@saasicat/nest 0.21.0 → 0.22.1

package/dist/{chunk-NZLAYCEX.js → chunk-A7FHAN2I.js}

@@ -28,7 +28,7 @@ import {
   SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN,
   isLimitExceededError,
   toEffectiveLimitsSnapshot
-} from "./chunk-AGOG5B77.js";
+} from "./chunk-NNNXXUPT.js";
 import {
   PLAN_CATALOG_TOKEN,
   findPlan,
@@ -174,6 +174,16 @@ function computeNextPeriod(sub, now) {
 }
 __name(computeNextPeriod, "computeNextPeriod");
 
+// src/billing/feature-guard-marker.ts
+var FEATURE_GUARD_MARKER = /* @__PURE__ */ Symbol.for("saasicat/nest/feature-guard");
+function isPlatformFeatureGuard(target) {
+  if (target === null || typeof target !== "function" && typeof target !== "object") {
+    return false;
+  }
+  return target[FEATURE_GUARD_MARKER] === true;
+}
+__name(isPlatformFeatureGuard, "isPlatformFeatureGuard");
+
 // src/billing/require-feature.decorator.ts
 import { SetMetadata } from "@nestjs/common";
 var REQUIRE_FEATURE_KEY = "require-feature";
@@ -217,6 +227,8 @@ var FeatureGuard = class _FeatureGuard {
   entitlements;
   config;
   upsellResolver;
+  /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
+  static [FEATURE_GUARD_MARKER] = true;
   logger = new Logger(_FeatureGuard.name);
   constructor(reflector, entitlements, config = null, upsellResolver = null) {
     this.reflector = reflector;
@@ -577,7 +589,7 @@ function _ts_param3(paramIndex, decorator) {
 }
 __name(_ts_param3, "_ts_param");
 var PLAN_CATALOG_IMPORT_SINK_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanCatalogImportSink");
-var IMPORT_CHANGE_NOTE = "Initial import from saas.yaml (SPEC_V2 \xA711.1 M6 Pack 2c)";
+var IMPORT_CHANGE_NOTE = "Initial import from saas.yaml";
 var PlanCatalogImporterService = class {
   static {
     __name(this, "PlanCatalogImporterService");
@@ -868,7 +880,7 @@ var PublicCatalogController = class {
     return merged;
   }
   /**
-   * SPEC_V2 §11.1 M6 Pack 2c — public catalog endpoint for bundles
+   * — public catalog endpoint for bundles
    * (stem list with live versions). If a `MarketingProjection` with
    * `targetType=BUNDLE` + matching locale exists, it is merged in.
    */
@@ -3461,6 +3473,8 @@ export {
   decideRenewal,
   clearPendingPlanVersionFields,
   computeNextPeriod,
+  FEATURE_GUARD_MARKER,
+  isPlatformFeatureGuard,
   REQUIRE_FEATURE_KEY,
   RequireFeature,
   FEATURE_GUARD_CONFIG_TOKEN,

package/dist/{chunk-ZH5PYEMI.js → chunk-LPCUHZWC.js}

@@ -9,19 +9,21 @@ import {
   AdminStatsModule,
   MfaService,
   SuperAdminGuard
-} from "./chunk-FYWLPYBK.js";
+} from "./chunk-SN5UOC43.js";
 import {
+  FEATURE_GUARD_MARKER,
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
   SubscriptionBundleModule,
-  TenantBillingModule
-} from "./chunk-NZLAYCEX.js";
+  TenantBillingModule,
+  isPlatformFeatureGuard
+} from "./chunk-A7FHAN2I.js";
 import {
   SubscriptionContractModule
 } from "./chunk-B7NRY2LV.js";
 import {
   CatalogModule
-} from "./chunk-GC5AKN44.js";
+} from "./chunk-7X5MSAIL.js";
 import {
   CheckoutOfferModule
 } from "./chunk-XTVAFJ3P.js";
@@ -34,7 +36,7 @@ import {
 import {
   EntitlementModule,
   LimitExceededError
-} from "./chunk-AGOG5B77.js";
+} from "./chunk-NNNXXUPT.js";
 import {
   PLAN_CATALOG_TOKEN,
   PlanCatalogModule
@@ -445,10 +447,9 @@ StaticEntitlementService = _ts_decorate4([
   ])
 ], StaticEntitlementService);
 
-// src/platform/static-feature.guard.ts
-import { ForbiddenException as ForbiddenException2, Inject as Inject3, Injectable as Injectable3, Optional } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
-import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
+// src/platform/feature-guard-coverage.check.ts
+import { Inject as Inject3, Injectable as Injectable3, Logger } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner } from "@nestjs/core";
 function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -466,6 +467,115 @@ function _ts_param4(paramIndex, decorator) {
   };
 }
 __name(_ts_param4, "_ts_param");
+var GUARDS_METADATA = "__guards__";
+var METHOD_METADATA = "method";
+var FeatureGuardCoverageCheck = class {
+  static {
+    __name(this, "FeatureGuardCoverageCheck");
+  }
+  discoveryService;
+  metadataScanner;
+  logger = new Logger("SaaSiCat");
+  constructor(discoveryService, metadataScanner) {
+    this.discoveryService = discoveryService;
+    this.metadataScanner = metadataScanner;
+  }
+  onApplicationBootstrap() {
+    const uncovered = this.findUncoveredRoutes();
+    if (uncovered.length === 0) return;
+    const list = uncovered.map((r) => `  ${r.controller}.${r.handler} \u2014 requires ${r.features.join(" or ")}`).join("\n");
+    this.logger.warn(`globalFeatureGuard is off and ${uncovered.length} annotated route(s) have no feature guard in front of them, so they serve unlicensed traffic:
+${list}
+Bind one behind your auth guard \u2014 @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path. A guard of your own that wraps either one is not recognised here; if that is what these routes use, they are covered.`);
+  }
+  /**
+   * Annotated handlers whose own guards and whose controller's guards contain
+   * no recognisable feature guard.
+   *
+   * Deliberately conservative in one direction only: an unrecognised wrapper
+   * is reported (and the message says so) rather than assumed safe, because
+   * the named route is cheap to check. The reverse — staying silent about a
+   * route with no guard at all — is the failure this exists to prevent.
+   */
+  findUncoveredRoutes() {
+    const uncovered = [];
+    for (const wrapper of this.discoveryService.getControllers()) {
+      const instance = wrapper.instance;
+      if (!instance || typeof instance !== "object") continue;
+      const ctor = instance.constructor;
+      if (!ctor) continue;
+      const classGuards = readGuards(ctor);
+      const prototype = Object.getPrototypeOf(instance);
+      for (const method of this.metadataScanner.getAllMethodNames(prototype)) {
+        const handler = instance[method];
+        if (typeof handler !== "function") continue;
+        if (Reflect.getMetadata(METHOD_METADATA, handler) === void 0) continue;
+        const features = readFeatures(handler) ?? readFeatures(ctor) ?? /* not annotated */
+        null;
+        if (!features || features.length === 0) continue;
+        const guards = [
+          ...classGuards,
+          ...readGuards(handler)
+        ];
+        if (guards.some(isPlatformFeatureGuard)) continue;
+        uncovered.push({
+          controller: ctor.name,
+          handler: method,
+          features
+        });
+      }
+    }
+    return uncovered;
+  }
+};
+FeatureGuardCoverageCheck = _ts_decorate5([
+  Injectable3(),
+  _ts_param4(0, Inject3(DiscoveryService)),
+  _ts_param4(1, Inject3(MetadataScanner)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
+    typeof MetadataScanner === "undefined" ? Object : MetadataScanner
+  ])
+], FeatureGuardCoverageCheck);
+function readFeatures(target) {
+  const value = Reflect.getMetadata(REQUIRE_FEATURE_KEY, target);
+  return Array.isArray(value) ? value : null;
+}
+__name(readFeatures, "readFeatures");
+function readGuards(target) {
+  const value = Reflect.getMetadata(GUARDS_METADATA, target);
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((guard) => typeof guard === "function" ? [
+    guard
+  ] : [
+    guard,
+    guard?.constructor
+  ]);
+}
+__name(readGuards, "readGuards");
+
+// src/platform/static-feature.guard.ts
+import { ForbiddenException as ForbiddenException2, Inject as Inject4, Injectable as Injectable4, Optional } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
 var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
 var StaticFeatureGuard = class {
   static {
@@ -474,6 +584,8 @@ var StaticFeatureGuard = class {
   reflector;
   entitlements;
   config;
+  /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
+  static [FEATURE_GUARD_MARKER] = true;
   constructor(reflector, entitlements, config = null) {
     this.reflector = reflector;
     this.entitlements = entitlements;
@@ -517,14 +629,14 @@ var StaticFeatureGuard = class {
     return true;
   }
 };
-StaticFeatureGuard = _ts_decorate5([
-  Injectable3(),
-  _ts_param4(0, Inject3(Reflector)),
-  _ts_param4(1, Inject3(StaticEntitlementService)),
-  _ts_param4(2, Optional()),
-  _ts_param4(2, Inject3(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+StaticFeatureGuard = _ts_decorate6([
+  Injectable4(),
+  _ts_param5(0, Inject4(Reflector)),
+  _ts_param5(1, Inject4(StaticEntitlementService)),
+  _ts_param5(2, Optional()),
+  _ts_param5(2, Inject4(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof Reflector === "undefined" ? Object : Reflector,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -532,27 +644,27 @@ StaticFeatureGuard = _ts_decorate5([
 ], StaticFeatureGuard);
 
 // src/platform/enforce-quota.interceptor.ts
-import { Inject as Inject4, Injectable as Injectable4, Optional as Optional2 } from "@nestjs/common";
+import { Inject as Inject5, Injectable as Injectable5, Optional as Optional2 } from "@nestjs/common";
 import { Reflector as Reflector2 } from "@nestjs/core";
 import { from } from "rxjs";
 import { switchMap } from "rxjs/operators";
-function _ts_decorate6(decorators, target, key, desc) {
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param5, "_ts_param");
+__name(_ts_param6, "_ts_param");
 var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/QuotaProviders");
 var EnforceQuotaInterceptor = class {
   static {
@@ -595,14 +707,14 @@ var EnforceQuotaInterceptor = class {
     }
   }
 };
-EnforceQuotaInterceptor = _ts_decorate6([
-  Injectable4(),
-  _ts_param5(0, Inject4(Reflector2)),
-  _ts_param5(1, Inject4(StaticEntitlementService)),
-  _ts_param5(2, Optional2()),
-  _ts_param5(2, Inject4(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+EnforceQuotaInterceptor = _ts_decorate7([
+  Injectable5(),
+  _ts_param6(0, Inject5(Reflector2)),
+  _ts_param6(1, Inject5(StaticEntitlementService)),
+  _ts_param6(2, Optional2()),
+  _ts_param6(2, Inject5(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof Reflector2 === "undefined" ? Object : Reflector2,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -650,18 +762,18 @@ var SubscriptionPlanResolver = class {
 };
 
 // src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable5 } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
+import { Injectable as Injectable6 } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
+__name(_ts_metadata7, "_ts_metadata");
 var TenantManifestService = class {
   static {
     __name(this, "TenantManifestService");
@@ -707,10 +819,10 @@ var TenantManifestService = class {
     };
   }
 };
-TenantManifestService = _ts_decorate7([
-  Injectable5(),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+TenantManifestService = _ts_decorate8([
+  Injectable6(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
   ])
 ], TenantManifestService);
@@ -724,24 +836,24 @@ function isVisible(item, features) {
 __name(isVisible, "isVisible");
 
 // src/platform/tenant-manifest.controller.ts
-import { Controller as Controller2, Get as Get2, Inject as Inject5, Req, UseGuards } from "@nestjs/common";
-function _ts_decorate8(decorators, target, key, desc) {
+import { Controller as Controller2, Get as Get2, Inject as Inject6, Req, UseGuards } from "@nestjs/common";
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata8(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param7, "_ts_param");
 function buildTenantManifestController(options) {
   const path = options.path ?? "tenant/manifest";
   let GeneratedTenantManifestController = class GeneratedTenantManifestController {
@@ -760,21 +872,21 @@ function buildTenantManifestController(options) {
       return this.svc.getManifest(tenantId);
     }
   };
-  _ts_decorate8([
+  _ts_decorate9([
     Get2(),
-    _ts_param6(0, Req()),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", [
+    _ts_param7(0, Req()),
+    _ts_metadata8("design:type", Function),
+    _ts_metadata8("design:paramtypes", [
       typeof RequestWithUser === "undefined" ? Object : RequestWithUser
     ]),
-    _ts_metadata7("design:returntype", Promise)
+    _ts_metadata8("design:returntype", Promise)
   ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate8([
+  GeneratedTenantManifestController = _ts_decorate9([
     Controller2(path),
     UseGuards(...options.guards),
-    _ts_param6(0, Inject5(TenantManifestService)),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", [
+    _ts_param7(0, Inject6(TenantManifestService)),
+    _ts_metadata8("design:type", Function),
+    _ts_metadata8("design:paramtypes", [
       typeof TenantManifestService === "undefined" ? Object : TenantManifestService
     ])
   ], GeneratedTenantManifestController);
@@ -783,16 +895,17 @@ function buildTenantManifestController(options) {
 __name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/saas-platform.module.ts
-import { Module as Module2 } from "@nestjs/common";
+import { Logger as Logger2, Module as Module2 } from "@nestjs/common";
 import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
 import { assertPersistenceCapabilities } from "@saasicat/types";
-function _ts_decorate9(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
+__name(_ts_decorate10, "_ts_decorate");
+var PLATFORM_LOGGER = new Logger2("SaaSiCat");
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
@@ -1257,6 +1370,11 @@ var SaasPlatformModule = class _SaasPlatformModule {
         useExisting: EnforceQuotaInterceptor
       });
       lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
+      if (options.globalFeatureGuard === false) {
+        lightweightProviders.push(FeatureGuardCoverageCheck);
+      }
+    } else {
+      PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
     }
     const tenantControllers = [];
     if (options.tenantManifest) {
@@ -1318,7 +1436,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
     };
   }
 };
-SaasPlatformModule = _ts_decorate9([
+SaasPlatformModule = _ts_decorate10([
   Module2({})
 ], SaasPlatformModule);
 
@@ -1331,6 +1449,7 @@ export {
   PLAN_RESOLVER_PORT_TOKEN,
   StaticPlanResolver,
   StaticEntitlementService,
+  FeatureGuardCoverageCheck,
   STATIC_FEATURE_GUARD_CONFIG_TOKEN,
   StaticFeatureGuard,
   QUOTA_PROVIDERS_TOKEN,

package/dist/{chunk-3DRZ5GCP.js → chunk-MJ32VNZD.js}

@@ -1405,7 +1405,7 @@ var SaveRegistrationConfigSelectionDto = class {
   billingCycle;
   appliedPromoCode;
   /**
-   * METAMODELL §17a — Bundle consistency. ID of the `CheckoutOffer` that was
+   * — Bundle consistency. ID of the `CheckoutOffer` that was
    * created on the pricing page (`<app>/register?offer=<id>`). Passed
    * through unchanged in `configJson`; the ActivationOrchestrator freezes it
    * as `packageSnapshot` when the subscription is created and sets the offer

package/dist/{chunk-AGOG5B77.js → chunk-NNNXXUPT.js}

@@ -504,7 +504,7 @@ var EntitlementService = class {
   // ---------------------------------------------------------------------
   /**
    * Plan fallback for TRIAL/PENDING_SALES: returns the PlanVersion active
-   * as of `asOf` (SPEC_V2 §4.2). If the repo does not implement
+   * as of `asOf`. If the repo does not implement
    * `findActive`, we fall back to `findLatestLive` (backward compat for
    * adapters without `validFrom` columns).
    */

package/dist/{chunk-FYWLPYBK.js → chunk-SN5UOC43.js}

@@ -575,7 +575,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "dashboard.read"
       },
-      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
+      // — discovery snapshot of the running backend.
       // Apps must set `discovery.read` in their manifest capabilities
       // to `true` so that the NavBuilder wires the page into the
       // sidebar; otherwise it is filtered out automatically.
@@ -583,7 +583,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "discovery.read"
       },
-      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
+      // — Bundle editor in SuperAdmin.
       // Apps with a DB-driven catalog set `bundles.read = true`.
       bundles: {
         enabled: true,
@@ -593,7 +593,7 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
         enabled: true,
         requiredCapability: "plans.read"
       },
-      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
+      // — marketing catalog (locale pivot).
       // Apps that market a public catalog set
       // `marketingProjections.read = true`.
       marketingCatalog: {

package/dist/{define-saasicat-B20Ms8UC.d.ts → define-saasicat-BK6RRWWG.d.ts}

@@ -3,7 +3,7 @@ import { ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { SuperAdminProvisioningPort, SetupStatusResponse, SetupRequest, SetupResult, SetupConfirmMfaRequest, SetupConfirmMfaResponse } from '@saasicat/types';
 import { h as MfaService } from './admin-stats.service-Db2exT_d.js';
-import { f as SaasPlatformModuleOptions } from './saas-platform.module-DChhDrR-.js';
+import { f as SaasPlatformModuleOptions } from './saas-platform.module-D1mUZPrz.js';
 
 /**
  * Shared metadata key for endpoints that intentionally run without application

package/dist/{define-saasicat-Cf9DpEsY.d.cts → define-saasicat-D30I-WET.d.cts}

@@ -3,7 +3,7 @@ import { ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { SuperAdminProvisioningPort, SetupStatusResponse, SetupRequest, SetupResult, SetupConfirmMfaRequest, SetupConfirmMfaResponse } from '@saasicat/types';
 import { h as MfaService } from './admin-stats.service-HUZIU448.cjs';
-import { f as SaasPlatformModuleOptions } from './saas-platform.module-BfaYfL-G.cjs';
+import { f as SaasPlatformModuleOptions } from './saas-platform.module-CgalxzcT.cjs';
 
 /**
  * Shared metadata key for endpoints that intentionally run without application

package/dist/discovery/index.d.cts

@@ -16,7 +16,7 @@ interface ImplementsCapabilityOptions {
     /**
      * Aggregation wrapper: the feature key this capability belongs to.
      * Bundles are planned exclusively in the SuperAdmin UI and are
-     * **deliberately not** part of the code decorator (SPEC_V2 §3.1).
+     * **deliberately not** part of the code decorator.
      */
     feature?: string;
     /**
@@ -109,7 +109,7 @@ interface ImplementsCapabilityMetadata extends ImplementsCapabilityOptions {
  * - `status` controls visibility/lifecycle (default `active`).
  * - `kind` declares the implementation kind (default `endpoint`).
  *
- * **Bundles are deliberately NOT declared in the decorator** (SPEC_V2 §3.1).
+ * **Bundles are deliberately NOT declared in the decorator**.
  * They are created exclusively in the SuperAdmin UI (DB table `bundles`),
  * by the admin grouping features there.
  *

package/dist/discovery/index.d.ts

@@ -16,7 +16,7 @@ interface ImplementsCapabilityOptions {
     /**
      * Aggregation wrapper: the feature key this capability belongs to.
      * Bundles are planned exclusively in the SuperAdmin UI and are
-     * **deliberately not** part of the code decorator (SPEC_V2 §3.1).
+     * **deliberately not** part of the code decorator.
      */
     feature?: string;
     /**
@@ -109,7 +109,7 @@ interface ImplementsCapabilityMetadata extends ImplementsCapabilityOptions {
  * - `status` controls visibility/lifecycle (default `active`).
  * - `kind` declares the implementation kind (default `endpoint`).
  *
- * **Bundles are deliberately NOT declared in the decorator** (SPEC_V2 §3.1).
+ * **Bundles are deliberately NOT declared in the decorator**.
  * They are created exclusively in the SuperAdmin UI (DB table `bundles`),
  * by the admin grouping features there.
  *

package/dist/{enforce-quota.interceptor-CUyfR4cQ.d.ts → enforce-quota.interceptor-B9QueAFf.d.ts}

@@ -1,8 +1,9 @@
 import { CanActivate, ExecutionContext, NestInterceptor, CallHandler } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { F as FEATURE_GUARD_MARKER } from './subscription-bundles.module-BDbODWvA.js';
 import { Observable } from 'rxjs';
 import { PlanCatalog, QuotaProvider } from '@saasicat/types';
-import { p as PlanResolverPort } from './saas-platform.module-DChhDrR-.js';
+import { p as PlanResolverPort } from './saas-platform.module-D1mUZPrz.js';
 
 interface StaticEntitlementSnapshot {
     planId: string | null;
@@ -43,6 +44,8 @@ declare class StaticFeatureGuard implements CanActivate {
     private readonly reflector;
     private readonly entitlements;
     private readonly config;
+    /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
+    static readonly [FEATURE_GUARD_MARKER] = true;
     constructor(reflector: Reflector, entitlements: StaticEntitlementService, config?: StaticFeatureGuardConfig | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
 }

package/dist/{enforce-quota.interceptor-Dtg5WdFj.d.cts → enforce-quota.interceptor-DY6CLjoP.d.cts}

@@ -1,8 +1,9 @@
 import { CanActivate, ExecutionContext, NestInterceptor, CallHandler } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { F as FEATURE_GUARD_MARKER } from './subscription-bundles.module-Cfi-lFWF.cjs';
 import { Observable } from 'rxjs';
 import { PlanCatalog, QuotaProvider } from '@saasicat/types';
-import { p as PlanResolverPort } from './saas-platform.module-BfaYfL-G.cjs';
+import { p as PlanResolverPort } from './saas-platform.module-CgalxzcT.cjs';
 
 interface StaticEntitlementSnapshot {
     planId: string | null;
@@ -43,6 +44,8 @@ declare class StaticFeatureGuard implements CanActivate {
     private readonly reflector;
     private readonly entitlements;
     private readonly config;
+    /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
+    static readonly [FEATURE_GUARD_MARKER] = true;
     constructor(reflector: Reflector, entitlements: StaticEntitlementService, config?: StaticFeatureGuardConfig | null);
     canActivate(context: ExecutionContext): Promise<boolean>;
 }

package/dist/entitlement/index.d.cts

@@ -1,4 +1,4 @@
-export { C as CustomLimitsShape, E as EffectiveLimits, a as EffectiveLimitsSnapshot, b as EnforceLimitInput, c as EntitlementService, P as PlanVersionSnapshot, S as SubscriptionBundleSnapshot, d as SubscriptionLimitsInput, e as aggregateContractLineItemEntitlements, f as aggregateLimits, g as aggregateSubscriptionBundleQuotas, h as applyCustomLimits, i as collectSubscriptionBundleFeatures, j as contractBundleVersionIds, k as contractLimits, l as filterActiveSubscriptionBundles, m as filterPlannedOnlyFeatures, n as hasAnyFeature, o as hasFeature, p as mergeSubscriptionBundlesIntoLimits, t as toEffectiveLimitsSnapshot } from '../aggregation-SKfXu09x.cjs';
+export { C as CustomLimitsShape, E as EffectiveLimits, a as EffectiveLimitsSnapshot, b as EnforceLimitInput, c as EntitlementService, P as PlanVersionSnapshot, S as SubscriptionBundleSnapshot, d as SubscriptionLimitsInput, e as aggregateContractLineItemEntitlements, f as aggregateLimits, g as aggregateSubscriptionBundleQuotas, h as applyCustomLimits, i as collectSubscriptionBundleFeatures, j as contractBundleVersionIds, k as contractLimits, l as filterActiveSubscriptionBundles, m as filterPlannedOnlyFeatures, n as hasAnyFeature, o as hasFeature, p as mergeSubscriptionBundlesIntoLimits, t as toEffectiveLimitsSnapshot } from '../aggregation-mZ7WZROK.cjs';
 import { DiscoveredFeature, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionContractRepository, SubscriptionBundleRepository, BundleRepository } from '@saasicat/types';
 import { E as EntitlementResolutionConfig } from '../plan-resolution-CFCoUkrE.cjs';
 export { a as EntitlementResolutionInput, r as resolveEntitlementPlan } from '../plan-resolution-CFCoUkrE.cjs';

package/dist/entitlement/index.d.ts

@@ -1,4 +1,4 @@
-export { C as CustomLimitsShape, E as EffectiveLimits, a as EffectiveLimitsSnapshot, b as EnforceLimitInput, c as EntitlementService, P as PlanVersionSnapshot, S as SubscriptionBundleSnapshot, d as SubscriptionLimitsInput, e as aggregateContractLineItemEntitlements, f as aggregateLimits, g as aggregateSubscriptionBundleQuotas, h as applyCustomLimits, i as collectSubscriptionBundleFeatures, j as contractBundleVersionIds, k as contractLimits, l as filterActiveSubscriptionBundles, m as filterPlannedOnlyFeatures, n as hasAnyFeature, o as hasFeature, p as mergeSubscriptionBundlesIntoLimits, t as toEffectiveLimitsSnapshot } from '../aggregation-o0LMenvl.js';
+export { C as CustomLimitsShape, E as EffectiveLimits, a as EffectiveLimitsSnapshot, b as EnforceLimitInput, c as EntitlementService, P as PlanVersionSnapshot, S as SubscriptionBundleSnapshot, d as SubscriptionLimitsInput, e as aggregateContractLineItemEntitlements, f as aggregateLimits, g as aggregateSubscriptionBundleQuotas, h as applyCustomLimits, i as collectSubscriptionBundleFeatures, j as contractBundleVersionIds, k as contractLimits, l as filterActiveSubscriptionBundles, m as filterPlannedOnlyFeatures, n as hasAnyFeature, o as hasFeature, p as mergeSubscriptionBundlesIntoLimits, t as toEffectiveLimitsSnapshot } from '../aggregation-DP5zfKbU.js';
 import { DiscoveredFeature, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionContractRepository, SubscriptionBundleRepository, BundleRepository } from '@saasicat/types';
 import { E as EntitlementResolutionConfig } from '../plan-resolution-CFCoUkrE.js';
 export { a as EntitlementResolutionInput, r as resolveEntitlementPlan } from '../plan-resolution-CFCoUkrE.js';

package/dist/entitlement/index.js

@@ -19,7 +19,7 @@ import {
   mergeSubscriptionBundlesIntoLimits,
   resolveEntitlementPlan,
   toEffectiveLimitsSnapshot
-} from "../chunk-AGOG5B77.js";
+} from "../chunk-NNNXXUPT.js";
 import "../chunk-DQKCK7DX.js";
 import "../chunk-NYLON2VC.js";
 import "../chunk-EBJJNTW6.js";