@saasicat/nest 0.7.0 → 0.9.0

package/dist/{chunk-SD3TT2BR.js → chunk-WGVTXSYW.js}

@@ -1,6 +1,6 @@
 import {
   SuperAdminGuard
-} from "./chunk-U6HT27J7.js";
+} from "./chunk-3M6VLT5N.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";

package/dist/{chunk-A2QBXDJC.js → chunk-ZZMAHX22.js}

@@ -1,17 +1,29 @@
+import {
+  PromoCodesModule
+} from "./chunk-OFBDEO45.js";
 import {
   AdminManifestModule,
-  AdminModule
-} from "./chunk-U6HT27J7.js";
+  AdminManifestService,
+  AdminModule,
+  AdminResourcesModule,
+  SuperAdminGuard
+} from "./chunk-3M6VLT5N.js";
+import {
+  PublicCatalogModule,
+  REQUIRE_FEATURE_KEY,
+  SubscriptionBundleModule,
+  TenantBillingModule
+} from "./chunk-HXAWPPFW.js";
 import {
-  REQUIRE_FEATURE_KEY
-} from "./chunk-Q53N43LQ.js";
+  CatalogModule
+} from "./chunk-PBQRPDO2.js";
 import {
   DiscoveryModule
 } from "./chunk-AJ3EPELS.js";
 import {
   EntitlementModule,
   LimitExceededError
-} from "./chunk-RZU4HIAN.js";
+} from "./chunk-GW2I3JZD.js";
 import {
   PLAN_CATALOG_TOKEN,
   PlanCatalogModule
@@ -269,6 +281,46 @@ EnforceQuotaInterceptor = _ts_decorate3([
   ])
 ], EnforceQuotaInterceptor);
 
+// src/platform/quota-providers-usage-snapshot.ts
+var QuotaProvidersUsageSnapshot = class {
+  static {
+    __name(this, "QuotaProvidersUsageSnapshot");
+  }
+  providers;
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async snapshot(tenantId) {
+    const entries = await Promise.all(this.providers.map(async (provider) => [
+      provider.key,
+      await provider.count(tenantId)
+    ]));
+    return Object.fromEntries(entries);
+  }
+};
+
+// src/platform/subscription-plan-resolver.ts
+var DEFAULT_ACTIVE_STATUSES = /* @__PURE__ */ new Set([
+  "ACTIVE",
+  "TRIAL"
+]);
+var SubscriptionPlanResolver = class {
+  static {
+    __name(this, "SubscriptionPlanResolver");
+  }
+  subscriptions;
+  activeStatuses;
+  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
+    this.subscriptions = subscriptions;
+    this.activeStatuses = activeStatuses;
+  }
+  async getPlanIdForTenant(tenantId) {
+    const subscription = await this.subscriptions.findByTenantId(tenantId);
+    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
+    return subscription.plan;
+  }
+};
+
 // src/platform/tenant-manifest.service.ts
 import { Injectable as Injectable4 } from "@nestjs/common";
 function _ts_decorate4(decorators, target, key, desc) {
@@ -413,6 +465,75 @@ function _ts_decorate6(decorators, target, key, desc) {
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 __name(_ts_decorate6, "_ts_decorate");
+var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlatformSubscriptionRepository");
+var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StandardManifestRegistration");
+function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
+  const capabilities = {
+    "discovery.read": true
+  };
+  if (catalog && catalog.adminControllers !== false) {
+    Object.assign(capabilities, {
+      "plans.read": true,
+      "plans.publish": true,
+      "bundles.read": true,
+      "bundles.write": true,
+      "bundles.publish": true,
+      "marketingProjections.read": true,
+      "marketingProjections.write": true
+    });
+  }
+  const navigation = {};
+  if (adminResources) {
+    Object.assign(capabilities, {
+      "tenants.read": true,
+      "tenants.suspend": true,
+      "tenants.reactivate": true,
+      "users.read": true,
+      "audit.read": true,
+      "subscriptions.read": true
+    });
+    navigation.standardPages = {
+      subscriptions: {
+        enabled: true,
+        requiredCapability: "subscriptions.read"
+      }
+    };
+  }
+  if (promoCodes) {
+    Object.assign(capabilities, {
+      "promoCodes.read": true,
+      "promoCodes.write": true,
+      "promoCodes.delete": true
+    });
+    navigation.standardPages = {
+      ...navigation.standardPages ?? {},
+      promoCodes: {
+        enabled: true,
+        requiredCapability: "promoCodes.read"
+      }
+    };
+  }
+  return {
+    capabilities,
+    navigation: navigation.standardPages ? navigation : void 0
+  };
+}
+__name(buildStandardManifestContribution, "buildStandardManifestContribution");
+function normalizeTenantAuthGuards(guards) {
+  if (!Array.isArray(guards)) return guards;
+  return {
+    useFactory: /* @__PURE__ */ __name((...instances) => instances, "useFactory"),
+    inject: guards
+  };
+}
+__name(normalizeTenantAuthGuards, "normalizeTenantAuthGuards");
+function quotaUsageSnapshotProvider(quotaProviders) {
+  return {
+    useFactory: /* @__PURE__ */ __name((...providers) => new QuotaProvidersUsageSnapshot(providers), "useFactory"),
+    inject: quotaProviders
+  };
+}
+__name(quotaUsageSnapshotProvider, "quotaUsageSnapshotProvider");
 function buildMinimalManifestConfig() {
   return {
     useFactory: /* @__PURE__ */ __name((catalog) => ({
@@ -452,6 +573,12 @@ var SaasPlatformModule = class _SaasPlatformModule {
   static forRoot(options) {
     const explicit = options.adapters ?? {};
     const persistence = options.persistence;
+    const catalogConfig = options.catalog || null;
+    const tenantBillingConfig = options.tenantBilling || null;
+    const subscriptionBundlesConfig = options.subscriptionBundles || null;
+    const adminResourcesConfig = options.adminResources || null;
+    const promoCodesConfig = options.promoCodes || null;
+    const requiresFullEntitlement = Boolean(options.entitlement || tenantBillingConfig || subscriptionBundlesConfig);
     const adapters = {
       mfa: explicit.mfa ?? persistence?.core.mfa,
       audit: explicit.audit ?? persistence?.core.audit,
@@ -476,13 +603,52 @@ var SaasPlatformModule = class _SaasPlatformModule {
     if (!options.planCatalog && (!adapters.planCatalogReadSink || !options.dbCatalog)) {
       throw new Error("SaasPlatformModule.forRoot: either set `planCatalog` (quickstart YAML path) or, for DB hydration, BOTH a planCatalogReadSink (`adapters`/`persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }).");
     }
-    if (options.entitlement) {
+    if (catalogConfig && !persistence?.catalog) {
+      throw new Error("SaasPlatformModule.forRoot: catalog is enabled, but `persistence.catalog` is missing. Use a complete persistence bundle or wire CatalogModule directly.");
+    }
+    if (adminResourcesConfig && adminResourcesConfig !== true && !adminResourcesConfig.resources && !persistence?.adminResources) {
+      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
+    }
+    if (promoCodesConfig && (!persistence?.promo || !adapters.transactionRunner)) {
+      throw new Error("SaasPlatformModule.forRoot: promoCodes requires `persistence.promo` and a transactionRunner.");
+    }
+    if (promoCodesConfig && promoCodesConfig !== true && promoCodesConfig.includePublicController !== false && !promoCodesConfig.firstTimeCustomerCheck) {
+      throw new Error("SaasPlatformModule.forRoot: public promo preview requires `firstTimeCustomerCheck`.");
+    }
+    if (adminResourcesConfig === true && !persistence?.adminResources) {
+      throw new Error("SaasPlatformModule.forRoot: adminResources is enabled, but `persistence.adminResources` is missing.");
+    }
+    if (tenantBillingConfig && !persistence?.tenantBilling) {
+      const missing = [
+        !tenantBillingConfig.subscriptionUsagePort && "subscriptionUsagePort",
+        !tenantBillingConfig.subscriptionWritePort && "subscriptionWritePort"
+      ].filter(Boolean);
+      if (missing.length) {
+        throw new Error(`SaasPlatformModule.forRoot: tenantBilling is enabled, but adapters are missing: ${missing.join(", ")}`);
+      }
+    }
+    if (subscriptionBundlesConfig && !tenantBillingConfig) {
+      throw new Error("SaasPlatformModule.forRoot: subscriptionBundles requires tenantBilling so auth and subscription usage can be shared.");
+    }
+    if (subscriptionBundlesConfig) {
+      const missing = [];
+      if (!persistence?.entitlement?.subscriptionBundleRepository) {
+        missing.push("subscriptionBundleRepository");
+      }
+      if (!persistence?.catalog?.bundleRepository) {
+        missing.push("bundleRepository");
+      }
+      if (missing.length) {
+        throw new Error(`SaasPlatformModule.forRoot: subscriptionBundles is enabled, but persistence adapters are missing: ${missing.join(", ")}`);
+      }
+    }
+    if (requiresFullEntitlement) {
       const missing = [];
       if (!adapters.subscriptionRepository) missing.push("subscriptionRepository");
       if (!adapters.planVersionRepository) missing.push("planVersionRepository");
       if (!adapters.transactionRunner) missing.push("transactionRunner");
       if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: entitlement active, but adapters are missing: ${missing.join(", ")}`);
+        throw new Error(`SaasPlatformModule.forRoot: entitlement active or required by the standard stack, but adapters are missing: ${missing.join(", ")}`);
       }
       if (persistence) {
         assertPersistenceCapabilities(persistence.capabilities, {
@@ -508,6 +674,9 @@ var SaasPlatformModule = class _SaasPlatformModule {
       version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
     };
     const imports = [
+      // Make injected client/auth providers visible to the high-level
+      // module's own quota providers and automatic plan resolver too.
+      ...options.imports ?? [],
       planCatalogModule,
       DiscoveryModule.forRoot({
         app: appInfo,
@@ -521,12 +690,14 @@ var SaasPlatformModule = class _SaasPlatformModule {
         mfaPort,
         auditPort,
         rlsBypassPort,
+        imports: options.imports,
         global: true
       }),
       AdminManifestModule.forRoot({
         config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
         guards: options.controller.guards,
         reloadGuards: options.reloadGuards,
+        imports: options.imports,
         // Global like AdminModule above: apps register their manifest
         // contribution by injecting AdminManifestService into one of
         // their own modules (handbook §6.6). Re-exporting the module
@@ -534,26 +705,163 @@ var SaasPlatformModule = class _SaasPlatformModule {
         global: true
       })
     ];
-    if (options.entitlement) {
+    if (requiresFullEntitlement) {
       imports.push(EntitlementModule.forRoot({
         subscriptionRepository: adapters.subscriptionRepository,
         planVersionRepository: adapters.planVersionRepository,
         transactionRunner: adapters.transactionRunner,
-        resolutionConfig: options.entitlement.resolutionConfig,
+        resolutionConfig: options.entitlement ? options.entitlement.resolutionConfig : void 0,
         subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
         subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.entitlement?.bundleRepository
+        bundleRepository: persistence?.entitlement?.bundleRepository,
+        imports: options.imports,
+        global: Boolean(tenantBillingConfig || subscriptionBundlesConfig)
+      }));
+    }
+    if (catalogConfig) {
+      const catalog = persistence?.catalog;
+      imports.push(CatalogModule.forRoot({
+        planRepository: catalog.planRepository,
+        bundleRepository: catalog.bundleRepository,
+        catalogEntryRepository: catalog.catalogEntryRepository,
+        marketingProjectionRepository: catalog.marketingProjectionRepository,
+        promotionRepository: catalog.promotionRepository,
+        marketingSettingsRepository: catalog.marketingSettingsRepository,
+        controller: catalogConfig.adminControllers === false ? void 0 : {
+          guards: options.controller.guards
+        },
+        imports: catalogConfig.imports ?? options.imports,
+        extraProviders: catalogConfig.extraProviders,
+        strictModeCheckMode: catalogConfig.strictModeCheckMode,
+        autoSyncDiscoveryAtBoot: catalogConfig.autoSyncDiscoveryAtBoot,
+        marketedOnlyFeatures: catalogConfig.marketedOnlyFeatures,
+        featureUiRegistry: catalogConfig.featureUiRegistry,
+        publicMarketingCatalog: catalogConfig.publicMarketingCatalog
+      }));
+      if (catalogConfig.publicCatalog !== false) {
+        imports.push(PublicCatalogModule.forRoot({
+          featureUiRegistry: catalogConfig.featureUiRegistry,
+          projectKey: appInfo.key,
+          bundleRepository: catalog.bundleRepository,
+          marketingRepository: catalog.marketingProjectionRepository,
+          catalogEntryRepository: catalog.catalogEntryRepository,
+          imports: catalogConfig.imports ?? options.imports
+        }));
+      }
+    }
+    if (adminResourcesConfig) {
+      const config = adminResourcesConfig === true ? {} : adminResourcesConfig;
+      imports.push(AdminResourcesModule.forRoot({
+        resources: config.resources ?? persistence?.adminResources?.resources,
+        guards: config.guards ?? [
+          ...options.controller.guards,
+          SuperAdminGuard
+        ],
+        imports: config.imports ?? options.imports
+      }));
+    }
+    if (promoCodesConfig) {
+      const config = promoCodesConfig === true ? {} : promoCodesConfig;
+      const promo = persistence?.promo;
+      const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, ...promoOptions } = config;
+      imports.push(PromoCodesModule.forRoot({
+        ...promoOptions,
+        promoCodeRepository: promo.promoCodeRepository,
+        redemptionRepository: promo.redemptionRepository,
+        validationLogRepository: promo.validationLogRepository,
+        subscriptionLookup: promo.subscriptionLookup,
+        revenueAggregator: promo.revenueAggregator,
+        transactionRunner: adapters.transactionRunner,
+        firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
+          hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
+        },
+        includePublicController: includePublicController ?? false,
+        adminController: {
+          guards: adminGuards ?? [
+            ...options.controller.guards,
+            SuperAdminGuard
+          ]
+        },
+        imports: promoImports ?? options.imports
+      }));
+    }
+    let sharedTenantAuthGuards;
+    let sharedSubscriptionUsagePort;
+    let quotaProvidersHostedByTenantBilling = false;
+    if (tenantBillingConfig) {
+      const tenantSlice = persistence?.tenantBilling;
+      const { authGuards, subscriptionUsagePort, usageSnapshotPort, subscriptionWritePort, imports: tenantImports, extraProviders, extraExports, ...tenantOptions } = tenantBillingConfig;
+      const quotaProviders = options.quotaProviders ?? [];
+      quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
+      sharedTenantAuthGuards = normalizeTenantAuthGuards(authGuards);
+      sharedSubscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
+      const resolvedUsageSnapshotPort = usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(options.quotaProviders ?? []);
+      imports.push(TenantBillingModule.forRoot({
+        ...tenantOptions,
+        authGuards: sharedTenantAuthGuards,
+        subscriptionUsagePort: sharedSubscriptionUsagePort,
+        usageSnapshotPort: resolvedUsageSnapshotPort,
+        subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
+        imports: tenantImports ?? options.imports,
+        extraProviders: [
+          ...quotaProviders,
+          ...extraProviders ?? []
+        ],
+        extraExports: [
+          ...quotaProviders,
+          ...extraExports ?? []
+        ]
+      }));
+    }
+    if (subscriptionBundlesConfig) {
+      const config = subscriptionBundlesConfig === true ? {} : subscriptionBundlesConfig;
+      const { controller, imports: bundleImports, extraProviders, ...bundleOptions } = config;
+      imports.push(SubscriptionBundleModule.forRoot({
+        ...bundleOptions,
+        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
+        bundleRepository: persistence?.catalog?.bundleRepository,
+        controller: controller === false ? void 0 : {
+          ...controller ?? {},
+          authGuards: sharedTenantAuthGuards,
+          subscriptionUsagePort: sharedSubscriptionUsagePort
+        },
+        imports: bundleImports ?? tenantBillingConfig?.imports ?? options.imports,
+        extraProviders
       }));
     }
     const lightweightProviders = [];
     const lightweightExports = [];
-    const hasResolver = !!adapters.planResolver;
+    if (options.autoManifest !== false) {
+      const contribution = buildStandardManifestContribution(catalogConfig, adminResourcesConfig, promoCodesConfig);
+      lightweightProviders.push({
+        provide: STANDARD_MANIFEST_REGISTRATION_TOKEN,
+        useFactory: /* @__PURE__ */ __name((manifest) => {
+          manifest.register(contribution);
+          return contribution;
+        }, "useFactory"),
+        inject: [
+          AdminManifestService
+        ]
+      });
+    }
+    const hasExplicitResolver = !!adapters.planResolver;
+    const hasSubscriptionResolver = Boolean(tenantBillingConfig && adapters.subscriptionRepository);
+    const hasResolver = hasExplicitResolver || hasSubscriptionResolver;
     const hasFallback = !!options.defaultPlanId;
     if (hasResolver || hasFallback) {
-      lightweightProviders.push(hasResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, adapters.planResolver) : {
+      if (hasSubscriptionResolver && !hasExplicitResolver) {
+        lightweightProviders.push(asProvider(PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN, adapters.subscriptionRepository));
+      }
+      lightweightProviders.push(hasExplicitResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, adapters.planResolver) : hasSubscriptionResolver ? {
+        provide: PLAN_RESOLVER_PORT_TOKEN,
+        useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
+        inject: [
+          PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
+        ]
+      } : {
         provide: PLAN_RESOLVER_PORT_TOKEN,
         useValue: new StaticPlanResolver(options.defaultPlanId)
-      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...options.quotaProviders ?? [], {
+      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...quotaProvidersHostedByTenantBilling ? [] : options.quotaProviders ?? [], {
         provide: QUOTA_PROVIDERS_TOKEN,
         useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
         inject: options.quotaProviders ?? []
@@ -569,11 +877,13 @@ var SaasPlatformModule = class _SaasPlatformModule {
     const tenantControllers = [];
     if (options.tenantManifest) {
       if (!hasResolver && !hasFallback) {
-        throw new Error("SaasPlatformModule.forRoot: tenantManifest erfordert defaultPlanId oder adapters.planResolver, sonst kann das Manifest keine Features aufl\xF6sen.");
+        throw new Error("SaasPlatformModule.forRoot: tenantManifest requires defaultPlanId, adapters.planResolver or tenantBilling so it can resolve features.");
       }
       lightweightProviders.push(TenantManifestService);
       lightweightExports.push(TenantManifestService);
-      tenantControllers.push(buildTenantManifestController(options.tenantManifest));
+      tenantControllers.push(buildTenantManifestController(options.tenantManifest === true ? {
+        guards: Array.isArray(tenantBillingConfig?.authGuards) ? tenantBillingConfig.authGuards : options.controller.guards
+      } : options.tenantManifest));
     }
     return {
       module: _SaasPlatformModule,
@@ -588,9 +898,24 @@ var SaasPlatformModule = class _SaasPlatformModule {
         // imported module's token directly is an UnknownExportException
         // at boot — the module export below already carries it.
         AdminManifestModule,
-        ...options.entitlement ? [
+        ...requiresFullEntitlement ? [
           EntitlementModule
         ] : [],
+        ...catalogConfig ? [
+          CatalogModule
+        ] : [],
+        ...tenantBillingConfig ? [
+          TenantBillingModule
+        ] : [],
+        ...subscriptionBundlesConfig ? [
+          SubscriptionBundleModule
+        ] : [],
+        ...adminResourcesConfig ? [
+          AdminResourcesModule
+        ] : [],
+        ...promoCodesConfig ? [
+          PromoCodesModule
+        ] : [],
         ...lightweightExports
       ],
       global: true
@@ -609,6 +934,8 @@ export {
   StaticFeatureGuard,
   QUOTA_PROVIDERS_TOKEN,
   EnforceQuotaInterceptor,
+  QuotaProvidersUsageSnapshot,
+  SubscriptionPlanResolver,
   TenantManifestService,
   buildTenantManifestController,
   SaasPlatformModule

package/dist/{enforce-quota.interceptor-Dj1Kusr5.d.ts → enforce-quota.interceptor-B3CL5MSw.d.ts}

@@ -1,9 +1,12 @@
-import { Type, CanActivate, DynamicModule, ForwardReference, FactoryProvider, ExecutionContext, NestInterceptor, CallHandler } from '@nestjs/common';
-import { MfaPort, AuditPort, RlsBypassPort, PlanCatalogReadSink, SubscriptionRepository, PlanVersionRepository, TransactionRunner, PlanCatalog, SaasicatPersistenceAdapter, QuotaProvider } from '@saasicat/types';
+import { Type, CanActivate, DynamicModule, ForwardReference, FactoryProvider, Provider, ExecutionContext, NestInterceptor, CallHandler } from '@nestjs/common';
+import { PlanCatalog, SaasicatPersistenceAdapter, MfaPort, AuditPort, RlsBypassPort, PlanCatalogReadSink, SubscriptionRepository, PlanVersionRepository, TransactionRunner, QuotaProvider, FeatureUiRegistry, SubscriptionUsagePort, UsageSnapshotPort, TenantSubscriptionWritePort, AdminResourcesPort, FirstTimeCustomerCheck } from '@saasicat/types';
 import { P as ProviderSpec } from './di-CcNeq9v-.js';
-import { A as AdminManifestConfig } from './admin-manifest.config-DyrQNT7M.js';
-import { b as DiscoveryAppInfo } from './discovery.scanner-DLgEvuoy.js';
+import { A as AdminManifestConfig, d as AdminResourcesModuleOptions } from './admin-resources.module-CUCLlUAi.js';
 import { E as EntitlementResolutionConfig } from './plan-resolution-CFCoUkrE.js';
+import { a as PromoCodesModuleOptions } from './module-B5m080F0.js';
+import { b as DiscoveryAppInfo } from './discovery.scanner-DLgEvuoy.js';
+import { b as CatalogModuleOptions } from './catalog.module-BKObceo0.js';
+import { t as TenantBillingModuleOptions, p as SubscriptionBundleModuleOptions, n as SubscriptionBundleControllerOptions } from './subscription-bundles.module-BQmoozm5.js';
 import { Reflector } from '@nestjs/core';
 import { Observable } from 'rxjs';
 
@@ -67,8 +70,8 @@ interface SaasPlatformAdapters {
      * Optional — resolver `tenantId → planId`. The quickstart path uses this
      * together with the `StaticEntitlementService` to automatically check
      * `@RequireFeature` and `@EnforceQuota` against the plan catalog limit.
-     * If not set, `defaultPlanId` **must** be provided — a `StaticPlanResolver`
-     * then returns the same plan for all tenants.
+     * If not set, `tenantBilling` derives the resolver from the subscription
+     * repository. Lightweight setups can instead set `defaultPlanId`.
      */
     planResolver?: ProviderSpec<PlanResolverPort>;
     /**
@@ -79,6 +82,50 @@ interface SaasPlatformAdapters {
     planVersionRepository?: ProviderSpec<PlanVersionRepository>;
     transactionRunner?: ProviderSpec<TransactionRunner>;
 }
+type PlatformImports = Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+interface SaasPlatformCatalogOptions extends Pick<CatalogModuleOptions, 'strictModeCheckMode' | 'autoSyncDiscoveryAtBoot' | 'marketedOnlyFeatures' | 'publicMarketingCatalog' | 'extraProviders'> {
+    /** Labels/icons used by discovery review and the public catalog. */
+    featureUiRegistry: FeatureUiRegistry;
+    /** Mount the SuperAdmin catalog controllers. Default `true`. */
+    adminControllers?: boolean;
+    /** Mount `/billing/plans|bundles|feature-registry`. Default `true`. */
+    publicCatalog?: boolean;
+    /** Override the top-level module imports for catalog adapter factories. */
+    imports?: PlatformImports;
+}
+type SaasPlatformTenantAuthGuards = Array<Type<CanActivate>> | ProviderSpec<ReadonlyArray<CanActivate>>;
+interface SaasPlatformTenantBillingOptions extends Omit<TenantBillingModuleOptions, 'authGuards' | 'subscriptionUsagePort' | 'usageSnapshotPort' | 'subscriptionWritePort' | 'global'> {
+    /**
+     * Tenant guards as classes (the common path) or as a custom provider
+     * factory. Guard classes are resolved from `imports`.
+     */
+    authGuards: SaasPlatformTenantAuthGuards;
+    /** Optional overrides; otherwise the persistence bundle supplies them. */
+    subscriptionUsagePort?: ProviderSpec<SubscriptionUsagePort>;
+    usageSnapshotPort?: ProviderSpec<UsageSnapshotPort>;
+    subscriptionWritePort?: ProviderSpec<TenantSubscriptionWritePort>;
+}
+interface SaasPlatformSubscriptionBundlesOptions extends Omit<SubscriptionBundleModuleOptions, 'subscriptionBundleRepository' | 'bundleRepository' | 'controller' | 'imports' | 'extraProviders' | 'global'> {
+    /** Default mounts the tenant controller and reuses tenant-billing auth. */
+    controller?: false | Omit<SubscriptionBundleControllerOptions, 'authGuards' | 'subscriptionUsagePort'>;
+    imports?: PlatformImports;
+    extraProviders?: Provider[];
+}
+interface SaasPlatformAdminResourcesOptions extends Omit<AdminResourcesModuleOptions, 'resources' | 'guards' | 'global'> {
+    /** Override the default controller guards + `SuperAdminGuard` chain. */
+    guards?: Array<Type<CanActivate>>;
+    /** Custom schema override; the persistence bundle supplies the default. */
+    resources?: ProviderSpec<AdminResourcesPort>;
+}
+interface SaasPlatformPromoCodesOptions extends Omit<PromoCodesModuleOptions, 'promoCodeRepository' | 'redemptionRepository' | 'validationLogRepository' | 'subscriptionLookup' | 'revenueAggregator' | 'transactionRunner' | 'firstTimeCustomerCheck' | 'adminController' | 'global'> {
+    /**
+     * Required when the public preview/redeem flow is enabled. Admin-only
+     * setups do not need an app-specific customer-history check.
+     */
+    firstTimeCustomerCheck?: ProviderSpec<FirstTimeCustomerCheck>;
+    /** Override the default controller guards + `SuperAdminGuard` chain. */
+    adminGuards?: Array<Type<CanActivate>>;
+}
 interface SaasPlatformModuleOptions {
     /**
      * Plan catalog. Either as an already-loaded object (quickstart, comes
@@ -135,7 +182,7 @@ interface SaasPlatformModuleOptions {
      * Modules whose providers must be visible in the DI scope (typically:
      * `AuthModule` with the `JwtAuthGuard`).
      */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    imports?: PlatformImports;
     /**
      * App identity for the DiscoveryScanner. If omitted, `planCatalog.app` is
      * used (recommendation: simply declare it in the YAML).
@@ -154,10 +201,17 @@ interface SaasPlatformModuleOptions {
      */
     adminManifestConfig?: AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
     /**
-     * Default `false`. If `true`, `EntitlementModule.forRoot({...})` is called
+     * Infer manifest capabilities for platform endpoints mounted by this
+     * module. Default `true`; set `false` only when the app owns the complete
+     * manifest capability policy.
+     */
+    autoManifest?: boolean;
+    /**
+     * Default `false`. When set, `EntitlementModule.forRoot({...})` is called
      * with the repositories from `adapters` — only meaningful if the app
      * implements the V3 contract path (`subscriptionRepository` & co. must then
-     * be set).
+     * be set). `tenantBilling` and `subscriptionBundles` enable it
+     * automatically.
      */
     entitlement?: false | {
         resolutionConfig?: EntitlementResolutionConfig;
@@ -177,12 +231,40 @@ interface SaasPlatformModuleOptions {
      * `QUOTA_PROVIDERS_TOKEN`.
      */
     quotaProviders?: Array<Type<QuotaProvider>>;
+    /**
+     * Standard DB-backed catalog stack. Repositories are taken from
+     * `persistence.catalog`; no consumer forwarding module is needed.
+     */
+    catalog?: false | SaasPlatformCatalogOptions;
+    /**
+     * Standard tenant self-service stack. Subscription read/write adapters
+     * come from `persistence.tenantBilling`; usage is derived from
+     * `quotaProviders` unless explicitly overridden.
+     */
+    tenantBilling?: false | SaasPlatformTenantBillingOptions;
+    /**
+     * Add-on bundle service and tenant controller. `true` uses defaults and
+     * reuses tenant-billing auth/usage; an object customizes policy.
+     */
+    subscriptionBundles?: false | true | SaasPlatformSubscriptionBundlesOptions;
+    /**
+     * Standard SuperAdmin Tenant/User/Audit/Subscription endpoints. `true`
+     * uses `persistence.adminResources` and the standard guard chain.
+     */
+    adminResources?: false | true | SaasPlatformAdminResourcesOptions;
+    /**
+     * Promo-code domain and SuperAdmin CRUD. `true` enables the admin API
+     * without the public preview endpoint; pass an object to enable preview.
+     */
+    promoCodes?: false | true | SaasPlatformPromoCodesOptions;
     /**
      * Enable the tenant manifest — the app UI gets a filtered manifest per
      * tenant with features, quotas and visible navigation. Requires that
-     * `defaultPlanId` or `adapters.planResolver` is set.
+     * `defaultPlanId`, `adapters.planResolver` or `tenantBilling` is set.
+     * `true` reuses tenant-billing guard classes when available, otherwise
+     * `controller.guards`.
      */
-    tenantManifest?: TenantManifestControllerOptions;
+    tenantManifest?: true | TenantManifestControllerOptions;
 }
 /**
  * Bundles PlanCatalog + Discovery + Admin + AdminManifest (+ optionally
@@ -260,4 +342,4 @@ declare class EnforceQuotaInterceptor implements NestInterceptor {
     private check;
 }
 
-export { EnforceQuotaInterceptor as E, PLAN_RESOLVER_PORT_TOKEN as P, QUOTA_PROVIDERS_TOKEN as Q, StaticEntitlementService as S, type TenantManifestControllerOptions as T, type PlanResolverPort as a, STATIC_FEATURE_GUARD_CONFIG_TOKEN as b, type SaasPlatformAdapters as c, SaasPlatformModule as d, type SaasPlatformModuleOptions as e, type StaticEntitlementSnapshot as f, StaticFeatureGuard as g, type StaticFeatureGuardConfig as h, StaticPlanResolver as i, buildTenantManifestController as j };
+export { EnforceQuotaInterceptor as E, PLAN_RESOLVER_PORT_TOKEN as P, QUOTA_PROVIDERS_TOKEN as Q, type SaasPlatformAdapters as S, type TenantManifestControllerOptions as T, StaticEntitlementService as a, StaticFeatureGuard as b, StaticPlanResolver as c, type SaasPlatformModuleOptions as d, type PlanResolverPort as e, STATIC_FEATURE_GUARD_CONFIG_TOKEN as f, SaasPlatformModule as g, type SaasPlatformAdminResourcesOptions as h, type SaasPlatformCatalogOptions as i, type SaasPlatformPromoCodesOptions as j, type SaasPlatformSubscriptionBundlesOptions as k, type SaasPlatformTenantAuthGuards as l, type SaasPlatformTenantBillingOptions as m, type StaticEntitlementSnapshot as n, type StaticFeatureGuardConfig as o, buildTenantManifestController as p };