@saasicat/nest 0.26.1 → 0.27.0

package/dist/{chunk-TCBYOFAC.js → chunk-EHKMPP6J.js}

@@ -1,6 +1,9 @@
 import {
   PromoCodesModule
 } from "./chunk-B6IWLV7R.js";
+import {
+  SubscriptionContractModule
+} from "./chunk-3E6ONOMG.js";
 import {
   AdminManifestModule,
   AdminManifestService,
@@ -17,10 +20,7 @@ import {
   SubscriptionBundleModule,
   TenantBillingModule,
   isPlatformFeatureGuard
-} from "./chunk-YWDLYOFN.js";
-import {
-  SubscriptionContractModule
-} from "./chunk-B7NRY2LV.js";
+} from "./chunk-UHD6FJBQ.js";
 import {
   CatalogModule
 } from "./chunk-7X5MSAIL.js";
@@ -34,9 +34,11 @@ import {
   DiscoveryModule
 } from "./chunk-6WL6VQ7Z.js";
 import {
-  EntitlementModule,
+  EntitlementModule
+} from "./chunk-H4DOTO7S.js";
+import {
   LimitExceededError
-} from "./chunk-NNNXXUPT.js";
+} from "./chunk-F4B2NJUZ.js";
 import {
   PLAN_CATALOG_TOKEN,
   PlanCatalogModule
@@ -350,6 +352,707 @@ SetupModule = _ts_decorate3([
   Module({})
 ], SetupModule);
 
+// src/platform/enforcement-chain.check.ts
+import { Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var GUARDS_METADATA = "__guards__";
+var METHOD_METADATA = "method";
+var ENFORCEMENT_CHAIN_STATE_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/EnforcementChainState");
+var EnforcementChainCheck = class {
+  static {
+    __name(this, "EnforcementChainCheck");
+  }
+  discoveryService;
+  metadataScanner;
+  state;
+  constructor(discoveryService, metadataScanner, state = {
+    featureEnforcementActive: true,
+    quotaEnforcementActive: true,
+    globalGuardBound: true,
+    globalGuardOptedOut: false
+  }) {
+    this.discoveryService = discoveryService;
+    this.metadataScanner = metadataScanner;
+    this.state = state;
+  }
+  onApplicationBootstrap() {
+    const annotated = this.findAnnotatedRoutes();
+    if (!this.state.featureEnforcementActive) {
+      if (annotated.length === 0) return;
+      throw new Error(`${annotated.length} route(s) are annotated for licence enforcement, but nothing can resolve a tenant to a plan, so @RequireFeature and @EnforceQuota do nothing at all: every annotated route serves unlicensed traffic and every quota reads as unlimited.
+${describe(annotated)}
+Set one of: adapters.planResolver, defaultPlanId, or tenantBilling. If this application deliberately publishes a catalogue without enforcing it, remove the annotations \u2014 a decorator that cannot act is not documentation, it is a claim the code does not keep.`);
+    }
+    if (!this.state.quotaEnforcementActive) {
+      const unenforced = annotated.filter((r) => r.quota !== null);
+      if (unenforced.length > 0) {
+        throw new Error(`${unenforced.length} route(s) enforce a quota, but nothing registers EnforceQuotaInterceptor, so every @EnforceQuota reads as unlimited and the limit a customer paid for is not applied:
+${describe(unenforced)}
+The V3 entitlement stack resolves features, not quotas: the interceptor is registered only where a plan can be resolved. Set one of adapters.planResolver, defaultPlanId, or tenantBilling with a subscription repository \u2014 or remove the annotations, because a decorator that cannot act is not documentation.
+If this application enforces these quotas itself, set \`enforcementChainCheck: false\` \u2014 it turns this check off and nothing else.`);
+      }
+    }
+    if (this.state.globalGuardBound) return;
+    const uncovered = annotated.filter((r) => r.features.length > 0 && !r.guarded);
+    if (uncovered.length === 0) return;
+    const why = this.state.globalGuardOptedOut ? "globalFeatureGuard is off" : "the platform binds no global feature guard on this entitlement path";
+    throw new Error(`${why} and ${uncovered.length} annotated route(s) have no feature guard in front of them, so they serve unlicensed traffic:
+${describe(uncovered)}
+Bind one behind your auth guard \u2014 @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path.
+Two things this cannot see, and the way out of each: a guard of your own that wraps ours (put FEATURE_GUARD_MARKER on the wrapper class \u2014 the symbol StaticFeatureGuard and FeatureGuard both carry), and a feature guard you bind globally as an APP_GUARD rather than per controller. If either is what these routes use, set \`enforcementChainCheck: false\` \u2014 it turns this check off and nothing else.`);
+  }
+  /**
+   * Every route carrying an enforcement annotation, with whether a
+   * recognisable feature guard covers it.
+   *
+   * Deliberately conservative in one direction only: an unrecognised wrapper
+   * is reported (and the message says so) rather than assumed safe, because
+   * the named route is cheap to check. The reverse — staying silent about a
+   * route with no guard at all — is the failure this exists to prevent.
+   */
+  findAnnotatedRoutes() {
+    const annotated = [];
+    for (const wrapper of this.discoveryService.getControllers()) {
+      const instance = wrapper.instance;
+      if (!instance || typeof instance !== "object") continue;
+      const ctor = instance.constructor;
+      if (!ctor) continue;
+      const classGuards = readGuards(ctor);
+      const prototype = Object.getPrototypeOf(instance);
+      for (const method of this.metadataScanner.getAllMethodNames(prototype)) {
+        const handler = instance[method];
+        if (typeof handler !== "function") continue;
+        if (Reflect.getMetadata(METHOD_METADATA, handler) === void 0) continue;
+        const features = readFeatures(handler) ?? readFeatures(ctor) ?? /* none */
+        [];
+        const quota = readQuota(handler) ?? readQuota(ctor);
+        if (features.length === 0 && quota === null) continue;
+        const guards = [
+          ...classGuards,
+          ...readGuards(handler)
+        ];
+        annotated.push({
+          controller: ctor.name,
+          handler: method,
+          features,
+          quota,
+          guarded: guards.some(isPlatformFeatureGuard)
+        });
+      }
+    }
+    return annotated;
+  }
+};
+EnforcementChainCheck = _ts_decorate4([
+  Injectable2(),
+  _ts_param3(0, Inject2(DiscoveryService)),
+  _ts_param3(1, Inject2(MetadataScanner)),
+  _ts_param3(2, Optional()),
+  _ts_param3(2, Inject2(ENFORCEMENT_CHAIN_STATE_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
+    typeof MetadataScanner === "undefined" ? Object : MetadataScanner,
+    typeof EnforcementChainState === "undefined" ? Object : EnforcementChainState
+  ])
+], EnforcementChainCheck);
+function describe(routes) {
+  return routes.map((r) => {
+    const requirement = r.features.length > 0 ? `requires ${r.features.join(" or ")}` : `enforces quota ${r.quota}`;
+    return `  ${r.controller}.${r.handler} \u2014 ${requirement}`;
+  }).join("\n");
+}
+__name(describe, "describe");
+function readFeatures(target) {
+  const value = Reflect.getMetadata(REQUIRE_FEATURE_KEY, target);
+  return Array.isArray(value) ? value : null;
+}
+__name(readFeatures, "readFeatures");
+function readQuota(target) {
+  const value = Reflect.getMetadata(ENFORCE_QUOTA_KEY, target);
+  if (typeof value !== "object" || value === null) return null;
+  const quotaKey = value.quotaKey;
+  return typeof quotaKey === "string" ? quotaKey : null;
+}
+__name(readQuota, "readQuota");
+function readGuards(target) {
+  const value = Reflect.getMetadata(GUARDS_METADATA, target);
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((guard) => typeof guard === "function" ? [
+    guard
+  ] : [
+    guard,
+    guard?.constructor
+  ]);
+}
+__name(readGuards, "readGuards");
+
+// src/platform/validation/rules.ts
+import { assertPersistenceCapabilities } from "@saasicat/types";
+var DOCS_BASE = "https://github.com/uelker70/saasicat/blob/main/docs/reference/options.md";
+var headingSlug = /* @__PURE__ */ __name((text) => text.trim().toLowerCase().replace(/[^a-z0-9 -]/g, "").replace(/ /g, "-"), "headingSlug");
+var docsUrlFor = /* @__PURE__ */ __name((id) => `${DOCS_BASE}#${headingSlug(id)}`, "docsUrlFor");
+function optionsOf(slot) {
+  return typeof slot === "object" ? slot : void 0;
+}
+__name(optionsOf, "optionsOf");
+var bundle = /* @__PURE__ */ __name((c) => c.options.persistence, "bundle");
+var requiresFullEntitlement = /* @__PURE__ */ __name((c) => Boolean(c.options.entitlement || c.options.tenantBilling || c.options.subscriptionBundles), "requiresFullEntitlement");
+var resolvesPlans = /* @__PURE__ */ __name((c) => Boolean(c.adapters.planResolver || c.options.defaultPlanId || c.options.tenantBilling && c.adapters.subscriptionRepository), "resolvesPlans");
+function absent(required) {
+  return Object.keys(required).filter((key) => !required[key]);
+}
+__name(absent, "absent");
+var list = /* @__PURE__ */ __name((names) => names.join(", "), "list");
+var RULE_SPECS = [
+  {
+    id: "core.adapters-bound",
+    when: /* @__PURE__ */ __name(() => true, "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(coreAdapters(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `the core adapters are missing: ${list(absent(coreAdapters(c)))}. Bind them through \`persistence: prismaPersistence({ client })\` or one by one through \`adapters\`.`, "message")
+  },
+  {
+    id: "catalog.identity-or-sink",
+    when: /* @__PURE__ */ __name((c) => !c.options.planCatalog, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(c.adapters.planCatalogReadSink && c.options.dbCatalog), "assert"),
+    message: "no plan catalogue is reachable. Either set `planCatalog` (the quickstart YAML path) or, for DB hydration, BOTH a `planCatalogReadSink` (via `adapters` or `persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }). Without the identity the sink loads with projectKey '' and the app boots with a silently empty catalogue."
+  },
+  {
+    id: "catalog.requires-persistence",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.catalog), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.catalog), "assert"),
+    message: "catalog is enabled, but `persistence.catalog` is missing. Use a complete persistence bundle, or wire `CatalogModule` directly."
+  },
+  {
+    id: "admin-resources.requires-persistence",
+    when: /* @__PURE__ */ __name((c) => {
+      if (!c.options.adminResources) return false;
+      return !optionsOf(c.options.adminResources)?.resources;
+    }, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.adminResources), "assert"),
+    message: "adminResources is enabled, but `persistence.adminResources` is missing. Use a complete persistence bundle, or pass your own `adminResources.resources`."
+  },
+  {
+    id: "promo-codes.requires-persistence-and-transactions",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.promoCodes), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.promo && c.adapters.transactionRunner), "assert"),
+    message: /* @__PURE__ */ __name((c) => `promoCodes requires \`persistence.promo\` and a transactionRunner; missing: ${list(absent({
+      "persistence.promo": bundle(c)?.promo,
+      transactionRunner: c.adapters.transactionRunner
+    }))}. Redeeming a code writes two rows and must not half-apply.`, "message")
+  },
+  {
+    id: "setup.requires-provisioning-port",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.setup), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.setup)?.provisioningPort ?? bundle(c)?.core.superAdminProvisioning), "assert"),
+    message: "setup is enabled, but no provisioningPort is available. Set `setup.provisioningPort` or use a bundle providing `persistence.core.superAdminProvisioning`."
+  },
+  {
+    id: "admin-stats.requires-audit-stats-port",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.adminStats), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.adminStats)?.auditStatsPort ?? bundle(c)?.core.auditStats), "assert"),
+    message: "adminStats is enabled, but no auditStatsPort is available. Set `adminStats.auditStatsPort` or use a bundle providing `persistence.core.auditStats`."
+  },
+  {
+    id: "subscription-contract.requires-repository",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionContract), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.subscriptionContract)?.subscriptionContractRepository ?? bundle(c)?.entitlement?.subscriptionContractRepository), "assert"),
+    message: "subscriptionContract is enabled, but no repository is available. Set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle."
+  },
+  {
+    id: "promo-codes.public-preview-requires-first-time-check",
+    when: /* @__PURE__ */ __name((c) => {
+      const config = optionsOf(c.options.promoCodes);
+      return config !== void 0 && config.includePublicController !== false;
+    }, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.promoCodes)?.firstTimeCustomerCheck), "assert"),
+    message: "the public promo preview is mounted but has no `firstTimeCustomerCheck`, so every first-time-only code would preview as unavailable. Pass one, or set `promoCodes.includePublicController: false`."
+  },
+  {
+    id: "tenant-billing.requires-ports",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantBilling) && !bundle(c)?.tenantBilling, "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(tenantBillingPorts(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `tenantBilling is enabled without a \`persistence.tenantBilling\` slice, and these adapters are missing: ${list(absent(tenantBillingPorts(c)))}.`, "message")
+  },
+  {
+    id: "subscription-bundles.requires-tenant-billing",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionBundles), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantBilling), "assert"),
+    message: "subscriptionBundles requires tenantBilling, so the two share authentication and subscription usage rather than resolving them twice."
+  },
+  {
+    id: "subscription-bundles.requires-repositories",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionBundles), "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(bundleRepositories(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `subscriptionBundles is enabled, but these persistence adapters are missing: ${list(absent(bundleRepositories(c)))}.`, "message")
+  },
+  {
+    id: "entitlement.requires-adapters",
+    when: requiresFullEntitlement,
+    assert: /* @__PURE__ */ __name((c) => absent(entitlementAdapters(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `entitlement active or required by the standard stack, but adapters are missing: ${list(absent(entitlementAdapters(c)))}.`, "message")
+  },
+  {
+    id: "entitlement.requires-transactional-persistence",
+    when: /* @__PURE__ */ __name((c) => requiresFullEntitlement(c) && Boolean(bundle(c)), "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(entitlementCapabilities(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `the entitlement stack needs a store that can do ${list(absent(entitlementCapabilities(c)))}, and the persistence bundle declares it cannot. \`enforceLimit()\` reads a counter and writes it back; without a transaction and a row lock two concurrent requests both pass the limit.`, "message"),
+    // `PersistenceCapabilityError` carries `code:
+    // 'PERSISTENCE_CAPABILITY_MISSING'`, which is a machine-readable part
+    // of the published contract rather than prose. Raising it through the
+    // shared helper keeps the class, the code and the wording identical to
+    // what a consumer catches today.
+    error: /* @__PURE__ */ __name((c) => {
+      assertPersistenceCapabilities(bundle(c).capabilities, {
+        transactions: true,
+        pessimisticLocking: true
+      }, "SaasPlatformModule entitlement (transactional enforceLimit)");
+      throw new Error("persistence capabilities check did not fail as expected");
+    }, "error")
+  },
+  {
+    id: "tenant-manifest.requires-plan-resolution",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantManifest), "when"),
+    assert: resolvesPlans,
+    message: "tenantManifest is enabled but nothing can resolve a tenant to a plan, so it could not filter features. Set `defaultPlanId`, `adapters.planResolver`, or enable `tenantBilling`."
+  }
+];
+var PLATFORM_RULES = RULE_SPECS.map((spec) => ({
+  ...spec,
+  docs: docsUrlFor(spec.id)
+}));
+var coreAdapters = /* @__PURE__ */ __name((c) => ({
+  mfa: c.adapters.mfa,
+  audit: c.adapters.audit,
+  rlsBypass: c.adapters.rlsBypass
+}), "coreAdapters");
+var tenantBillingPorts = /* @__PURE__ */ __name((c) => {
+  const config = optionsOf(c.options.tenantBilling);
+  return {
+    subscriptionUsagePort: config?.subscriptionUsagePort,
+    subscriptionWritePort: config?.subscriptionWritePort
+  };
+}, "tenantBillingPorts");
+var bundleRepositories = /* @__PURE__ */ __name((c) => ({
+  subscriptionBundleRepository: bundle(c)?.entitlement?.subscriptionBundleRepository,
+  bundleRepository: bundle(c)?.catalog?.bundleRepository
+}), "bundleRepositories");
+var entitlementAdapters = /* @__PURE__ */ __name((c) => ({
+  subscriptionRepository: c.adapters.subscriptionRepository,
+  planVersionRepository: c.adapters.planVersionRepository,
+  transactionRunner: c.adapters.transactionRunner
+}), "entitlementAdapters");
+var entitlementCapabilities = /* @__PURE__ */ __name((c) => ({
+  transactions: bundle(c)?.capabilities.transactions,
+  "pessimistic locking": bundle(c)?.capabilities.pessimisticLocking
+}), "entitlementCapabilities");
+
+// src/platform/validation/validate.ts
+function findViolations(configuration, rules = PLATFORM_RULES) {
+  const violations = [];
+  for (const rule of rules) {
+    if (!rule.when(configuration)) continue;
+    if (rule.assert(configuration)) continue;
+    violations.push({
+      id: rule.id,
+      message: typeof rule.message === "string" ? rule.message : rule.message(configuration),
+      docs: rule.docs
+    });
+  }
+  return violations;
+}
+__name(findViolations, "findViolations");
+var SaaSiCatConfigurationError = class extends Error {
+  static {
+    __name(this, "SaaSiCatConfigurationError");
+  }
+  violations;
+  constructor(violations) {
+    super(formatViolations(violations)), this.violations = violations;
+    this.name = "SaaSiCatConfigurationError";
+  }
+};
+function formatViolations(violations) {
+  const heading = violations.length === 1 ? "SaaSiCatModule.forRoot: 1 configuration problem:" : `SaaSiCatModule.forRoot: ${violations.length} configuration problems:`;
+  const body = violations.map((v, index) => `  ${index + 1}. [${v.id}] ${v.message}
+     \u2192 ${v.docs}`).join("\n");
+  return `${heading}
+${body}`;
+}
+__name(formatViolations, "formatViolations");
+function assertConfiguration(configuration, rules = PLATFORM_RULES) {
+  const violations = findViolations(configuration, rules);
+  if (violations.length === 0) return;
+  if (violations.length === 1) {
+    const rule = rules.find((r) => r.id === violations[0].id);
+    if (rule?.error) throw rule.error(configuration);
+  }
+  throw new SaaSiCatConfigurationError(violations);
+}
+__name(assertConfiguration, "assertConfiguration");
+
+// src/platform/quota-providers-usage-snapshot.ts
+var QuotaProvidersUsageSnapshot = class {
+  static {
+    __name(this, "QuotaProvidersUsageSnapshot");
+  }
+  providers;
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async snapshot(tenantId) {
+    const entries = await Promise.all(this.providers.map(async (provider) => [
+      provider.key,
+      await provider.count(tenantId)
+    ]));
+    return Object.fromEntries(entries);
+  }
+};
+
+// src/platform/compose/context.ts
+function optionsOf2(slot) {
+  return typeof slot === "object" ? slot : {};
+}
+__name(optionsOf2, "optionsOf");
+
+// src/platform/compose/admin-resources.ts
+function composeAdminResources({ options, persistence }) {
+  if (!options.adminResources) return [];
+  const config = optionsOf2(options.adminResources);
+  return [
+    AdminResourcesModule.forRoot({
+      resources: config.resources ?? persistence?.adminResources?.resources,
+      guards: config.guards ?? [
+        ...options.controller.guards,
+        SuperAdminGuard
+      ],
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeAdminResources, "composeAdminResources");
+
+// src/platform/compose/catalog.ts
+function composeCatalog({ options, persistence, appInfo }) {
+  const config = options.catalog;
+  if (!config) return [];
+  const catalog = persistence?.catalog;
+  const modules = [
+    CatalogModule.forRoot({
+      planRepository: catalog.planRepository,
+      bundleRepository: catalog.bundleRepository,
+      catalogEntryRepository: catalog.catalogEntryRepository,
+      marketingProjectionRepository: catalog.marketingProjectionRepository,
+      promotionRepository: catalog.promotionRepository,
+      marketingSettingsRepository: catalog.marketingSettingsRepository,
+      controller: config.adminControllers === false ? void 0 : {
+        guards: options.controller.guards
+      },
+      imports: config.imports ?? options.imports,
+      extraProviders: config.extraProviders,
+      strictModeCheckMode: config.strictModeCheckMode,
+      autoSyncDiscoveryAtBoot: config.autoSyncDiscoveryAtBoot,
+      marketedOnlyFeatures: config.marketedOnlyFeatures,
+      featureUiRegistry: config.featureUiRegistry,
+      publicMarketingCatalog: config.publicMarketingCatalog
+    })
+  ];
+  if (config.publicCatalog !== false) {
+    modules.push(PublicCatalogModule.forRoot({
+      featureUiRegistry: config.featureUiRegistry,
+      projectKey: appInfo.key,
+      bundleRepository: catalog.bundleRepository,
+      marketingRepository: catalog.marketingProjectionRepository,
+      catalogEntryRepository: catalog.catalogEntryRepository,
+      imports: config.imports ?? options.imports
+    }));
+  }
+  return modules;
+}
+__name(composeCatalog, "composeCatalog");
+
+// src/platform/compose/entitlement.ts
+function composeEntitlement({ options, adapters, persistence, requiresFullEntitlement: requiresFullEntitlement2 }) {
+  if (!requiresFullEntitlement2) return [];
+  return [
+    EntitlementModule.forRoot({
+      subscriptionRepository: adapters.subscriptionRepository,
+      planVersionRepository: adapters.planVersionRepository,
+      transactionRunner: adapters.transactionRunner,
+      resolutionConfig: options.entitlement ? options.entitlement.resolutionConfig : void 0,
+      subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
+      subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
+      bundleRepository: persistence?.entitlement?.bundleRepository,
+      imports: options.imports,
+      global: Boolean(options.tenantBilling || options.subscriptionBundles)
+    })
+  ];
+}
+__name(composeEntitlement, "composeEntitlement");
+
+// src/platform/compose/optional-modules.ts
+function composeSetup({ options, persistence }) {
+  if (!options.setup) return [];
+  const config = optionsOf2(options.setup);
+  return [
+    SetupModule.forRoot({
+      ...config,
+      provisioningPort: config.provisioningPort ?? persistence?.core.superAdminProvisioning,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeSetup, "composeSetup");
+function composeAdminStats({ options, persistence }) {
+  const config = options.adminStats;
+  if (!config) return [];
+  return [
+    AdminStatsModule.forRoot({
+      ...config,
+      guards: config.guards ?? [
+        ...options.controller.guards,
+        SuperAdminGuard
+      ],
+      auditStatsPort: config.auditStatsPort ?? persistence?.core.auditStats,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeAdminStats, "composeAdminStats");
+function composeCheckoutOffer({ options, persistence }) {
+  const config = options.checkoutOffer;
+  if (!config) return [];
+  return [
+    CheckoutOfferModule.forRoot({
+      ...config,
+      bundleRepository: config.bundleRepository ?? persistence?.catalog?.bundleRepository,
+      planRepository: config.planRepository ?? persistence?.catalog?.planRepository,
+      catalogEntryRepository: config.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeCheckoutOffer, "composeCheckoutOffer");
+function composeSubscriptionContract({ options, persistence }) {
+  if (!options.subscriptionContract) return [];
+  const config = optionsOf2(options.subscriptionContract);
+  return [
+    SubscriptionContractModule.forRoot({
+      ...config,
+      subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeSubscriptionContract, "composeSubscriptionContract");
+
+// src/platform/compose/promo-codes.ts
+function composePromoCodes({ options, adapters, persistence }) {
+  if (!options.promoCodes) return [];
+  const config = optionsOf2(options.promoCodes);
+  const promo = persistence?.promo;
+  const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, adminController, ...promoOptions } = config;
+  return [
+    PromoCodesModule.forRoot({
+      ...promoOptions,
+      promoCodeRepository: promo.promoCodeRepository,
+      redemptionRepository: promo.redemptionRepository,
+      validationLogRepository: promo.validationLogRepository,
+      subscriptionLookup: promo.subscriptionLookup,
+      revenueAggregator: promo.revenueAggregator,
+      transactionRunner: adapters.transactionRunner,
+      firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
+        hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
+      },
+      includePublicController: includePublicController ?? false,
+      adminController: adminController === false ? false : {
+        guards: adminGuards ?? [
+          ...options.controller.guards,
+          SuperAdminGuard
+        ]
+      },
+      imports: promoImports ?? options.imports
+    })
+  ];
+}
+__name(composePromoCodes, "composePromoCodes");
+
+// src/platform/compose/tenant-bindings.ts
+function normalizeTenantAuthGuards(guards) {
+  if (!Array.isArray(guards)) return guards;
+  return {
+    useFactory: /* @__PURE__ */ __name((...instances) => instances, "useFactory"),
+    inject: guards
+  };
+}
+__name(normalizeTenantAuthGuards, "normalizeTenantAuthGuards");
+function quotaUsageSnapshotProvider(quotaProviders) {
+  return {
+    useFactory: /* @__PURE__ */ __name((...providers) => new QuotaProvidersUsageSnapshot(providers), "useFactory"),
+    inject: [
+      ...quotaProviders
+    ]
+  };
+}
+__name(quotaUsageSnapshotProvider, "quotaUsageSnapshotProvider");
+
+// src/platform/compose/tenant-billing.ts
+function composeTenantBilling(ctx) {
+  const config = ctx.options.tenantBilling;
+  if (!config) return [];
+  const tenantSlice = ctx.persistence?.tenantBilling;
+  const { authGuards, subscriptionUsagePort, usageSnapshotPort, subscriptionWritePort, imports: tenantImports, extraProviders, extraExports, ...tenantOptions } = config;
+  const quotaProviders = ctx.options.quotaProviders ?? [];
+  ctx.shared.quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
+  ctx.shared.authGuards = normalizeTenantAuthGuards(authGuards);
+  ctx.shared.subscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
+  return [
+    TenantBillingModule.forRoot({
+      ...tenantOptions,
+      authGuards: ctx.shared.authGuards,
+      subscriptionUsagePort: ctx.shared.subscriptionUsagePort,
+      usageSnapshotPort: usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(quotaProviders),
+      subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
+      imports: tenantImports ?? ctx.options.imports,
+      extraProviders: [
+        ...quotaProviders,
+        ...extraProviders ?? []
+      ],
+      extraExports: [
+        ...quotaProviders,
+        ...extraExports ?? []
+      ]
+    })
+  ];
+}
+__name(composeTenantBilling, "composeTenantBilling");
+function composeSubscriptionBundles(ctx) {
+  if (!ctx.options.subscriptionBundles) return [];
+  const config = optionsOf2(ctx.options.subscriptionBundles);
+  const { controller, imports: bundleImports, extraProviders, ...bundleOptions } = config;
+  return [
+    SubscriptionBundleModule.forRoot({
+      ...bundleOptions,
+      subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
+      bundleRepository: ctx.persistence?.catalog?.bundleRepository,
+      controller: controller === false ? void 0 : {
+        ...controller ?? {},
+        authGuards: ctx.shared.authGuards,
+        subscriptionUsagePort: ctx.shared.subscriptionUsagePort
+      },
+      // Falls back to the tenant-billing imports before the shared ones,
+      // because the two controllers usually resolve the same app
+      // providers and an app that scoped them for one meant both.
+      imports: bundleImports ?? optionsOf2(ctx.options.tenantBilling).imports ?? ctx.options.imports,
+      extraProviders
+    })
+  ];
+}
+__name(composeSubscriptionBundles, "composeSubscriptionBundles");
+
+// src/platform/compose/index.ts
+var FEATURE_COMPOSERS = [
+  composeEntitlement,
+  composeCatalog,
+  composeAdminResources,
+  composePromoCodes,
+  // Before the bundles — see the note above.
+  composeTenantBilling,
+  composeSubscriptionBundles,
+  composeSetup,
+  composeAdminStats,
+  composeCheckoutOffer,
+  composeSubscriptionContract
+];
+function composeFeatures(ctx) {
+  return FEATURE_COMPOSERS.flatMap((compose) => compose(ctx));
+}
+__name(composeFeatures, "composeFeatures");
+
+// src/platform/compose/module-exports.ts
+var ALWAYS = [
+  PlanCatalogModule,
+  DiscoveryModule,
+  AdminModule,
+  // ADMIN_MANIFEST_CONFIG travels transitively: re-exporting an imported
+  // module's token directly is an UnknownExportException at boot — the module
+  // export here already carries it.
+  AdminManifestModule
+];
+function optionalExports({ options, requiresFullEntitlement: requiresFullEntitlement2 }) {
+  return [
+    [
+      requiresFullEntitlement2,
+      EntitlementModule
+    ],
+    [
+      options.catalog,
+      CatalogModule
+    ],
+    [
+      options.tenantBilling,
+      TenantBillingModule
+    ],
+    [
+      options.subscriptionBundles,
+      SubscriptionBundleModule
+    ],
+    [
+      options.adminResources,
+      AdminResourcesModule
+    ],
+    [
+      options.promoCodes,
+      PromoCodesModule
+    ],
+    [
+      options.setup,
+      SetupModule
+    ],
+    [
+      options.adminStats,
+      AdminStatsModule
+    ],
+    [
+      options.checkoutOffer,
+      CheckoutOfferModule
+    ],
+    [
+      options.subscriptionContract,
+      SubscriptionContractModule
+    ]
+  ];
+}
+__name(optionalExports, "optionalExports");
+var MOUNTED_BUT_NOT_EXPORTED = [
+  "PublicCatalogModule"
+];
+function composeModuleExports(ctx, ownExports) {
+  return [
+    ...ALWAYS,
+    ...optionalExports(ctx).filter(([enabled]) => Boolean(enabled)).map(([, module]) => module),
+    ...ownExports
+  ];
+}
+__name(composeModuleExports, "composeModuleExports");
+
 // src/platform/plan-resolver.port.ts
 var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlanResolverPort");
 var StaticPlanResolver = class {
@@ -366,24 +1069,24 @@ var StaticPlanResolver = class {
 };
 
 // src/platform/static-entitlement.service.ts
-import { Inject as Inject2, Injectable as Injectable2 } from "@nestjs/common";
-function _ts_decorate4(decorators, target, key, desc) {
+import { Inject as Inject3, Injectable as Injectable3 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
+__name(_ts_param4, "_ts_param");
 var StaticEntitlementService = class {
   static {
     __name(this, "StaticEntitlementService");
@@ -436,229 +1139,166 @@ var StaticEntitlementService = class {
     return (this.catalog.plans ?? []).find((p) => p.id === planId);
   }
 };
-StaticEntitlementService = _ts_decorate4([
-  Injectable2(),
-  _ts_param3(0, Inject2(PLAN_CATALOG_TOKEN)),
-  _ts_param3(1, Inject2(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+StaticEntitlementService = _ts_decorate5([
+  Injectable3(),
+  _ts_param4(0, Inject3(PLAN_CATALOG_TOKEN)),
+  _ts_param4(1, Inject3(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
     typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
   ])
 ], StaticEntitlementService);
 
-// src/platform/feature-guard-coverage.check.ts
-import { Inject as Inject3, Injectable as Injectable3, Logger } from "@nestjs/common";
-import { DiscoveryService, MetadataScanner } from "@nestjs/core";
-function _ts_decorate5(decorators, target, key, desc) {
+// src/platform/tenant-manifest.service.ts
+import { Injectable as Injectable4 } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-var GUARDS_METADATA = "__guards__";
-var METHOD_METADATA = "method";
-var FeatureGuardCoverageCheck = class {
+__name(_ts_metadata5, "_ts_metadata");
+var TenantManifestService = class {
   static {
-    __name(this, "FeatureGuardCoverageCheck");
-  }
-  discoveryService;
-  metadataScanner;
-  logger = new Logger("SaaSiCat");
-  constructor(discoveryService, metadataScanner) {
-    this.discoveryService = discoveryService;
-    this.metadataScanner = metadataScanner;
+    __name(this, "TenantManifestService");
   }
-  onApplicationBootstrap() {
-    const uncovered = this.findUncoveredRoutes();
-    if (uncovered.length === 0) return;
-    const list = uncovered.map((r) => `  ${r.controller}.${r.handler} \u2014 requires ${r.features.join(" or ")}`).join("\n");
-    this.logger.warn(`globalFeatureGuard is off and ${uncovered.length} annotated route(s) have no feature guard in front of them, so they serve unlicensed traffic:
-${list}
-Bind one behind your auth guard \u2014 @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path. A guard of your own that wraps either one is not recognised here; if that is what these routes use, they are covered.`);
+  entitlements;
+  navItems = [];
+  constructor(entitlements) {
+    this.entitlements = entitlements;
   }
   /**
-   * Annotated handlers whose own guards and whose controller's guards contain
-   * no recognisable feature guard.
-   *
-   * Deliberately conservative in one direction only: an unrecognised wrapper
-   * is reported (and the message says so) rather than assumed safe, because
-   * the named route is cheap to check. The reverse — staying silent about a
-   * route with no guard at all — is the failure this exists to prevent.
+   * Call in the app's `OnModuleInit`: registers app navigation for the
+   * Tenant UI. Idempotent: the same `id` overwrites.
    */
-  findUncoveredRoutes() {
-    const uncovered = [];
-    for (const wrapper of this.discoveryService.getControllers()) {
-      const instance = wrapper.instance;
-      if (!instance || typeof instance !== "object") continue;
-      const ctor = instance.constructor;
-      if (!ctor) continue;
-      const classGuards = readGuards(ctor);
-      const prototype = Object.getPrototypeOf(instance);
-      for (const method of this.metadataScanner.getAllMethodNames(prototype)) {
-        const handler = instance[method];
-        if (typeof handler !== "function") continue;
-        if (Reflect.getMetadata(METHOD_METADATA, handler) === void 0) continue;
-        const features = readFeatures(handler) ?? readFeatures(ctor) ?? /* not annotated */
-        null;
-        if (!features || features.length === 0) continue;
-        const guards = [
-          ...classGuards,
-          ...readGuards(handler)
-        ];
-        if (guards.some(isPlatformFeatureGuard)) continue;
-        uncovered.push({
-          controller: ctor.name,
-          handler: method,
-          features
-        });
-      }
-    }
-    return uncovered;
+  registerNavItem(item) {
+    const existing = this.navItems.findIndex((i) => i.id === item.id);
+    if (existing >= 0) this.navItems[existing] = item;
+    else this.navItems.push(item);
+  }
+  /** Bulk variant. */
+  registerNavItems(items) {
+    for (const item of items) this.registerNavItem(item);
+  }
+  /**
+   * Returns the filtered manifest for a Tenant. NavItems with
+   * `requiresFeature` are filtered out server-side as soon as none of the
+   * required features are present in the entitlement snapshot.
+   */
+  async getManifest(tenantId) {
+    const snap = await this.entitlements.snapshot(tenantId);
+    const featureSet = new Set(snap.features);
+    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
+      ...item
+    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+    return {
+      schemaVersion: 1,
+      tenant: {
+        id: tenantId
+      },
+      planId: snap.planId,
+      features: snap.features,
+      quotas: snap.quotas,
+      navigation: visible
+    };
   }
 };
-FeatureGuardCoverageCheck = _ts_decorate5([
-  Injectable3(),
-  _ts_param4(0, Inject3(DiscoveryService)),
-  _ts_param4(1, Inject3(MetadataScanner)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
-    typeof MetadataScanner === "undefined" ? Object : MetadataScanner
+TenantManifestService = _ts_decorate6([
+  Injectable4(),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
   ])
-], FeatureGuardCoverageCheck);
-function readFeatures(target) {
-  const value = Reflect.getMetadata(REQUIRE_FEATURE_KEY, target);
-  return Array.isArray(value) ? value : null;
-}
-__name(readFeatures, "readFeatures");
-function readGuards(target) {
-  const value = Reflect.getMetadata(GUARDS_METADATA, target);
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((guard) => typeof guard === "function" ? [
-    guard
-  ] : [
-    guard,
-    guard?.constructor
-  ]);
+], TenantManifestService);
+function isVisible(item, features) {
+  if (!item.requiresFeature) return true;
+  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
+    item.requiresFeature
+  ];
+  return required.some((f) => features.has(f));
 }
-__name(readGuards, "readGuards");
+__name(isVisible, "isVisible");
 
-// src/platform/static-feature.guard.ts
-import { ForbiddenException as ForbiddenException2, Inject as Inject4, Injectable as Injectable4, Optional } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
-import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
-function _ts_decorate6(decorators, target, key, desc) {
+// src/platform/tenant-manifest.controller.ts
+import { Controller as Controller2, Get as Get2, Inject as Inject4, Req, UseGuards } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
+__name(_ts_metadata6, "_ts_metadata");
 function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
 __name(_ts_param5, "_ts_param");
-var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
-var StaticFeatureGuard = class {
-  static {
-    __name(this, "StaticFeatureGuard");
-  }
-  reflector;
-  entitlements;
-  config;
-  /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
-  static [FEATURE_GUARD_MARKER] = true;
-  constructor(reflector, entitlements, config = null) {
-    this.reflector = reflector;
-    this.entitlements = entitlements;
-    this.config = config;
-  }
-  async canActivate(context) {
-    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!required || required.length === 0) return true;
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) {
-      throw new ForbiddenException2({
-        code: AUTH_ERROR_CODES.NOT_AUTHENTICATED,
-        message: "Not authenticated"
-      });
+function buildTenantManifestController(options) {
+  const path = options.path ?? "tenant/manifest";
+  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
+    static {
+      __name(this, "GeneratedTenantManifestController");
     }
-    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
-    if (role === "SUPER_ADMIN") return true;
-    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
-    if (!tenantId) {
-      throw new ForbiddenException2({
-        code: AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
-        message: "No tenant assigned"
-      });
+    svc;
+    constructor(svc) {
+      this.svc = svc;
     }
-    const snap = await this.entitlements.snapshot(tenantId);
-    const allowed = required.some((f) => snap.features.includes(f));
-    if (!allowed) {
-      const body = {
-        code: FEATURE_NOT_LICENSED,
-        featureKey: required[0],
-        featureKeys: required,
-        offers: [],
-        message: `Feature ${required.join(" / ")} is not included in the current plan.`
-      };
-      throw new ForbiddenException2(body);
+    async get(req) {
+      const tenantId = req.user?.tenantId ?? req.tenantId;
+      if (!tenantId) {
+        throw new Error("No tenant on the request \u2014 TenantManifest requires user.tenantId.");
+      }
+      return this.svc.getManifest(tenantId);
     }
-    return true;
-  }
-};
-StaticFeatureGuard = _ts_decorate6([
-  Injectable4(),
-  _ts_param5(0, Inject4(Reflector)),
-  _ts_param5(1, Inject4(StaticEntitlementService)),
-  _ts_param5(2, Optional()),
-  _ts_param5(2, Inject4(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof Reflector === "undefined" ? Object : Reflector,
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
-    Object
-  ])
-], StaticFeatureGuard);
+  };
+  _ts_decorate7([
+    Get2(),
+    _ts_param5(0, Req()),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
+    ]),
+    _ts_metadata6("design:returntype", Promise)
+  ], GeneratedTenantManifestController.prototype, "get", null);
+  GeneratedTenantManifestController = _ts_decorate7([
+    Controller2(path),
+    UseGuards(...options.guards),
+    _ts_param5(0, Inject4(TenantManifestService)),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
+    ])
+  ], GeneratedTenantManifestController);
+  return GeneratedTenantManifestController;
+}
+__name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/enforce-quota.interceptor.ts
 import { Inject as Inject5, Injectable as Injectable5, Optional as Optional2 } from "@nestjs/common";
-import { Reflector as Reflector2 } from "@nestjs/core";
+import { Reflector } from "@nestjs/core";
 import { from } from "rxjs";
 import { switchMap } from "rxjs/operators";
-function _ts_decorate7(decorators, target, key, desc) {
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
+__name(_ts_metadata7, "_ts_metadata");
 function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
@@ -707,136 +1347,24 @@ var EnforceQuotaInterceptor = class {
     }
   }
 };
-EnforceQuotaInterceptor = _ts_decorate7([
+EnforceQuotaInterceptor = _ts_decorate8([
   Injectable5(),
-  _ts_param6(0, Inject5(Reflector2)),
+  _ts_param6(0, Inject5(Reflector)),
   _ts_param6(1, Inject5(StaticEntitlementService)),
   _ts_param6(2, Optional2()),
   _ts_param6(2, Inject5(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    typeof Reflector2 === "undefined" ? Object : Reflector2,
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
   ])
 ], EnforceQuotaInterceptor);
 
-// src/platform/quota-providers-usage-snapshot.ts
-var QuotaProvidersUsageSnapshot = class {
-  static {
-    __name(this, "QuotaProvidersUsageSnapshot");
-  }
-  providers;
-  constructor(providers) {
-    this.providers = providers;
-  }
-  async snapshot(tenantId) {
-    const entries = await Promise.all(this.providers.map(async (provider) => [
-      provider.key,
-      await provider.count(tenantId)
-    ]));
-    return Object.fromEntries(entries);
-  }
-};
-
-// src/platform/subscription-plan-resolver.ts
-var DEFAULT_ACTIVE_STATUSES = /* @__PURE__ */ new Set([
-  "ACTIVE",
-  "TRIAL"
-]);
-var SubscriptionPlanResolver = class {
-  static {
-    __name(this, "SubscriptionPlanResolver");
-  }
-  subscriptions;
-  activeStatuses;
-  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
-    this.subscriptions = subscriptions;
-    this.activeStatuses = activeStatuses;
-  }
-  async getPlanIdForTenant(tenantId) {
-    const subscription = await this.subscriptions.findByTenantId(tenantId);
-    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
-    return subscription.plan;
-  }
-};
-
-// src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable6 } from "@nestjs/common";
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-var TenantManifestService = class {
-  static {
-    __name(this, "TenantManifestService");
-  }
-  entitlements;
-  navItems = [];
-  constructor(entitlements) {
-    this.entitlements = entitlements;
-  }
-  /**
-   * Call in the app's `OnModuleInit`: registers app navigation for the
-   * Tenant UI. Idempotent: the same `id` overwrites.
-   */
-  registerNavItem(item) {
-    const existing = this.navItems.findIndex((i) => i.id === item.id);
-    if (existing >= 0) this.navItems[existing] = item;
-    else this.navItems.push(item);
-  }
-  /** Bulk variant. */
-  registerNavItems(items) {
-    for (const item of items) this.registerNavItem(item);
-  }
-  /**
-   * Returns the filtered manifest for a Tenant. NavItems with
-   * `requiresFeature` are filtered out server-side as soon as none of the
-   * required features are present in the entitlement snapshot.
-   */
-  async getManifest(tenantId) {
-    const snap = await this.entitlements.snapshot(tenantId);
-    const featureSet = new Set(snap.features);
-    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
-      ...item
-    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
-    return {
-      schemaVersion: 1,
-      tenant: {
-        id: tenantId
-      },
-      planId: snap.planId,
-      features: snap.features,
-      quotas: snap.quotas,
-      navigation: visible
-    };
-  }
-};
-TenantManifestService = _ts_decorate8([
-  Injectable6(),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
-  ])
-], TenantManifestService);
-function isVisible(item, features) {
-  if (!item.requiresFeature) return true;
-  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
-    item.requiresFeature
-  ];
-  return required.some((f) => features.has(f));
-}
-__name(isVisible, "isVisible");
-
-// src/platform/tenant-manifest.controller.ts
-import { Controller as Controller2, Get as Get2, Inject as Inject6, Req, UseGuards } from "@nestjs/common";
+// src/platform/static-feature.guard.ts
+import { ForbiddenException as ForbiddenException2, Inject as Inject6, Injectable as Injectable6, Optional as Optional3 } from "@nestjs/common";
+import { Reflector as Reflector2 } from "@nestjs/core";
+import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
 function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -854,59 +1382,100 @@ function _ts_param7(paramIndex, decorator) {
   };
 }
 __name(_ts_param7, "_ts_param");
-function buildTenantManifestController(options) {
-  const path = options.path ?? "tenant/manifest";
-  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
-    static {
-      __name(this, "GeneratedTenantManifestController");
+var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
+var StaticFeatureGuard = class {
+  static {
+    __name(this, "StaticFeatureGuard");
+  }
+  reflector;
+  entitlements;
+  config;
+  /** Lets `EnforcementChainCheck` recognise this guard across CJS entries. */
+  static [FEATURE_GUARD_MARKER] = true;
+  constructor(reflector, entitlements, config = null) {
+    this.reflector = reflector;
+    this.entitlements = entitlements;
+    this.config = config;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required || required.length === 0) return true;
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) {
+      throw new ForbiddenException2({
+        code: AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        message: "Not authenticated"
+      });
     }
-    svc;
-    constructor(svc) {
-      this.svc = svc;
+    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
+    if (role === "SUPER_ADMIN") return true;
+    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
+    if (!tenantId) {
+      throw new ForbiddenException2({
+        code: AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
+        message: "No tenant assigned"
+      });
     }
-    async get(req) {
-      const tenantId = req.user?.tenantId ?? req.tenantId;
-      if (!tenantId) {
-        throw new Error("No tenant on the request \u2014 TenantManifest requires user.tenantId.");
-      }
-      return this.svc.getManifest(tenantId);
+    const snap = await this.entitlements.snapshot(tenantId);
+    const allowed = required.some((f) => snap.features.includes(f));
+    if (!allowed) {
+      const body = {
+        code: FEATURE_NOT_LICENSED,
+        featureKey: required[0],
+        featureKeys: required,
+        offers: [],
+        message: `Feature ${required.join(" / ")} is not included in the current plan.`
+      };
+      throw new ForbiddenException2(body);
     }
-  };
-  _ts_decorate9([
-    Get2(),
-    _ts_param7(0, Req()),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", [
-      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
-    ]),
-    _ts_metadata8("design:returntype", Promise)
-  ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate9([
-    Controller2(path),
-    UseGuards(...options.guards),
-    _ts_param7(0, Inject6(TenantManifestService)),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", [
-      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
-    ])
-  ], GeneratedTenantManifestController);
-  return GeneratedTenantManifestController;
-}
-__name(buildTenantManifestController, "buildTenantManifestController");
+    return true;
+  }
+};
+StaticFeatureGuard = _ts_decorate9([
+  Injectable6(),
+  _ts_param7(0, Inject6(Reflector2)),
+  _ts_param7(1, Inject6(StaticEntitlementService)),
+  _ts_param7(2, Optional3()),
+  _ts_param7(2, Inject6(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof Reflector2 === "undefined" ? Object : Reflector2,
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
+    Object
+  ])
+], StaticFeatureGuard);
+
+// src/platform/subscription-plan-resolver.ts
+var DEFAULT_ACTIVE_STATUSES = /* @__PURE__ */ new Set([
+  "ACTIVE",
+  "TRIAL"
+]);
+var SubscriptionPlanResolver = class {
+  static {
+    __name(this, "SubscriptionPlanResolver");
+  }
+  subscriptions;
+  activeStatuses;
+  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
+    this.subscriptions = subscriptions;
+    this.activeStatuses = activeStatuses;
+  }
+  async getPlanIdForTenant(tenantId) {
+    const subscription = await this.subscriptions.findByTenantId(tenantId);
+    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
+    return subscription.plan;
+  }
+};
 
 // src/platform/saas-platform.module.ts
-import { Logger as Logger2, Module as Module2 } from "@nestjs/common";
-import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
-import { assertPersistenceCapabilities } from "@saasicat/types";
+import { Logger, Module as Module2 } from "@nestjs/common";
 import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
-function _ts_decorate10(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate10, "_ts_decorate");
-var PLATFORM_LOGGER = new Logger2("SaaSiCat");
+
+// src/platform/compose/manifest.ts
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
@@ -961,21 +1530,6 @@ function buildStandardManifestContribution(catalog, adminResources, promoCodes)
   };
 }
 __name(buildStandardManifestContribution, "buildStandardManifestContribution");
-function normalizeTenantAuthGuards(guards) {
-  if (!Array.isArray(guards)) return guards;
-  return {
-    useFactory: /* @__PURE__ */ __name((...instances) => instances, "useFactory"),
-    inject: guards
-  };
-}
-__name(normalizeTenantAuthGuards, "normalizeTenantAuthGuards");
-function quotaUsageSnapshotProvider(quotaProviders) {
-  return {
-    useFactory: /* @__PURE__ */ __name((...providers) => new QuotaProvidersUsageSnapshot(providers), "useFactory"),
-    inject: quotaProviders
-  };
-}
-__name(quotaUsageSnapshotProvider, "quotaUsageSnapshotProvider");
 function buildMinimalManifestConfig() {
   return {
     useFactory: /* @__PURE__ */ __name((catalog) => ({
@@ -1008,6 +1562,189 @@ function buildMinimalManifestConfig() {
   };
 }
 __name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
+
+// src/platform/compose/base.ts
+var DEFAULT_SNAPSHOT_PATH = "var/discovery-snapshot.json";
+function resolveAppInfo(options) {
+  return options.app ?? {
+    key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
+    version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
+  };
+}
+__name(resolveAppInfo, "resolveAppInfo");
+function composePlanCatalog(options, sink) {
+  if (options.planCatalog) {
+    return PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
+      global: true
+    });
+  }
+  const dbCatalog = options.dbCatalog;
+  return PlanCatalogModule.forRoot({
+    projectKey: dbCatalog.projectKey,
+    app: dbCatalog.app,
+    currency: dbCatalog.currency,
+    vatRate: dbCatalog.vatRate,
+    marketing: dbCatalog.marketing,
+    sink,
+    imports: options.imports
+  });
+}
+__name(composePlanCatalog, "composePlanCatalog");
+function composeBaseModules(options, appInfo, ports) {
+  return [
+    DiscoveryModule.forRoot({
+      app: appInfo,
+      controller: {
+        guards: options.controller.guards
+      },
+      imports: options.imports,
+      snapshotPath: options.discoverySnapshotPath === void 0 ? DEFAULT_SNAPSHOT_PATH : options.discoverySnapshotPath
+    }),
+    AdminModule.forRoot({
+      ...ports,
+      imports: options.imports,
+      global: true
+    }),
+    AdminManifestModule.forRoot({
+      config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
+      extraProviders: options.adminManifestExtraProviders,
+      includeManifestController: options.includeManifestController,
+      guards: options.controller.guards,
+      reloadGuards: options.reloadGuards,
+      imports: options.imports,
+      // Global like AdminModule above: apps register their manifest
+      // contribution by injecting AdminManifestService into one of their
+      // own modules (handbook §6.6). Re-exporting the module from here
+      // does not make that injection resolvable.
+      global: true
+    })
+  ];
+}
+__name(composeBaseModules, "composeBaseModules");
+
+// src/platform/compose/tenant-manifest.ts
+var NONE = {
+  providers: [],
+  exports: [],
+  controllers: []
+};
+function composeTenantManifest(ctx) {
+  const { options } = ctx;
+  if (!options.tenantManifest) return NONE;
+  const tenantAuthGuards = optionsOf2(options.tenantBilling).authGuards;
+  return {
+    providers: [
+      TenantManifestService
+    ],
+    exports: [
+      TenantManifestService
+    ],
+    controllers: [
+      buildTenantManifestController(options.tenantManifest === true ? {
+        guards: Array.isArray(tenantAuthGuards) ? tenantAuthGuards : options.controller.guards
+      } : options.tenantManifest)
+    ]
+  };
+}
+__name(composeTenantManifest, "composeTenantManifest");
+
+// src/platform/compose/enforcement-runtime.ts
+import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
+function resolvePlanResolution(ctx) {
+  const explicit = !!ctx.adapters.planResolver;
+  const viaSubscriptions = Boolean(ctx.options.tenantBilling && ctx.adapters.subscriptionRepository);
+  const fallback = !!ctx.options.defaultPlanId;
+  return {
+    explicit,
+    viaSubscriptions,
+    fallback,
+    available: explicit || viaSubscriptions || fallback
+  };
+}
+__name(resolvePlanResolution, "resolvePlanResolution");
+function composeEnforcementRuntime(ctx, resolution) {
+  if (!resolution.available) return {
+    providers: [],
+    exports: []
+  };
+  const { options, adapters, shared } = ctx;
+  const providers = [];
+  if (resolution.viaSubscriptions && !resolution.explicit) {
+    providers.push(asProvider(PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN, adapters.subscriptionRepository));
+  }
+  providers.push(
+    planResolverProvider(ctx, resolution),
+    StaticEntitlementService,
+    StaticFeatureGuard,
+    EnforceQuotaInterceptor,
+    ...shared.quotaProvidersHostedByTenantBilling ? [] : options.quotaProviders ?? [],
+    {
+      provide: QUOTA_PROVIDERS_TOKEN,
+      useFactory: /* @__PURE__ */ __name((...quotas) => quotas, "useFactory"),
+      inject: options.quotaProviders ?? []
+    },
+    ...options.globalFeatureGuard === false ? [] : [
+      {
+        provide: APP_GUARD,
+        useExisting: StaticFeatureGuard
+      }
+    ],
+    // The interceptor stays global either way: interceptors run after all
+    // guards, so it sees the authenticated request even when the app binds
+    // its own guard chain.
+    {
+      provide: APP_INTERCEPTOR,
+      useExisting: EnforceQuotaInterceptor
+    }
+  );
+  return {
+    providers,
+    exports: [
+      PLAN_RESOLVER_PORT_TOKEN,
+      StaticEntitlementService,
+      StaticFeatureGuard,
+      EnforceQuotaInterceptor,
+      QUOTA_PROVIDERS_TOKEN
+    ]
+  };
+}
+__name(composeEnforcementRuntime, "composeEnforcementRuntime");
+function planResolverProvider(ctx, resolution) {
+  if (resolution.explicit) {
+    return asProvider(PLAN_RESOLVER_PORT_TOKEN, ctx.adapters.planResolver);
+  }
+  if (resolution.viaSubscriptions) {
+    return {
+      provide: PLAN_RESOLVER_PORT_TOKEN,
+      useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
+      inject: [
+        PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
+      ]
+    };
+  }
+  return {
+    provide: PLAN_RESOLVER_PORT_TOKEN,
+    useValue: new StaticPlanResolver(ctx.options.defaultPlanId)
+  };
+}
+__name(planResolverProvider, "planResolverProvider");
+
+// src/platform/saas-platform.module.ts
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+var PLATFORM_LOGGER = new Logger("SaaSiCat");
+function enforcementChainState(state) {
+  return {
+    provide: ENFORCEMENT_CHAIN_STATE_TOKEN,
+    useValue: state
+  };
+}
+__name(enforcementChainState, "enforcementChainState");
 var SaasPlatformModule = class _SaasPlatformModule {
   static {
     __name(this, "SaasPlatformModule");
@@ -1020,11 +1757,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
     const subscriptionBundlesConfig = options.subscriptionBundles || null;
     const adminResourcesConfig = options.adminResources || null;
     const promoCodesConfig = options.promoCodes || null;
-    const setupConfig = options.setup || null;
-    const adminStatsConfig = options.adminStats || null;
-    const checkoutOfferConfig = options.checkoutOffer || null;
-    const subscriptionContractConfig = options.subscriptionContract || null;
-    const requiresFullEntitlement = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
+    const requiresFullEntitlement2 = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
     const adapters = {
       mfa: explicit.mfa ?? persistence?.core.mfa,
       audit: explicit.audit ?? persistence?.core.audit,
@@ -1035,296 +1768,36 @@ var SaasPlatformModule = class _SaasPlatformModule {
       planVersionRepository: explicit.planVersionRepository ?? persistence?.entitlement?.planVersionRepository,
       transactionRunner: explicit.transactionRunner ?? persistence?.core.transactionRunner
     };
-    const missingCore = [
-      "mfa",
-      "audit",
-      "rlsBypass"
-    ].filter((key) => adapters[key] === void 0);
-    if (missingCore.length) {
-      throw new Error(`SaasPlatformModule.forRoot: adapters missing (provide them via \`adapters\` or a \`persistence\` bundle): ${missingCore.join(", ")}`);
-    }
+    assertConfiguration({
+      options,
+      adapters
+    });
     const mfaPort = adapters.mfa;
     const auditPort = adapters.audit;
     const rlsBypassPort = adapters.rlsBypass;
-    if (!options.planCatalog && (!adapters.planCatalogReadSink || !options.dbCatalog)) {
-      throw new Error("SaasPlatformModule.forRoot: either set `planCatalog` (quickstart YAML path) or, for DB hydration, BOTH a planCatalogReadSink (`adapters`/`persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }).");
-    }
-    if (catalogConfig && !persistence?.catalog) {
-      throw new Error("SaasPlatformModule.forRoot: catalog is enabled, but `persistence.catalog` is missing. Use a complete persistence bundle or wire CatalogModule directly.");
-    }
-    if (adminResourcesConfig && adminResourcesConfig !== true && !adminResourcesConfig.resources && !persistence?.adminResources) {
-      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
-    }
-    if (promoCodesConfig && (!persistence?.promo || !adapters.transactionRunner)) {
-      throw new Error("SaasPlatformModule.forRoot: promoCodes requires `persistence.promo` and a transactionRunner.");
-    }
-    if (setupConfig && !((setupConfig === true ? void 0 : setupConfig.provisioningPort) ?? persistence?.core.superAdminProvisioning)) {
-      throw new Error("SaasPlatformModule.forRoot: setup is enabled, but no provisioningPort is available (set `setup.provisioningPort` or `persistence.core.superAdminProvisioning`).");
-    }
-    if (adminStatsConfig && !adminStatsConfig.auditStatsPort && !persistence?.core.auditStats) {
-      throw new Error("SaasPlatformModule.forRoot: adminStats is enabled, but no auditStatsPort is available (set `adminStats.auditStatsPort` or `persistence.core.auditStats`).");
-    }
-    if (subscriptionContractConfig) {
-      const explicitRepository = subscriptionContractConfig === true ? void 0 : subscriptionContractConfig.subscriptionContractRepository;
-      if (!explicitRepository && !persistence?.entitlement?.subscriptionContractRepository) {
-        throw new Error("SaasPlatformModule.forRoot: subscriptionContract is enabled, but no repository is available (set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle).");
-      }
-    }
-    if (promoCodesConfig && promoCodesConfig !== true && promoCodesConfig.includePublicController !== false && !promoCodesConfig.firstTimeCustomerCheck) {
-      throw new Error("SaasPlatformModule.forRoot: public promo preview requires `firstTimeCustomerCheck`.");
-    }
-    if (adminResourcesConfig === true && !persistence?.adminResources) {
-      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
-    }
-    if (tenantBillingConfig && !persistence?.tenantBilling) {
-      const missing = [
-        !tenantBillingConfig.subscriptionUsagePort && "subscriptionUsagePort",
-        !tenantBillingConfig.subscriptionWritePort && "subscriptionWritePort"
-      ].filter(Boolean);
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: tenantBilling is enabled, but adapters are missing: ${missing.join(", ")}`);
-      }
-    }
-    if (subscriptionBundlesConfig && !tenantBillingConfig) {
-      throw new Error("SaasPlatformModule.forRoot: subscriptionBundles requires tenantBilling so auth and subscription usage can be shared.");
-    }
-    if (subscriptionBundlesConfig) {
-      const missing = [];
-      if (!persistence?.entitlement?.subscriptionBundleRepository) {
-        missing.push("subscriptionBundleRepository");
-      }
-      if (!persistence?.catalog?.bundleRepository) {
-        missing.push("bundleRepository");
-      }
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: subscriptionBundles is enabled, but persistence adapters are missing: ${missing.join(", ")}`);
-      }
-    }
-    if (requiresFullEntitlement) {
-      const missing = [];
-      if (!adapters.subscriptionRepository) missing.push("subscriptionRepository");
-      if (!adapters.planVersionRepository) missing.push("planVersionRepository");
-      if (!adapters.transactionRunner) missing.push("transactionRunner");
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: entitlement active or required by the standard stack, but adapters are missing: ${missing.join(", ")}`);
-      }
-      if (persistence) {
-        assertPersistenceCapabilities(persistence.capabilities, {
-          transactions: true,
-          pessimisticLocking: true
-        }, "SaasPlatformModule entitlement (transactional enforceLimit)");
-      }
-    }
-    const dbCatalog = options.dbCatalog;
-    const planCatalogModule = options.planCatalog ? PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
-      global: true
-    }) : PlanCatalogModule.forRoot({
-      projectKey: dbCatalog.projectKey,
-      app: dbCatalog.app,
-      currency: dbCatalog.currency,
-      vatRate: dbCatalog.vatRate,
-      marketing: dbCatalog.marketing,
-      sink: adapters.planCatalogReadSink,
-      imports: options.imports
-    });
-    const appInfo = options.app ?? {
-      key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
-      version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
-    };
+    const appInfo = resolveAppInfo(options);
     const imports = [
       // Make injected client/auth providers visible to the high-level
       // module's own quota providers and automatic plan resolver too.
       ...options.imports ?? [],
-      planCatalogModule,
-      DiscoveryModule.forRoot({
-        app: appInfo,
-        controller: {
-          guards: options.controller.guards
-        },
-        imports: options.imports,
-        snapshotPath: options.discoverySnapshotPath === void 0 ? "var/discovery-snapshot.json" : options.discoverySnapshotPath
-      }),
-      AdminModule.forRoot({
+      composePlanCatalog(options, adapters.planCatalogReadSink),
+      ...composeBaseModules(options, appInfo, {
         mfaPort,
         auditPort,
-        rlsBypassPort,
-        imports: options.imports,
-        global: true
-      }),
-      AdminManifestModule.forRoot({
-        config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
-        extraProviders: options.adminManifestExtraProviders,
-        includeManifestController: options.includeManifestController,
-        guards: options.controller.guards,
-        reloadGuards: options.reloadGuards,
-        imports: options.imports,
-        // Global like AdminModule above: apps register their manifest
-        // contribution by injecting AdminManifestService into one of
-        // their own modules (handbook §6.6). Re-exporting the module
-        // from here does not make that injection resolvable.
-        global: true
+        rlsBypassPort
       })
     ];
-    if (requiresFullEntitlement) {
-      imports.push(EntitlementModule.forRoot({
-        subscriptionRepository: adapters.subscriptionRepository,
-        planVersionRepository: adapters.planVersionRepository,
-        transactionRunner: adapters.transactionRunner,
-        resolutionConfig: options.entitlement ? options.entitlement.resolutionConfig : void 0,
-        subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
-        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.entitlement?.bundleRepository,
-        imports: options.imports,
-        global: Boolean(tenantBillingConfig || subscriptionBundlesConfig)
-      }));
-    }
-    if (catalogConfig) {
-      const catalog = persistence?.catalog;
-      imports.push(CatalogModule.forRoot({
-        planRepository: catalog.planRepository,
-        bundleRepository: catalog.bundleRepository,
-        catalogEntryRepository: catalog.catalogEntryRepository,
-        marketingProjectionRepository: catalog.marketingProjectionRepository,
-        promotionRepository: catalog.promotionRepository,
-        marketingSettingsRepository: catalog.marketingSettingsRepository,
-        controller: catalogConfig.adminControllers === false ? void 0 : {
-          guards: options.controller.guards
-        },
-        imports: catalogConfig.imports ?? options.imports,
-        extraProviders: catalogConfig.extraProviders,
-        strictModeCheckMode: catalogConfig.strictModeCheckMode,
-        autoSyncDiscoveryAtBoot: catalogConfig.autoSyncDiscoveryAtBoot,
-        marketedOnlyFeatures: catalogConfig.marketedOnlyFeatures,
-        featureUiRegistry: catalogConfig.featureUiRegistry,
-        publicMarketingCatalog: catalogConfig.publicMarketingCatalog
-      }));
-      if (catalogConfig.publicCatalog !== false) {
-        imports.push(PublicCatalogModule.forRoot({
-          featureUiRegistry: catalogConfig.featureUiRegistry,
-          projectKey: appInfo.key,
-          bundleRepository: catalog.bundleRepository,
-          marketingRepository: catalog.marketingProjectionRepository,
-          catalogEntryRepository: catalog.catalogEntryRepository,
-          imports: catalogConfig.imports ?? options.imports
-        }));
+    const composition = {
+      options,
+      adapters,
+      persistence,
+      appInfo,
+      requiresFullEntitlement: requiresFullEntitlement2,
+      shared: {
+        quotaProvidersHostedByTenantBilling: false
       }
-    }
-    if (adminResourcesConfig) {
-      const config = adminResourcesConfig === true ? {} : adminResourcesConfig;
-      imports.push(AdminResourcesModule.forRoot({
-        resources: config.resources ?? persistence?.adminResources?.resources,
-        guards: config.guards ?? [
-          ...options.controller.guards,
-          SuperAdminGuard
-        ],
-        imports: config.imports ?? options.imports
-      }));
-    }
-    if (promoCodesConfig) {
-      const config = promoCodesConfig === true ? {} : promoCodesConfig;
-      const promo = persistence?.promo;
-      const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, adminController, ...promoOptions } = config;
-      imports.push(PromoCodesModule.forRoot({
-        ...promoOptions,
-        promoCodeRepository: promo.promoCodeRepository,
-        redemptionRepository: promo.redemptionRepository,
-        validationLogRepository: promo.validationLogRepository,
-        subscriptionLookup: promo.subscriptionLookup,
-        revenueAggregator: promo.revenueAggregator,
-        transactionRunner: adapters.transactionRunner,
-        firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
-          hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
-        },
-        includePublicController: includePublicController ?? false,
-        adminController: adminController === false ? false : {
-          guards: adminGuards ?? [
-            ...options.controller.guards,
-            SuperAdminGuard
-          ]
-        },
-        imports: promoImports ?? options.imports
-      }));
-    }
-    let sharedTenantAuthGuards;
-    let sharedSubscriptionUsagePort;
-    let quotaProvidersHostedByTenantBilling = false;
-    if (tenantBillingConfig) {
-      const tenantSlice = persistence?.tenantBilling;
-      const { authGuards, subscriptionUsagePort, usageSnapshotPort, subscriptionWritePort, imports: tenantImports, extraProviders, extraExports, ...tenantOptions } = tenantBillingConfig;
-      const quotaProviders = options.quotaProviders ?? [];
-      quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
-      sharedTenantAuthGuards = normalizeTenantAuthGuards(authGuards);
-      sharedSubscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
-      const resolvedUsageSnapshotPort = usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(options.quotaProviders ?? []);
-      imports.push(TenantBillingModule.forRoot({
-        ...tenantOptions,
-        authGuards: sharedTenantAuthGuards,
-        subscriptionUsagePort: sharedSubscriptionUsagePort,
-        usageSnapshotPort: resolvedUsageSnapshotPort,
-        subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
-        imports: tenantImports ?? options.imports,
-        extraProviders: [
-          ...quotaProviders,
-          ...extraProviders ?? []
-        ],
-        extraExports: [
-          ...quotaProviders,
-          ...extraExports ?? []
-        ]
-      }));
-    }
-    if (subscriptionBundlesConfig) {
-      const config = subscriptionBundlesConfig === true ? {} : subscriptionBundlesConfig;
-      const { controller, imports: bundleImports, extraProviders, ...bundleOptions } = config;
-      imports.push(SubscriptionBundleModule.forRoot({
-        ...bundleOptions,
-        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.catalog?.bundleRepository,
-        controller: controller === false ? void 0 : {
-          ...controller ?? {},
-          authGuards: sharedTenantAuthGuards,
-          subscriptionUsagePort: sharedSubscriptionUsagePort
-        },
-        imports: bundleImports ?? tenantBillingConfig?.imports ?? options.imports,
-        extraProviders
-      }));
-    }
-    if (setupConfig) {
-      const config = setupConfig === true ? {} : setupConfig;
-      imports.push(SetupModule.forRoot({
-        ...config,
-        provisioningPort: config.provisioningPort ?? persistence?.core.superAdminProvisioning,
-        imports: config.imports ?? options.imports
-      }));
-    }
-    if (adminStatsConfig) {
-      imports.push(AdminStatsModule.forRoot({
-        ...adminStatsConfig,
-        guards: adminStatsConfig.guards ?? [
-          ...options.controller.guards,
-          SuperAdminGuard
-        ],
-        auditStatsPort: adminStatsConfig.auditStatsPort ?? persistence?.core.auditStats,
-        imports: adminStatsConfig.imports ?? options.imports
-      }));
-    }
-    if (checkoutOfferConfig) {
-      imports.push(CheckoutOfferModule.forRoot({
-        ...checkoutOfferConfig,
-        bundleRepository: checkoutOfferConfig.bundleRepository ?? persistence?.catalog?.bundleRepository,
-        planRepository: checkoutOfferConfig.planRepository ?? persistence?.catalog?.planRepository,
-        catalogEntryRepository: checkoutOfferConfig.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
-        imports: checkoutOfferConfig.imports ?? options.imports
-      }));
-    }
-    if (subscriptionContractConfig) {
-      const config = subscriptionContractConfig === true ? {} : subscriptionContractConfig;
-      imports.push(SubscriptionContractModule.forRoot({
-        ...config,
-        subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
-        imports: config.imports ?? options.imports
-      }));
-    }
+    };
+    imports.push(...composeFeatures(composition));
     const lightweightProviders = [];
     const lightweightExports = [];
     if (options.autoManifest !== false) {
@@ -1340,100 +1813,35 @@ var SaasPlatformModule = class _SaasPlatformModule {
         ]
       });
     }
-    const hasExplicitResolver = !!adapters.planResolver;
-    const hasSubscriptionResolver = Boolean(tenantBillingConfig && adapters.subscriptionRepository);
-    const hasResolver = hasExplicitResolver || hasSubscriptionResolver;
-    const hasFallback = !!options.defaultPlanId;
-    if (hasResolver || hasFallback) {
-      if (hasSubscriptionResolver && !hasExplicitResolver) {
-        lightweightProviders.push(asProvider(PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN, adapters.subscriptionRepository));
-      }
-      lightweightProviders.push(hasExplicitResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, adapters.planResolver) : hasSubscriptionResolver ? {
-        provide: PLAN_RESOLVER_PORT_TOKEN,
-        useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
-        inject: [
-          PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
-        ]
-      } : {
-        provide: PLAN_RESOLVER_PORT_TOKEN,
-        useValue: new StaticPlanResolver(options.defaultPlanId)
-      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...quotaProvidersHostedByTenantBilling ? [] : options.quotaProviders ?? [], {
-        provide: QUOTA_PROVIDERS_TOKEN,
-        useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
-        inject: options.quotaProviders ?? []
-      }, ...options.globalFeatureGuard === false ? [] : [
-        {
-          provide: APP_GUARD,
-          useExisting: StaticFeatureGuard
-        }
-      ], {
-        provide: APP_INTERCEPTOR,
-        useExisting: EnforceQuotaInterceptor
-      });
-      lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
-      if (options.globalFeatureGuard === false) {
-        lightweightProviders.push(FeatureGuardCoverageCheck);
-        imports.push(NestDiscoveryModule);
-      }
-    } else {
+    const resolution = resolvePlanResolution(composition);
+    const runtime = composeEnforcementRuntime(composition, resolution);
+    lightweightProviders.push(...runtime.providers);
+    lightweightExports.push(...runtime.exports);
+    if (!resolution.available && !requiresFullEntitlement2) {
       PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
     }
-    const tenantControllers = [];
-    if (options.tenantManifest) {
-      if (!hasResolver && !hasFallback) {
-        throw new Error("SaasPlatformModule.forRoot: tenantManifest requires defaultPlanId, adapters.planResolver or tenantBilling so it can resolve features.");
-      }
-      lightweightProviders.push(TenantManifestService);
-      lightweightExports.push(TenantManifestService);
-      tenantControllers.push(buildTenantManifestController(options.tenantManifest === true ? {
-        guards: Array.isArray(tenantBillingConfig?.authGuards) ? tenantBillingConfig.authGuards : options.controller.guards
-      } : options.tenantManifest));
+    if (options.enforcementChainCheck !== false) {
+      lightweightProviders.push(EnforcementChainCheck, enforcementChainState({
+        featureEnforcementActive: resolution.available || requiresFullEntitlement2,
+        quotaEnforcementActive: resolution.available,
+        globalGuardBound: resolution.available && options.globalFeatureGuard !== false,
+        // Whether the OPTION unbound it, as opposed to this simply
+        // being a path where the platform binds none. The message
+        // names the true cause, and an application that never set
+        // the option is not told to look for it.
+        globalGuardOptedOut: options.globalFeatureGuard === false
+      }));
     }
+    if (options.enforcementChainCheck !== false) imports.push(NestDiscoveryModule);
+    const tenantManifest = composeTenantManifest(composition);
+    lightweightProviders.push(...tenantManifest.providers);
+    lightweightExports.push(...tenantManifest.exports);
     return {
       module: _SaasPlatformModule,
       imports,
       providers: lightweightProviders,
-      controllers: tenantControllers,
-      exports: [
-        PlanCatalogModule,
-        DiscoveryModule,
-        AdminModule,
-        // ADMIN_MANIFEST_CONFIG travels transitively: re-exporting an
-        // imported module's token directly is an UnknownExportException
-        // at boot — the module export below already carries it.
-        AdminManifestModule,
-        ...requiresFullEntitlement ? [
-          EntitlementModule
-        ] : [],
-        ...catalogConfig ? [
-          CatalogModule
-        ] : [],
-        ...tenantBillingConfig ? [
-          TenantBillingModule
-        ] : [],
-        ...subscriptionBundlesConfig ? [
-          SubscriptionBundleModule
-        ] : [],
-        ...adminResourcesConfig ? [
-          AdminResourcesModule
-        ] : [],
-        ...promoCodesConfig ? [
-          PromoCodesModule
-        ] : [],
-        ...setupConfig ? [
-          SetupModule
-        ] : [],
-        ...adminStatsConfig ? [
-          AdminStatsModule
-        ] : [],
-        ...checkoutOfferConfig ? [
-          CheckoutOfferModule
-        ] : [],
-        ...subscriptionContractConfig ? [
-          SubscriptionContractModule
-        ] : [],
-        ...lightweightExports
-      ],
+      controllers: tenantManifest.controllers,
+      exports: composeModuleExports(composition, lightweightExports),
       global: true
     };
   }
@@ -1448,17 +1856,28 @@ export {
   SetupService,
   SetupController,
   SetupModule,
+  ENFORCEMENT_CHAIN_STATE_TOKEN,
+  EnforcementChainCheck,
+  headingSlug,
+  docsUrlFor,
+  PLATFORM_RULES,
+  findViolations,
+  SaaSiCatConfigurationError,
+  assertConfiguration,
+  QuotaProvidersUsageSnapshot,
+  FEATURE_COMPOSERS,
+  composeFeatures,
+  MOUNTED_BUT_NOT_EXPORTED,
+  composeModuleExports,
   PLAN_RESOLVER_PORT_TOKEN,
   StaticPlanResolver,
   StaticEntitlementService,
-  FeatureGuardCoverageCheck,
-  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
-  StaticFeatureGuard,
+  TenantManifestService,
+  buildTenantManifestController,
   QUOTA_PROVIDERS_TOKEN,
   EnforceQuotaInterceptor,
-  QuotaProvidersUsageSnapshot,
+  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
+  StaticFeatureGuard,
   SubscriptionPlanResolver,
-  TenantManifestService,
-  buildTenantManifestController,
   SaasPlatformModule
 };