@saasicat/nest 0.26.1 → 1.0.0-rc.0

package/dist/chunk-TCBYOFAC.js

@@ -1,1464 +0,0 @@
-import {
-  PromoCodesModule
-} from "./chunk-B6IWLV7R.js";
-import {
-  AdminManifestModule,
-  AdminManifestService,
-  AdminModule,
-  AdminResourcesModule,
-  AdminStatsModule,
-  MfaService,
-  SuperAdminGuard
-} from "./chunk-SN5UOC43.js";
-import {
-  FEATURE_GUARD_MARKER,
-  PublicCatalogModule,
-  REQUIRE_FEATURE_KEY,
-  SubscriptionBundleModule,
-  TenantBillingModule,
-  isPlatformFeatureGuard
-} from "./chunk-YWDLYOFN.js";
-import {
-  SubscriptionContractModule
-} from "./chunk-B7NRY2LV.js";
-import {
-  CatalogModule
-} from "./chunk-7X5MSAIL.js";
-import {
-  CheckoutOfferModule
-} from "./chunk-XTVAFJ3P.js";
-import {
-  SaaSiCatPublicRoute
-} from "./chunk-YSC46BGM.js";
-import {
-  DiscoveryModule
-} from "./chunk-6WL6VQ7Z.js";
-import {
-  EntitlementModule,
-  LimitExceededError
-} from "./chunk-NNNXXUPT.js";
-import {
-  PLAN_CATALOG_TOKEN,
-  PlanCatalogModule
-} from "./chunk-DQKCK7DX.js";
-import {
-  codedError
-} from "./chunk-EBJJNTW6.js";
-import {
-  asProvider
-} from "./chunk-SABTXESR.js";
-import {
-  ENFORCE_QUOTA_KEY
-} from "./chunk-L4SUWH5B.js";
-import {
-  __name
-} from "./chunk-SHUYVCID.js";
-
-// src/setup/tokens.ts
-var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupProvisioningPort");
-var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupConfig");
-
-// src/setup/setup.service.ts
-import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
-import { isPlatformUserExistsError, SETUP_ERROR_CODES } from "@saasicat/types";
-import { randomBytes, timingSafeEqual } from "crypto";
-import QRCode from "qrcode";
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param, "_ts_param");
-var GENERATED_PASSWORD_BYTES = 12;
-function timingSafeEqualStr(a, b) {
-  const ab = Buffer.from(a, "utf8");
-  const bb = Buffer.from(b, "utf8");
-  if (ab.length !== bb.length) return false;
-  return timingSafeEqual(ab, bb);
-}
-__name(timingSafeEqualStr, "timingSafeEqualStr");
-var SetupService = class {
-  static {
-    __name(this, "SetupService");
-  }
-  users;
-  config;
-  mfa;
-  constructor(users, config, mfa) {
-    this.users = users;
-    this.config = config;
-    this.mfa = mfa;
-  }
-  async status() {
-    return {
-      needsSetup: await this.users.countSuperAdmins() === 0
-    };
-  }
-  async setup(req) {
-    this.assertToken(req.token);
-    await this.assertNoSuperAdmin();
-    const email = req.email.trim().toLowerCase();
-    if (!email.includes("@")) {
-      throw new BadRequestException(codedError(SETUP_ERROR_CODES.INVALID_EMAIL));
-    }
-    const generated = !req.password;
-    const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
-    let user;
-    try {
-      user = await this.users.createSuperAdmin({
-        email,
-        password
-      });
-    } catch (err) {
-      if (isPlatformUserExistsError(err)) {
-        throw new ConflictException({
-          code: SETUP_ERROR_CODES.EMAIL_EXISTS,
-          message: err.message
-        });
-      }
-      throw err;
-    }
-    const totp = await this.mfa.setup(user.id, user.email, this.config.mfaIssuer);
-    const qrDataUrl = await QRCode.toDataURL(totp.otpauthUri, {
-      width: 220,
-      margin: 1
-    });
-    return {
-      userId: user.id,
-      email: user.email,
-      otpauthUri: totp.otpauthUri,
-      qrDataUrl,
-      secret: totp.secret,
-      ...generated ? {
-        generatedPassword: password
-      } : {}
-    };
-  }
-  async confirmMfa(req) {
-    this.assertToken(req.token);
-    const ok = await this.mfa.verify({
-      userId: req.userId,
-      code: req.code
-    });
-    return {
-      ok
-    };
-  }
-  assertToken(token) {
-    const expected = process.env[this.config.setupTokenEnvVar]?.trim();
-    if (!expected) {
-      throw new ForbiddenException({
-        code: SETUP_ERROR_CODES.SETUP_DISABLED,
-        message: `${this.config.setupTokenEnvVar} is not set \u2014 setup is disabled.`,
-        params: {
-          envVar: this.config.setupTokenEnvVar
-        }
-      });
-    }
-    if (!token || !timingSafeEqualStr(token, expected)) {
-      throw new UnauthorizedException(codedError(SETUP_ERROR_CODES.INVALID_SETUP_TOKEN));
-    }
-  }
-  async assertNoSuperAdmin() {
-    if (await this.users.countSuperAdmins() > 0) {
-      throw new ConflictException(codedError(SETUP_ERROR_CODES.SETUP_ALREADY_DONE));
-    }
-  }
-};
-SetupService = _ts_decorate([
-  Injectable(),
-  _ts_param(0, Inject(SETUP_PROVISIONING_PORT_TOKEN)),
-  _ts_param(1, Inject(SETUP_CONFIG_TOKEN)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof SuperAdminProvisioningPort === "undefined" ? Object : SuperAdminProvisioningPort,
-    typeof SetupConfig === "undefined" ? Object : SetupConfig,
-    typeof MfaService === "undefined" ? Object : MfaService
-  ])
-], SetupService);
-
-// src/setup/setup.controller.ts
-import { Body, Controller, Get, Post } from "@nestjs/common";
-import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from "class-validator";
-function _ts_decorate2(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var SetupDto = class SetupDto2 {
-  static {
-    __name(this, "SetupDto");
-  }
-  token;
-  email;
-  password;
-};
-_ts_decorate2([
-  IsString(),
-  IsNotEmpty(),
-  _ts_metadata2("design:type", String)
-], SetupDto.prototype, "token", void 0);
-_ts_decorate2([
-  IsEmail(),
-  _ts_metadata2("design:type", String)
-], SetupDto.prototype, "email", void 0);
-_ts_decorate2([
-  IsOptional(),
-  IsString(),
-  MinLength(8),
-  _ts_metadata2("design:type", String)
-], SetupDto.prototype, "password", void 0);
-var SetupConfirmMfaDto = class SetupConfirmMfaDto2 {
-  static {
-    __name(this, "SetupConfirmMfaDto");
-  }
-  token;
-  userId;
-  code;
-};
-_ts_decorate2([
-  IsString(),
-  IsNotEmpty(),
-  _ts_metadata2("design:type", String)
-], SetupConfirmMfaDto.prototype, "token", void 0);
-_ts_decorate2([
-  IsString(),
-  IsNotEmpty(),
-  _ts_metadata2("design:type", String)
-], SetupConfirmMfaDto.prototype, "userId", void 0);
-_ts_decorate2([
-  IsString(),
-  IsNotEmpty(),
-  _ts_metadata2("design:type", String)
-], SetupConfirmMfaDto.prototype, "code", void 0);
-var SetupController = class {
-  static {
-    __name(this, "SetupController");
-  }
-  setup;
-  constructor(setup) {
-    this.setup = setup;
-  }
-  status() {
-    return this.setup.status();
-  }
-  run(dto) {
-    return this.setup.setup(dto);
-  }
-  confirm(dto) {
-    return this.setup.confirmMfa(dto);
-  }
-};
-_ts_decorate2([
-  Get("status"),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
-], SetupController.prototype, "status", null);
-_ts_decorate2([
-  Post(),
-  _ts_param2(0, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof SetupDto === "undefined" ? Object : SetupDto
-  ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
-], SetupController.prototype, "run", null);
-_ts_decorate2([
-  Post("confirm-mfa"),
-  _ts_param2(0, Body()),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof SetupConfirmMfaDto === "undefined" ? Object : SetupConfirmMfaDto
-  ]),
-  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
-], SetupController.prototype, "confirm", null);
-SetupController = _ts_decorate2([
-  Controller("admin/setup"),
-  SaaSiCatPublicRoute(),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof SetupService === "undefined" ? Object : SetupService
-  ])
-], SetupController);
-
-// src/setup/setup.module.ts
-import { Module } from "@nestjs/common";
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-var DEFAULT_SETUP_TOKEN_ENV_VAR = "SETUP_TOKEN";
-var DEFAULT_MFA_ISSUER = "SuperAdmin";
-var SetupModule = class _SetupModule {
-  static {
-    __name(this, "SetupModule");
-  }
-  static forRoot(options) {
-    return {
-      module: _SetupModule,
-      global: options.global ?? false,
-      imports: options.imports ?? [],
-      controllers: [
-        SetupController
-      ],
-      providers: [
-        asProvider(SETUP_PROVISIONING_PORT_TOKEN, options.provisioningPort),
-        {
-          provide: SETUP_CONFIG_TOKEN,
-          useValue: {
-            setupTokenEnvVar: options.setupTokenEnvVar ?? DEFAULT_SETUP_TOKEN_ENV_VAR,
-            mfaIssuer: options.mfaIssuer ?? DEFAULT_MFA_ISSUER
-          }
-        },
-        SetupService,
-        ...options.extraProviders ?? []
-      ],
-      exports: [
-        SetupService
-      ]
-    };
-  }
-};
-SetupModule = _ts_decorate3([
-  Module({})
-], SetupModule);
-
-// src/platform/plan-resolver.port.ts
-var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlanResolverPort");
-var StaticPlanResolver = class {
-  static {
-    __name(this, "StaticPlanResolver");
-  }
-  planId;
-  constructor(planId) {
-    this.planId = planId;
-  }
-  async getPlanIdForTenant() {
-    return this.planId;
-  }
-};
-
-// src/platform/static-entitlement.service.ts
-import { Inject as Inject2, Injectable as Injectable2 } from "@nestjs/common";
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var StaticEntitlementService = class {
-  static {
-    __name(this, "StaticEntitlementService");
-  }
-  catalog;
-  resolver;
-  constructor(catalog, resolver) {
-    this.catalog = catalog;
-    this.resolver = resolver;
-  }
-  /**
-   * Returns the effective features + quotas of a tenant from the
-   * plan catalog. When the plan is missing: an empty snapshot (no feature,
-   * all quotas at 0).
-   */
-  async snapshot(tenantId) {
-    const planId = await this.resolver.getPlanIdForTenant(tenantId);
-    if (!planId) {
-      return {
-        planId: null,
-        features: [],
-        quotas: {}
-      };
-    }
-    const plan = this.findPlan(planId);
-    if (!plan) {
-      return {
-        planId,
-        features: [],
-        quotas: {}
-      };
-    }
-    return {
-      planId,
-      features: plan.features ?? [],
-      quotas: plan.quotas ?? {}
-    };
-  }
-  /** Convenience helper for tests / synchronous checks in the UI manifest. */
-  async hasFeature(tenantId, featureKey) {
-    const snap = await this.snapshot(tenantId);
-    return snap.features.includes(featureKey);
-  }
-  async quotaLimit(tenantId, quotaKey) {
-    const snap = await this.snapshot(tenantId);
-    const value = snap.quotas[quotaKey];
-    return value === void 0 ? null : value;
-  }
-  findPlan(planId) {
-    return (this.catalog.plans ?? []).find((p) => p.id === planId);
-  }
-};
-StaticEntitlementService = _ts_decorate4([
-  Injectable2(),
-  _ts_param3(0, Inject2(PLAN_CATALOG_TOKEN)),
-  _ts_param3(1, Inject2(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
-    typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
-  ])
-], StaticEntitlementService);
-
-// src/platform/feature-guard-coverage.check.ts
-import { Inject as Inject3, Injectable as Injectable3, Logger } from "@nestjs/common";
-import { DiscoveryService, MetadataScanner } from "@nestjs/core";
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-var GUARDS_METADATA = "__guards__";
-var METHOD_METADATA = "method";
-var FeatureGuardCoverageCheck = class {
-  static {
-    __name(this, "FeatureGuardCoverageCheck");
-  }
-  discoveryService;
-  metadataScanner;
-  logger = new Logger("SaaSiCat");
-  constructor(discoveryService, metadataScanner) {
-    this.discoveryService = discoveryService;
-    this.metadataScanner = metadataScanner;
-  }
-  onApplicationBootstrap() {
-    const uncovered = this.findUncoveredRoutes();
-    if (uncovered.length === 0) return;
-    const list = uncovered.map((r) => `  ${r.controller}.${r.handler} \u2014 requires ${r.features.join(" or ")}`).join("\n");
-    this.logger.warn(`globalFeatureGuard is off and ${uncovered.length} annotated route(s) have no feature guard in front of them, so they serve unlicensed traffic:
-${list}
-Bind one behind your auth guard \u2014 @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path. A guard of your own that wraps either one is not recognised here; if that is what these routes use, they are covered.`);
-  }
-  /**
-   * Annotated handlers whose own guards and whose controller's guards contain
-   * no recognisable feature guard.
-   *
-   * Deliberately conservative in one direction only: an unrecognised wrapper
-   * is reported (and the message says so) rather than assumed safe, because
-   * the named route is cheap to check. The reverse — staying silent about a
-   * route with no guard at all — is the failure this exists to prevent.
-   */
-  findUncoveredRoutes() {
-    const uncovered = [];
-    for (const wrapper of this.discoveryService.getControllers()) {
-      const instance = wrapper.instance;
-      if (!instance || typeof instance !== "object") continue;
-      const ctor = instance.constructor;
-      if (!ctor) continue;
-      const classGuards = readGuards(ctor);
-      const prototype = Object.getPrototypeOf(instance);
-      for (const method of this.metadataScanner.getAllMethodNames(prototype)) {
-        const handler = instance[method];
-        if (typeof handler !== "function") continue;
-        if (Reflect.getMetadata(METHOD_METADATA, handler) === void 0) continue;
-        const features = readFeatures(handler) ?? readFeatures(ctor) ?? /* not annotated */
-        null;
-        if (!features || features.length === 0) continue;
-        const guards = [
-          ...classGuards,
-          ...readGuards(handler)
-        ];
-        if (guards.some(isPlatformFeatureGuard)) continue;
-        uncovered.push({
-          controller: ctor.name,
-          handler: method,
-          features
-        });
-      }
-    }
-    return uncovered;
-  }
-};
-FeatureGuardCoverageCheck = _ts_decorate5([
-  Injectable3(),
-  _ts_param4(0, Inject3(DiscoveryService)),
-  _ts_param4(1, Inject3(MetadataScanner)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
-    typeof MetadataScanner === "undefined" ? Object : MetadataScanner
-  ])
-], FeatureGuardCoverageCheck);
-function readFeatures(target) {
-  const value = Reflect.getMetadata(REQUIRE_FEATURE_KEY, target);
-  return Array.isArray(value) ? value : null;
-}
-__name(readFeatures, "readFeatures");
-function readGuards(target) {
-  const value = Reflect.getMetadata(GUARDS_METADATA, target);
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((guard) => typeof guard === "function" ? [
-    guard
-  ] : [
-    guard,
-    guard?.constructor
-  ]);
-}
-__name(readGuards, "readGuards");
-
-// src/platform/static-feature.guard.ts
-import { ForbiddenException as ForbiddenException2, Inject as Inject4, Injectable as Injectable4, Optional } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
-import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
-var StaticFeatureGuard = class {
-  static {
-    __name(this, "StaticFeatureGuard");
-  }
-  reflector;
-  entitlements;
-  config;
-  /** Lets `FeatureGuardCoverageCheck` recognise this guard across CJS entries. */
-  static [FEATURE_GUARD_MARKER] = true;
-  constructor(reflector, entitlements, config = null) {
-    this.reflector = reflector;
-    this.entitlements = entitlements;
-    this.config = config;
-  }
-  async canActivate(context) {
-    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!required || required.length === 0) return true;
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) {
-      throw new ForbiddenException2({
-        code: AUTH_ERROR_CODES.NOT_AUTHENTICATED,
-        message: "Not authenticated"
-      });
-    }
-    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
-    if (role === "SUPER_ADMIN") return true;
-    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
-    if (!tenantId) {
-      throw new ForbiddenException2({
-        code: AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
-        message: "No tenant assigned"
-      });
-    }
-    const snap = await this.entitlements.snapshot(tenantId);
-    const allowed = required.some((f) => snap.features.includes(f));
-    if (!allowed) {
-      const body = {
-        code: FEATURE_NOT_LICENSED,
-        featureKey: required[0],
-        featureKeys: required,
-        offers: [],
-        message: `Feature ${required.join(" / ")} is not included in the current plan.`
-      };
-      throw new ForbiddenException2(body);
-    }
-    return true;
-  }
-};
-StaticFeatureGuard = _ts_decorate6([
-  Injectable4(),
-  _ts_param5(0, Inject4(Reflector)),
-  _ts_param5(1, Inject4(StaticEntitlementService)),
-  _ts_param5(2, Optional()),
-  _ts_param5(2, Inject4(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof Reflector === "undefined" ? Object : Reflector,
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
-    Object
-  ])
-], StaticFeatureGuard);
-
-// src/platform/enforce-quota.interceptor.ts
-import { Inject as Inject5, Injectable as Injectable5, Optional as Optional2 } from "@nestjs/common";
-import { Reflector as Reflector2 } from "@nestjs/core";
-import { from } from "rxjs";
-import { switchMap } from "rxjs/operators";
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param6, "_ts_param");
-var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/QuotaProviders");
-var EnforceQuotaInterceptor = class {
-  static {
-    __name(this, "EnforceQuotaInterceptor");
-  }
-  reflector;
-  entitlements;
-  providers;
-  constructor(reflector, entitlements, providers = null) {
-    this.reflector = reflector;
-    this.entitlements = entitlements;
-    this.providers = providers;
-  }
-  intercept(context, next) {
-    const meta = this.reflector.getAllAndOverride(ENFORCE_QUOTA_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!meta?.quotaKey) return next.handle();
-    return from(this.check(context, meta)).pipe(switchMap(() => next.handle()));
-  }
-  async check(context, meta) {
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) return;
-    const role = user.role ?? user.platformRole;
-    if (role === "SUPER_ADMIN") return;
-    const tenantId = request.tenantId ?? user.tenantId;
-    if (!tenantId) return;
-    const provider = (this.providers ?? []).find((p) => p.key === meta.quotaKey);
-    if (!provider) {
-      return;
-    }
-    const limit = await this.entitlements.quotaLimit(tenantId, meta.quotaKey);
-    if (limit === null || limit === -1) return;
-    const current = await provider.count(tenantId);
-    const delta = meta.incrementBy ?? 1;
-    if (current + delta > limit) {
-      throw new LimitExceededError(meta.quotaKey, limit, current);
-    }
-  }
-};
-EnforceQuotaInterceptor = _ts_decorate7([
-  Injectable5(),
-  _ts_param6(0, Inject5(Reflector2)),
-  _ts_param6(1, Inject5(StaticEntitlementService)),
-  _ts_param6(2, Optional2()),
-  _ts_param6(2, Inject5(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    typeof Reflector2 === "undefined" ? Object : Reflector2,
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
-    Object
-  ])
-], EnforceQuotaInterceptor);
-
-// src/platform/quota-providers-usage-snapshot.ts
-var QuotaProvidersUsageSnapshot = class {
-  static {
-    __name(this, "QuotaProvidersUsageSnapshot");
-  }
-  providers;
-  constructor(providers) {
-    this.providers = providers;
-  }
-  async snapshot(tenantId) {
-    const entries = await Promise.all(this.providers.map(async (provider) => [
-      provider.key,
-      await provider.count(tenantId)
-    ]));
-    return Object.fromEntries(entries);
-  }
-};
-
-// src/platform/subscription-plan-resolver.ts
-var DEFAULT_ACTIVE_STATUSES = /* @__PURE__ */ new Set([
-  "ACTIVE",
-  "TRIAL"
-]);
-var SubscriptionPlanResolver = class {
-  static {
-    __name(this, "SubscriptionPlanResolver");
-  }
-  subscriptions;
-  activeStatuses;
-  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
-    this.subscriptions = subscriptions;
-    this.activeStatuses = activeStatuses;
-  }
-  async getPlanIdForTenant(tenantId) {
-    const subscription = await this.subscriptions.findByTenantId(tenantId);
-    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
-    return subscription.plan;
-  }
-};
-
-// src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable6 } from "@nestjs/common";
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-var TenantManifestService = class {
-  static {
-    __name(this, "TenantManifestService");
-  }
-  entitlements;
-  navItems = [];
-  constructor(entitlements) {
-    this.entitlements = entitlements;
-  }
-  /**
-   * Call in the app's `OnModuleInit`: registers app navigation for the
-   * Tenant UI. Idempotent: the same `id` overwrites.
-   */
-  registerNavItem(item) {
-    const existing = this.navItems.findIndex((i) => i.id === item.id);
-    if (existing >= 0) this.navItems[existing] = item;
-    else this.navItems.push(item);
-  }
-  /** Bulk variant. */
-  registerNavItems(items) {
-    for (const item of items) this.registerNavItem(item);
-  }
-  /**
-   * Returns the filtered manifest for a Tenant. NavItems with
-   * `requiresFeature` are filtered out server-side as soon as none of the
-   * required features are present in the entitlement snapshot.
-   */
-  async getManifest(tenantId) {
-    const snap = await this.entitlements.snapshot(tenantId);
-    const featureSet = new Set(snap.features);
-    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
-      ...item
-    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
-    return {
-      schemaVersion: 1,
-      tenant: {
-        id: tenantId
-      },
-      planId: snap.planId,
-      features: snap.features,
-      quotas: snap.quotas,
-      navigation: visible
-    };
-  }
-};
-TenantManifestService = _ts_decorate8([
-  Injectable6(),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
-  ])
-], TenantManifestService);
-function isVisible(item, features) {
-  if (!item.requiresFeature) return true;
-  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
-    item.requiresFeature
-  ];
-  return required.some((f) => features.has(f));
-}
-__name(isVisible, "isVisible");
-
-// src/platform/tenant-manifest.controller.ts
-import { Controller as Controller2, Get as Get2, Inject as Inject6, Req, UseGuards } from "@nestjs/common";
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata8(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param7, "_ts_param");
-function buildTenantManifestController(options) {
-  const path = options.path ?? "tenant/manifest";
-  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
-    static {
-      __name(this, "GeneratedTenantManifestController");
-    }
-    svc;
-    constructor(svc) {
-      this.svc = svc;
-    }
-    async get(req) {
-      const tenantId = req.user?.tenantId ?? req.tenantId;
-      if (!tenantId) {
-        throw new Error("No tenant on the request \u2014 TenantManifest requires user.tenantId.");
-      }
-      return this.svc.getManifest(tenantId);
-    }
-  };
-  _ts_decorate9([
-    Get2(),
-    _ts_param7(0, Req()),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", [
-      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
-    ]),
-    _ts_metadata8("design:returntype", Promise)
-  ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate9([
-    Controller2(path),
-    UseGuards(...options.guards),
-    _ts_param7(0, Inject6(TenantManifestService)),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", [
-      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
-    ])
-  ], GeneratedTenantManifestController);
-  return GeneratedTenantManifestController;
-}
-__name(buildTenantManifestController, "buildTenantManifestController");
-
-// src/platform/saas-platform.module.ts
-import { Logger as Logger2, Module as Module2 } from "@nestjs/common";
-import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
-import { assertPersistenceCapabilities } from "@saasicat/types";
-import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
-function _ts_decorate10(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate10, "_ts_decorate");
-var PLATFORM_LOGGER = new Logger2("SaaSiCat");
-var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
-var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
-function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
-  const capabilities = {
-    "discovery.read": true
-  };
-  if (catalog && catalog.adminControllers !== false) {
-    Object.assign(capabilities, {
-      "plans.read": true,
-      "plans.publish": true,
-      "bundles.read": true,
-      "bundles.write": true,
-      "bundles.publish": true,
-      "marketingProjections.read": true,
-      "marketingProjections.write": true
-    });
-  }
-  const navigation = {};
-  if (adminResources) {
-    Object.assign(capabilities, {
-      "tenants.read": true,
-      "tenants.suspend": true,
-      "tenants.reactivate": true,
-      "users.read": true,
-      "audit.read": true,
-      "subscriptions.read": true
-    });
-    navigation.standardPages = {
-      subscriptions: {
-        enabled: true,
-        requiredCapability: "subscriptions.read"
-      }
-    };
-  }
-  if (promoCodes) {
-    Object.assign(capabilities, {
-      "promoCodes.read": true,
-      "promoCodes.write": true,
-      "promoCodes.delete": true
-    });
-    navigation.standardPages = {
-      ...navigation.standardPages ?? {},
-      promoCodes: {
-        enabled: true,
-        requiredCapability: "promoCodes.read"
-      }
-    };
-  }
-  return {
-    capabilities,
-    navigation: navigation.standardPages ? navigation : void 0
-  };
-}
-__name(buildStandardManifestContribution, "buildStandardManifestContribution");
-function normalizeTenantAuthGuards(guards) {
-  if (!Array.isArray(guards)) return guards;
-  return {
-    useFactory: /* @__PURE__ */ __name((...instances) => instances, "useFactory"),
-    inject: guards
-  };
-}
-__name(normalizeTenantAuthGuards, "normalizeTenantAuthGuards");
-function quotaUsageSnapshotProvider(quotaProviders) {
-  return {
-    useFactory: /* @__PURE__ */ __name((...providers) => new QuotaProvidersUsageSnapshot(providers), "useFactory"),
-    inject: quotaProviders
-  };
-}
-__name(quotaUsageSnapshotProvider, "quotaUsageSnapshotProvider");
-function buildMinimalManifestConfig() {
-  return {
-    useFactory: /* @__PURE__ */ __name((catalog) => ({
-      project: {
-        key: catalog.projectKey,
-        displayName: catalog.app?.name ?? catalog.projectKey,
-        label: catalog.app?.label,
-        icon: catalog.app?.icon,
-        logoUrl: catalog.app?.logoUrl,
-        environment: process.env.NODE_ENV === "production" ? "production" : "development",
-        availableLocales: catalog.marketing?.availableLocales,
-        defaultLocale: catalog.marketing?.availableLocales?.[0]
-      },
-      build: {
-        platformPackageVersion: "0.0.0",
-        appVersion: "0.0.0"
-      },
-      planCatalogSnapshot: {
-        source: "saas-platform-module",
-        hash: "sha256-quickstart",
-        currency: catalog.currency,
-        vatRate: catalog.vatRate,
-        plans: catalog.plans ?? [],
-        features: catalog.features ?? []
-      }
-    }), "useFactory"),
-    inject: [
-      PLAN_CATALOG_TOKEN
-    ]
-  };
-}
-__name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
-var SaasPlatformModule = class _SaasPlatformModule {
-  static {
-    __name(this, "SaasPlatformModule");
-  }
-  static forRoot(options) {
-    const explicit = options.adapters ?? {};
-    const persistence = options.persistence;
-    const catalogConfig = options.catalog || null;
-    const tenantBillingConfig = options.tenantBilling || null;
-    const subscriptionBundlesConfig = options.subscriptionBundles || null;
-    const adminResourcesConfig = options.adminResources || null;
-    const promoCodesConfig = options.promoCodes || null;
-    const setupConfig = options.setup || null;
-    const adminStatsConfig = options.adminStats || null;
-    const checkoutOfferConfig = options.checkoutOffer || null;
-    const subscriptionContractConfig = options.subscriptionContract || null;
-    const requiresFullEntitlement = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
-    const adapters = {
-      mfa: explicit.mfa ?? persistence?.core.mfa,
-      audit: explicit.audit ?? persistence?.core.audit,
-      rlsBypass: explicit.rlsBypass ?? persistence?.core.rlsBypass,
-      planCatalogReadSink: explicit.planCatalogReadSink ?? persistence?.planCatalogReadSink,
-      planResolver: explicit.planResolver,
-      subscriptionRepository: explicit.subscriptionRepository ?? persistence?.entitlement?.subscriptionRepository,
-      planVersionRepository: explicit.planVersionRepository ?? persistence?.entitlement?.planVersionRepository,
-      transactionRunner: explicit.transactionRunner ?? persistence?.core.transactionRunner
-    };
-    const missingCore = [
-      "mfa",
-      "audit",
-      "rlsBypass"
-    ].filter((key) => adapters[key] === void 0);
-    if (missingCore.length) {
-      throw new Error(`SaasPlatformModule.forRoot: adapters missing (provide them via \`adapters\` or a \`persistence\` bundle): ${missingCore.join(", ")}`);
-    }
-    const mfaPort = adapters.mfa;
-    const auditPort = adapters.audit;
-    const rlsBypassPort = adapters.rlsBypass;
-    if (!options.planCatalog && (!adapters.planCatalogReadSink || !options.dbCatalog)) {
-      throw new Error("SaasPlatformModule.forRoot: either set `planCatalog` (quickstart YAML path) or, for DB hydration, BOTH a planCatalogReadSink (`adapters`/`persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }).");
-    }
-    if (catalogConfig && !persistence?.catalog) {
-      throw new Error("SaasPlatformModule.forRoot: catalog is enabled, but `persistence.catalog` is missing. Use a complete persistence bundle or wire CatalogModule directly.");
-    }
-    if (adminResourcesConfig && adminResourcesConfig !== true && !adminResourcesConfig.resources && !persistence?.adminResources) {
-      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
-    }
-    if (promoCodesConfig && (!persistence?.promo || !adapters.transactionRunner)) {
-      throw new Error("SaasPlatformModule.forRoot: promoCodes requires `persistence.promo` and a transactionRunner.");
-    }
-    if (setupConfig && !((setupConfig === true ? void 0 : setupConfig.provisioningPort) ?? persistence?.core.superAdminProvisioning)) {
-      throw new Error("SaasPlatformModule.forRoot: setup is enabled, but no provisioningPort is available (set `setup.provisioningPort` or `persistence.core.superAdminProvisioning`).");
-    }
-    if (adminStatsConfig && !adminStatsConfig.auditStatsPort && !persistence?.core.auditStats) {
-      throw new Error("SaasPlatformModule.forRoot: adminStats is enabled, but no auditStatsPort is available (set `adminStats.auditStatsPort` or `persistence.core.auditStats`).");
-    }
-    if (subscriptionContractConfig) {
-      const explicitRepository = subscriptionContractConfig === true ? void 0 : subscriptionContractConfig.subscriptionContractRepository;
-      if (!explicitRepository && !persistence?.entitlement?.subscriptionContractRepository) {
-        throw new Error("SaasPlatformModule.forRoot: subscriptionContract is enabled, but no repository is available (set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle).");
-      }
-    }
-    if (promoCodesConfig && promoCodesConfig !== true && promoCodesConfig.includePublicController !== false && !promoCodesConfig.firstTimeCustomerCheck) {
-      throw new Error("SaasPlatformModule.forRoot: public promo preview requires `firstTimeCustomerCheck`.");
-    }
-    if (adminResourcesConfig === true && !persistence?.adminResources) {
-      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
-    }
-    if (tenantBillingConfig && !persistence?.tenantBilling) {
-      const missing = [
-        !tenantBillingConfig.subscriptionUsagePort && "subscriptionUsagePort",
-        !tenantBillingConfig.subscriptionWritePort && "subscriptionWritePort"
-      ].filter(Boolean);
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: tenantBilling is enabled, but adapters are missing: ${missing.join(", ")}`);
-      }
-    }
-    if (subscriptionBundlesConfig && !tenantBillingConfig) {
-      throw new Error("SaasPlatformModule.forRoot: subscriptionBundles requires tenantBilling so auth and subscription usage can be shared.");
-    }
-    if (subscriptionBundlesConfig) {
-      const missing = [];
-      if (!persistence?.entitlement?.subscriptionBundleRepository) {
-        missing.push("subscriptionBundleRepository");
-      }
-      if (!persistence?.catalog?.bundleRepository) {
-        missing.push("bundleRepository");
-      }
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: subscriptionBundles is enabled, but persistence adapters are missing: ${missing.join(", ")}`);
-      }
-    }
-    if (requiresFullEntitlement) {
-      const missing = [];
-      if (!adapters.subscriptionRepository) missing.push("subscriptionRepository");
-      if (!adapters.planVersionRepository) missing.push("planVersionRepository");
-      if (!adapters.transactionRunner) missing.push("transactionRunner");
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: entitlement active or required by the standard stack, but adapters are missing: ${missing.join(", ")}`);
-      }
-      if (persistence) {
-        assertPersistenceCapabilities(persistence.capabilities, {
-          transactions: true,
-          pessimisticLocking: true
-        }, "SaasPlatformModule entitlement (transactional enforceLimit)");
-      }
-    }
-    const dbCatalog = options.dbCatalog;
-    const planCatalogModule = options.planCatalog ? PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
-      global: true
-    }) : PlanCatalogModule.forRoot({
-      projectKey: dbCatalog.projectKey,
-      app: dbCatalog.app,
-      currency: dbCatalog.currency,
-      vatRate: dbCatalog.vatRate,
-      marketing: dbCatalog.marketing,
-      sink: adapters.planCatalogReadSink,
-      imports: options.imports
-    });
-    const appInfo = options.app ?? {
-      key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
-      version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
-    };
-    const imports = [
-      // Make injected client/auth providers visible to the high-level
-      // module's own quota providers and automatic plan resolver too.
-      ...options.imports ?? [],
-      planCatalogModule,
-      DiscoveryModule.forRoot({
-        app: appInfo,
-        controller: {
-          guards: options.controller.guards
-        },
-        imports: options.imports,
-        snapshotPath: options.discoverySnapshotPath === void 0 ? "var/discovery-snapshot.json" : options.discoverySnapshotPath
-      }),
-      AdminModule.forRoot({
-        mfaPort,
-        auditPort,
-        rlsBypassPort,
-        imports: options.imports,
-        global: true
-      }),
-      AdminManifestModule.forRoot({
-        config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
-        extraProviders: options.adminManifestExtraProviders,
-        includeManifestController: options.includeManifestController,
-        guards: options.controller.guards,
-        reloadGuards: options.reloadGuards,
-        imports: options.imports,
-        // Global like AdminModule above: apps register their manifest
-        // contribution by injecting AdminManifestService into one of
-        // their own modules (handbook §6.6). Re-exporting the module
-        // from here does not make that injection resolvable.
-        global: true
-      })
-    ];
-    if (requiresFullEntitlement) {
-      imports.push(EntitlementModule.forRoot({
-        subscriptionRepository: adapters.subscriptionRepository,
-        planVersionRepository: adapters.planVersionRepository,
-        transactionRunner: adapters.transactionRunner,
-        resolutionConfig: options.entitlement ? options.entitlement.resolutionConfig : void 0,
-        subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
-        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.entitlement?.bundleRepository,
-        imports: options.imports,
-        global: Boolean(tenantBillingConfig || subscriptionBundlesConfig)
-      }));
-    }
-    if (catalogConfig) {
-      const catalog = persistence?.catalog;
-      imports.push(CatalogModule.forRoot({
-        planRepository: catalog.planRepository,
-        bundleRepository: catalog.bundleRepository,
-        catalogEntryRepository: catalog.catalogEntryRepository,
-        marketingProjectionRepository: catalog.marketingProjectionRepository,
-        promotionRepository: catalog.promotionRepository,
-        marketingSettingsRepository: catalog.marketingSettingsRepository,
-        controller: catalogConfig.adminControllers === false ? void 0 : {
-          guards: options.controller.guards
-        },
-        imports: catalogConfig.imports ?? options.imports,
-        extraProviders: catalogConfig.extraProviders,
-        strictModeCheckMode: catalogConfig.strictModeCheckMode,
-        autoSyncDiscoveryAtBoot: catalogConfig.autoSyncDiscoveryAtBoot,
-        marketedOnlyFeatures: catalogConfig.marketedOnlyFeatures,
-        featureUiRegistry: catalogConfig.featureUiRegistry,
-        publicMarketingCatalog: catalogConfig.publicMarketingCatalog
-      }));
-      if (catalogConfig.publicCatalog !== false) {
-        imports.push(PublicCatalogModule.forRoot({
-          featureUiRegistry: catalogConfig.featureUiRegistry,
-          projectKey: appInfo.key,
-          bundleRepository: catalog.bundleRepository,
-          marketingRepository: catalog.marketingProjectionRepository,
-          catalogEntryRepository: catalog.catalogEntryRepository,
-          imports: catalogConfig.imports ?? options.imports
-        }));
-      }
-    }
-    if (adminResourcesConfig) {
-      const config = adminResourcesConfig === true ? {} : adminResourcesConfig;
-      imports.push(AdminResourcesModule.forRoot({
-        resources: config.resources ?? persistence?.adminResources?.resources,
-        guards: config.guards ?? [
-          ...options.controller.guards,
-          SuperAdminGuard
-        ],
-        imports: config.imports ?? options.imports
-      }));
-    }
-    if (promoCodesConfig) {
-      const config = promoCodesConfig === true ? {} : promoCodesConfig;
-      const promo = persistence?.promo;
-      const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, adminController, ...promoOptions } = config;
-      imports.push(PromoCodesModule.forRoot({
-        ...promoOptions,
-        promoCodeRepository: promo.promoCodeRepository,
-        redemptionRepository: promo.redemptionRepository,
-        validationLogRepository: promo.validationLogRepository,
-        subscriptionLookup: promo.subscriptionLookup,
-        revenueAggregator: promo.revenueAggregator,
-        transactionRunner: adapters.transactionRunner,
-        firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
-          hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
-        },
-        includePublicController: includePublicController ?? false,
-        adminController: adminController === false ? false : {
-          guards: adminGuards ?? [
-            ...options.controller.guards,
-            SuperAdminGuard
-          ]
-        },
-        imports: promoImports ?? options.imports
-      }));
-    }
-    let sharedTenantAuthGuards;
-    let sharedSubscriptionUsagePort;
-    let quotaProvidersHostedByTenantBilling = false;
-    if (tenantBillingConfig) {
-      const tenantSlice = persistence?.tenantBilling;
-      const { authGuards, subscriptionUsagePort, usageSnapshotPort, subscriptionWritePort, imports: tenantImports, extraProviders, extraExports, ...tenantOptions } = tenantBillingConfig;
-      const quotaProviders = options.quotaProviders ?? [];
-      quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
-      sharedTenantAuthGuards = normalizeTenantAuthGuards(authGuards);
-      sharedSubscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
-      const resolvedUsageSnapshotPort = usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(options.quotaProviders ?? []);
-      imports.push(TenantBillingModule.forRoot({
-        ...tenantOptions,
-        authGuards: sharedTenantAuthGuards,
-        subscriptionUsagePort: sharedSubscriptionUsagePort,
-        usageSnapshotPort: resolvedUsageSnapshotPort,
-        subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
-        imports: tenantImports ?? options.imports,
-        extraProviders: [
-          ...quotaProviders,
-          ...extraProviders ?? []
-        ],
-        extraExports: [
-          ...quotaProviders,
-          ...extraExports ?? []
-        ]
-      }));
-    }
-    if (subscriptionBundlesConfig) {
-      const config = subscriptionBundlesConfig === true ? {} : subscriptionBundlesConfig;
-      const { controller, imports: bundleImports, extraProviders, ...bundleOptions } = config;
-      imports.push(SubscriptionBundleModule.forRoot({
-        ...bundleOptions,
-        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.catalog?.bundleRepository,
-        controller: controller === false ? void 0 : {
-          ...controller ?? {},
-          authGuards: sharedTenantAuthGuards,
-          subscriptionUsagePort: sharedSubscriptionUsagePort
-        },
-        imports: bundleImports ?? tenantBillingConfig?.imports ?? options.imports,
-        extraProviders
-      }));
-    }
-    if (setupConfig) {
-      const config = setupConfig === true ? {} : setupConfig;
-      imports.push(SetupModule.forRoot({
-        ...config,
-        provisioningPort: config.provisioningPort ?? persistence?.core.superAdminProvisioning,
-        imports: config.imports ?? options.imports
-      }));
-    }
-    if (adminStatsConfig) {
-      imports.push(AdminStatsModule.forRoot({
-        ...adminStatsConfig,
-        guards: adminStatsConfig.guards ?? [
-          ...options.controller.guards,
-          SuperAdminGuard
-        ],
-        auditStatsPort: adminStatsConfig.auditStatsPort ?? persistence?.core.auditStats,
-        imports: adminStatsConfig.imports ?? options.imports
-      }));
-    }
-    if (checkoutOfferConfig) {
-      imports.push(CheckoutOfferModule.forRoot({
-        ...checkoutOfferConfig,
-        bundleRepository: checkoutOfferConfig.bundleRepository ?? persistence?.catalog?.bundleRepository,
-        planRepository: checkoutOfferConfig.planRepository ?? persistence?.catalog?.planRepository,
-        catalogEntryRepository: checkoutOfferConfig.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
-        imports: checkoutOfferConfig.imports ?? options.imports
-      }));
-    }
-    if (subscriptionContractConfig) {
-      const config = subscriptionContractConfig === true ? {} : subscriptionContractConfig;
-      imports.push(SubscriptionContractModule.forRoot({
-        ...config,
-        subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
-        imports: config.imports ?? options.imports
-      }));
-    }
-    const lightweightProviders = [];
-    const lightweightExports = [];
-    if (options.autoManifest !== false) {
-      const contribution = buildStandardManifestContribution(catalogConfig, adminResourcesConfig, promoCodesConfig);
-      lightweightProviders.push({
-        provide: STANDARD_MANIFEST_REGISTRATION_TOKEN,
-        useFactory: /* @__PURE__ */ __name((manifest) => {
-          manifest.register(contribution);
-          return contribution;
-        }, "useFactory"),
-        inject: [
-          AdminManifestService
-        ]
-      });
-    }
-    const hasExplicitResolver = !!adapters.planResolver;
-    const hasSubscriptionResolver = Boolean(tenantBillingConfig && adapters.subscriptionRepository);
-    const hasResolver = hasExplicitResolver || hasSubscriptionResolver;
-    const hasFallback = !!options.defaultPlanId;
-    if (hasResolver || hasFallback) {
-      if (hasSubscriptionResolver && !hasExplicitResolver) {
-        lightweightProviders.push(asProvider(PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN, adapters.subscriptionRepository));
-      }
-      lightweightProviders.push(hasExplicitResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, adapters.planResolver) : hasSubscriptionResolver ? {
-        provide: PLAN_RESOLVER_PORT_TOKEN,
-        useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
-        inject: [
-          PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
-        ]
-      } : {
-        provide: PLAN_RESOLVER_PORT_TOKEN,
-        useValue: new StaticPlanResolver(options.defaultPlanId)
-      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...quotaProvidersHostedByTenantBilling ? [] : options.quotaProviders ?? [], {
-        provide: QUOTA_PROVIDERS_TOKEN,
-        useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
-        inject: options.quotaProviders ?? []
-      }, ...options.globalFeatureGuard === false ? [] : [
-        {
-          provide: APP_GUARD,
-          useExisting: StaticFeatureGuard
-        }
-      ], {
-        provide: APP_INTERCEPTOR,
-        useExisting: EnforceQuotaInterceptor
-      });
-      lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
-      if (options.globalFeatureGuard === false) {
-        lightweightProviders.push(FeatureGuardCoverageCheck);
-        imports.push(NestDiscoveryModule);
-      }
-    } else {
-      PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
-    }
-    const tenantControllers = [];
-    if (options.tenantManifest) {
-      if (!hasResolver && !hasFallback) {
-        throw new Error("SaasPlatformModule.forRoot: tenantManifest requires defaultPlanId, adapters.planResolver or tenantBilling so it can resolve features.");
-      }
-      lightweightProviders.push(TenantManifestService);
-      lightweightExports.push(TenantManifestService);
-      tenantControllers.push(buildTenantManifestController(options.tenantManifest === true ? {
-        guards: Array.isArray(tenantBillingConfig?.authGuards) ? tenantBillingConfig.authGuards : options.controller.guards
-      } : options.tenantManifest));
-    }
-    return {
-      module: _SaasPlatformModule,
-      imports,
-      providers: lightweightProviders,
-      controllers: tenantControllers,
-      exports: [
-        PlanCatalogModule,
-        DiscoveryModule,
-        AdminModule,
-        // ADMIN_MANIFEST_CONFIG travels transitively: re-exporting an
-        // imported module's token directly is an UnknownExportException
-        // at boot — the module export below already carries it.
-        AdminManifestModule,
-        ...requiresFullEntitlement ? [
-          EntitlementModule
-        ] : [],
-        ...catalogConfig ? [
-          CatalogModule
-        ] : [],
-        ...tenantBillingConfig ? [
-          TenantBillingModule
-        ] : [],
-        ...subscriptionBundlesConfig ? [
-          SubscriptionBundleModule
-        ] : [],
-        ...adminResourcesConfig ? [
-          AdminResourcesModule
-        ] : [],
-        ...promoCodesConfig ? [
-          PromoCodesModule
-        ] : [],
-        ...setupConfig ? [
-          SetupModule
-        ] : [],
-        ...adminStatsConfig ? [
-          AdminStatsModule
-        ] : [],
-        ...checkoutOfferConfig ? [
-          CheckoutOfferModule
-        ] : [],
-        ...subscriptionContractConfig ? [
-          SubscriptionContractModule
-        ] : [],
-        ...lightweightExports
-      ],
-      global: true
-    };
-  }
-};
-SaasPlatformModule = _ts_decorate10([
-  Module2({})
-], SaasPlatformModule);
-
-export {
-  SETUP_PROVISIONING_PORT_TOKEN,
-  SETUP_CONFIG_TOKEN,
-  SetupService,
-  SetupController,
-  SetupModule,
-  PLAN_RESOLVER_PORT_TOKEN,
-  StaticPlanResolver,
-  StaticEntitlementService,
-  FeatureGuardCoverageCheck,
-  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
-  StaticFeatureGuard,
-  QUOTA_PROVIDERS_TOKEN,
-  EnforceQuotaInterceptor,
-  QuotaProvidersUsageSnapshot,
-  SubscriptionPlanResolver,
-  TenantManifestService,
-  buildTenantManifestController,
-  SaasPlatformModule
-};