@saasicat/nest 0.26.1 → 1.0.0-rc.0

package/dist/chunk-JCAZT727.js

@@ -0,0 +1,1883 @@
+import {
+  PromoCodesModule
+} from "./chunk-VTMCMVYQ.js";
+import {
+  SubscriptionContractModule
+} from "./chunk-Y43SGD5J.js";
+import {
+  AdminManifestModule,
+  AdminManifestService,
+  AdminModule,
+  AdminResourcesModule,
+  AdminStatsModule,
+  MfaService,
+  SuperAdminGuard
+} from "./chunk-IPOLCDKN.js";
+import {
+  FEATURE_GUARD_MARKER,
+  PublicCatalogModule,
+  REQUIRE_FEATURE_KEY,
+  SubscriptionBundleModule,
+  TenantBillingModule,
+  isPlatformFeatureGuard
+} from "./chunk-WSPHIIGS.js";
+import {
+  CatalogModule
+} from "./chunk-SH7J5IU7.js";
+import {
+  CheckoutOfferModule
+} from "./chunk-AEEK64XD.js";
+import {
+  SaaSiCatPublicRoute
+} from "./chunk-YSC46BGM.js";
+import {
+  DiscoveryModule
+} from "./chunk-XBYAFEOR.js";
+import {
+  EntitlementModule
+} from "./chunk-H3W6QDQH.js";
+import {
+  LimitExceededError
+} from "./chunk-XEW6YXL5.js";
+import {
+  PLAN_CATALOG_TOKEN,
+  PlanCatalogModule
+} from "./chunk-DQKCK7DX.js";
+import {
+  codedError
+} from "./chunk-EBJJNTW6.js";
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  ENFORCE_QUOTA_KEY
+} from "./chunk-QUZU2M33.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/setup/setup.tokens.ts
+var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/SetupProvisioningPort");
+var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/SetupConfig");
+
+// src/setup/setup.service.ts
+import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import { isPlatformUserExistsError, SETUP_ERROR_CODES } from "@saasicat/types";
+import { randomBytes, timingSafeEqual } from "crypto";
+import QRCode from "qrcode";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var GENERATED_PASSWORD_BYTES = 12;
+function timingSafeEqualStr(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+__name(timingSafeEqualStr, "timingSafeEqualStr");
+var SetupService = class {
+  static {
+    __name(this, "SetupService");
+  }
+  users;
+  config;
+  mfa;
+  constructor(users, config, mfa) {
+    this.users = users;
+    this.config = config;
+    this.mfa = mfa;
+  }
+  async status() {
+    return {
+      needsSetup: await this.users.countSuperAdmins() === 0
+    };
+  }
+  async setup(req) {
+    this.assertToken(req.token);
+    await this.assertNoSuperAdmin();
+    const email = req.email.trim().toLowerCase();
+    if (!email.includes("@")) {
+      throw new BadRequestException(codedError(SETUP_ERROR_CODES.INVALID_EMAIL));
+    }
+    const generated = !req.password;
+    const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
+    let user;
+    try {
+      user = await this.users.createSuperAdmin({
+        email,
+        password
+      });
+    } catch (err) {
+      if (isPlatformUserExistsError(err)) {
+        throw new ConflictException({
+          code: SETUP_ERROR_CODES.EMAIL_EXISTS,
+          message: err.message
+        });
+      }
+      throw err;
+    }
+    const totp = await this.mfa.setup(user.id, user.email, this.config.mfaIssuer);
+    const qrDataUrl = await QRCode.toDataURL(totp.otpauthUri, {
+      width: 220,
+      margin: 1
+    });
+    return {
+      userId: user.id,
+      email: user.email,
+      otpauthUri: totp.otpauthUri,
+      qrDataUrl,
+      secret: totp.secret,
+      ...generated ? {
+        generatedPassword: password
+      } : {}
+    };
+  }
+  async confirmMfa(req) {
+    this.assertToken(req.token);
+    const ok = await this.mfa.verify({
+      userId: req.userId,
+      code: req.code
+    });
+    return {
+      ok
+    };
+  }
+  assertToken(token) {
+    const expected = process.env[this.config.setupTokenEnvVar]?.trim();
+    if (!expected) {
+      throw new ForbiddenException({
+        code: SETUP_ERROR_CODES.SETUP_DISABLED,
+        message: `${this.config.setupTokenEnvVar} is not set \u2014 setup is disabled.`,
+        params: {
+          envVar: this.config.setupTokenEnvVar
+        }
+      });
+    }
+    if (!token || !timingSafeEqualStr(token, expected)) {
+      throw new UnauthorizedException(codedError(SETUP_ERROR_CODES.INVALID_SETUP_TOKEN));
+    }
+  }
+  async assertNoSuperAdmin() {
+    if (await this.users.countSuperAdmins() > 0) {
+      throw new ConflictException(codedError(SETUP_ERROR_CODES.SETUP_ALREADY_DONE));
+    }
+  }
+};
+SetupService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(SETUP_PROVISIONING_PORT_TOKEN)),
+  _ts_param(1, Inject(SETUP_CONFIG_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof SuperAdminProvisioningPort === "undefined" ? Object : SuperAdminProvisioningPort,
+    typeof SetupConfig === "undefined" ? Object : SetupConfig,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], SetupService);
+
+// src/setup/setup.controller.ts
+import { Body, Controller, Get, Post } from "@nestjs/common";
+import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from "class-validator";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var SetupDto = class SetupDto2 {
+  static {
+    __name(this, "SetupDto");
+  }
+  token;
+  email;
+  password;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsEmail(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "email", void 0);
+_ts_decorate2([
+  IsOptional(),
+  IsString(),
+  MinLength(8),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "password", void 0);
+var SetupConfirmMfaDto = class SetupConfirmMfaDto2 {
+  static {
+    __name(this, "SetupConfirmMfaDto");
+  }
+  token;
+  userId;
+  code;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "userId", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "code", void 0);
+var SetupController = class {
+  static {
+    __name(this, "SetupController");
+  }
+  setup;
+  constructor(setup) {
+    this.setup = setup;
+  }
+  status() {
+    return this.setup.status();
+  }
+  run(dto) {
+    return this.setup.setup(dto);
+  }
+  confirm(dto) {
+    return this.setup.confirmMfa(dto);
+  }
+};
+_ts_decorate2([
+  Get("status"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "status", null);
+_ts_decorate2([
+  Post(),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupDto === "undefined" ? Object : SetupDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "run", null);
+_ts_decorate2([
+  Post("confirm-mfa"),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupConfirmMfaDto === "undefined" ? Object : SetupConfirmMfaDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "confirm", null);
+SetupController = _ts_decorate2([
+  Controller("admin/setup"),
+  SaaSiCatPublicRoute(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupService === "undefined" ? Object : SetupService
+  ])
+], SetupController);
+
+// src/setup/setup.module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var DEFAULT_SETUP_TOKEN_ENV_VAR = "SETUP_TOKEN";
+var DEFAULT_MFA_ISSUER = "SuperAdmin";
+var SetupModule = class _SetupModule {
+  static {
+    __name(this, "SetupModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _SetupModule,
+      global: options.global ?? false,
+      imports: options.imports ?? [],
+      controllers: [
+        SetupController
+      ],
+      providers: [
+        asProvider(SETUP_PROVISIONING_PORT_TOKEN, options.provisioningPort),
+        {
+          provide: SETUP_CONFIG_TOKEN,
+          useValue: {
+            setupTokenEnvVar: options.setupTokenEnvVar ?? DEFAULT_SETUP_TOKEN_ENV_VAR,
+            mfaIssuer: options.mfaIssuer ?? DEFAULT_MFA_ISSUER
+          }
+        },
+        SetupService,
+        ...options.extraProviders ?? []
+      ],
+      exports: [
+        SetupService
+      ]
+    };
+  }
+};
+SetupModule = _ts_decorate3([
+  Module({})
+], SetupModule);
+
+// src/platform/enforcement-chain.check.ts
+import { Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var GUARDS_METADATA = "__guards__";
+var METHOD_METADATA = "method";
+var ENFORCEMENT_CHAIN_STATE_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/EnforcementChainState");
+var EnforcementChainCheck = class {
+  static {
+    __name(this, "EnforcementChainCheck");
+  }
+  discoveryService;
+  metadataScanner;
+  state;
+  constructor(discoveryService, metadataScanner, state = {
+    featureEnforcementActive: true,
+    quotaEnforcementActive: true,
+    globalGuardBound: true,
+    globalGuardOptedOut: false
+  }) {
+    this.discoveryService = discoveryService;
+    this.metadataScanner = metadataScanner;
+    this.state = state;
+  }
+  onApplicationBootstrap() {
+    const annotated = this.findAnnotatedRoutes();
+    if (!this.state.featureEnforcementActive) {
+      if (annotated.length === 0) return;
+      throw new Error(`${annotated.length} route(s) are annotated for licence enforcement, but nothing can resolve a tenant to a plan, so @RequireFeature and @EnforceQuota do nothing at all: every annotated route serves unlicensed traffic and every quota reads as unlimited.
+${describe(annotated)}
+Set one of: adapters.planResolver, defaultPlanId, or tenantBilling. If this application deliberately publishes a catalogue without enforcing it, remove the annotations \u2014 a decorator that cannot act is not documentation, it is a claim the code does not keep.`);
+    }
+    if (!this.state.quotaEnforcementActive) {
+      const unenforced = annotated.filter((r) => r.quota !== null);
+      if (unenforced.length > 0) {
+        throw new Error(`${unenforced.length} route(s) enforce a quota, but nothing registers EnforceQuotaInterceptor, so every @EnforceQuota reads as unlimited and the limit a customer paid for is not applied:
+${describe(unenforced)}
+The V3 entitlement stack resolves features, not quotas: the interceptor is registered only where a plan can be resolved. Set one of adapters.planResolver, defaultPlanId, or tenantBilling with a subscription repository \u2014 or remove the annotations, because a decorator that cannot act is not documentation.
+If this application enforces these quotas itself, set \`enforcementChainCheck: false\` \u2014 it turns this check off and nothing else.`);
+      }
+    }
+    if (this.state.globalGuardBound) return;
+    const uncovered = annotated.filter((r) => r.features.length > 0 && !r.guarded);
+    if (uncovered.length === 0) return;
+    const why = this.state.globalGuardOptedOut ? "globalFeatureGuard is off" : "the platform binds no global feature guard on this entitlement path";
+    throw new Error(`${why} and ${uncovered.length} annotated route(s) have no feature guard in front of them, so they serve unlicensed traffic:
+${describe(uncovered)}
+Bind one behind your auth guard \u2014 @UseGuards(JwtAuthGuard, StaticFeatureGuard), or FeatureGuard from @saasicat/nest/billing on the V3 entitlement path.
+Two things this cannot see, and the way out of each: a guard of your own that wraps ours (put FEATURE_GUARD_MARKER on the wrapper class \u2014 the symbol StaticFeatureGuard and FeatureGuard both carry), and a feature guard you bind globally as an APP_GUARD rather than per controller. If either is what these routes use, set \`enforcementChainCheck: false\` \u2014 it turns this check off and nothing else.`);
+  }
+  /**
+   * Every route carrying an enforcement annotation, with whether a
+   * recognisable feature guard covers it.
+   *
+   * Deliberately conservative in one direction only: an unrecognised wrapper
+   * is reported (and the message says so) rather than assumed safe, because
+   * the named route is cheap to check. The reverse — staying silent about a
+   * route with no guard at all — is the failure this exists to prevent.
+   */
+  findAnnotatedRoutes() {
+    const annotated = [];
+    for (const wrapper of this.discoveryService.getControllers()) {
+      const instance = wrapper.instance;
+      if (!instance || typeof instance !== "object") continue;
+      const ctor = instance.constructor;
+      if (!ctor) continue;
+      const classGuards = readGuards(ctor);
+      const prototype = Object.getPrototypeOf(instance);
+      for (const method of this.metadataScanner.getAllMethodNames(prototype)) {
+        const handler = instance[method];
+        if (typeof handler !== "function") continue;
+        if (Reflect.getMetadata(METHOD_METADATA, handler) === void 0) continue;
+        const features = readFeatures(handler) ?? readFeatures(ctor) ?? /* none */
+        [];
+        const quota = readQuota(handler) ?? readQuota(ctor);
+        if (features.length === 0 && quota === null) continue;
+        const guards = [
+          ...classGuards,
+          ...readGuards(handler)
+        ];
+        annotated.push({
+          controller: ctor.name,
+          handler: method,
+          features,
+          quota,
+          guarded: guards.some(isPlatformFeatureGuard)
+        });
+      }
+    }
+    return annotated;
+  }
+};
+EnforcementChainCheck = _ts_decorate4([
+  Injectable2(),
+  _ts_param3(0, Inject2(DiscoveryService)),
+  _ts_param3(1, Inject2(MetadataScanner)),
+  _ts_param3(2, Optional()),
+  _ts_param3(2, Inject2(ENFORCEMENT_CHAIN_STATE_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
+    typeof MetadataScanner === "undefined" ? Object : MetadataScanner,
+    typeof EnforcementChainState === "undefined" ? Object : EnforcementChainState
+  ])
+], EnforcementChainCheck);
+function describe(routes) {
+  return routes.map((r) => {
+    const requirement = r.features.length > 0 ? `requires ${r.features.join(" or ")}` : `enforces quota ${r.quota}`;
+    return `  ${r.controller}.${r.handler} \u2014 ${requirement}`;
+  }).join("\n");
+}
+__name(describe, "describe");
+function readFeatures(target) {
+  const value = Reflect.getMetadata(REQUIRE_FEATURE_KEY, target);
+  return Array.isArray(value) ? value : null;
+}
+__name(readFeatures, "readFeatures");
+function readQuota(target) {
+  const value = Reflect.getMetadata(ENFORCE_QUOTA_KEY, target);
+  if (typeof value !== "object" || value === null) return null;
+  const quotaKey = value.quotaKey;
+  return typeof quotaKey === "string" ? quotaKey : null;
+}
+__name(readQuota, "readQuota");
+function readGuards(target) {
+  const value = Reflect.getMetadata(GUARDS_METADATA, target);
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((guard) => typeof guard === "function" ? [
+    guard
+  ] : [
+    guard,
+    guard?.constructor
+  ]);
+}
+__name(readGuards, "readGuards");
+
+// src/platform/validation/rules.ts
+import { assertPersistenceCapabilities } from "@saasicat/types";
+var DOCS_BASE = "https://github.com/uelker70/saasicat/blob/main/docs/reference/options.md";
+var headingSlug = /* @__PURE__ */ __name((text) => text.trim().toLowerCase().replace(/[^a-z0-9 -]/g, "").replace(/ /g, "-"), "headingSlug");
+var docsUrlFor = /* @__PURE__ */ __name((id) => `${DOCS_BASE}#${headingSlug(id)}`, "docsUrlFor");
+function optionsOf(slot) {
+  return typeof slot === "object" ? slot : void 0;
+}
+__name(optionsOf, "optionsOf");
+var bundle = /* @__PURE__ */ __name((c) => c.options.persistence, "bundle");
+var requiresFullEntitlement = /* @__PURE__ */ __name((c) => Boolean(c.options.entitlement || c.options.tenantBilling || c.options.subscriptionBundles), "requiresFullEntitlement");
+var resolvesPlans = /* @__PURE__ */ __name((c) => Boolean(c.adapters.planResolver || c.options.defaultPlanId || c.options.tenantBilling && c.adapters.subscriptionRepository), "resolvesPlans");
+function absent(required) {
+  return Object.keys(required).filter((key) => !required[key]);
+}
+__name(absent, "absent");
+var list = /* @__PURE__ */ __name((names) => names.join(", "), "list");
+var RULE_SPECS = [
+  {
+    id: "core.adapters-bound",
+    when: /* @__PURE__ */ __name(() => true, "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(coreAdapters(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `the core adapters are missing: ${list(absent(coreAdapters(c)))}. Bind them through \`persistence: prismaPersistence({ client })\` or one by one through \`adapters\`.`, "message")
+  },
+  {
+    id: "catalog.identity-or-sink",
+    when: /* @__PURE__ */ __name((c) => !c.options.planCatalog, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(c.adapters.planCatalogReadSink && c.options.dbCatalog), "assert"),
+    message: "no plan catalogue is reachable. Either set `planCatalog` (the quickstart YAML path) or, for DB hydration, BOTH a `planCatalogReadSink` (via `adapters` or `persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }). Without the identity the sink loads with projectKey '' and the app boots with a silently empty catalogue."
+  },
+  {
+    id: "catalog.requires-persistence",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.catalog), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.catalog), "assert"),
+    message: "catalog is enabled, but `persistence.catalog` is missing. Use a complete persistence bundle, or wire `CatalogModule` directly."
+  },
+  {
+    id: "admin-resources.requires-persistence",
+    when: /* @__PURE__ */ __name((c) => {
+      if (!c.options.adminResources) return false;
+      return !optionsOf(c.options.adminResources)?.resources;
+    }, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.adminResources), "assert"),
+    message: "adminResources is enabled, but `persistence.adminResources` is missing. Use a complete persistence bundle, or pass your own `adminResources.resources`."
+  },
+  {
+    id: "promo-codes.requires-persistence-and-transactions",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.promoCodes), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(bundle(c)?.promo && c.adapters.transactionRunner), "assert"),
+    message: /* @__PURE__ */ __name((c) => `promoCodes requires \`persistence.promo\` and a transactionRunner; missing: ${list(absent({
+      "persistence.promo": bundle(c)?.promo,
+      transactionRunner: c.adapters.transactionRunner
+    }))}. Redeeming a code writes two rows and must not half-apply.`, "message")
+  },
+  {
+    id: "setup.requires-provisioning-port",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.setup), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.setup)?.provisioningPort ?? bundle(c)?.core.superAdminProvisioning), "assert"),
+    message: "setup is enabled, but no provisioningPort is available. Set `setup.provisioningPort` or use a bundle providing `persistence.core.superAdminProvisioning`."
+  },
+  {
+    id: "admin-stats.requires-audit-stats-port",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.adminStats), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.adminStats)?.auditStatsPort ?? bundle(c)?.core.auditStats), "assert"),
+    message: "adminStats is enabled, but no auditStatsPort is available. Set `adminStats.auditStatsPort` or use a bundle providing `persistence.core.auditStats`."
+  },
+  {
+    id: "subscription-contract.requires-repository",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionContract), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.subscriptionContract)?.subscriptionContractRepository ?? bundle(c)?.entitlement?.subscriptionContractRepository), "assert"),
+    message: "subscriptionContract is enabled, but no repository is available. Set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle."
+  },
+  {
+    id: "promo-codes.public-preview-requires-first-time-check",
+    when: /* @__PURE__ */ __name((c) => {
+      const config = optionsOf(c.options.promoCodes);
+      return config !== void 0 && config.includePublicController !== false;
+    }, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.promoCodes)?.firstTimeCustomerCheck), "assert"),
+    message: "the public promo preview is mounted but has no `firstTimeCustomerCheck`, so every first-time-only code would preview as unavailable. Pass one, or set `promoCodes.includePublicController: false`."
+  },
+  {
+    id: "tenant-billing.requires-ports",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantBilling) && !bundle(c)?.tenantBilling, "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(tenantBillingPorts(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `tenantBilling is enabled without a \`persistence.tenantBilling\` slice, and these adapters are missing: ${list(absent(tenantBillingPorts(c)))}.`, "message")
+  },
+  {
+    id: "subscription-bundles.requires-tenant-billing",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionBundles), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantBilling), "assert"),
+    message: "subscriptionBundles requires tenantBilling, so the two share authentication and subscription usage rather than resolving them twice."
+  },
+  {
+    id: "subscription-bundles.requires-repositories",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionBundles), "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(bundleRepositories(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `subscriptionBundles is enabled, but these persistence adapters are missing: ${list(absent(bundleRepositories(c)))}.`, "message")
+  },
+  {
+    id: "entitlement.requires-adapters",
+    when: requiresFullEntitlement,
+    assert: /* @__PURE__ */ __name((c) => absent(entitlementAdapters(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `entitlement active or required by the standard stack, but adapters are missing: ${list(absent(entitlementAdapters(c)))}.`, "message")
+  },
+  {
+    id: "entitlement.requires-transactional-persistence",
+    when: /* @__PURE__ */ __name((c) => requiresFullEntitlement(c) && Boolean(bundle(c)), "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(entitlementCapabilities(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `the entitlement stack needs a store that can do ${list(absent(entitlementCapabilities(c)))}, and the persistence bundle declares it cannot. \`enforceLimit()\` reads a counter and writes it back; without a transaction and a row lock two concurrent requests both pass the limit.`, "message"),
+    // `PersistenceCapabilityError` carries `code:
+    // 'PERSISTENCE_CAPABILITY_MISSING'`, which is a machine-readable part
+    // of the published contract rather than prose. Raising it through the
+    // shared helper keeps the class, the code and the wording identical to
+    // what a consumer catches today.
+    error: /* @__PURE__ */ __name((c) => {
+      assertPersistenceCapabilities(bundle(c).capabilities, {
+        transactions: true,
+        pessimisticLocking: true
+      }, "SaaSiCatModule entitlement (transactional enforceLimit)");
+      throw new Error("persistence capabilities check did not fail as expected");
+    }, "error")
+  },
+  {
+    id: "tenant-manifest.requires-plan-resolution",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.tenantManifest), "when"),
+    assert: resolvesPlans,
+    message: "tenantManifest is enabled but nothing can resolve a tenant to a plan, so it could not filter features. Set `defaultPlanId`, `adapters.planResolver`, or enable `tenantBilling`."
+  }
+];
+var PLATFORM_RULES = RULE_SPECS.map((spec) => ({
+  ...spec,
+  docs: docsUrlFor(spec.id)
+}));
+var coreAdapters = /* @__PURE__ */ __name((c) => ({
+  mfa: c.adapters.mfa,
+  audit: c.adapters.audit,
+  rlsBypass: c.adapters.rlsBypass
+}), "coreAdapters");
+var tenantBillingPorts = /* @__PURE__ */ __name((c) => {
+  const config = optionsOf(c.options.tenantBilling);
+  return {
+    subscriptionUsagePort: config?.subscriptionUsagePort,
+    subscriptionWritePort: config?.subscriptionWritePort
+  };
+}, "tenantBillingPorts");
+var bundleRepositories = /* @__PURE__ */ __name((c) => ({
+  subscriptionBundleRepository: bundle(c)?.entitlement?.subscriptionBundleRepository,
+  bundleRepository: bundle(c)?.catalog?.bundleRepository
+}), "bundleRepositories");
+var entitlementAdapters = /* @__PURE__ */ __name((c) => ({
+  subscriptionRepository: c.adapters.subscriptionRepository,
+  planVersionRepository: c.adapters.planVersionRepository,
+  transactionRunner: c.adapters.transactionRunner
+}), "entitlementAdapters");
+var entitlementCapabilities = /* @__PURE__ */ __name((c) => ({
+  transactions: bundle(c)?.capabilities.transactions,
+  "pessimistic locking": bundle(c)?.capabilities.pessimisticLocking
+}), "entitlementCapabilities");
+
+// src/platform/validation/validate.ts
+function findViolations(configuration, rules = PLATFORM_RULES) {
+  const violations = [];
+  for (const rule of rules) {
+    if (!rule.when(configuration)) continue;
+    if (rule.assert(configuration)) continue;
+    violations.push({
+      id: rule.id,
+      message: typeof rule.message === "string" ? rule.message : rule.message(configuration),
+      docs: rule.docs
+    });
+  }
+  return violations;
+}
+__name(findViolations, "findViolations");
+var SaaSiCatConfigurationError = class extends Error {
+  static {
+    __name(this, "SaaSiCatConfigurationError");
+  }
+  violations;
+  constructor(violations) {
+    super(formatViolations(violations)), this.violations = violations;
+    this.name = "SaaSiCatConfigurationError";
+  }
+};
+function formatViolations(violations) {
+  const heading = violations.length === 1 ? "SaaSiCatModule.forRoot: 1 configuration problem:" : `SaaSiCatModule.forRoot: ${violations.length} configuration problems:`;
+  const body = violations.map((v, index) => `  ${index + 1}. [${v.id}] ${v.message}
+     \u2192 ${v.docs}`).join("\n");
+  return `${heading}
+${body}`;
+}
+__name(formatViolations, "formatViolations");
+function assertConfiguration(configuration, rules = PLATFORM_RULES) {
+  const violations = findViolations(configuration, rules);
+  if (violations.length === 0) return;
+  if (violations.length === 1) {
+    const rule = rules.find((r) => r.id === violations[0].id);
+    if (rule?.error) throw rule.error(configuration);
+  }
+  throw new SaaSiCatConfigurationError(violations);
+}
+__name(assertConfiguration, "assertConfiguration");
+
+// src/platform/quota-providers-usage-snapshot.ts
+var QuotaProvidersUsageSnapshot = class {
+  static {
+    __name(this, "QuotaProvidersUsageSnapshot");
+  }
+  providers;
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async snapshot(tenantId) {
+    const entries = await Promise.all(this.providers.map(async (provider) => [
+      provider.key,
+      await provider.count(tenantId)
+    ]));
+    return Object.fromEntries(entries);
+  }
+};
+
+// src/platform/compose/context.ts
+function optionsOf2(slot) {
+  return typeof slot === "object" ? slot : {};
+}
+__name(optionsOf2, "optionsOf");
+
+// src/platform/compose/admin-resources.ts
+function composeAdminResources({ options, persistence }) {
+  if (!options.adminResources) return [];
+  const config = optionsOf2(options.adminResources);
+  return [
+    AdminResourcesModule.forRoot({
+      resources: config.resources ?? persistence?.adminResources?.resources,
+      guards: config.guards ?? [
+        ...options.controller.guards,
+        SuperAdminGuard
+      ],
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeAdminResources, "composeAdminResources");
+
+// src/platform/compose/catalog.ts
+function composeCatalog({ options, persistence, appInfo }) {
+  const config = options.catalog;
+  if (!config) return [];
+  const catalog = persistence?.catalog;
+  const modules = [
+    CatalogModule.forRoot({
+      planRepository: catalog.planRepository,
+      bundleRepository: catalog.bundleRepository,
+      catalogEntryRepository: catalog.catalogEntryRepository,
+      marketingProjectionRepository: catalog.marketingProjectionRepository,
+      promotionRepository: catalog.promotionRepository,
+      marketingSettingsRepository: catalog.marketingSettingsRepository,
+      controller: config.adminControllers === false ? void 0 : {
+        guards: options.controller.guards
+      },
+      imports: config.imports ?? options.imports,
+      extraProviders: config.extraProviders,
+      strictModeCheckMode: config.strictModeCheckMode,
+      autoSyncDiscoveryAtBoot: config.autoSyncDiscoveryAtBoot,
+      marketedOnlyFeatures: config.marketedOnlyFeatures,
+      featureUiRegistry: config.featureUiRegistry,
+      publicMarketingCatalog: config.publicMarketingCatalog
+    })
+  ];
+  if (config.publicCatalog !== false) {
+    modules.push(PublicCatalogModule.forRoot({
+      featureUiRegistry: config.featureUiRegistry,
+      projectKey: appInfo.key,
+      bundleRepository: catalog.bundleRepository,
+      marketingRepository: catalog.marketingProjectionRepository,
+      catalogEntryRepository: catalog.catalogEntryRepository,
+      imports: config.imports ?? options.imports
+    }));
+  }
+  return modules;
+}
+__name(composeCatalog, "composeCatalog");
+
+// src/platform/compose/entitlement.ts
+function composeEntitlement({ options, adapters, persistence, requiresFullEntitlement: requiresFullEntitlement2 }) {
+  if (!requiresFullEntitlement2) return [];
+  return [
+    EntitlementModule.forRoot({
+      subscriptionRepository: adapters.subscriptionRepository,
+      planVersionRepository: adapters.planVersionRepository,
+      transactionRunner: adapters.transactionRunner,
+      resolutionConfig: options.entitlement ? options.entitlement.resolutionConfig : void 0,
+      subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
+      subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
+      bundleRepository: persistence?.entitlement?.bundleRepository,
+      imports: options.imports,
+      global: Boolean(options.tenantBilling || options.subscriptionBundles)
+    })
+  ];
+}
+__name(composeEntitlement, "composeEntitlement");
+
+// src/platform/compose/optional-modules.ts
+function composeSetup({ options, persistence }) {
+  if (!options.setup) return [];
+  const config = optionsOf2(options.setup);
+  return [
+    SetupModule.forRoot({
+      ...config,
+      provisioningPort: config.provisioningPort ?? persistence?.core.superAdminProvisioning,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeSetup, "composeSetup");
+function composeAdminStats({ options, persistence }) {
+  const config = options.adminStats;
+  if (!config) return [];
+  return [
+    AdminStatsModule.forRoot({
+      ...config,
+      guards: config.guards ?? [
+        ...options.controller.guards,
+        SuperAdminGuard
+      ],
+      auditStatsPort: config.auditStatsPort ?? persistence?.core.auditStats,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeAdminStats, "composeAdminStats");
+function composeCheckoutOffer({ options, persistence }) {
+  const config = options.checkoutOffer;
+  if (!config) return [];
+  return [
+    CheckoutOfferModule.forRoot({
+      ...config,
+      bundleRepository: config.bundleRepository ?? persistence?.catalog?.bundleRepository,
+      planRepository: config.planRepository ?? persistence?.catalog?.planRepository,
+      catalogEntryRepository: config.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeCheckoutOffer, "composeCheckoutOffer");
+function composeSubscriptionContract({ options, persistence }) {
+  if (!options.subscriptionContract) return [];
+  const config = optionsOf2(options.subscriptionContract);
+  return [
+    SubscriptionContractModule.forRoot({
+      ...config,
+      subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
+      imports: config.imports ?? options.imports
+    })
+  ];
+}
+__name(composeSubscriptionContract, "composeSubscriptionContract");
+
+// src/platform/compose/promo-codes.ts
+function composePromoCodes({ options, adapters, persistence }) {
+  if (!options.promoCodes) return [];
+  const config = optionsOf2(options.promoCodes);
+  const promo = persistence?.promo;
+  const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, adminController, ...promoOptions } = config;
+  return [
+    PromoCodesModule.forRoot({
+      ...promoOptions,
+      promoCodeRepository: promo.promoCodeRepository,
+      redemptionRepository: promo.redemptionRepository,
+      validationLogRepository: promo.validationLogRepository,
+      subscriptionLookup: promo.subscriptionLookup,
+      revenueAggregator: promo.revenueAggregator,
+      transactionRunner: adapters.transactionRunner,
+      firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
+        hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
+      },
+      includePublicController: includePublicController ?? false,
+      adminController: adminController === false ? false : {
+        guards: adminGuards ?? [
+          ...options.controller.guards,
+          SuperAdminGuard
+        ]
+      },
+      imports: promoImports ?? options.imports
+    })
+  ];
+}
+__name(composePromoCodes, "composePromoCodes");
+
+// src/platform/compose/tenant-bindings.ts
+function normalizeTenantAuthGuards(guards) {
+  if (!Array.isArray(guards)) return guards;
+  return {
+    useFactory: /* @__PURE__ */ __name((...instances) => instances, "useFactory"),
+    inject: guards
+  };
+}
+__name(normalizeTenantAuthGuards, "normalizeTenantAuthGuards");
+function quotaUsageSnapshotProvider(quotaProviders) {
+  return {
+    useFactory: /* @__PURE__ */ __name((...providers) => new QuotaProvidersUsageSnapshot(providers), "useFactory"),
+    inject: [
+      ...quotaProviders
+    ]
+  };
+}
+__name(quotaUsageSnapshotProvider, "quotaUsageSnapshotProvider");
+
+// src/platform/compose/tenant-billing.ts
+function composeTenantBilling(ctx) {
+  const config = ctx.options.tenantBilling;
+  if (!config) return [];
+  const tenantSlice = ctx.persistence?.tenantBilling;
+  const { authGuards, subscriptionUsagePort, usageSnapshotPort, subscriptionWritePort, imports: tenantImports, extraProviders, extraExports, ...tenantOptions } = config;
+  const quotaProviders = ctx.options.quotaProviders ?? [];
+  ctx.shared.quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
+  ctx.shared.authGuards = normalizeTenantAuthGuards(authGuards);
+  ctx.shared.subscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
+  return [
+    TenantBillingModule.forRoot({
+      ...tenantOptions,
+      authGuards: ctx.shared.authGuards,
+      subscriptionUsagePort: ctx.shared.subscriptionUsagePort,
+      usageSnapshotPort: usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(quotaProviders),
+      subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
+      imports: tenantImports ?? ctx.options.imports,
+      extraProviders: [
+        ...quotaProviders,
+        ...extraProviders ?? []
+      ],
+      extraExports: [
+        ...quotaProviders,
+        ...extraExports ?? []
+      ]
+    })
+  ];
+}
+__name(composeTenantBilling, "composeTenantBilling");
+function composeSubscriptionBundles(ctx) {
+  if (!ctx.options.subscriptionBundles) return [];
+  const config = optionsOf2(ctx.options.subscriptionBundles);
+  const { controller, imports: bundleImports, extraProviders, ...bundleOptions } = config;
+  return [
+    SubscriptionBundleModule.forRoot({
+      ...bundleOptions,
+      subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
+      bundleRepository: ctx.persistence?.catalog?.bundleRepository,
+      controller: controller === false ? void 0 : {
+        ...controller ?? {},
+        authGuards: ctx.shared.authGuards,
+        subscriptionUsagePort: ctx.shared.subscriptionUsagePort
+      },
+      // Falls back to the tenant-billing imports before the shared ones,
+      // because the two controllers usually resolve the same app
+      // providers and an app that scoped them for one meant both.
+      imports: bundleImports ?? optionsOf2(ctx.options.tenantBilling).imports ?? ctx.options.imports,
+      extraProviders
+    })
+  ];
+}
+__name(composeSubscriptionBundles, "composeSubscriptionBundles");
+
+// src/platform/compose/index.ts
+var FEATURE_COMPOSERS = [
+  composeEntitlement,
+  composeCatalog,
+  composeAdminResources,
+  composePromoCodes,
+  // Before the bundles — see the note above.
+  composeTenantBilling,
+  composeSubscriptionBundles,
+  composeSetup,
+  composeAdminStats,
+  composeCheckoutOffer,
+  composeSubscriptionContract
+];
+function composeFeatures(ctx) {
+  return FEATURE_COMPOSERS.flatMap((compose) => compose(ctx));
+}
+__name(composeFeatures, "composeFeatures");
+
+// src/platform/compose/module-exports.ts
+var ALWAYS = [
+  PlanCatalogModule,
+  DiscoveryModule,
+  AdminModule,
+  // ADMIN_MANIFEST_CONFIG travels transitively: re-exporting an imported
+  // module's token directly is an UnknownExportException at boot — the module
+  // export here already carries it.
+  AdminManifestModule
+];
+function optionalExports({ options, requiresFullEntitlement: requiresFullEntitlement2 }) {
+  return [
+    [
+      requiresFullEntitlement2,
+      EntitlementModule
+    ],
+    [
+      options.catalog,
+      CatalogModule
+    ],
+    [
+      options.tenantBilling,
+      TenantBillingModule
+    ],
+    [
+      options.subscriptionBundles,
+      SubscriptionBundleModule
+    ],
+    [
+      options.adminResources,
+      AdminResourcesModule
+    ],
+    [
+      options.promoCodes,
+      PromoCodesModule
+    ],
+    [
+      options.setup,
+      SetupModule
+    ],
+    [
+      options.adminStats,
+      AdminStatsModule
+    ],
+    [
+      options.checkoutOffer,
+      CheckoutOfferModule
+    ],
+    [
+      options.subscriptionContract,
+      SubscriptionContractModule
+    ]
+  ];
+}
+__name(optionalExports, "optionalExports");
+var MOUNTED_BUT_NOT_EXPORTED = [
+  "PublicCatalogModule"
+];
+function composeModuleExports(ctx, ownExports) {
+  return [
+    ...ALWAYS,
+    ...optionalExports(ctx).filter(([enabled]) => Boolean(enabled)).map(([, module]) => module),
+    ...ownExports
+  ];
+}
+__name(composeModuleExports, "composeModuleExports");
+
+// src/platform/plan-resolver.port.ts
+var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PlanResolverPort");
+var StaticPlanResolver = class {
+  static {
+    __name(this, "StaticPlanResolver");
+  }
+  planId;
+  constructor(planId) {
+    this.planId = planId;
+  }
+  async getPlanIdForTenant() {
+    return this.planId;
+  }
+};
+
+// src/platform/static-entitlement.service.ts
+import { Inject as Inject3, Injectable as Injectable3 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var StaticEntitlementService = class {
+  static {
+    __name(this, "StaticEntitlementService");
+  }
+  catalog;
+  resolver;
+  constructor(catalog, resolver) {
+    this.catalog = catalog;
+    this.resolver = resolver;
+  }
+  /**
+   * Returns the effective features + quotas of a tenant from the
+   * plan catalog. When the plan is missing: an empty snapshot (no feature,
+   * all quotas at 0).
+   */
+  async snapshot(tenantId) {
+    const planId = await this.resolver.getPlanIdForTenant(tenantId);
+    if (!planId) {
+      return {
+        planId: null,
+        features: [],
+        quotas: {}
+      };
+    }
+    const plan = this.findPlan(planId);
+    if (!plan) {
+      return {
+        planId,
+        features: [],
+        quotas: {}
+      };
+    }
+    return {
+      planId,
+      features: plan.features ?? [],
+      quotas: plan.quotas ?? {}
+    };
+  }
+  /** Convenience helper for tests / synchronous checks in the UI manifest. */
+  async hasFeature(tenantId, featureKey) {
+    const snap = await this.snapshot(tenantId);
+    return snap.features.includes(featureKey);
+  }
+  async quotaLimit(tenantId, quotaKey) {
+    const snap = await this.snapshot(tenantId);
+    const value = snap.quotas[quotaKey];
+    return value === void 0 ? null : value;
+  }
+  findPlan(planId) {
+    return (this.catalog.plans ?? []).find((p) => p.id === planId);
+  }
+};
+StaticEntitlementService = _ts_decorate5([
+  Injectable3(),
+  _ts_param4(0, Inject3(PLAN_CATALOG_TOKEN)),
+  _ts_param4(1, Inject3(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
+    typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
+  ])
+], StaticEntitlementService);
+
+// src/platform/tenant-manifest.service.ts
+import { Injectable as Injectable4 } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var TenantManifestService = class {
+  static {
+    __name(this, "TenantManifestService");
+  }
+  entitlements;
+  navItems = [];
+  constructor(entitlements) {
+    this.entitlements = entitlements;
+  }
+  /**
+   * Call in the app's `OnModuleInit`: registers app navigation for the
+   * Tenant UI. Idempotent: the same `id` overwrites.
+   */
+  registerNavItem(item) {
+    const existing = this.navItems.findIndex((i) => i.id === item.id);
+    if (existing >= 0) this.navItems[existing] = item;
+    else this.navItems.push(item);
+  }
+  /** Bulk variant. */
+  registerNavItems(items) {
+    for (const item of items) this.registerNavItem(item);
+  }
+  /**
+   * Returns the filtered manifest for a Tenant. NavItems with
+   * `requiresFeature` are filtered out server-side as soon as none of the
+   * required features are present in the entitlement snapshot.
+   */
+  async getManifest(tenantId) {
+    const snap = await this.entitlements.snapshot(tenantId);
+    const featureSet = new Set(snap.features);
+    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
+      ...item
+    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+    return {
+      schemaVersion: 1,
+      tenant: {
+        id: tenantId
+      },
+      planId: snap.planId,
+      features: snap.features,
+      quotas: snap.quotas,
+      navigation: visible
+    };
+  }
+};
+TenantManifestService = _ts_decorate6([
+  Injectable4(),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
+  ])
+], TenantManifestService);
+function isVisible(item, features) {
+  if (!item.requiresFeature) return true;
+  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
+    item.requiresFeature
+  ];
+  return required.some((f) => features.has(f));
+}
+__name(isVisible, "isVisible");
+
+// src/platform/tenant-manifest.controller.ts
+import { Controller as Controller2, Get as Get2, Inject as Inject4, Req, UseGuards } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+function buildTenantManifestController(options) {
+  const path = options.path ?? "tenant/manifest";
+  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
+    static {
+      __name(this, "GeneratedTenantManifestController");
+    }
+    svc;
+    constructor(svc) {
+      this.svc = svc;
+    }
+    async get(req) {
+      const tenantId = req.user?.tenantId ?? req.tenantId;
+      if (!tenantId) {
+        throw new Error("No tenant on the request \u2014 TenantManifest requires user.tenantId.");
+      }
+      return this.svc.getManifest(tenantId);
+    }
+  };
+  _ts_decorate7([
+    Get2(),
+    _ts_param5(0, Req()),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
+    ]),
+    _ts_metadata6("design:returntype", Promise)
+  ], GeneratedTenantManifestController.prototype, "get", null);
+  GeneratedTenantManifestController = _ts_decorate7([
+    Controller2(path),
+    UseGuards(...options.guards),
+    _ts_param5(0, Inject4(TenantManifestService)),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
+      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
+    ])
+  ], GeneratedTenantManifestController);
+  return GeneratedTenantManifestController;
+}
+__name(buildTenantManifestController, "buildTenantManifestController");
+
+// src/platform/enforce-quota.interceptor.ts
+import { Inject as Inject5, Injectable as Injectable5, Optional as Optional2 } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { from } from "rxjs";
+import { switchMap } from "rxjs/operators";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
+var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/QuotaProviders");
+var EnforceQuotaInterceptor = class {
+  static {
+    __name(this, "EnforceQuotaInterceptor");
+  }
+  reflector;
+  entitlements;
+  providers;
+  constructor(reflector, entitlements, providers = null) {
+    this.reflector = reflector;
+    this.entitlements = entitlements;
+    this.providers = providers;
+  }
+  intercept(context, next) {
+    const meta = this.reflector.getAllAndOverride(ENFORCE_QUOTA_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!meta?.quotaKey) return next.handle();
+    return from(this.check(context, meta)).pipe(switchMap(() => next.handle()));
+  }
+  async check(context, meta) {
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) return;
+    const role = user.role ?? user.platformRole;
+    if (role === "SUPER_ADMIN") return;
+    const tenantId = request.tenantId ?? user.tenantId;
+    if (!tenantId) return;
+    const provider = (this.providers ?? []).find((p) => p.key === meta.quotaKey);
+    if (!provider) {
+      return;
+    }
+    const limit = await this.entitlements.quotaLimit(tenantId, meta.quotaKey);
+    if (limit === null || limit === -1) return;
+    const current = await provider.count(tenantId);
+    const delta = meta.incrementBy ?? 1;
+    if (current + delta > limit) {
+      throw new LimitExceededError(meta.quotaKey, limit, current);
+    }
+  }
+};
+EnforceQuotaInterceptor = _ts_decorate8([
+  Injectable5(),
+  _ts_param6(0, Inject5(Reflector)),
+  _ts_param6(1, Inject5(StaticEntitlementService)),
+  _ts_param6(2, Optional2()),
+  _ts_param6(2, Inject5(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
+    Object
+  ])
+], EnforceQuotaInterceptor);
+
+// src/platform/static-feature.guard.ts
+import { ForbiddenException as ForbiddenException2, Inject as Inject6, Injectable as Injectable6, Optional as Optional3 } from "@nestjs/common";
+import { Reflector as Reflector2 } from "@nestjs/core";
+import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/types";
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StaticFeatureGuardConfig");
+var StaticFeatureGuard = class {
+  static {
+    __name(this, "StaticFeatureGuard");
+  }
+  reflector;
+  entitlements;
+  config;
+  /** Lets `EnforcementChainCheck` recognise this guard across CJS entries. */
+  static [FEATURE_GUARD_MARKER] = true;
+  constructor(reflector, entitlements, config = null) {
+    this.reflector = reflector;
+    this.entitlements = entitlements;
+    this.config = config;
+  }
+  async canActivate(context) {
+    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (!required || required.length === 0) return true;
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user) {
+      throw new ForbiddenException2({
+        code: AUTH_ERROR_CODES.NOT_AUTHENTICATED,
+        message: "Not authenticated"
+      });
+    }
+    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
+    if (role === "SUPER_ADMIN") return true;
+    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
+    if (!tenantId) {
+      throw new ForbiddenException2({
+        code: AUTH_ERROR_CODES.NO_TENANT_ASSIGNED,
+        message: "No tenant assigned"
+      });
+    }
+    const snap = await this.entitlements.snapshot(tenantId);
+    const allowed = required.some((f) => snap.features.includes(f));
+    if (!allowed) {
+      const body = {
+        code: FEATURE_NOT_LICENSED,
+        featureKey: required[0],
+        featureKeys: required,
+        offers: [],
+        message: `Feature ${required.join(" / ")} is not included in the current plan.`
+      };
+      throw new ForbiddenException2(body);
+    }
+    return true;
+  }
+};
+StaticFeatureGuard = _ts_decorate9([
+  Injectable6(),
+  _ts_param7(0, Inject6(Reflector2)),
+  _ts_param7(1, Inject6(StaticEntitlementService)),
+  _ts_param7(2, Optional3()),
+  _ts_param7(2, Inject6(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof Reflector2 === "undefined" ? Object : Reflector2,
+    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
+    Object
+  ])
+], StaticFeatureGuard);
+
+// src/platform/subscription-plan-resolver.ts
+var DEFAULT_ACTIVE_STATUSES = /* @__PURE__ */ new Set([
+  "ACTIVE",
+  "TRIAL"
+]);
+var SubscriptionPlanResolver = class {
+  static {
+    __name(this, "SubscriptionPlanResolver");
+  }
+  subscriptions;
+  activeStatuses;
+  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
+    this.subscriptions = subscriptions;
+    this.activeStatuses = activeStatuses;
+  }
+  async getPlanIdForTenant(tenantId) {
+    const subscription = await this.subscriptions.findByTenantId(tenantId);
+    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
+    return subscription.plan;
+  }
+};
+
+// src/platform/saasicat.module.ts
+import { Logger, Module as Module2 } from "@nestjs/common";
+import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
+
+// src/platform/compose/manifest.ts
+var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PlatformSubscriptionRepository");
+var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StandardManifestRegistration");
+function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
+  const capabilities = {
+    "discovery.read": true
+  };
+  if (catalog && catalog.adminControllers !== false) {
+    Object.assign(capabilities, {
+      "plans.read": true,
+      "plans.publish": true,
+      "bundles.read": true,
+      "bundles.write": true,
+      "bundles.publish": true,
+      "marketingProjections.read": true,
+      "marketingProjections.write": true
+    });
+  }
+  const navigation = {};
+  if (adminResources) {
+    Object.assign(capabilities, {
+      "tenants.read": true,
+      "tenants.suspend": true,
+      "tenants.reactivate": true,
+      "users.read": true,
+      "audit.read": true,
+      "subscriptions.read": true
+    });
+    navigation.standardPages = {
+      subscriptions: {
+        enabled: true,
+        requiredCapability: "subscriptions.read"
+      }
+    };
+  }
+  if (promoCodes) {
+    Object.assign(capabilities, {
+      "promoCodes.read": true,
+      "promoCodes.write": true,
+      "promoCodes.delete": true
+    });
+    navigation.standardPages = {
+      ...navigation.standardPages ?? {},
+      promoCodes: {
+        enabled: true,
+        requiredCapability: "promoCodes.read"
+      }
+    };
+  }
+  return {
+    capabilities,
+    navigation: navigation.standardPages ? navigation : void 0
+  };
+}
+__name(buildStandardManifestContribution, "buildStandardManifestContribution");
+function buildMinimalManifestConfig() {
+  return {
+    useFactory: /* @__PURE__ */ __name((catalog) => ({
+      project: {
+        key: catalog.projectKey,
+        displayName: catalog.app?.name ?? catalog.projectKey,
+        label: catalog.app?.label,
+        icon: catalog.app?.icon,
+        logoUrl: catalog.app?.logoUrl,
+        environment: process.env.NODE_ENV === "production" ? "production" : "development",
+        availableLocales: catalog.marketing?.availableLocales,
+        defaultLocale: catalog.marketing?.availableLocales?.[0]
+      },
+      build: {
+        platformPackageVersion: "0.0.0",
+        appVersion: "0.0.0"
+      },
+      planCatalogSnapshot: {
+        source: "saasicat-module",
+        hash: "sha256-quickstart",
+        currency: catalog.currency,
+        vatRate: catalog.vatRate,
+        plans: catalog.plans ?? [],
+        features: catalog.features ?? []
+      }
+    }), "useFactory"),
+    inject: [
+      PLAN_CATALOG_TOKEN
+    ]
+  };
+}
+__name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
+
+// src/platform/compose/base.ts
+var DEFAULT_SNAPSHOT_PATH = "var/discovery-snapshot.json";
+function resolveAppInfo(options) {
+  return options.app ?? {
+    key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
+    version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
+  };
+}
+__name(resolveAppInfo, "resolveAppInfo");
+function composePlanCatalog(options, sink) {
+  if (options.planCatalog) {
+    return PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
+      global: true
+    });
+  }
+  const dbCatalog = options.dbCatalog;
+  return PlanCatalogModule.forRoot({
+    projectKey: dbCatalog.projectKey,
+    app: dbCatalog.app,
+    currency: dbCatalog.currency,
+    vatRate: dbCatalog.vatRate,
+    marketing: dbCatalog.marketing,
+    sink,
+    imports: options.imports
+  });
+}
+__name(composePlanCatalog, "composePlanCatalog");
+function composeBaseModules(options, appInfo, ports) {
+  return [
+    DiscoveryModule.forRoot({
+      app: appInfo,
+      controller: {
+        guards: options.controller.guards
+      },
+      imports: options.imports,
+      snapshotPath: options.discoverySnapshotPath === void 0 ? DEFAULT_SNAPSHOT_PATH : options.discoverySnapshotPath
+    }),
+    AdminModule.forRoot({
+      ...ports,
+      imports: options.imports,
+      global: true
+    }),
+    AdminManifestModule.forRoot({
+      config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
+      extraProviders: options.adminManifestExtraProviders,
+      includeManifestController: options.includeManifestController,
+      guards: options.controller.guards,
+      reloadGuards: options.reloadGuards,
+      imports: options.imports,
+      // Global like AdminModule above: apps register their manifest
+      // contribution by injecting AdminManifestService into one of their
+      // own modules (handbook §6.6). Re-exporting the module from here
+      // does not make that injection resolvable.
+      global: true
+    })
+  ];
+}
+__name(composeBaseModules, "composeBaseModules");
+
+// src/platform/compose/tenant-manifest.ts
+var NONE = {
+  providers: [],
+  exports: [],
+  controllers: []
+};
+function composeTenantManifest(ctx) {
+  const { options } = ctx;
+  if (!options.tenantManifest) return NONE;
+  const tenantAuthGuards = optionsOf2(options.tenantBilling).authGuards;
+  return {
+    providers: [
+      TenantManifestService
+    ],
+    exports: [
+      TenantManifestService
+    ],
+    controllers: [
+      buildTenantManifestController(options.tenantManifest === true ? {
+        guards: Array.isArray(tenantAuthGuards) ? tenantAuthGuards : options.controller.guards
+      } : options.tenantManifest)
+    ]
+  };
+}
+__name(composeTenantManifest, "composeTenantManifest");
+
+// src/platform/compose/enforcement-runtime.ts
+import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
+function resolvePlanResolution(ctx) {
+  const explicit = !!ctx.adapters.planResolver;
+  const viaSubscriptions = Boolean(ctx.options.tenantBilling && ctx.adapters.subscriptionRepository);
+  const fallback = !!ctx.options.defaultPlanId;
+  return {
+    explicit,
+    viaSubscriptions,
+    fallback,
+    available: explicit || viaSubscriptions || fallback
+  };
+}
+__name(resolvePlanResolution, "resolvePlanResolution");
+function composeEnforcementRuntime(ctx, resolution) {
+  if (!resolution.available) return {
+    providers: [],
+    exports: []
+  };
+  const { options, adapters, shared } = ctx;
+  const providers = [];
+  if (resolution.viaSubscriptions && !resolution.explicit) {
+    providers.push(asProvider(PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN, adapters.subscriptionRepository));
+  }
+  providers.push(
+    planResolverProvider(ctx, resolution),
+    StaticEntitlementService,
+    StaticFeatureGuard,
+    EnforceQuotaInterceptor,
+    ...shared.quotaProvidersHostedByTenantBilling ? [] : options.quotaProviders ?? [],
+    {
+      provide: QUOTA_PROVIDERS_TOKEN,
+      useFactory: /* @__PURE__ */ __name((...quotas) => quotas, "useFactory"),
+      inject: options.quotaProviders ?? []
+    },
+    ...options.globalFeatureGuard === false ? [] : [
+      {
+        provide: APP_GUARD,
+        useExisting: StaticFeatureGuard
+      }
+    ],
+    // The interceptor stays global either way: interceptors run after all
+    // guards, so it sees the authenticated request even when the app binds
+    // its own guard chain.
+    {
+      provide: APP_INTERCEPTOR,
+      useExisting: EnforceQuotaInterceptor
+    }
+  );
+  return {
+    providers,
+    exports: [
+      PLAN_RESOLVER_PORT_TOKEN,
+      StaticEntitlementService,
+      StaticFeatureGuard,
+      EnforceQuotaInterceptor,
+      QUOTA_PROVIDERS_TOKEN
+    ]
+  };
+}
+__name(composeEnforcementRuntime, "composeEnforcementRuntime");
+function planResolverProvider(ctx, resolution) {
+  if (resolution.explicit) {
+    return asProvider(PLAN_RESOLVER_PORT_TOKEN, ctx.adapters.planResolver);
+  }
+  if (resolution.viaSubscriptions) {
+    return {
+      provide: PLAN_RESOLVER_PORT_TOKEN,
+      useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
+      inject: [
+        PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
+      ]
+    };
+  }
+  return {
+    provide: PLAN_RESOLVER_PORT_TOKEN,
+    useValue: new StaticPlanResolver(ctx.options.defaultPlanId)
+  };
+}
+__name(planResolverProvider, "planResolverProvider");
+
+// src/platform/saasicat.module.ts
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+var PLATFORM_LOGGER = new Logger("SaaSiCat");
+function enforcementChainState(state) {
+  return {
+    provide: ENFORCEMENT_CHAIN_STATE_TOKEN,
+    useValue: state
+  };
+}
+__name(enforcementChainState, "enforcementChainState");
+var SaaSiCatModule = class _SaaSiCatModule {
+  static {
+    __name(this, "SaaSiCatModule");
+  }
+  static forRoot(options) {
+    const explicit = options.adapters ?? {};
+    const persistence = options.persistence;
+    const catalogConfig = options.catalog || null;
+    const tenantBillingConfig = options.tenantBilling || null;
+    const subscriptionBundlesConfig = options.subscriptionBundles || null;
+    const adminResourcesConfig = options.adminResources || null;
+    const promoCodesConfig = options.promoCodes || null;
+    const requiresFullEntitlement2 = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
+    const adapters = {
+      mfa: explicit.mfa ?? persistence?.core.mfa,
+      audit: explicit.audit ?? persistence?.core.audit,
+      rlsBypass: explicit.rlsBypass ?? persistence?.core.rlsBypass,
+      planCatalogReadSink: explicit.planCatalogReadSink ?? persistence?.planCatalogReadSink,
+      planResolver: explicit.planResolver,
+      subscriptionRepository: explicit.subscriptionRepository ?? persistence?.entitlement?.subscriptionRepository,
+      planVersionRepository: explicit.planVersionRepository ?? persistence?.entitlement?.planVersionRepository,
+      transactionRunner: explicit.transactionRunner ?? persistence?.core.transactionRunner
+    };
+    assertConfiguration({
+      options,
+      adapters
+    });
+    const mfaPort = adapters.mfa;
+    const auditPort = adapters.audit;
+    const rlsBypassPort = adapters.rlsBypass;
+    const appInfo = resolveAppInfo(options);
+    const imports = [
+      // Make injected client/auth providers visible to the high-level
+      // module's own quota providers and automatic plan resolver too.
+      ...options.imports ?? [],
+      composePlanCatalog(options, adapters.planCatalogReadSink),
+      ...composeBaseModules(options, appInfo, {
+        mfaPort,
+        auditPort,
+        rlsBypassPort
+      })
+    ];
+    const composition = {
+      options,
+      adapters,
+      persistence,
+      appInfo,
+      requiresFullEntitlement: requiresFullEntitlement2,
+      shared: {
+        quotaProvidersHostedByTenantBilling: false
+      }
+    };
+    imports.push(...composeFeatures(composition));
+    const lightweightProviders = [];
+    const lightweightExports = [];
+    if (options.autoManifest !== false) {
+      const contribution = buildStandardManifestContribution(catalogConfig, adminResourcesConfig, promoCodesConfig);
+      lightweightProviders.push({
+        provide: STANDARD_MANIFEST_REGISTRATION_TOKEN,
+        useFactory: /* @__PURE__ */ __name((manifest) => {
+          manifest.register(contribution);
+          return contribution;
+        }, "useFactory"),
+        inject: [
+          AdminManifestService
+        ]
+      });
+    }
+    const resolution = resolvePlanResolution(composition);
+    const runtime = composeEnforcementRuntime(composition, resolution);
+    lightweightProviders.push(...runtime.providers);
+    lightweightExports.push(...runtime.exports);
+    if (!resolution.available && !requiresFullEntitlement2) {
+      PLATFORM_LOGGER.warn("No plan resolver configured \u2014 @RequireFeature and @EnforceQuota are INERT. The platform registered neither StaticFeatureGuard nor EnforceQuotaInterceptor, so every annotated route serves unlicensed traffic and every quota is unlimited. Set one of: adapters.planResolver, defaultPlanId, or tenantBilling.");
+    }
+    if (options.enforcementChainCheck !== false) {
+      lightweightProviders.push(EnforcementChainCheck, enforcementChainState({
+        featureEnforcementActive: resolution.available || requiresFullEntitlement2,
+        quotaEnforcementActive: resolution.available,
+        globalGuardBound: resolution.available && options.globalFeatureGuard !== false,
+        // Whether the OPTION unbound it, as opposed to this simply
+        // being a path where the platform binds none. The message
+        // names the true cause, and an application that never set
+        // the option is not told to look for it.
+        globalGuardOptedOut: options.globalFeatureGuard === false
+      }));
+    }
+    if (options.enforcementChainCheck !== false) imports.push(NestDiscoveryModule);
+    const tenantManifest = composeTenantManifest(composition);
+    lightweightProviders.push(...tenantManifest.providers);
+    lightweightExports.push(...tenantManifest.exports);
+    return {
+      module: _SaaSiCatModule,
+      imports,
+      providers: lightweightProviders,
+      controllers: tenantManifest.controllers,
+      exports: composeModuleExports(composition, lightweightExports),
+      global: true
+    };
+  }
+};
+SaaSiCatModule = _ts_decorate10([
+  Module2({})
+], SaaSiCatModule);
+
+export {
+  SETUP_PROVISIONING_PORT_TOKEN,
+  SETUP_CONFIG_TOKEN,
+  SetupService,
+  SetupController,
+  SetupModule,
+  ENFORCEMENT_CHAIN_STATE_TOKEN,
+  EnforcementChainCheck,
+  headingSlug,
+  docsUrlFor,
+  PLATFORM_RULES,
+  findViolations,
+  SaaSiCatConfigurationError,
+  assertConfiguration,
+  QuotaProvidersUsageSnapshot,
+  FEATURE_COMPOSERS,
+  composeFeatures,
+  MOUNTED_BUT_NOT_EXPORTED,
+  composeModuleExports,
+  PLAN_RESOLVER_PORT_TOKEN,
+  StaticPlanResolver,
+  StaticEntitlementService,
+  TenantManifestService,
+  buildTenantManifestController,
+  QUOTA_PROVIDERS_TOKEN,
+  EnforceQuotaInterceptor,
+  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
+  StaticFeatureGuard,
+  SubscriptionPlanResolver,
+  SaaSiCatModule
+};