminPublicBootController = class {
+  static {
+    __name(this, "AdminPublicBootController");
+  }
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  getBoot() {
+    return {
+      project: {
+        key: this.config.project.key,
+        displayName: this.config.project.displayName,
+        label: this.config.project.label,
+        icon: this.config.project.icon,
+        logoUrl: this.config.project.logoUrl,
+        environment: this.config.project.environment
+      }
+    };
+  }
+};
+_ts_decorate8([
+  (0, import_common8.Get)("boot"),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
+], AdminPublicBootController.prototype, "getBoot", null);
+AdminPublicBootController = _ts_decorate8([
+  (0, import_common8.Controller)("admin"),
+  _ts_param6(0, (0, import_common8.Inject)(ADMIN_MANIFEST_CONFIG)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig
+  ])
+], AdminPublicBootController);
+
+// src/admin/manifest-core.ts
+var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
+  navigation: {
+    // Key order is render order in the sidebar (within the
+    // section, see `DEFAULT_NAV_SECTIONS` in the nav-builder). The order per
+    // section is deliberately curated:
+    //   Overview: dashboard
+    //   Product catalog: discovery → bundles → businessTypes → plans →
+    //                   planVersions → marketingCatalog → promoCodes
+    //                   (promoCodes is appended by the app contributions
+    //                   and therefore lands at the end of the section)
+    //   Customers: tenants → users → pilots
+    //   System: audit
+    standardPages: {
+      dashboard: {
+        enabled: true,
+        requiredCapability: "dashboard.read"
+      },
+      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // Apps must set `discovery.read` in their manifest capabilities
+      // to `true` so that the NavBuilder wires the page into the
+      // sidebar; otherwise it is filtered out automatically.
+      discovery: {
+        enabled: true,
+        requiredCapability: "discovery.read"
+      },
+      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // Apps with a DB-driven catalog set `bundles.read = true`.
+      bundles: {
+        enabled: true,
+        requiredCapability: "bundles.read"
+      },
+      // SPEC_V2 §11.1 M3 — BusinessType editor in SuperAdmin.
+      // Apps with domain verticals set `businessTypes.read = true`.
+      businessTypes: {
+        enabled: true,
+        requiredCapability: "businessTypes.read"
+      },
+      plans: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      planVersions: {
+        enabled: true,
+        requiredCapability: "plans.read"
+      },
+      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // Apps that market a public catalog set
+      // `marketingProjections.read = true`.
+      marketingCatalog: {
+        enabled: true,
+        requiredCapability: "marketingProjections.read"
+      },
+      tenants: {
+        enabled: true,
+        requiredCapability: "tenants.read"
+      },
+      users: {
+        enabled: true,
+        requiredCapability: "users.read"
+      },
+      pilots: {
+        enabled: true,
+        requiredCapability: "pilots.read"
+      },
+      // Audit log deliberately at the end — rarely needed, should
+      // not obscure the productive pages.
+      audit: {
+        enabled: true,
+        requiredCapability: "audit.read"
+      },
+      // Platform email sender (system/registration mails). Apps
+      // set `platformEmail.read = true` so that the NavBuilder wires the page
+      // in; otherwise it is filtered out automatically.
+      platformEmail: {
+        enabled: true,
+        requiredCapability: "platformEmail.read"
+      },
+      // Platform email history (audit of the sent system mails). Apps
+      // set `platformEmailHistory.read = true` so that the NavBuilder wires the
+      // page in; otherwise it is filtered out automatically.
+      platformEmailHistory: {
+        enabled: true,
+        requiredCapability: "platformEmailHistory.read"
+      }
+    }
+  },
+  tenants: {
+    actions: [
+      {
+        id: "platform.tenants.suspend",
+        label: "Mandant suspendieren",
+        actionKey: "tenants.suspend",
+        requiredCapability: "tenants.suspend",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.tenants.reactivate",
+        label: "Mandant reaktivieren",
+        actionKey: "tenants.reactivate",
+        requiredCapability: "tenants.reactivate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.impersonate",
+        label: "Impersonate",
+        actionKey: "tenants.impersonate",
+        requiredCapability: "tenants.impersonate",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.tenants.export",
+        label: "DSGVO-Export",
+        actionKey: "tenants.export",
+        requiredCapability: "tenants.export",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.subscriptions.cancel",
+        label: "Subscription k\xFCndigen",
+        actionKey: "subscriptions.cancel",
+        requiredCapability: "subscriptions.cancel",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.grant",
+        label: "Pilot-Status setzen",
+        actionKey: "pilots.grant",
+        requiredCapability: "pilots.grant",
+        requiresMfa: true,
+        confirmType: "simple"
+      },
+      {
+        id: "platform.pilots.revoke",
+        label: "Pilot-Status entziehen",
+        actionKey: "pilots.revoke",
+        requiredCapability: "pilots.revoke",
+        requiresMfa: true,
+        confirmType: "typed-slug"
+      },
+      {
+        id: "platform.pilots.extend",
+        label: "Pilot verl\xE4ngern",
+        actionKey: "pilots.extend",
+        requiredCapability: "pilots.extend",
+        requiresMfa: true,
+        confirmType: "date"
+      }
+    ]
+  },
+  audit: {
+    actions: [
+      {
+        key: "TENANT_SUSPEND",
+        label: "Mandant suspendiert",
+        severity: "high"
+      },
+      {
+        key: "TENANT_REACTIVATE",
+        label: "Mandant reaktiviert",
+        severity: "medium"
+      },
+      {
+        key: "TENANT_IMPERSONATE",
+        label: "Impersonation gestartet",
+        severity: "high"
+      },
+      {
+        key: "TENANT_EXPORT",
+        label: "DSGVO-Export ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_CREATE",
+        label: "Pilot-Tenant angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_GRANT",
+        label: "Pilot-Status gesetzt",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_REVOKE",
+        label: "Pilot-Status entzogen",
+        severity: "medium"
+      },
+      {
+        key: "PILOT_EXTEND",
+        label: "Pilot verl\xE4ngert",
+        severity: "low"
+      },
+      {
+        key: "PLAN_VERSION_PUBLISH",
+        label: "Plan-Version freigegeben",
+        severity: "high"
+      },
+      {
+        key: "PLAN_VERSION_TERMINATE",
+        label: "Plan-Version terminiert",
+        severity: "high"
+      },
+      {
+        key: "SUBSCRIPTION_CANCEL",
+        label: "Subscription gek\xFCndigt",
+        severity: "high"
+      },
+      {
+        key: "USER_RESET_PASSWORD",
+        label: "Passwort-Reset ausgel\xF6st",
+        severity: "medium"
+      },
+      {
+        key: "USER_DEACTIVATE",
+        label: "User deaktiviert",
+        severity: "high"
+      },
+      {
+        key: "USER_REASSIGN_ADMIN",
+        label: "Admin-Rolle \xFCbertragen",
+        severity: "high"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_CREATE",
+        label: "Plattform-Absender angelegt",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_UPDATE",
+        label: "Plattform-Absender ge\xE4ndert",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_DELETE",
+        label: "Plattform-Absender gel\xF6scht",
+        severity: "medium"
+      },
+      {
+        key: "PLATFORM_EMAIL_PROVIDER_TEST",
+        label: "Plattform-Absender Test-Versand",
+        severity: "low"
+      },
+      {
+        key: "EMAIL_HISTORY_DELETE",
+        label: "Plattform-E-Mail aus Verlauf entfernt",
+        severity: "medium"
+      },
+      {
+        key: "EMAIL_HISTORY_RESEND",
+        label: "Plattform-E-Mail erneut versendet",
+        severity: "low"
+      }
+    ]
+  }
+};
+
+// src/admin/admin-manifest.module.ts
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+function asConfigProvider(impl) {
+  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
+    return {
+      provide: ADMIN_MANIFEST_CONFIG,
+      useFactory: impl.useFactory,
+      inject: impl.inject
+    };
+  }
+  return {
+    provide: ADMIN_MANIFEST_CONFIG,
+    useValue: impl
+  };
+}
+__name(asConfigProvider, "asConfigProvider");
+function buildManifestController(guards, reloadGuards) {
+  const reloadChain = [
+    ...guards,
+    ...reloadGuards
+  ];
+  let GeneratedAdminManifestController = class GeneratedAdminManifestController {
+    static {
+      __name(this, "GeneratedAdminManifestController");
+    }
+    manifest;
+    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+    // `design:paramtypes` metadata, so Nest cannot otherwise resolve the
+    // service type at the constructor.
+    constructor(manifest) {
+      this.manifest = manifest;
+    }
+    getManifest(ifNoneMatch, res) {
+      const m = this.manifest.getManifest();
+      const etag = `"${m.build.manifestHash}"`;
+      res.header("ETag", etag);
+      if (ifNoneMatch && ifNoneMatch === etag) {
+        res.status(import_common9.HttpStatus.NOT_MODIFIED);
+        return null;
+      }
+      return m;
+    }
+    reload() {
+      const m = this.manifest.rebuild();
+      return {
+        manifestHash: m.build.manifestHash,
+        reloadedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  };
+  _ts_decorate9([
+    (0, import_common9.Get)("manifest"),
+    (0, import_common9.Header)("Cache-Control", "private, max-age=60, must-revalidate"),
+    _ts_param7(0, (0, import_common9.Headers)("if-none-match")),
+    _ts_param7(1, (0, import_common9.Res)({
+      passthrough: true
+    })),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      Object,
+      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
+    ]),
+    _ts_metadata7("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "getManifest", null);
+  _ts_decorate9([
+    (0, import_common9.Post)("manifest/reload"),
+    (0, import_common9.UseGuards)(...reloadChain),
+    (0, import_common9.HttpCode)(import_common9.HttpStatus.OK),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", []),
+    _ts_metadata7("design:returntype", void 0)
+  ], GeneratedAdminManifestController.prototype, "reload", null);
+  GeneratedAdminManifestController = _ts_decorate9([
+    (0, import_common9.Controller)("admin"),
+    (0, import_common9.UseGuards)(...guards),
+    _ts_param7(0, (0, import_common9.Inject)(AdminManifestService)),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof AdminManifestService === "undefined" ? Object : AdminManifestService
+    ])
+  ], GeneratedAdminManifestController);
+  return GeneratedAdminManifestController;
+}
+__name(buildManifestController, "buildManifestController");
+var AdminManifestModule = class _AdminManifestModule {
+  static {
+    __name(this, "AdminManifestModule");
+  }
+  static forRoot(options) {
+    const includeManifestController = options.includeManifestController ?? true;
+    const registerPlatformCore = options.registerPlatformCore ?? true;
+    const controllers = [
+      AdminPublicBootController
+    ];
+    if (includeManifestController) {
+      if (options.guards === void 0) {
+        throw new Error("AdminManifestModule.forRoot: `guards` ist Pflicht, wenn `includeManifestController` aktiv ist (Default `true`). Setze `guards: [JwtAuthGuard, SuperAdminGuard]` (oder analog) \u2014 oder `guards: []`, um den Endpoint absichtlich auth-frei zu betreiben. Alternative: `includeManifestController: false` und einen eigenen Wrapping-Controller registrieren.");
+      }
+      controllers.push(buildManifestController(options.guards, options.reloadGuards ?? []));
+    }
+    const providers = [
+      asConfigProvider(options.config),
+      AdminManifestService,
+      ...options.extraProviders ?? []
+    ];
+    if (registerPlatformCore) {
+      providers.push({
+        provide: PLATFORM_CORE_CONTRIBUTION_TOKEN,
+        useValue: PLATFORM_CORE_MANIFEST_CONTRIBUTION
+      });
+    }
+    return {
+      module: _AdminManifestModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers,
+      providers,
+      exports: [
+        ADMIN_MANIFEST_CONFIG,
+        AdminManifestService
+      ]
+    };
+  }
+};
+AdminManifestModule = _ts_decorate9([
+  (0, import_common9.Module)({})
+], AdminManifestModule);
+
+// src/billing/plan-catalog.module.ts
+var import_common10 = require("@nestjs/common");
+
+// src/billing/plan-catalog-from-snapshot.ts
+function buildPlanCatalogFromSnapshot(settings, snapshot) {
+  const liveByPlanKey = new Map(snapshot.livePlanVersions.map((v) => [
+    v.planId,
+    v
+  ]));
+  const plans = snapshot.plans.filter((p) => p.deletedAt === null).sort((a, b) => a.sortOrder - b.sortOrder).map((stem) => {
+    const live = liveByPlanKey.get(stem.planKey);
+    if (!live) {
+      return {
+        id: stem.planKey,
+        name: stem.label,
+        tagline: stem.description ?? void 0,
+        marketed: false,
+        monthlyNet: null,
+        yearlyNet: null,
+        features: [],
+        quotas: {}
+      };
+    }
+    return {
+      id: stem.planKey,
+      name: stem.label,
+      tagline: stem.description ?? void 0,
+      marketed: live.marketed,
+      monthlyNet: parseFloat(live.monthlyNet),
+      yearlyNet: parseFloat(live.yearlyNet),
+      features: live.features,
+      quotas: live.quotas ?? {}
+    };
+  });
+  const features = snapshot.featureEntries.filter((f) => f.deletedAt === null).sort((a, b) => a.sortOrder - b.sortOrder).map((row) => ({
+    key: row.featureKey,
+    label: row.label,
+    icon: row.icon ?? void 0,
+    tier: row.tier ?? void 0,
+    plannedOnly: row.plannedOnly
+  }));
+  return {
+    schemaVersion: 1,
+    projectKey: settings.projectKey,
+    ...settings.app ? {
+      app: settings.app
+    } : {},
+    currency: settings.currency,
+    vatRate: settings.vatRate,
+    ...settings.marketing ? {
+      marketing: settings.marketing
+    } : {},
+    features,
+    plans
+  };
+}
+__name(buildPlanCatalogFromSnapshot, "buildPlanCatalogFromSnapshot");
+
+// src/billing/plan-catalog.module.ts
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+var PLAN_CATALOG_TOKEN = /* @__PURE__ */ Symbol("PLAN_CATALOG");
+var PLAN_CATALOG_READ_SINK_TOKEN = /* @__PURE__ */ Symbol("PLAN_CATALOG_READ_SINK");
+var PlanCatalogModule = class _PlanCatalogModule {
+  static {
+    __name(this, "PlanCatalogModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _PlanCatalogModule,
+      global: options.global ?? true,
+      imports: options.imports ?? [],
+      providers: [
+        ...options.extraProviders ?? [],
+        asProvider(PLAN_CATALOG_READ_SINK_TOKEN, options.sink),
+        {
+          provide: PLAN_CATALOG_TOKEN,
+          useFactory: /* @__PURE__ */ __name(async (sink) => {
+            const snapshot = await sink.loadSnapshot(options.projectKey);
+            return buildPlanCatalogFromSnapshot({
+              projectKey: options.projectKey,
+              app: options.app,
+              currency: options.currency,
+              vatRate: options.vatRate,
+              marketing: options.marketing
+            }, snapshot);
+          }, "useFactory"),
+          inject: [
+            PLAN_CATALOG_READ_SINK_TOKEN
+          ]
+        }
+      ],
+      exports: [
+        PLAN_CATALOG_TOKEN,
+        PLAN_CATALOG_READ_SINK_TOKEN
+      ]
+    };
+  }
+  /**
+   * Tests / in-memory setup: takes the catalog object directly, without a
+   * sink/DB lookup. For unit tests + test bootstraps.
+   */
+  static forRootWithCatalog(catalog, opts = {}) {
+    return {
+      module: _PlanCatalogModule,
+      providers: [
+        {
+          provide: PLAN_CATALOG_TOKEN,
+          useValue: catalog
+        }
+      ],
+      exports: [
+        PLAN_CATALOG_TOKEN
+      ],
+      global: opts.global ?? true
+    };
+  }
+};
+PlanCatalogModule = _ts_decorate10([
+  (0, import_common10.Module)({})
+], PlanCatalogModule);
+
+// src/discovery/discovery.module.ts
+var import_common13 = require("@nestjs/common");
+var import_core3 = require("@nestjs/core");
+
+// src/discovery/discovery.controller.ts
+var import_common12 = require("@nestjs/common");
+
+// src/discovery/discovery.scanner.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_common11 = require("@nestjs/common");
+var import_core2 = require("@nestjs/core");
+
+// src/discovery/tokens.ts
+var IMPLEMENTS_CAPABILITY_KEY = "discovery:implements-capability";
+var DEFINES_QUOTA_KEY = "discovery:defines-quota";
+var ENFORCE_QUOTA_KEY = "discovery:enforce-quota";
+var DISCOVERY_SNAPSHOT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoverySnapshot");
+
+// src/discovery/discovery.scanner.ts
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param8(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param8, "_ts_param");
+var DEFAULT_APP_INFO = {
+  key: "unknown",
+  version: "0.0.0"
+};
+var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_APP_INFO");
+var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_SNAPSHOT_PATH");
+var DiscoveryScanner = class _DiscoveryScanner {
+  static {
+    __name(this, "DiscoveryScanner");
+  }
+  discoveryService;
+  metadataScanner;
+  reflector;
+  appInfo;
+  snapshotPath;
+  logger = new import_common11.Logger(_DiscoveryScanner.name);
+  snapshot = null;
+  // Explicit @Inject instead of type reflection: in the platform package
+  // build tsup/esbuild do not emit `design:paramtypes` metadata, so Nest
+  // cannot otherwise resolve the DI targets at the constructor
+  // (UndefinedDependencyException at the consumer's boot). Pattern
+  // analogous to admin/admin-manifest.module.ts.
+  constructor(discoveryService, metadataScanner, reflector, appInfo = DEFAULT_APP_INFO, snapshotPath = null) {
+    this.discoveryService = discoveryService;
+    this.metadataScanner = metadataScanner;
+    this.reflector = reflector;
+    this.appInfo = appInfo;
+    this.snapshotPath = snapshotPath;
+  }
+  onApplicationBootstrap() {
+    this.snapshot = this.buildSnapshot();
+    this.logger.log(`Discovery snapshot built: ${this.snapshot.capabilities.length} capabilities, ${this.snapshot.features.length} features, ${this.snapshot.quotas.length} quotas (hash=${this.snapshot.hash.slice(0, 12)}\u2026)`);
+    if (this.snapshotPath) {
+      this.persistSnapshot(this.snapshotPath, this.snapshot);
+    }
+  }
+  persistSnapshot(path, snapshot) {
+    try {
+      (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), {
+        recursive: true
+      });
+      (0, import_node_fs.writeFileSync)(path, JSON.stringify(snapshot, null, 2) + "\n", "utf-8");
+      this.logger.log(`Discovery snapshot persisted to ${path}`);
+    } catch (err) {
+      this.logger.warn(`Discovery snapshot konnte nicht nach ${path} geschrieben werden: ${err.message}`);
+    }
+  }
+  /**
+   * Returns the boot-time snapshot. Before `onApplicationBootstrap` (e.g. in
+   * tests) the snapshot is built lazily.
+   */
+  getSnapshot() {
+    if (!this.snapshot) {
+      this.snapshot = this.buildSnapshot();
+    }
+    return this.snapshot;
+  }
+  /**
+   * Forces a re-scan (SuperAdmin "re-run discovery" or tests with
+   * dynamically registered providers). `scannedAt` is set anew and the
+   * snapshot — as at boot — is persisted to disk so that the last scan
+   * actually performed is preserved.
+   */
+  rebuildSnapshot() {
+    this.snapshot = this.buildSnapshot();
+    if (this.snapshotPath) {
+      this.persistSnapshot(this.snapshotPath, this.snapshot);
+    }
+    return this.snapshot;
+  }
+  buildSnapshot() {
+    const capabilitiesByKey = /* @__PURE__ */ new Map();
+    const quotasByKey = /* @__PURE__ */ new Map();
+    const enforceRefs = [];
+    const wrappers = [
+      ...this.discoveryService.getProviders(),
+      ...this.discoveryService.getControllers()
+    ];
+    for (const wrapper of wrappers) {
+      const instance = wrapper.instance;
+      if (!instance || typeof instance !== "object") continue;
+      const ctor = instance.constructor;
+      if (!ctor) continue;
+      const quotaOpts = this.reflector.get(DEFINES_QUOTA_KEY, ctor);
+      if (quotaOpts) {
+        this.registerQuota(quotasByKey, quotaOpts, ctor.name);
+      }
+      const prototype = Object.getPrototypeOf(instance);
+      const methodNames = this.metadataScanner.getAllMethodNames(prototype);
+      for (const methodName of methodNames) {
+        const methodRef = instance[methodName];
+        if (typeof methodRef !== "function") continue;
+        const capMeta = this.reflector.get(IMPLEMENTS_CAPABILITY_KEY, methodRef);
+        if (capMeta) {
+          this.registerCapability(capabilitiesByKey, capMeta, `${ctor.name}.${methodName}`);
+        }
+        const enforceMeta = this.reflector.get(ENFORCE_QUOTA_KEY, methodRef);
+        if (enforceMeta && capMeta) {
+          enforceRefs.push({
+            capabilityKey: capMeta.capabilityKey,
+            quotaKey: enforceMeta.quotaKey
+          });
+        }
+      }
+    }
+    const capabilities = sortByKey([
+      ...capabilitiesByKey.values()
+    ], (c) => c.capabilityKey);
+    const features = aggregateFeatures(capabilities);
+    const quotas = sortByKey(decorateQuotasWithEnforcers([
+      ...quotasByKey.values()
+    ], enforceRefs), (q) => q.quotaKey);
+    const snapshot = {
+      schemaVersion: 1,
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      app: {
+        ...this.appInfo
+      },
+      capabilities,
+      features,
+      quotas,
+      hash: ""
+    };
+    snapshot.hash = computeSnapshotHash(snapshot);
+    return snapshot;
+  }
+  registerCapability(target, meta, declaredAt) {
+    const existing = target.get(meta.capabilityKey);
+    if (existing) {
+      this.logger.warn(`Capability '${meta.capabilityKey}' wird an mehreren Stellen deklariert (${existing.declaredAt} und ${declaredAt}); erste Deklaration gewinnt`);
+      return;
+    }
+    target.set(meta.capabilityKey, {
+      capabilityKey: meta.capabilityKey,
+      label: meta.label ?? null,
+      feature: meta.feature ?? null,
+      status: meta.status ?? "active",
+      kind: meta.kind ?? "endpoint",
+      owner: meta.owner ?? null,
+      replacementKey: meta.replacementKey ?? null,
+      removalPlannedAt: meta.removalPlannedAt ?? null,
+      reason: meta.reason ?? null,
+      requires: normalizeKeyList(meta.requires),
+      replaces: normalizeKeyList(meta.replaces),
+      declaredAt
+    });
+  }
+  registerQuota(target, opts, declaredAt) {
+    const existing = target.get(opts.key);
+    if (existing) {
+      this.logger.warn(`Quota '${opts.key}' wird an mehreren Stellen definiert (${existing.declaredAt} und ${declaredAt}); erste Definition gewinnt`);
+      return;
+    }
+    target.set(opts.key, {
+      quotaKey: opts.key,
+      label: opts.label,
+      unit: opts.unit,
+      policy: opts.policy,
+      feature: opts.feature ?? null,
+      replaces: normalizeKeyList(opts.replaces),
+      declaredAt,
+      enforcedBy: []
+    });
+  }
+};
+DiscoveryScanner = _ts_decorate11([
+  (0, import_common11.Injectable)(),
+  _ts_param8(0, (0, import_common11.Inject)(import_core2.DiscoveryService)),
+  _ts_param8(1, (0, import_common11.Inject)(import_core2.MetadataScanner)),
+  _ts_param8(2, (0, import_common11.Inject)(import_core2.Reflector)),
+  _ts_param8(3, (0, import_common11.Optional)()),
+  _ts_param8(3, (0, import_common11.Inject)(DISCOVERY_APP_INFO_TOKEN)),
+  _ts_param8(4, (0, import_common11.Optional)()),
+  _ts_param8(4, (0, import_common11.Inject)(DISCOVERY_SNAPSHOT_PATH_TOKEN)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof import_core2.DiscoveryService === "undefined" ? Object : import_core2.DiscoveryService,
+    typeof import_core2.MetadataScanner === "undefined" ? Object : import_core2.MetadataScanner,
+    typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
+    typeof DiscoveryAppInfo === "undefined" ? Object : DiscoveryAppInfo,
+    Object
+  ])
+], DiscoveryScanner);
+function aggregateFeatures(capabilities) {
+  const byFeature = /* @__PURE__ */ new Map();
+  for (const cap of capabilities) {
+    if (!cap.feature) continue;
+    const acc = byFeature.get(cap.feature) ?? {
+      capabilityKeys: [],
+      requires: /* @__PURE__ */ new Set(),
+      replaces: /* @__PURE__ */ new Set()
+    };
+    acc.capabilityKeys.push(cap.capabilityKey);
+    for (const key of cap.requires ?? []) acc.requires.add(key);
+    for (const key of cap.replaces ?? []) acc.replaces.add(key);
+    byFeature.set(cap.feature, acc);
+  }
+  return sortByKey([
+    ...byFeature.entries()
+  ].map(([featureKey, acc]) => {
+    acc.requires.delete(featureKey);
+    acc.replaces.delete(featureKey);
+    return {
+      featureKey,
+      capabilityKeys: [
+        ...acc.capabilityKeys
+      ].sort((a, b) => a.localeCompare(b)),
+      requires: setToSortedListOrNull(acc.requires),
+      replaces: setToSortedListOrNull(acc.replaces)
+    };
+  }), (f) => f.featureKey);
+}
+__name(aggregateFeatures, "aggregateFeatures");
+function normalizeKeyList(keys) {
+  if (!keys || keys.length === 0) return null;
+  return [
+    ...new Set(keys)
+  ].sort((a, b) => a.localeCompare(b));
+}
+__name(normalizeKeyList, "normalizeKeyList");
+function setToSortedListOrNull(keys) {
+  if (keys.size === 0) return null;
+  return [
+    ...keys
+  ].sort((a, b) => a.localeCompare(b));
+}
+__name(setToSortedListOrNull, "setToSortedListOrNull");
+function decorateQuotasWithEnforcers(quotas, enforceRefs) {
+  const enforcedByQuota = /* @__PURE__ */ new Map();
+  for (const ref of enforceRefs) {
+    const set = enforcedByQuota.get(ref.quotaKey) ?? /* @__PURE__ */ new Set();
+    set.add(ref.capabilityKey);
+    enforcedByQuota.set(ref.quotaKey, set);
+  }
+  return quotas.map((q) => ({
+    ...q,
+    enforcedBy: [
+      ...enforcedByQuota.get(q.quotaKey) ?? /* @__PURE__ */ new Set()
+    ].sort((a, b) => a.localeCompare(b))
+  }));
+}
+__name(decorateQuotasWithEnforcers, "decorateQuotasWithEnforcers");
+function sortByKey(items, keyFn) {
+  return [
+    ...items
+  ].sort((a, b) => keyFn(a).localeCompare(keyFn(b)));
+}
+__name(sortByKey, "sortByKey");
+function computeSnapshotHash(snapshot) {
+  const stableInput = {
+    schemaVersion: snapshot.schemaVersion,
+    appKey: snapshot.app.key,
+    capabilities: snapshot.capabilities.map((c) => ({
+      ...c
+    })),
+    features: snapshot.features,
+    quotas: snapshot.quotas
+  };
+  const json = canonicalStringify(stableInput);
+  return `sha256-${(0, import_node_crypto2.createHash)("sha256").update(json).digest("hex")}`;
+}
+__name(computeSnapshotHash, "computeSnapshotHash");
+function canonicalStringify(value) {
+  return JSON.stringify(value, (_key, val) => {
+    if (val && typeof val === "object" && !Array.isArray(val)) {
+      const sorted = {};
+      for (const k of Object.keys(val).sort()) {
+        sorted[k] = val[k];
+      }
+      return sorted;
+    }
+    return val;
+  });
+}
+__name(canonicalStringify, "canonicalStringify");
+
+// src/discovery/discovery.controller.ts
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+function _ts_metadata9(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata9, "_ts_metadata");
+function _ts_param9(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param9, "_ts_param");
+function buildDiscoveryController(guards) {
+  let GeneratedDiscoveryController = class GeneratedDiscoveryController {
+    static {
+      __name(this, "GeneratedDiscoveryController");
+    }
+    scanner;
+    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
+    // any `design:paramtypes` metadata, so otherwise Nest cannot resolve the
+    // service type on the constructor.
+    constructor(scanner) {
+      this.scanner = scanner;
+    }
+    getDiscovery(ifNoneMatch, res) {
+      const snapshot = this.scanner.getSnapshot();
+      const etag = `"${snapshot.hash}-${snapshot.scannedAt}"`;
+      res.header("ETag", etag);
+      if (ifNoneMatch && ifNoneMatch === etag) {
+        res.status(import_common12.HttpStatus.NOT_MODIFIED);
+        return null;
+      }
+      return snapshot;
+    }
+    /**
+     * Forces a fresh code scan and returns the new snapshot.
+     * `scannedAt` is updated; the Capability/Feature/Quota data
+     * are identical within the running process (code is stable at runtime).
+     */
+    rescanDiscovery() {
+      return this.scanner.rebuildSnapshot();
+    }
+  };
+  _ts_decorate12([
+    (0, import_common12.Get)("discovery"),
+    (0, import_common12.Header)("Cache-Control", "private, no-cache"),
+    _ts_param9(0, (0, import_common12.Headers)("if-none-match")),
+    _ts_param9(1, (0, import_common12.Res)({
+      passthrough: true
+    })),
+    _ts_metadata9("design:type", Function),
+    _ts_metadata9("design:paramtypes", [
+      Object,
+      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
+    ]),
+    _ts_metadata9("design:returntype", Object)
+  ], GeneratedDiscoveryController.prototype, "getDiscovery", null);
+  _ts_decorate12([
+    (0, import_common12.Post)("discovery/rescan"),
+    _ts_metadata9("design:type", Function),
+    _ts_metadata9("design:paramtypes", []),
+    _ts_metadata9("design:returntype", typeof DiscoverySnapshot === "undefined" ? Object : DiscoverySnapshot)
+  ], GeneratedDiscoveryController.prototype, "rescanDiscovery", null);
+  GeneratedDiscoveryController = _ts_decorate12([
+    (0, import_common12.Controller)("admin"),
+    (0, import_common12.UseGuards)(...guards),
+    _ts_param9(0, (0, import_common12.Inject)(DiscoveryScanner)),
+    _ts_metadata9("design:type", Function),
+    _ts_metadata9("design:paramtypes", [
+      typeof DiscoveryScanner === "undefined" ? Object : DiscoveryScanner
+    ])
+  ], GeneratedDiscoveryController);
+  return GeneratedDiscoveryController;
+}
+__name(buildDiscoveryController, "buildDiscoveryController");
+
+// src/discovery/discovery.module.ts
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+var DiscoveryModule = class _DiscoveryModule {
+  static {
+    __name(this, "DiscoveryModule");
+  }
+  static forRoot(options) {
+    const isGlobal = options.isGlobal ?? true;
+    const controllers = [];
+    if (options.controller) {
+      controllers.push(buildDiscoveryController(options.controller.guards));
+    }
+    const providers = [
+      {
+        provide: DISCOVERY_APP_INFO_TOKEN,
+        useValue: options.app
+      },
+      {
+        provide: DISCOVERY_SNAPSHOT_PATH_TOKEN,
+        useValue: options.snapshotPath ?? null
+      },
+      DiscoveryScanner,
+      {
+        provide: DISCOVERY_SNAPSHOT_TOKEN,
+        useFactory: /* @__PURE__ */ __name((scanner) => scanner.getSnapshot(), "useFactory"),
+        inject: [
+          DiscoveryScanner
+        ]
+      }
+    ];
+    return {
+      module: _DiscoveryModule,
+      imports: [
+        import_core3.DiscoveryModule,
+        ...options.imports ?? []
+      ],
+      controllers,
+      providers,
+      exports: [
+        DiscoveryScanner,
+        DISCOVERY_SNAPSHOT_TOKEN
+      ],
+      global: isGlobal
+    };
+  }
+};
+DiscoveryModule = _ts_decorate13([
+  (0, import_common13.Module)({})
+], DiscoveryModule);
+
+// src/entitlement/module.ts
+var import_common15 = require("@nestjs/common");
+
+// src/entitlement/service.ts
+var import_common14 = require("@nestjs/common");
+
+// src/catalog/tokens.ts
+var BUNDLE_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol("BUNDLE_REPOSITORY");
+
+// src/billing/subscription-bundles.tokens.ts
+var SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionBundleRepository");
+
+// src/subscription-contract/tokens.ts
+var SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionContractRepository");
+
+// src/billing/plan-helpers.ts
+function isFeaturePlannedOnly(catalog, featureKey) {
+  const def = (catalog.features ?? []).find((f) => f.key === featureKey);
+  return def?.plannedOnly === true;
+}
+__name(isFeaturePlannedOnly, "isFeaturePlannedOnly");
+
+// src/entitlement/aggregation.ts
+function aggregateBusinessTypeQuotas(snapshot) {
+  const sums = {};
+  for (const bundle of snapshot.bundles) {
+    for (const [key, value] of Object.entries(bundle.quotas)) {
+      if (sums[key] === -1 || value === -1) {
+        sums[key] = -1;
+      } else {
+        sums[key] = (sums[key] ?? 0) + value;
+      }
+    }
+  }
+  for (const [key, value] of Object.entries(snapshot.quotaOverrides)) {
+    if (value !== void 0) {
+      sums[key] = value;
+    }
+  }
+  return sums;
+}
+__name(aggregateBusinessTypeQuotas, "aggregateBusinessTypeQuotas");
+function filterActiveSubscriptionBundles(bundles, now) {
+  return bundles.filter((b) => b.canceledEffectiveAt === null || b.canceledEffectiveAt > now);
+}
+__name(filterActiveSubscriptionBundles, "filterActiveSubscriptionBundles");
+function aggregateSubscriptionBundleQuotas(bundles) {
+  const sums = {};
+  for (const bundle of bundles) {
+    for (const [key, value] of Object.entries(bundle.quotas)) {
+      if (sums[key] === -1 || value === -1) {
+        sums[key] = -1;
+      } else {
+        sums[key] = (sums[key] ?? 0) + value;
+      }
+    }
+  }
+  return sums;
+}
+__name(aggregateSubscriptionBundleQuotas, "aggregateSubscriptionBundleQuotas");
+function collectSubscriptionBundleFeatures(bundles) {
+  const set = /* @__PURE__ */ new Set();
+  for (const bundle of bundles) {
+    for (const f of bundle.features) set.add(f);
+  }
+  return Array.from(set);
+}
+__name(collectSubscriptionBundleFeatures, "collectSubscriptionBundleFeatures");
+function aggregateContractLineItemEntitlements(lineItems, fallbackPlan = "UNKNOWN") {
+  const planItem = lineItems.find((item) => item.kind === "plan");
+  const plan = planItem?.sourceKey ?? fallbackPlan;
+  const quotas = {};
+  const features = /* @__PURE__ */ new Set();
+  for (const item of lineItems) {
+    for (const feature of item.featuresSnapshot) {
+      features.add(feature);
+    }
+    for (const [key, value] of Object.entries(item.quotaEffectsSnapshot)) {
+      if (quotas[key] === -1 || value === -1) {
+        quotas[key] = -1;
+      } else {
+        quotas[key] = (quotas[key] ?? 0) + value;
+      }
+    }
+  }
+  return {
+    plan,
+    quotas,
+    features
+  };
+}
+__name(aggregateContractLineItemEntitlements, "aggregateContractLineItemEntitlements");
+function collectBusinessTypeFeatures(snapshot) {
+  const set = /* @__PURE__ */ new Set();
+  for (const bundle of snapshot.bundles) {
+    for (const f of bundle.features) {
+      set.add(f);
+    }
+  }
+  return Array.from(set);
+}
+__name(collectBusinessTypeFeatures, "collectBusinessTypeFeatures");
+function filterPlannedOnlyFeatures(features, catalog) {
+  const out = /* @__PURE__ */ new Set();
+  for (const f of features) {
+    if (!isFeaturePlannedOnly(catalog, f)) {
+      out.add(f);
+    }
+  }
+  return out;
+}
+__name(filterPlannedOnlyFeatures, "filterPlannedOnlyFeatures");
+function applyCustomLimits(base, custom) {
+  if (!custom) return base;
+  const quotas = {
+    ...base.quotas
+  };
+  if (custom.quotas) {
+    for (const [k, v] of Object.entries(custom.quotas)) {
+      quotas[k] = v;
+    }
+  }
+  const features = new Set(base.features);
+  if (custom.features) {
+    for (const f of custom.features) features.add(f);
+  }
+  return {
+    plan: base.plan,
+    quotas,
+    features
+  };
+}
+__name(applyCustomLimits, "applyCustomLimits");
+function aggregateLimits(input, catalog, now) {
+  const businessTypeQuotas = input.businessTypeVersion ? aggregateBusinessTypeQuotas(input.businessTypeVersion) : {};
+  const businessTypeFeatures = input.businessTypeVersion ? collectBusinessTypeFeatures(input.businessTypeVersion) : [];
+  const activeBundles = filterActiveSubscriptionBundles(input.subscriptionBundles ?? [], now);
+  const subBundleQuotas = aggregateSubscriptionBundleQuotas(activeBundles);
+  const subBundleFeatures = collectSubscriptionBundleFeatures(activeBundles);
+  const quotas = {};
+  for (const [k, v] of Object.entries(input.planVersion.quotas)) {
+    quotas[k] = v;
+  }
+  for (const [k, v] of Object.entries(businessTypeQuotas)) {
+    if (quotas[k] === -1 || v === -1) {
+      quotas[k] = -1;
+    } else {
+      quotas[k] = (quotas[k] ?? 0) + v;
+    }
+  }
+  for (const [k, v] of Object.entries(subBundleQuotas)) {
+    if (quotas[k] === -1 || v === -1) {
+      quotas[k] = -1;
+    } else {
+      quotas[k] = (quotas[k] ?? 0) + v;
+    }
+  }
+  const features = /* @__PURE__ */ new Set([
+    ...input.planVersion.features,
+    ...businessTypeFeatures,
+    ...subBundleFeatures
+  ]);
+  const withCustom = applyCustomLimits({
+    plan: input.plan,
+    quotas,
+    features
+  }, input.customLimits);
+  const filteredFeatures = filterPlannedOnlyFeatures(withCustom.features, catalog);
+  return {
+    plan: withCustom.plan,
+    quotas: withCustom.quotas,
+    features: filteredFeatures
+  };
+}
+__name(aggregateLimits, "aggregateLimits");
+
+// src/entitlement/feature-aliases.ts
+function buildReplacedByIndex(features) {
+  const index = /* @__PURE__ */ new Map();
+  for (const feature of features) {
+    for (const oldKey of feature.replaces ?? []) {
+      if (oldKey === feature.featureKey) continue;
+      const list = index.get(oldKey) ?? [];
+      list.push(feature.featureKey);
+      index.set(oldKey, list);
+    }
+  }
+  for (const list of index.values()) list.sort((a, b) => a.localeCompare(b));
+  assertNoReplacesCycle(index);
+  return index;
+}
+__name(buildReplacedByIndex, "buildReplacedByIndex");
+function expandReplacedFeatures(granted, index) {
+  const expanded = new Set(granted);
+  const worklist = [
+    ...granted
+  ];
+  while (worklist.length > 0) {
+    const key = worklist.pop();
+    for (const successor of index.get(key) ?? []) {
+      if (expanded.has(successor)) continue;
+      expanded.add(successor);
+      worklist.push(successor);
+    }
+  }
+  return expanded;
+}
+__name(expandReplacedFeatures, "expandReplacedFeatures");
+function assertNoReplacesCycle(index) {
+  const DONE = 2;
+  const IN_PROGRESS = 1;
+  const state = /* @__PURE__ */ new Map();
+  const visit = /* @__PURE__ */ __name((key, path) => {
+    const s = state.get(key);
+    if (s === DONE) return;
+    if (s === IN_PROGRESS) {
+      const cycleStart = path.indexOf(key);
+      const cycle = [
+        ...path.slice(cycleStart),
+        key
+      ].join(" \u2192 ");
+      throw new Error(`replaces-Zyklus in den Discovery-Metadaten: ${cycle}. Feature-Ersetzungen m\xFCssen azyklisch sein \u2014 replaces-Deklarationen im Code korrigieren (#39).`);
+    }
+    state.set(key, IN_PROGRESS);
+    for (const successor of index.get(key) ?? []) {
+      visit(successor, [
+        ...path,
+        key
+      ]);
+    }
+    state.set(key, DONE);
+  }, "visit");
+  for (const key of index.keys()) visit(key, []);
+}
+__name(assertNoReplacesCycle, "assertNoReplacesCycle");
+
+// src/entitlement/limit-exceeded-error.ts
+var LimitExceededError = class extends Error {
+  static {
+    __name(this, "LimitExceededError");
+  }
+  dimension;
+  max;
+  used;
+  constructor(dimension, max, used) {
+    super(`Limit f\xFCr ${dimension} erreicht: ${used}/${max}.`), this.dimension = dimension, this.max = max, this.used = used;
+    this.name = "LimitExceededError";
+  }
+};
+
+// src/entitlement/plan-resolution.ts
+function resolveEntitlementPlan(input, config, now) {
+  if (input.isPilot && config.pilotEntitlementPlan !== void 0) {
+    return config.pilotEntitlementPlan;
+  }
+  if (input.status === "TRIAL") {
+    return input.trialEntitlementPlan ?? config.defaultTrialEntitlementPlan ?? input.plan;
+  }
+  if (input.status === "PENDING_SALES" && config.pendingSalesEntitlementPlan !== void 0) {
+    return config.pendingSalesEntitlementPlan;
+  }
+  if (input.pendingPlan && input.pendingEffectiveAt && input.pendingEffectiveAt <= now) {
+    return input.pendingPlan;
+  }
+  return input.plan;
+}
+__name(resolveEntitlementPlan, "resolveEntitlementPlan");
+
+// src/entitlement/tokens.ts
+var SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionRepository");
+var PLAN_VERSION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanVersionRepository");
+var TRANSACTION_RUNNER_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/TransactionRunner");
+var ENTITLEMENT_RESOLUTION_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/EntitlementResolutionConfig");
+
+// src/entitlement/service.ts
+function _ts_decorate14(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate14, "_ts_decorate");
+function _ts_metadata10(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata10, "_ts_metadata");
+function _ts_param10(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param10, "_ts_param");
+var CACHE_TTL_MS = 6e4;
+var CACHE_MAX_ENTRIES = 1e3;
+var EntitlementService = class {
+  static {
+    __name(this, "EntitlementService");
+  }
+  catalog;
+  subscriptions;
+  planVersions;
+  tx;
+  resolutionConfig;
+  subscriptionBundles;
+  bundles;
+  subscriptionContracts;
+  discoverySnapshot;
+  // Map preserves insert order — on a hit the entry is removed and
+  // re-inserted (LRU). The TTL is a safety net for forgotten
+  // invalidations — 60s is enough, because limits generally only change
+  // through mutations, not through time (a pending plan's effective date
+  // is day-granular).
+  cache = /* @__PURE__ */ new Map();
+  // #39 — replaces alias index, built lazily from the boot-static snapshot;
+  // throws on replaces cycles (a clear error instead of an infinite loop).
+  replacedByIndex = null;
+  constructor(catalog, subscriptions, planVersions, tx, resolutionConfig = null, subscriptionBundles = null, bundles = null, subscriptionContracts = null, discoverySnapshot = null) {
+    this.catalog = catalog;
+    this.subscriptions = subscriptions;
+    this.planVersions = planVersions;
+    this.tx = tx;
+    this.resolutionConfig = resolutionConfig;
+    this.subscriptionBundles = subscriptionBundles;
+    this.bundles = bundles;
+    this.subscriptionContracts = subscriptionContracts;
+    this.discoverySnapshot = discoverySnapshot;
+  }
+  // ---------------------------------------------------------------------
+  // Read path — for FeatureGuard, sidebar hooks, GET /billing/entitlement
+  // ---------------------------------------------------------------------
+  async computeLimits(tenantId, now = /* @__PURE__ */ new Date()) {
+    const cached = this.readCache(tenantId, now.getTime());
+    if (cached) return cached;
+    const sub = await this.subscriptions.findByTenantId(tenantId);
+    if (!sub) {
+      throw new import_common14.NotFoundException(`Keine Subscription f\xFCr Tenant ${tenantId}`);
+    }
+    const limits = await this.deriveLimits(sub, now);
+    this.writeCache(tenantId, limits, now.getTime());
+    return limits;
+  }
+  /**
+   * Clears a tenant's cache entry. MUST be called as soon as a mutation
+   * changes the subscription, a bundle booking, or a PlanVersion binding —
+   * otherwise FeatureGuard and the sidebar stay on stale state for up to
+   * 60s.
+   */
+  invalidateTenant(tenantId) {
+    this.cache.delete(tenantId);
+  }
+  /** Clears the entire cache. Only for tests / bootstrap. */
+  invalidateAll() {
+    this.cache.clear();
+  }
+  /**
+   * Aggregator path — also callable directly by consumers that already
+   * have a `SubscriptionRecord` (e.g. within a transaction).
+   */
+  async deriveLimits(sub, now, tx) {
+    const contractLimits = await this.deriveLimitsFromContract(sub.tenantId, now);
+    if (contractLimits) return this.withReplacedFeatureAliases(contractLimits);
+    const effectivePlan = resolveEntitlementPlan(sub, this.resolutionConfig ?? {}, now);
+    const planVersion = effectivePlan === sub.plan ? sub.planVersion : await this.findActivePlanVersionOrFallback(effectivePlan, now, tx);
+    const subscriptionBundles = await this.loadSubscriptionBundleSnapshots(sub.id, now);
+    return this.withReplacedFeatureAliases(aggregateLimits({
+      plan: effectivePlan,
+      planVersion,
+      subscriptionBundles,
+      customLimits: sub.customLimits ?? null
+    }, this.catalog, now));
+  }
+  /**
+   * Grandfathering (#39): granted old feature keys transitively grant
+   * their successors from the `replaces` chains of the discovery snapshot.
+   * A no-op without a snapshot or without replaces declarations.
+   */
+  withReplacedFeatureAliases(limits) {
+    if (!this.discoverySnapshot) return limits;
+    if (!this.replacedByIndex) {
+      this.replacedByIndex = buildReplacedByIndex(this.discoverySnapshot.features);
+    }
+    if (this.replacedByIndex.size === 0) return limits;
+    return {
+      ...limits,
+      features: expandReplacedFeatures(limits.features, this.replacedByIndex)
+    };
+  }
+  async deriveLimitsFromContract(tenantId, now) {
+    if (!this.subscriptionContracts) return null;
+    const contract = await this.subscriptionContracts.findActiveByTenantId(tenantId, now);
+    if (!contract) return null;
+    if (contract.entitlementSnapshot) {
+      return {
+        plan: contract.entitlementSnapshot.plan,
+        quotas: {
+          ...contract.entitlementSnapshot.quotas
+        },
+        features: new Set(contract.entitlementSnapshot.features)
+      };
+    }
+    return aggregateContractLineItemEntitlements(contract.lineItems);
+  }
+  /**
+   * Loads a subscription's active bundle bookings and resolves the
+   * `BundleVersion` features/quotas per entry. Without a registered
+   * `SubscriptionBundleRepository` or `BundleRepository` the method
+   * returns an empty list — apps without a bundle schema stay unchanged
+   * (plan-only aggregation).
+   */
+  async loadSubscriptionBundleSnapshots(subscriptionId, now) {
+    if (!this.subscriptionBundles || !this.bundles) return [];
+    const active = await this.subscriptionBundles.listActiveBySubscription(subscriptionId, now);
+    if (active.length === 0) return [];
+    return Promise.all(active.map(async (booking) => {
+      const bv = await this.bundles.findVersionById(booking.bundleVersionId);
+      if (!bv) {
+        throw new Error(`BundleVersion '${booking.bundleVersionId}' aus aktiver SubscriptionBundle nicht gefunden`);
+      }
+      return {
+        bundleKey: bv.bundleKey,
+        features: bv.features,
+        quotas: bv.quotas,
+        canceledEffectiveAt: booking.canceledEffectiveAt
+      };
+    }));
+  }
+  // ---------------------------------------------------------------------
+  // Write/consumption path — row lock + count + insert in the same
+  // transaction. Protects against race conditions on concurrent creations
+  // for the same tenant.
+  // ---------------------------------------------------------------------
+  async enforceLimit(input) {
+    const now = input.now ?? /* @__PURE__ */ new Date();
+    const delta = input.delta ?? 1;
+    return this.tx.run(async (tx) => {
+      const sub = await this.subscriptions.findByTenantIdLocked(input.tenantId, tx);
+      if (!sub) {
+        throw new import_common14.NotFoundException(`Keine Subscription f\xFCr Tenant ${input.tenantId}`);
+      }
+      const limits = await this.deriveLimits(sub, now, tx);
+      const max = limits.quotas[input.dimension];
+      if (max === void 0) {
+        throw new Error(`Quota-Dimension "${input.dimension}" nicht im PlanCatalog (${this.catalog.projectKey}).`);
+      }
+      const used = await input.currentUsage(tx, input.tenantId);
+      if (max !== -1 && used + delta > max) {
+        throw new LimitExceededError(input.dimension, max, used);
+      }
+      return input.insert(tx);
+    });
+  }
+  // ---------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------
+  /**
+   * Plan fallback for TRIAL/PENDING_SALES: returns the PlanVersion active
+   * as of `asOf` (SPEC_V2 §4.2). If the repo does not implement
+   * `findActive`, we fall back to `findLatestLive` (backward compat for
+   * adapters without `validFrom` columns).
+   */
+  async findActivePlanVersionOrFallback(planId, asOf, tx) {
+    const v = this.planVersions.findActive ? await this.planVersions.findActive(planId, asOf, tx) : await this.planVersions.findLatestLive(planId, tx);
+    if (!v) {
+      throw new import_common14.NotFoundException(`Keine zu ${asOf.toISOString().slice(0, 10)} aktive PlanVersion f\xFCr ${planId} \u2014 weder validFrom-window erf\xFCllt noch latest-live verf\xFCgbar.`);
+    }
+    return v;
+  }
+  readCache(tenantId, nowMs) {
+    const entry = this.cache.get(tenantId);
+    if (!entry) return null;
+    if (entry.expiresAt < nowMs) {
+      this.cache.delete(tenantId);
+      return null;
+    }
+    this.cache.delete(tenantId);
+    this.cache.set(tenantId, entry);
+    return entry.value;
+  }
+  writeCache(tenantId, value, nowMs) {
+    if (this.cache.has(tenantId)) this.cache.delete(tenantId);
+    this.cache.set(tenantId, {
+      value,
+      expiresAt: nowMs + CACHE_TTL_MS
+    });
+    while (this.cache.size > CACHE_MAX_ENTRIES) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest === void 0) break;
+      this.cache.delete(oldest);
+    }
+  }
+};
+EntitlementService = _ts_decorate14([
+  (0, import_common14.Injectable)(),
+  _ts_param10(0, (0, import_common14.Inject)(PLAN_CATALOG_TOKEN)),
+  _ts_param10(1, (0, import_common14.Inject)(SUBSCRIPTION_REPOSITORY_TOKEN)),
+  _ts_param10(2, (0, import_common14.Inject)(PLAN_VERSION_REPOSITORY_TOKEN)),
+  _ts_param10(3, (0, import_common14.Inject)(TRANSACTION_RUNNER_TOKEN)),
+  _ts_param10(4, (0, import_common14.Optional)()),
+  _ts_param10(4, (0, import_common14.Inject)(ENTITLEMENT_RESOLUTION_CONFIG_TOKEN)),
+  _ts_param10(5, (0, import_common14.Optional)()),
+  _ts_param10(5, (0, import_common14.Inject)(SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN)),
+  _ts_param10(6, (0, import_common14.Optional)()),
+  _ts_param10(6, (0, import_common14.Inject)(BUNDLE_REPOSITORY_TOKEN)),
+  _ts_param10(7, (0, import_common14.Optional)()),
+  _ts_param10(7, (0, import_common14.Inject)(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN)),
+  _ts_param10(8, (0, import_common14.Optional)()),
+  _ts_param10(8, (0, import_common14.Inject)(DISCOVERY_SNAPSHOT_TOKEN)),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
+    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
+    typeof SubscriptionRepository === "undefined" ? Object : SubscriptionRepository,
+    typeof PlanVersionRepository === "undefined" ? Object : PlanVersionRepository,
+    typeof TransactionRunner === "undefined" ? Object : TransactionRunner,
+    Object,
+    Object,
+    Object,
+    Object,
+    Object
+  ])
+], EntitlementService);
+
+// src/entitlement/module.ts
+function _ts_decorate15(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate15, "_ts_decorate");
+var EntitlementModule = class _EntitlementModule {
+  static {
+    __name(this, "EntitlementModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      asProvider(SUBSCRIPTION_REPOSITORY_TOKEN, options.subscriptionRepository),
+      asProvider(PLAN_VERSION_REPOSITORY_TOKEN, options.planVersionRepository),
+      asProvider(TRANSACTION_RUNNER_TOKEN, options.transactionRunner),
+      EntitlementService
+    ];
+    if (options.resolutionConfig) {
+      providers.push({
+        provide: ENTITLEMENT_RESOLUTION_CONFIG_TOKEN,
+        useValue: options.resolutionConfig
+      });
+    }
+    if (options.subscriptionContractRepository) {
+      providers.push(asProvider(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN, options.subscriptionContractRepository));
+    }
+    if (options.subscriptionBundleRepository) {
+      providers.push(asProvider(SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN, options.subscriptionBundleRepository));
+    }
+    if (options.bundleRepository) {
+      providers.push(asProvider(BUNDLE_REPOSITORY_TOKEN, options.bundleRepository));
+    }
+    return {
+      module: _EntitlementModule,
+      global: options.global ?? false,
+      providers,
+      exports: [
+        EntitlementService,
+        SUBSCRIPTION_REPOSITORY_TOKEN
+      ]
+    };
+  }
+};
+EntitlementModule = _ts_decorate15([
+  (0, import_common15.Module)({})
+], EntitlementModule);
+
+// src/platform/plan-resolver.port.ts
+var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlanResolverPort");
+var StaticPlanResolver = class {
+  static {
+    __name(this, "StaticPlanResolver");
+  }
+  planId;
+  constructor(planId) {
+    this.planId = planId;
+  }
+  async getPlanIdForTenant() {
+    return this.planId;
+  }
+};
+
+// src/platform/static-entitlement.service.ts
+var import_common16 = require("@nestjs/common");
+function _ts_decorate16(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate16, "_ts_decorate");
+function _ts_metadata11(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata11, "_ts_metadata");
+function _ts_param11(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param11, "_ts_param");
+var StaticEntitlementService = class {
+  static {
+    __name(this, "StaticEntitlementService");
+  }
+  catalog;
+  resolver;
+  constructor(catalog, resolver) {
+    this.catalog = catalog;
+    this.resolver = resolver;
+  }
+  /**
+   * Returns the effective features + quotas of a tenant from the
+   * plan catalog. When the plan is missing: an empty snapshot (no feature,
+   * all quotas at 0).
+   */
+  async snapshot(tenantId) {
+    const planId = await this.resolver.getPlanIdForTenant(tenantId);
+    if (!planId) {
+      return {
+        planId: null,
+        features: [],
+        quotas: {}
+      };
+    }
+    const plan = this.findPlan(planId);
+    if (!plan) {
+      return {
+        planId,
+        features: [],
+        quotas: {}
+      };
+    }
+    return {
+      planId,
+      features: plan.features ?? [],
+      quotas: plan.quotas ?? {}
+    };
+  }
+  /** Convenience helper for tests / synchronous checks in the UI manifest. */
+  async hasFeature(tenantId, featureKey) {
+    const snap = await this.snapshot(tenantId);
+    return snap.features.includes(featureKey);
+  }
+  async quotaLimit(tenantId, quotaKey) {
+    const snap = await this.snapshot(tenantId);
+    const value = snap.quotas[quotaKey];
+    return value === void 0 ? null : value;
+  }
+  findPlan(planId) {
+    return (this.catalog.plans ?? []).find((p) => p.id === planId);
+  }
+};
+StaticEntitlementService = _ts_decorate16([
+  (0, import_common16.Injectable)(),
+  _ts_param11(0, (0, import_common16.Inject)(PLAN_CATALOG_TOKEN)),
+  _ts_param11(1, (0, import_common16.Inject)(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
+    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
+    typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
+  ])
+], StaticEntitlementService);
+
+// src/platform/static-feature.guard.ts
+var import_common18 = require("@nestjs/common");
+var import_core4 = require("@nestjs/core");
+
+// src/billing/require-feature.decorator.ts
+var import_common17 = require("@nestjs/common");
+var REQUIRE_FEATURE_KEY = "require-feature";
+
+// src/platform/static-feature.guard.ts
+function _ts_decorate17(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate17, "_ts_decorate");
+function _ts_metadata12(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata12, "_ts_metadata");
+function _ts_param12(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param12, "_ts_param");
+var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
+var StaticFeatureGuard = class {
+  static {
+    __name(this, "StaticFeatureGuard");
+  }
+  reflector;
+  entitlements;
+  config;
+  constructor(reflector, entitlements, config = null) {
+    this.reflector = reflector;
+    this.entitlements = entitlements;
+    this.config = config;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required || required.length === 0) return true;
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) throw new import_common18.ForbiddenException("Nicht authentifiziert");
+    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
+    if (role === "SUPER_ADMIN") return true;
+    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
+    if (!tenantId) throw new import_common18.ForbiddenException("Kein Mandant zugeordnet");
+    const snap = await this.entitlements.snapshot(tenantId);
+    const allowed = required.some((f) => snap.features.includes(f));
+    if (!allowed) {
+      throw new import_common18.ForbiddenException(`Feature ${required.join(" / ")} nicht im aktuellen Plan enthalten.`);
+    }
+    return true;
+  }
+};
+StaticFeatureGuard = _ts_decorate17([
+  (0, import_common18.Injectable)(),
+  _ts_param12(0, (0, import_common18.Inject)(import_core4.Reflector)),
+  _ts_param12(1, (0, import_common18.Inject)(StaticEntitlementService)),
+  _ts_param12(2, (0, import_common18.Optional)()),
+  _ts_param12(2, (0, import_common18.Inject)(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
+    typeof import_core4.Reflector === "undefined" ? Object : import_core4.Reflector,
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
+    Object
+  ])
+], StaticFeatureGuard);
+
+// src/platform/enforce-quota.interceptor.ts
+var import_common19 = require("@nestjs/common");
+var import_core5 = require("@nestjs/core");
+var import_rxjs2 = require("rxjs");
+var import_operators2 = require("rxjs/operators");
+function _ts_decorate18(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate18, "_ts_decorate");
+function _ts_metadata13(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata13, "_ts_metadata");
+function _ts_param13(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param13, "_ts_param");
+var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/QuotaProviders");
+var EnforceQuotaInterceptor = class {
+  static {
+    __name(this, "EnforceQuotaInterceptor");
+  }
+  reflector;
+  entitlements;
+  providers;
+  constructor(reflector, entitlements, providers = null) {
+    this.reflector = reflector;
+    this.entitlements = entitlements;
+    this.providers = providers;
+  }
+  intercept(context, next) {
+    const meta = this.reflector.getAllAndOverride(ENFORCE_QUOTA_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!meta?.quotaKey) return next.handle();
+    return (0, import_rxjs2.from)(this.check(context, meta)).pipe((0, import_operators2.switchMap)(() => next.handle()));
+  }
+  async check(context, meta) {
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) return;
+    const role = user.role ?? user.platformRole;
+    if (role === "SUPER_ADMIN") return;
+    const tenantId = request.tenantId ?? user.tenantId;
+    if (!tenantId) return;
+    const provider = (this.providers ?? []).find((p) => p.key === meta.quotaKey);
+    if (!provider) {
+      return;
+    }
+    const limit = await this.entitlements.quotaLimit(tenantId, meta.quotaKey);
+    if (limit === null || limit === -1) return;
+    const current = await provider.count(tenantId);
+    const delta = meta.incrementBy ?? 1;
+    if (current + delta > limit) {
+      throw new LimitExceededError(meta.quotaKey, limit, current);
+    }
+  }
+};
+EnforceQuotaInterceptor = _ts_decorate18([
+  (0, import_common19.Injectable)(),
+  _ts_param13(0, (0, import_common19.Inject)(import_core5.Reflector)),
+  _ts_param13(1, (0, import_common19.Inject)(StaticEntitlementService)),
+  _ts_param13(2, (0, import_common19.Optional)()),
+  _ts_param13(2, (0, import_common19.Inject)(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
+    typeof import_core5.Reflector === "undefined" ? Object : import_core5.Reflector,
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
+    Object
+  ])
+], EnforceQuotaInterceptor);
+
+// src/platform/tenant-manifest.service.ts
+var import_common20 = require("@nestjs/common");
+function _ts_decorate19(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate19, "_ts_decorate");
+function _ts_metadata14(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata14, "_ts_metadata");
+var TenantManifestService = class {
+  static {
+    __name(this, "TenantManifestService");
+  }
+  entitlements;
+  navItems = [];
+  constructor(entitlements) {
+    this.entitlements = entitlements;
+  }
+  /**
+   * Call in the app's `OnModuleInit`: registers app navigation for the
+   * Tenant UI. Idempotent: the same `id` overwrites.
+   */
+  registerNavItem(item) {
+    const existing = this.navItems.findIndex((i) => i.id === item.id);
+    if (existing >= 0) this.navItems[existing] = item;
+    else this.navItems.push(item);
+  }
+  /** Bulk variant. */
+  registerNavItems(items) {
+    for (const item of items) this.registerNavItem(item);
+  }
+  /**
+   * Returns the filtered manifest for a Tenant. NavItems with
+   * `requiresFeature` are filtered out server-side as soon as none of the
+   * required features are present in the entitlement snapshot.
+   */
+  async getManifest(tenantId) {
+    const snap = await this.entitlements.snapshot(tenantId);
+    const featureSet = new Set(snap.features);
+    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
+      ...item
+    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+    return {
+      schemaVersion: 1,
+      tenant: {
+        id: tenantId
+      },
+      planId: snap.planId,
+      features: snap.features,
+      quotas: snap.quotas,
+      navigation: visible
+    };
+  }
+};
+TenantManifestService = _ts_decorate19([
+  (0, import_common20.Injectable)(),
+  _ts_metadata14("design:type", Function),
+  _ts_metadata14("design:paramtypes", [
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
+  ])
+], TenantManifestService);
+function isVisible(item, features) {
+  if (!item.requiresFeature) return true;
+  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
+    item.requiresFeature
+  ];
+  return required.some((f) => features.has(f));
+}
+__name(isVisible, "isVisible");
+
+// src/platform/tenant-manifest.controller.ts
+var import_common21 = require("@nestjs/common");
+function _ts_decorate20(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate20, "_ts_decorate");
+function _ts_metadata15(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata15, "_ts_metadata");
+function _ts_param14(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param14, "_ts_param");
+function buildTenantManifestController(options) {
+  const path = options.path ?? "tenant/manifest";
+  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
+    static {
+      __name(this, "GeneratedTenantManifestController");
+    }
+    svc;
+    constructor(svc) {
+      this.svc = svc;
+    }
+    async get(req) {
+      const tenantId = req.user?.tenantId ?? req.tenantId;
+      if (!tenantId) {
+        throw new Error("Kein Mandant im Request \u2014 TenantManifest braucht user.tenantId.");
+      }
+      return this.svc.getManifest(tenantId);
+    }
+  };
+  _ts_decorate20([
+    (0, import_common21.Get)(),
+    _ts_param14(0, (0, import_common21.Req)()),
+    _ts_metadata15("design:type", Function),
+    _ts_metadata15("design:paramtypes", [
+      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
+    ]),
+    _ts_metadata15("design:returntype", Promise)
+  ], GeneratedTenantManifestController.prototype, "get", null);
+  GeneratedTenantManifestController = _ts_decorate20([
+    (0, import_common21.Controller)(path),
+    (0, import_common21.UseGuards)(...options.guards),
+    _ts_param14(0, (0, import_common21.Inject)(TenantManifestService)),
+    _ts_metadata15("design:type", Function),
+    _ts_metadata15("design:paramtypes", [
+      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
+    ])
+  ], GeneratedTenantManifestController);
+  return GeneratedTenantManifestController;
+}
+__name(buildTenantManifestController, "buildTenantManifestController");
+
+// src/platform/saas-platform.module.ts
+function _ts_decorate21(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate21, "_ts_decorate");
+function buildMinimalManifestConfig() {
+  return {
+    useFactory: /* @__PURE__ */ __name((catalog) => ({
+      project: {
+        key: catalog.projectKey,
+        displayName: catalog.app?.name ?? catalog.projectKey,
+        label: catalog.app?.label,
+        icon: catalog.app?.icon,
+        logoUrl: catalog.app?.logoUrl,
+        environment: process.env.NODE_ENV === "production" ? "production" : "development",
+        availableLocales: catalog.marketing?.availableLocales,
+        defaultLocale: catalog.marketing?.availableLocales?.[0]
+      },
+      build: {
+        platformPackageVersion: "0.0.0",
+        appVersion: "0.0.0"
+      },
+      planCatalogSnapshot: {
+        source: "saas-platform-module",
+        hash: "sha256-quickstart",
+        currency: catalog.currency,
+        vatRate: catalog.vatRate,
+        plans: catalog.plans ?? [],
+        features: catalog.features ?? []
+      }
+    }), "useFactory"),
+    inject: [
+      PLAN_CATALOG_TOKEN
+    ]
+  };
+}
+__name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
+var SaasPlatformModule = class _SaasPlatformModule {
+  static {
+    __name(this, "SaasPlatformModule");
+  }
+  static forRoot(options) {
+    if (!options.planCatalog && !options.adapters.planCatalogReadSink) {
+      throw new Error("SaasPlatformModule.forRoot: entweder `planCatalog` (Quickstart) oder `adapters.planCatalogReadSink` (DB-Hydration) muss gesetzt sein.");
+    }
+    if (options.entitlement) {
+      const missing = [];
+      if (!options.adapters.subscriptionRepository) missing.push("subscriptionRepository");
+      if (!options.adapters.planVersionRepository) missing.push("planVersionRepository");
+      if (!options.adapters.transactionRunner) missing.push("transactionRunner");
+      if (missing.length) {
+        throw new Error(`SaasPlatformModule.forRoot: entitlement aktiv, aber Adapter fehlen: ${missing.join(", ")}`);
+      }
+    }
+    const planCatalogModule = options.planCatalog ? PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
+      global: true
+    }) : PlanCatalogModule.forRoot({
+      projectKey: "",
+      currency: "",
+      vatRate: 0,
+      sink: options.adapters.planCatalogReadSink,
+      imports: options.imports
+    });
+    const appInfo = options.app ?? {
+      key: options.planCatalog?.projectKey ?? "app",
+      version: options.planCatalog?.app?.version ?? "0.0.0"
+    };
+    const imports = [
+      planCatalogModule,
+      DiscoveryModule.forRoot({
+        app: appInfo,
+        controller: {
+          guards: options.controller.guards
+        },
+        imports: options.imports,
+        snapshotPath: options.discoverySnapshotPath === void 0 ? "var/discovery-snapshot.json" : options.discoverySnapshotPath
+      }),
+      AdminModule.forRoot({
+        mfaPort: options.adapters.mfa,
+        auditPort: options.adapters.audit,
+        rlsBypassPort: options.adapters.rlsBypass,
+        global: true
+      }),
+      AdminManifestModule.forRoot({
+        config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
+        guards: options.controller.guards,
+        reloadGuards: options.reloadGuards
+      })
+    ];
+    if (options.entitlement) {
+      imports.push(EntitlementModule.forRoot({
+        subscriptionRepository: options.adapters.subscriptionRepository,
+        planVersionRepository: options.adapters.planVersionRepository,
+        transactionRunner: options.adapters.transactionRunner,
+        resolutionConfig: options.entitlement.resolutionConfig
+      }));
+    }
+    const lightweightProviders = [];
+    const lightweightExports = [];
+    const hasResolver = !!options.adapters.planResolver;
+    const hasFallback = !!options.defaultPlanId;
+    if (hasResolver || hasFallback) {
+      lightweightProviders.push(hasResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, options.adapters.planResolver) : {
+        provide: PLAN_RESOLVER_PORT_TOKEN,
+        useValue: new StaticPlanResolver(options.defaultPlanId)
+      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...options.quotaProviders ?? [], {
+        provide: QUOTA_PROVIDERS_TOKEN,
+        useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
+        inject: options.quotaProviders ?? []
+      }, {
+        provide: import_core6.APP_GUARD,
+        useExisting: StaticFeatureGuard
+      }, {
+        provide: import_core6.APP_INTERCEPTOR,
+        useExisting: EnforceQuotaInterceptor
+      });
+      lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
+    }
+    const tenantControllers = [];
+    if (options.tenantManifest) {
+      if (!hasResolver && !hasFallback) {
+        throw new Error("SaasPlatformModule.forRoot: tenantManifest erfordert defaultPlanId oder adapters.planResolver, sonst kann das Manifest keine Features aufl\xF6sen.");
+      }
+      lightweightProviders.push(TenantManifestService);
+      lightweightExports.push(TenantManifestService);
+      tenantControllers.push(buildTenantManifestController(options.tenantManifest));
+    }
+    return {
+      module: _SaasPlatformModule,
+      imports,
+      providers: lightweightProviders,
+      controllers: tenantControllers,
+      exports: [
+        PlanCatalogModule,
+        DiscoveryModule,
+        AdminModule,
+        AdminManifestModule,
+        ...options.entitlement ? [
+          EntitlementModule
+        ] : [],
+        ADMIN_MANIFEST_CONFIG,
+        ...lightweightExports
+      ],
+      global: true
+    };
+  }
+};
+SaasPlatformModule = _ts_decorate21([
+  (0, import_common22.Module)({})
+], SaasPlatformModule);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  EnforceQuotaInterceptor,
+  PLAN_RESOLVER_PORT_TOKEN,
+  QUOTA_PROVIDERS_TOKEN,
+  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
+  SaasPlatformModule,
+  StaticEntitlementService,
+  StaticFeatureGuard,
+  StaticPlanResolver,
+  TenantManifestService,
+  buildTenantManifestController
+});