@saasicat/nest 0.8.0 → 0.10.0

package/dist/platform/index.cjs

@@ -1,2779 +1,4 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from3, except, desc) => {
-  if (from3 && typeof from3 === "object" || typeof from3 === "function") {
-    for (let key of __getOwnPropNames(from3))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from3[key], enumerable: !(desc = __getOwnPropDesc(from3, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/platform/index.ts
-var platform_exports = {};
-__export(platform_exports, {
-  AdminManifestService: () => AdminManifestService,
-  EnforceQuotaInterceptor: () => EnforceQuotaInterceptor,
-  PLAN_RESOLVER_PORT_TOKEN: () => PLAN_RESOLVER_PORT_TOKEN,
-  QUOTA_PROVIDERS_TOKEN: () => QUOTA_PROVIDERS_TOKEN,
-  STATIC_FEATURE_GUARD_CONFIG_TOKEN: () => STATIC_FEATURE_GUARD_CONFIG_TOKEN,
-  SaasPlatformModule: () => SaasPlatformModule,
-  StaticEntitlementService: () => StaticEntitlementService,
-  StaticFeatureGuard: () => StaticFeatureGuard,
-  StaticPlanResolver: () => StaticPlanResolver,
-  TenantManifestService: () => TenantManifestService,
-  buildTenantManifestController: () => buildTenantManifestController
-});
-module.exports = __toCommonJS(platform_exports);
-
-// src/platform/saas-platform.module.ts
-var import_common22 = require("@nestjs/common");
-var import_core6 = require("@nestjs/core");
-var import_types = require("@saasicat/types");
-
-// src/core/di.ts
-function asProvider(token, impl) {
-  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
-    const factory = impl;
-    return {
-      provide: token,
-      useFactory: factory.useFactory,
-      inject: factory.inject
-    };
-  }
-  return {
-    provide: token,
-    useValue: impl
-  };
-}
-__name(asProvider, "asProvider");
-
-// src/admin/module.ts
-var import_common6 = require("@nestjs/common");
-
-// src/admin/admin-audit.service.ts
-var os = __toESM(require("os"), 1);
-var import_common = require("@nestjs/common");
-
-// src/admin/tokens.ts
-var MFA_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/MfaPort");
-var AUDIT_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/AuditPort");
-var RLS_BYPASS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/RlsBypassPort");
-
-// src/admin/admin-audit.service.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param, "_ts_param");
-var AdminAuditService = class {
-  static {
-    __name(this, "AdminAuditService");
-  }
-  audit;
-  constructor(audit) {
-    this.audit = audit;
-  }
-  async log(input) {
-    await this.audit.write({
-      actor: input.actor,
-      entity: input.entity,
-      entityId: input.entityId,
-      action: input.action,
-      changes: {
-        ...input.changes ?? {},
-        actor: this.actorTag(input.actor)
-      }
-    });
-  }
-  /**
-   * Standardized actor tag for the `changes.actor` column:
-   * `<source>:<email>:<context>`.
-   */
-  actorTag(actor) {
-    return `${actor.source}:${actor.email}:${actor.context}`;
-  }
-  /** Helper: build an AdminActor from an authenticated web request. */
-  fromWebRequest(user, sessionId) {
-    return {
-      userId: user.id,
-      email: user.email,
-      source: "web",
-      context: sessionId ?? "unknown"
-    };
-  }
-  /** Helper: build an AdminActor from a CLI identity (hostname as context). */
-  fromCli(user) {
-    return {
-      userId: user.id,
-      email: user.email,
-      source: "cli",
-      context: os.hostname()
-    };
-  }
-};
-AdminAuditService = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Inject)(AUDIT_PORT_TOKEN)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof AuditPort === "undefined" ? Object : AuditPort
-  ])
-], AdminAuditService);
-
-// src/admin/admin-bypass-rls.interceptor.ts
-var import_common2 = require("@nestjs/common");
-var import_rxjs = require("rxjs");
-var import_operators = require("rxjs/operators");
-function _ts_decorate2(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var AdminBypassRlsInterceptor = class {
-  static {
-    __name(this, "AdminBypassRlsInterceptor");
-  }
-  port;
-  constructor(port) {
-    this.port = port;
-  }
-  intercept(_context, next) {
-    return (0, import_rxjs.defer)(() => (0, import_rxjs.from)(this.port.runWithBypass(async () => {
-      return next.handle();
-    })).pipe((0, import_operators.switchAll)()));
-  }
-};
-AdminBypassRlsInterceptor = _ts_decorate2([
-  (0, import_common2.Injectable)(),
-  _ts_param2(0, (0, import_common2.Inject)(RLS_BYPASS_PORT_TOKEN)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof RlsBypassPort === "undefined" ? Object : RlsBypassPort
-  ])
-], AdminBypassRlsInterceptor);
-
-// src/admin/mfa.ts
-var import_common3 = require("@nestjs/common");
-var import_otplib = require("otplib");
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
-var CLOCK_DRIFT_TOLERANCE_SECONDS = 30;
-var OTPLIB_TOKEN_ERROR_NAMES = /* @__PURE__ */ new Set([
-  "TokenError",
-  "TokenFormatError",
-  "TokenLengthError"
-]);
-function isOtplibTokenError(error) {
-  return error instanceof Error && OTPLIB_TOKEN_ERROR_NAMES.has(error.name);
-}
-__name(isOtplibTokenError, "isOtplibTokenError");
-var MfaService = class _MfaService {
-  static {
-    __name(this, "MfaService");
-  }
-  mfa;
-  logger = new import_common3.Logger(_MfaService.name);
-  constructor(mfa) {
-    this.mfa = mfa;
-  }
-  /**
-   * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
-   * and returns the secret + the otpauth URI for the QR code.
-   *
-   * `issuer` and `label` shape the display in the authenticator (e.g.
-   * "DemoApp:taci@example.com").
-   */
-  async setup(userId, label, issuer) {
-    const secret = (0, import_otplib.generateSecret)();
-    const otpauthUri = (0, import_otplib.generateURI)({
-      issuer,
-      label,
-      secret
-    });
-    await this.mfa.setSecret(userId, secret);
-    return {
-      secret,
-      otpauthUri
-    };
-  }
-  /**
-   * Verifies the entered code against the stored secret,
-   * clock-drift-tolerant by ±1 time step.
-   */
-  async verify(input) {
-    const secret = await this.mfa.getSecret(input.userId);
-    if (!secret) return false;
-    try {
-      const result = await (0, import_otplib.verify)({
-        secret,
-        token: input.code.trim(),
-        epochTolerance: CLOCK_DRIFT_TOLERANCE_SECONDS
-      });
-      return result.valid;
-    } catch (error) {
-      if (isOtplibTokenError(error)) {
-        return false;
-      }
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.warn(`TOTP-Verify f\xFCr User ${input.userId} unerwartet fehlgeschlagen: ${message}`);
-      return false;
-    }
-  }
-  /**
-   * Deletes a user's secret — used by `ahp admin mfa-reset`.
-   */
-  async disable(userId) {
-    await this.mfa.setSecret(userId, null);
-  }
-  /** Delegates to `MfaPort.isEnabled`. */
-  async isEnabled(userId) {
-    return this.mfa.isEnabled(userId);
-  }
-};
-MfaService = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_param3(0, (0, import_common3.Inject)(MFA_PORT_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof MfaPort === "undefined" ? Object : MfaPort
-  ])
-], MfaService);
-
-// src/admin/mfa.guard.ts
-var import_common4 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param4, "_ts_param");
-var REQUIRE_MFA_KEY = "saas-platform/require-mfa";
-var MfaGuard = class _MfaGuard {
-  static {
-    __name(this, "MfaGuard");
-  }
-  reflector;
-  mfaService;
-  logger = new import_common4.Logger(_MfaGuard.name);
-  constructor(reflector, mfaService) {
-    this.reflector = reflector;
-    this.mfaService = mfaService;
-  }
-  async canActivate(context) {
-    const required = this.reflector.getAllAndOverride(REQUIRE_MFA_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!required) return true;
-    if (process.env.SAAS_PLATFORM_SKIP_MFA === "1" && process.env.NODE_ENV !== "production") {
-      return true;
-    }
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) throw new import_common4.UnauthorizedException({
-      reason: "NOT_AUTHENTICATED"
-    });
-    const enabled = await this.mfaService.isEnabled(user.id);
-    if (!enabled) {
-      throw new import_common4.UnauthorizedException({
-        reason: "MFA_NOT_SET_UP",
-        message: "Bitte zuerst MFA-Setup \xFCber das CLI ausf\xFChren."
-      });
-    }
-    const headerVal = request.headers?.["x-mfa-code"];
-    const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
-    if (!code) {
-      throw new import_common4.UnauthorizedException({
-        reason: "MFA_REQUIRED",
-        message: "TOTP-Code im Header X-Mfa-Code erforderlich."
-      });
-    }
-    const valid = await this.mfaService.verify({
-      userId: user.id,
-      code: String(code)
-    });
-    if (!valid) {
-      throw new import_common4.UnauthorizedException({
-        reason: "MFA_FAILED",
-        message: "TOTP-Code ung\xFCltig."
-      });
-    }
-    return true;
-  }
-};
-MfaGuard = _ts_decorate4([
-  (0, import_common4.Injectable)(),
-  _ts_param4(0, (0, import_common4.Inject)(import_core.Reflector)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
-    typeof MfaService === "undefined" ? Object : MfaService
-  ])
-], MfaGuard);
-
-// src/admin/super-admin.guard.ts
-var import_common5 = require("@nestjs/common");
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-var SuperAdminGuard = class {
-  static {
-    __name(this, "SuperAdminGuard");
-  }
-  canActivate(context) {
-    const request = context.switchToHttp().getRequest();
-    if (!request.user) throw new import_common5.ForbiddenException("Nicht authentifiziert");
-    const role = request.user.platformRole ?? request.user.role;
-    if (role !== "SUPER_ADMIN") {
-      throw new import_common5.ForbiddenException("Nur SUPER_ADMIN-Rolle erlaubt");
-    }
-    return true;
-  }
-};
-SuperAdminGuard = _ts_decorate5([
-  (0, import_common5.Injectable)()
-], SuperAdminGuard);
-
-// src/admin/module.ts
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-var AdminModule = class _AdminModule {
-  static {
-    __name(this, "AdminModule");
-  }
-  static forRoot(options) {
-    const providers = [
-      asProvider(MFA_PORT_TOKEN, options.mfaPort),
-      asProvider(AUDIT_PORT_TOKEN, options.auditPort),
-      asProvider(RLS_BYPASS_PORT_TOKEN, options.rlsBypassPort),
-      MfaService,
-      AdminAuditService,
-      SuperAdminGuard,
-      MfaGuard,
-      AdminBypassRlsInterceptor
-    ];
-    return {
-      module: _AdminModule,
-      global: options.global ?? false,
-      providers,
-      exports: [
-        MFA_PORT_TOKEN,
-        AUDIT_PORT_TOKEN,
-        RLS_BYPASS_PORT_TOKEN,
-        MfaService,
-        AdminAuditService,
-        SuperAdminGuard,
-        MfaGuard,
-        AdminBypassRlsInterceptor
-      ]
-    };
-  }
-};
-AdminModule = _ts_decorate6([
-  (0, import_common6.Module)({})
-], AdminModule);
-
-// src/admin/admin-manifest.module.ts
-var import_common9 = require("@nestjs/common");
-
-// src/admin/admin-manifest.config.ts
-var ADMIN_MANIFEST_CONFIG = /* @__PURE__ */ Symbol("ADMIN_MANIFEST_CONFIG");
-
-// src/admin/admin-manifest.service.ts
-var import_common7 = require("@nestjs/common");
-var import_node_crypto = require("crypto");
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata5(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param5, "_ts_param");
-var PLATFORM_CORE_CONTRIBUTION_TOKEN = /* @__PURE__ */ Symbol("PLATFORM_CORE_CONTRIBUTION");
-var AdminManifestService = class _AdminManifestService {
-  static {
-    __name(this, "AdminManifestService");
-  }
-  config;
-  logger = new import_common7.Logger(_AdminManifestService.name);
-  contributions = [];
-  cached = null;
-  constructor(config, platformCore = null) {
-    this.config = config;
-    if (platformCore) {
-      this.contributions.push(platformCore);
-    }
-  }
-  register(contribution) {
-    this.contributions.push(contribution);
-    this.cached = null;
-  }
-  getManifest() {
-    if (this.cached) return this.cached;
-    this.cached = this.build();
-    this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${this.cached.build.manifestHash.slice(0, 24)}\u2026`);
-    return this.cached;
-  }
-  rebuild() {
-    this.cached = null;
-    return this.getManifest();
-  }
-  build() {
-    const merged = this.mergeContributions(this.contributions);
-    const draft = {
-      schemaVersion: 1,
-      project: this.config.project,
-      build: {
-        ...this.config.build,
-        manifestHash: "sha256-pending"
-      },
-      planCatalogSnapshot: this.config.planCatalogSnapshot,
-      capabilities: merged.capabilities,
-      navigation: merged.navigation,
-      dashboard: merged.dashboard,
-      tenants: merged.tenants,
-      audit: merged.audit
-    };
-    return {
-      ...draft,
-      build: {
-        ...draft.build,
-        manifestHash: this.computeHash(draft)
-      }
-    };
-  }
-  mergeContributions(contributions) {
-    const capabilities = {};
-    const standardPages = {};
-    const projectPages = [];
-    const kpiCards = [];
-    const tenantColumns = [];
-    const tenantActions = [];
-    const auditActions = [];
-    for (const c of contributions) {
-      if (c.capabilities) Object.assign(capabilities, c.capabilities);
-      if (c.navigation?.standardPages) Object.assign(standardPages, c.navigation.standardPages);
-      if (c.navigation?.projectPages) projectPages.push(...c.navigation.projectPages);
-      if (c.dashboard?.kpiCards) kpiCards.push(...c.dashboard.kpiCards);
-      if (c.tenants?.columns) tenantColumns.push(...c.tenants.columns);
-      if (c.tenants?.actions) tenantActions.push(...c.tenants.actions);
-      if (c.audit?.actions) auditActions.push(...c.audit.actions);
-    }
-    kpiCards.sort((a, b) => (b.slotPriority ?? 0) - (a.slotPriority ?? 0));
-    return {
-      capabilities,
-      navigation: {
-        standardPages,
-        projectPages
-      },
-      dashboard: kpiCards.length > 0 ? {
-        kpiCards
-      } : void 0,
-      tenants: tenantColumns.length > 0 || tenantActions.length > 0 ? {
-        columns: tenantColumns,
-        actions: tenantActions
-      } : void 0,
-      audit: auditActions.length > 0 ? {
-        actions: auditActions
-      } : void 0
-    };
-  }
-  /**
-   * Deterministic SHA-256 hash over the manifest. Uses the insertion
-   * order of the object keys — so that semantically meaningful reorders (e.g.
-   * the order of the sidebar items in `navigation.standardPages`) change the
-   * hash and invalidate the browser ETag cache. The manifest's own
-   * `manifestHash` field is hidden before serialization.
-   */
-  computeHash(manifest) {
-    const canonical = stableStringify({
-      ...manifest,
-      build: {
-        ...manifest.build,
-        manifestHash: void 0
-      }
-    });
-    const digest = (0, import_node_crypto.createHash)("sha256").update(canonical).digest("base64url");
-    return `sha256-${digest}`;
-  }
-};
-AdminManifestService = _ts_decorate7([
-  (0, import_common7.Injectable)(),
-  _ts_param5(0, (0, import_common7.Inject)(ADMIN_MANIFEST_CONFIG)),
-  _ts_param5(1, (0, import_common7.Optional)()),
-  _ts_param5(1, (0, import_common7.Inject)(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
-    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig,
-    Object
-  ])
-], AdminManifestService);
-function stableStringify(value) {
-  if (value === null) return "null";
-  if (value === void 0) return "null";
-  if (typeof value === "number") return Number.isFinite(value) ? String(value) : "null";
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "string") return JSON.stringify(value);
-  if (Array.isArray(value)) {
-    return "[" + value.map(stableStringify).join(",") + "]";
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const keys = Object.keys(obj).filter((k) => obj[k] !== void 0);
-    return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
-  }
-  return JSON.stringify(value);
-}
-__name(stableStringify, "stableStringify");
-
-// src/admin/admin-public-boot.controller.ts
-var import_common8 = require("@nestjs/common");
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata6(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param6, "_ts_param");
-var AdminPublicBootController = class {
-  static {
-    __name(this, "AdminPublicBootController");
-  }
-  config;
-  constructor(config) {
-    this.config = config;
-  }
-  getBoot() {
-    return {
-      project: {
-        key: this.config.project.key,
-        displayName: this.config.project.displayName,
-        label: this.config.project.label,
-        icon: this.config.project.icon,
-        logoUrl: this.config.project.logoUrl,
-        environment: this.config.project.environment
-      }
-    };
-  }
-};
-_ts_decorate8([
-  (0, import_common8.Get)("boot"),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", []),
-  _ts_metadata6("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
-], AdminPublicBootController.prototype, "getBoot", null);
-AdminPublicBootController = _ts_decorate8([
-  (0, import_common8.Controller)("admin"),
-  _ts_param6(0, (0, import_common8.Inject)(ADMIN_MANIFEST_CONFIG)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
-    typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig
-  ])
-], AdminPublicBootController);
-
-// src/admin/manifest-core.ts
-var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
-  navigation: {
-    // Key order is render order in the sidebar (within the
-    // section, see `DEFAULT_NAV_SECTIONS` in the nav-builder). The order per
-    // section is deliberately curated:
-    //   Overview: dashboard
-    //   Product catalog: discovery → bundles → plans →
-    //                   marketingCatalog → promoCodes
-    //                   (promoCodes is appended by the app contributions
-    //                   and therefore lands at the end of the section)
-    //   Customers: tenants → users → pilots
-    //   System: audit
-    standardPages: {
-      dashboard: {
-        enabled: true,
-        requiredCapability: "dashboard.read"
-      },
-      // SPEC_V2 §3.3 — discovery snapshot of the running backend.
-      // Apps must set `discovery.read` in their manifest capabilities
-      // to `true` so that the NavBuilder wires the page into the
-      // sidebar; otherwise it is filtered out automatically.
-      discovery: {
-        enabled: true,
-        requiredCapability: "discovery.read"
-      },
-      // SPEC_V2 §11.1 M3 — Bundle editor in SuperAdmin.
-      // Apps with a DB-driven catalog set `bundles.read = true`.
-      bundles: {
-        enabled: true,
-        requiredCapability: "bundles.read"
-      },
-      plans: {
-        enabled: true,
-        requiredCapability: "plans.read"
-      },
-      // SPEC_V2 §11.1 M3 — marketing catalog (locale pivot).
-      // Apps that market a public catalog set
-      // `marketingProjections.read = true`.
-      marketingCatalog: {
-        enabled: true,
-        requiredCapability: "marketingProjections.read"
-      },
-      tenants: {
-        enabled: true,
-        requiredCapability: "tenants.read"
-      },
-      users: {
-        enabled: true,
-        requiredCapability: "users.read"
-      },
-      pilots: {
-        enabled: true,
-        requiredCapability: "pilots.read"
-      },
-      // Audit log deliberately at the end — rarely needed, should
-      // not obscure the productive pages.
-      audit: {
-        enabled: true,
-        requiredCapability: "audit.read"
-      },
-      // Platform email sender (system/registration mails). Apps
-      // set `platformEmail.read = true` so that the NavBuilder wires the page
-      // in; otherwise it is filtered out automatically.
-      platformEmail: {
-        enabled: true,
-        requiredCapability: "platformEmail.read"
-      },
-      // Platform email history (audit of the sent system mails). Apps
-      // set `platformEmailHistory.read = true` so that the NavBuilder wires the
-      // page in; otherwise it is filtered out automatically.
-      platformEmailHistory: {
-        enabled: true,
-        requiredCapability: "platformEmailHistory.read"
-      }
-    }
-  },
-  tenants: {
-    actions: [
-      {
-        id: "platform.tenants.suspend",
-        label: "Mandant suspendieren",
-        actionKey: "tenants.suspend",
-        requiredCapability: "tenants.suspend",
-        requiresMfa: true,
-        confirmType: "typed-slug"
-      },
-      {
-        id: "platform.tenants.reactivate",
-        label: "Mandant reaktivieren",
-        actionKey: "tenants.reactivate",
-        requiredCapability: "tenants.reactivate",
-        requiresMfa: true,
-        confirmType: "simple"
-      },
-      {
-        id: "platform.tenants.impersonate",
-        label: "Impersonate",
-        actionKey: "tenants.impersonate",
-        requiredCapability: "tenants.impersonate",
-        requiresMfa: true,
-        confirmType: "simple"
-      },
-      {
-        id: "platform.tenants.export",
-        label: "DSGVO-Export",
-        actionKey: "tenants.export",
-        requiredCapability: "tenants.export",
-        requiresMfa: true,
-        confirmType: "simple"
-      },
-      {
-        id: "platform.subscriptions.cancel",
-        label: "Subscription k\xFCndigen",
-        actionKey: "subscriptions.cancel",
-        requiredCapability: "subscriptions.cancel",
-        requiresMfa: true,
-        confirmType: "typed-slug"
-      },
-      {
-        id: "platform.pilots.grant",
-        label: "Pilot-Status setzen",
-        actionKey: "pilots.grant",
-        requiredCapability: "pilots.grant",
-        requiresMfa: true,
-        confirmType: "simple"
-      },
-      {
-        id: "platform.pilots.revoke",
-        label: "Pilot-Status entziehen",
-        actionKey: "pilots.revoke",
-        requiredCapability: "pilots.revoke",
-        requiresMfa: true,
-        confirmType: "typed-slug"
-      },
-      {
-        id: "platform.pilots.extend",
-        label: "Pilot verl\xE4ngern",
-        actionKey: "pilots.extend",
-        requiredCapability: "pilots.extend",
-        requiresMfa: true,
-        confirmType: "date"
-      }
-    ]
-  },
-  audit: {
-    actions: [
-      {
-        key: "TENANT_SUSPEND",
-        label: "Mandant suspendiert",
-        severity: "high"
-      },
-      {
-        key: "TENANT_REACTIVATE",
-        label: "Mandant reaktiviert",
-        severity: "medium"
-      },
-      {
-        key: "TENANT_IMPERSONATE",
-        label: "Impersonation gestartet",
-        severity: "high"
-      },
-      {
-        key: "TENANT_EXPORT",
-        label: "DSGVO-Export ausgel\xF6st",
-        severity: "medium"
-      },
-      {
-        key: "PILOT_CREATE",
-        label: "Pilot-Tenant angelegt",
-        severity: "medium"
-      },
-      {
-        key: "PILOT_GRANT",
-        label: "Pilot-Status gesetzt",
-        severity: "medium"
-      },
-      {
-        key: "PILOT_REVOKE",
-        label: "Pilot-Status entzogen",
-        severity: "medium"
-      },
-      {
-        key: "PILOT_EXTEND",
-        label: "Pilot verl\xE4ngert",
-        severity: "low"
-      },
-      {
-        key: "PLAN_VERSION_PUBLISH",
-        label: "Plan-Version freigegeben",
-        severity: "high"
-      },
-      {
-        key: "PLAN_VERSION_TERMINATE",
-        label: "Plan-Version terminiert",
-        severity: "high"
-      },
-      {
-        key: "SUBSCRIPTION_CANCEL",
-        label: "Subscription gek\xFCndigt",
-        severity: "high"
-      },
-      {
-        key: "USER_RESET_PASSWORD",
-        label: "Passwort-Reset ausgel\xF6st",
-        severity: "medium"
-      },
-      {
-        key: "USER_DEACTIVATE",
-        label: "User deaktiviert",
-        severity: "high"
-      },
-      {
-        key: "USER_REASSIGN_ADMIN",
-        label: "Admin-Rolle \xFCbertragen",
-        severity: "high"
-      },
-      {
-        key: "PLATFORM_EMAIL_PROVIDER_CREATE",
-        label: "Plattform-Absender angelegt",
-        severity: "medium"
-      },
-      {
-        key: "PLATFORM_EMAIL_PROVIDER_UPDATE",
-        label: "Plattform-Absender ge\xE4ndert",
-        severity: "medium"
-      },
-      {
-        key: "PLATFORM_EMAIL_PROVIDER_DELETE",
-        label: "Plattform-Absender gel\xF6scht",
-        severity: "medium"
-      },
-      {
-        key: "PLATFORM_EMAIL_PROVIDER_TEST",
-        label: "Plattform-Absender Test-Versand",
-        severity: "low"
-      },
-      {
-        key: "EMAIL_HISTORY_DELETE",
-        label: "Plattform-E-Mail aus Verlauf entfernt",
-        severity: "medium"
-      },
-      {
-        key: "EMAIL_HISTORY_RESEND",
-        label: "Plattform-E-Mail erneut versendet",
-        severity: "low"
-      }
-    ]
-  }
-};
-
-// src/admin/admin-manifest.module.ts
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param7, "_ts_param");
-function asConfigProvider(impl) {
-  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
-    return {
-      provide: ADMIN_MANIFEST_CONFIG,
-      useFactory: impl.useFactory,
-      inject: impl.inject
-    };
-  }
-  return {
-    provide: ADMIN_MANIFEST_CONFIG,
-    useValue: impl
-  };
-}
-__name(asConfigProvider, "asConfigProvider");
-function buildManifestController(guards, reloadGuards) {
-  const reloadChain = [
-    ...guards,
-    ...reloadGuards
-  ];
-  let GeneratedAdminManifestController = class GeneratedAdminManifestController {
-    static {
-      __name(this, "GeneratedAdminManifestController");
-    }
-    manifest;
-    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
-    // `design:paramtypes` metadata, so Nest cannot otherwise resolve the
-    // service type at the constructor.
-    constructor(manifest) {
-      this.manifest = manifest;
-    }
-    getManifest(ifNoneMatch, res) {
-      const m = this.manifest.getManifest();
-      const etag = `"${m.build.manifestHash}"`;
-      res.header("ETag", etag);
-      if (ifNoneMatch && ifNoneMatch === etag) {
-        res.status(import_common9.HttpStatus.NOT_MODIFIED);
-        return null;
-      }
-      return m;
-    }
-    reload() {
-      const m = this.manifest.rebuild();
-      return {
-        manifestHash: m.build.manifestHash,
-        reloadedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-    }
-  };
-  _ts_decorate9([
-    (0, import_common9.Get)("manifest"),
-    (0, import_common9.Header)("Cache-Control", "private, max-age=60, must-revalidate"),
-    _ts_param7(0, (0, import_common9.Headers)("if-none-match")),
-    _ts_param7(1, (0, import_common9.Res)({
-      passthrough: true
-    })),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", [
-      Object,
-      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
-    ]),
-    _ts_metadata7("design:returntype", void 0)
-  ], GeneratedAdminManifestController.prototype, "getManifest", null);
-  _ts_decorate9([
-    (0, import_common9.Post)("manifest/reload"),
-    (0, import_common9.UseGuards)(...reloadChain),
-    (0, import_common9.HttpCode)(import_common9.HttpStatus.OK),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", []),
-    _ts_metadata7("design:returntype", void 0)
-  ], GeneratedAdminManifestController.prototype, "reload", null);
-  GeneratedAdminManifestController = _ts_decorate9([
-    (0, import_common9.Controller)("admin"),
-    (0, import_common9.UseGuards)(...guards),
-    _ts_param7(0, (0, import_common9.Inject)(AdminManifestService)),
-    _ts_metadata7("design:type", Function),
-    _ts_metadata7("design:paramtypes", [
-      typeof AdminManifestService === "undefined" ? Object : AdminManifestService
-    ])
-  ], GeneratedAdminManifestController);
-  return GeneratedAdminManifestController;
-}
-__name(buildManifestController, "buildManifestController");
-var AdminManifestModule = class _AdminManifestModule {
-  static {
-    __name(this, "AdminManifestModule");
-  }
-  static forRoot(options) {
-    const includeManifestController = options.includeManifestController ?? true;
-    const registerPlatformCore = options.registerPlatformCore ?? true;
-    const controllers = [
-      AdminPublicBootController
-    ];
-    if (includeManifestController) {
-      if (options.guards === void 0) {
-        throw new Error("AdminManifestModule.forRoot: `guards` ist Pflicht, wenn `includeManifestController` aktiv ist (Default `true`). Setze `guards: [JwtAuthGuard, SuperAdminGuard]` (oder analog) \u2014 oder `guards: []`, um den Endpoint absichtlich auth-frei zu betreiben. Alternative: `includeManifestController: false` und einen eigenen Wrapping-Controller registrieren.");
-      }
-      controllers.push(buildManifestController(options.guards, options.reloadGuards ?? []));
-    }
-    const providers = [
-      asConfigProvider(options.config),
-      AdminManifestService,
-      ...options.extraProviders ?? []
-    ];
-    if (registerPlatformCore) {
-      providers.push({
-        provide: PLATFORM_CORE_CONTRIBUTION_TOKEN,
-        useValue: PLATFORM_CORE_MANIFEST_CONTRIBUTION
-      });
-    }
-    return {
-      module: _AdminManifestModule,
-      global: options.global ?? false,
-      imports: options.imports ?? [],
-      controllers,
-      providers,
-      exports: [
-        ADMIN_MANIFEST_CONFIG,
-        AdminManifestService
-      ]
-    };
-  }
-};
-AdminManifestModule = _ts_decorate9([
-  (0, import_common9.Module)({})
-], AdminManifestModule);
-
-// src/billing/plan-catalog.module.ts
-var import_common10 = require("@nestjs/common");
-
-// src/billing/plan-catalog-from-snapshot.ts
-function buildPlanCatalogFromSnapshot(settings, snapshot) {
-  const liveByPlanKey = new Map(snapshot.livePlanVersions.map((v) => [
-    v.planId,
-    v
-  ]));
-  const plans = snapshot.plans.filter((p) => p.deletedAt === null).sort((a, b) => a.sortOrder - b.sortOrder).map((stem) => {
-    const live = liveByPlanKey.get(stem.planKey);
-    if (!live) {
-      return {
-        id: stem.planKey,
-        name: stem.label,
-        tagline: stem.description ?? void 0,
-        marketed: false,
-        monthlyNet: null,
-        yearlyNet: null,
-        features: [],
-        quotas: {}
-      };
-    }
-    return {
-      id: stem.planKey,
-      name: stem.label,
-      tagline: stem.description ?? void 0,
-      marketed: live.marketed,
-      monthlyNet: parseFloat(live.monthlyNet),
-      yearlyNet: parseFloat(live.yearlyNet),
-      features: live.features,
-      quotas: live.quotas ?? {}
-    };
-  });
-  const features = snapshot.featureEntries.filter((f) => f.deletedAt === null).sort((a, b) => a.sortOrder - b.sortOrder).map((row) => ({
-    key: row.featureKey,
-    label: row.label,
-    icon: row.icon ?? void 0,
-    tier: row.tier ?? void 0,
-    plannedOnly: row.plannedOnly
-  }));
-  return {
-    schemaVersion: 1,
-    projectKey: settings.projectKey,
-    ...settings.app ? {
-      app: settings.app
-    } : {},
-    currency: settings.currency,
-    vatRate: settings.vatRate,
-    ...settings.marketing ? {
-      marketing: settings.marketing
-    } : {},
-    features,
-    plans
-  };
-}
-__name(buildPlanCatalogFromSnapshot, "buildPlanCatalogFromSnapshot");
-
-// src/billing/plan-catalog.module.ts
-function _ts_decorate10(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate10, "_ts_decorate");
-var PLAN_CATALOG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PLAN_CATALOG");
-var PLAN_CATALOG_READ_SINK_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PLAN_CATALOG_READ_SINK");
-var PlanCatalogModule = class _PlanCatalogModule {
-  static {
-    __name(this, "PlanCatalogModule");
-  }
-  static forRoot(options) {
-    return {
-      module: _PlanCatalogModule,
-      global: options.global ?? true,
-      imports: options.imports ?? [],
-      providers: [
-        ...options.extraProviders ?? [],
-        asProvider(PLAN_CATALOG_READ_SINK_TOKEN, options.sink),
-        {
-          provide: PLAN_CATALOG_TOKEN,
-          useFactory: /* @__PURE__ */ __name(async (sink) => {
-            const snapshot = await sink.loadSnapshot(options.projectKey);
-            return buildPlanCatalogFromSnapshot({
-              projectKey: options.projectKey,
-              app: options.app,
-              currency: options.currency,
-              vatRate: options.vatRate,
-              marketing: options.marketing
-            }, snapshot);
-          }, "useFactory"),
-          inject: [
-            PLAN_CATALOG_READ_SINK_TOKEN
-          ]
-        }
-      ],
-      exports: [
-        PLAN_CATALOG_TOKEN,
-        PLAN_CATALOG_READ_SINK_TOKEN
-      ]
-    };
-  }
-  /**
-   * Tests / in-memory setup: takes the catalog object directly, without a
-   * sink/DB lookup. For unit tests + test bootstraps.
-   */
-  static forRootWithCatalog(catalog, opts = {}) {
-    return {
-      module: _PlanCatalogModule,
-      providers: [
-        {
-          provide: PLAN_CATALOG_TOKEN,
-          useValue: catalog
-        }
-      ],
-      exports: [
-        PLAN_CATALOG_TOKEN
-      ],
-      global: opts.global ?? true
-    };
-  }
-};
-PlanCatalogModule = _ts_decorate10([
-  (0, import_common10.Module)({})
-], PlanCatalogModule);
-
-// src/discovery/discovery.module.ts
-var import_common13 = require("@nestjs/common");
-var import_core3 = require("@nestjs/core");
-
-// src/discovery/discovery.controller.ts
-var import_common12 = require("@nestjs/common");
-
-// src/discovery/discovery.scanner.ts
-var import_node_crypto2 = require("crypto");
-var import_node_fs = require("fs");
-var import_node_path = require("path");
-var import_common11 = require("@nestjs/common");
-var import_core2 = require("@nestjs/core");
-
-// src/discovery/tokens.ts
-var IMPLEMENTS_CAPABILITY_KEY = "discovery:implements-capability";
-var DEFINES_QUOTA_KEY = "discovery:defines-quota";
-var ENFORCE_QUOTA_KEY = "discovery:enforce-quota";
-var DISCOVERY_SNAPSHOT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoverySnapshot");
-
-// src/discovery/discovery.scanner.ts
-function _ts_decorate11(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata8(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param8(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param8, "_ts_param");
-var DEFAULT_APP_INFO = {
-  key: "unknown",
-  version: "0.0.0"
-};
-var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_APP_INFO");
-var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_SNAPSHOT_PATH");
-var DiscoveryScanner = class _DiscoveryScanner {
-  static {
-    __name(this, "DiscoveryScanner");
-  }
-  discoveryService;
-  metadataScanner;
-  reflector;
-  appInfo;
-  snapshotPath;
-  logger = new import_common11.Logger(_DiscoveryScanner.name);
-  snapshot = null;
-  // Explicit @Inject instead of type reflection: in the platform package
-  // build tsup/esbuild do not emit `design:paramtypes` metadata, so Nest
-  // cannot otherwise resolve the DI targets at the constructor
-  // (UndefinedDependencyException at the consumer's boot). Pattern
-  // analogous to admin/admin-manifest.module.ts.
-  constructor(discoveryService, metadataScanner, reflector, appInfo = DEFAULT_APP_INFO, snapshotPath = null) {
-    this.discoveryService = discoveryService;
-    this.metadataScanner = metadataScanner;
-    this.reflector = reflector;
-    this.appInfo = appInfo;
-    this.snapshotPath = snapshotPath;
-  }
-  onApplicationBootstrap() {
-    this.snapshot = this.buildSnapshot();
-    this.logger.log(`Discovery snapshot built: ${this.snapshot.capabilities.length} capabilities, ${this.snapshot.features.length} features, ${this.snapshot.quotas.length} quotas (hash=${this.snapshot.hash.slice(0, 12)}\u2026)`);
-    if (this.snapshotPath) {
-      this.persistSnapshot(this.snapshotPath, this.snapshot);
-    }
-  }
-  persistSnapshot(path, snapshot) {
-    try {
-      (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), {
-        recursive: true
-      });
-      (0, import_node_fs.writeFileSync)(path, JSON.stringify(snapshot, null, 2) + "\n", "utf-8");
-      this.logger.log(`Discovery snapshot persisted to ${path}`);
-    } catch (err) {
-      this.logger.warn(`Discovery snapshot konnte nicht nach ${path} geschrieben werden: ${err.message}`);
-    }
-  }
-  /**
-   * Returns the boot-time snapshot. Before `onApplicationBootstrap` (e.g. in
-   * tests) the snapshot is built lazily.
-   */
-  getSnapshot() {
-    if (!this.snapshot) {
-      this.snapshot = this.buildSnapshot();
-    }
-    return this.snapshot;
-  }
-  /**
-   * Forces a re-scan (SuperAdmin "re-run discovery" or tests with
-   * dynamically registered providers). `scannedAt` is set anew and the
-   * snapshot — as at boot — is persisted to disk so that the last scan
-   * actually performed is preserved.
-   */
-  rebuildSnapshot() {
-    this.snapshot = this.buildSnapshot();
-    if (this.snapshotPath) {
-      this.persistSnapshot(this.snapshotPath, this.snapshot);
-    }
-    return this.snapshot;
-  }
-  buildSnapshot() {
-    const capabilitiesByKey = /* @__PURE__ */ new Map();
-    const quotasByKey = /* @__PURE__ */ new Map();
-    const enforceRefs = [];
-    const wrappers = [
-      ...this.discoveryService.getProviders(),
-      ...this.discoveryService.getControllers()
-    ];
-    for (const wrapper of wrappers) {
-      const instance = wrapper.instance;
-      if (!instance || typeof instance !== "object") continue;
-      const ctor = instance.constructor;
-      if (!ctor) continue;
-      const quotaOpts = this.reflector.get(DEFINES_QUOTA_KEY, ctor);
-      if (quotaOpts) {
-        this.registerQuota(quotasByKey, quotaOpts, ctor.name);
-      }
-      const prototype = Object.getPrototypeOf(instance);
-      const methodNames = this.metadataScanner.getAllMethodNames(prototype);
-      for (const methodName of methodNames) {
-        const methodRef = instance[methodName];
-        if (typeof methodRef !== "function") continue;
-        const capMeta = this.reflector.get(IMPLEMENTS_CAPABILITY_KEY, methodRef);
-        if (capMeta) {
-          this.registerCapability(capabilitiesByKey, capMeta, `${ctor.name}.${methodName}`);
-        }
-        const enforceMeta = this.reflector.get(ENFORCE_QUOTA_KEY, methodRef);
-        if (enforceMeta && capMeta) {
-          enforceRefs.push({
-            capabilityKey: capMeta.capabilityKey,
-            quotaKey: enforceMeta.quotaKey
-          });
-        }
-      }
-    }
-    const capabilities = sortByKey([
-      ...capabilitiesByKey.values()
-    ], (c) => c.capabilityKey);
-    const features = aggregateFeatures(capabilities);
-    const quotas = sortByKey(decorateQuotasWithEnforcers([
-      ...quotasByKey.values()
-    ], enforceRefs), (q) => q.quotaKey);
-    const snapshot = {
-      schemaVersion: 1,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      app: {
-        ...this.appInfo
-      },
-      capabilities,
-      features,
-      quotas,
-      hash: ""
-    };
-    snapshot.hash = computeSnapshotHash(snapshot);
-    return snapshot;
-  }
-  registerCapability(target, meta, declaredAt) {
-    const existing = target.get(meta.capabilityKey);
-    if (existing) {
-      this.logger.warn(`Capability '${meta.capabilityKey}' wird an mehreren Stellen deklariert (${existing.declaredAt} und ${declaredAt}); erste Deklaration gewinnt`);
-      return;
-    }
-    target.set(meta.capabilityKey, {
-      capabilityKey: meta.capabilityKey,
-      label: meta.label ?? null,
-      feature: meta.feature ?? null,
-      status: meta.status ?? "active",
-      kind: meta.kind ?? "endpoint",
-      owner: meta.owner ?? null,
-      replacementKey: meta.replacementKey ?? null,
-      removalPlannedAt: meta.removalPlannedAt ?? null,
-      reason: meta.reason ?? null,
-      requires: normalizeKeyList(meta.requires),
-      replaces: normalizeKeyList(meta.replaces),
-      declaredAt
-    });
-  }
-  registerQuota(target, opts, declaredAt) {
-    const existing = target.get(opts.key);
-    if (existing) {
-      this.logger.warn(`Quota '${opts.key}' wird an mehreren Stellen definiert (${existing.declaredAt} und ${declaredAt}); erste Definition gewinnt`);
-      return;
-    }
-    target.set(opts.key, {
-      quotaKey: opts.key,
-      label: opts.label,
-      unit: opts.unit,
-      policy: opts.policy,
-      feature: opts.feature ?? null,
-      replaces: normalizeKeyList(opts.replaces),
-      declaredAt,
-      enforcedBy: []
-    });
-  }
-};
-DiscoveryScanner = _ts_decorate11([
-  (0, import_common11.Injectable)(),
-  _ts_param8(0, (0, import_common11.Inject)(import_core2.DiscoveryService)),
-  _ts_param8(1, (0, import_common11.Inject)(import_core2.MetadataScanner)),
-  _ts_param8(2, (0, import_common11.Inject)(import_core2.Reflector)),
-  _ts_param8(3, (0, import_common11.Optional)()),
-  _ts_param8(3, (0, import_common11.Inject)(DISCOVERY_APP_INFO_TOKEN)),
-  _ts_param8(4, (0, import_common11.Optional)()),
-  _ts_param8(4, (0, import_common11.Inject)(DISCOVERY_SNAPSHOT_PATH_TOKEN)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
-    typeof import_core2.DiscoveryService === "undefined" ? Object : import_core2.DiscoveryService,
-    typeof import_core2.MetadataScanner === "undefined" ? Object : import_core2.MetadataScanner,
-    typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
-    typeof DiscoveryAppInfo === "undefined" ? Object : DiscoveryAppInfo,
-    Object
-  ])
-], DiscoveryScanner);
-function aggregateFeatures(capabilities) {
-  const byFeature = /* @__PURE__ */ new Map();
-  for (const cap of capabilities) {
-    if (!cap.feature) continue;
-    const acc = byFeature.get(cap.feature) ?? {
-      capabilityKeys: [],
-      requires: /* @__PURE__ */ new Set(),
-      replaces: /* @__PURE__ */ new Set()
-    };
-    acc.capabilityKeys.push(cap.capabilityKey);
-    for (const key of cap.requires ?? []) acc.requires.add(key);
-    for (const key of cap.replaces ?? []) acc.replaces.add(key);
-    byFeature.set(cap.feature, acc);
-  }
-  return sortByKey([
-    ...byFeature.entries()
-  ].map(([featureKey, acc]) => {
-    acc.requires.delete(featureKey);
-    acc.replaces.delete(featureKey);
-    return {
-      featureKey,
-      capabilityKeys: [
-        ...acc.capabilityKeys
-      ].sort((a, b) => a.localeCompare(b)),
-      requires: setToSortedListOrNull(acc.requires),
-      replaces: setToSortedListOrNull(acc.replaces)
-    };
-  }), (f) => f.featureKey);
-}
-__name(aggregateFeatures, "aggregateFeatures");
-function normalizeKeyList(keys) {
-  if (!keys || keys.length === 0) return null;
-  return [
-    ...new Set(keys)
-  ].sort((a, b) => a.localeCompare(b));
-}
-__name(normalizeKeyList, "normalizeKeyList");
-function setToSortedListOrNull(keys) {
-  if (keys.size === 0) return null;
-  return [
-    ...keys
-  ].sort((a, b) => a.localeCompare(b));
-}
-__name(setToSortedListOrNull, "setToSortedListOrNull");
-function decorateQuotasWithEnforcers(quotas, enforceRefs) {
-  const enforcedByQuota = /* @__PURE__ */ new Map();
-  for (const ref of enforceRefs) {
-    const set = enforcedByQuota.get(ref.quotaKey) ?? /* @__PURE__ */ new Set();
-    set.add(ref.capabilityKey);
-    enforcedByQuota.set(ref.quotaKey, set);
-  }
-  return quotas.map((q) => ({
-    ...q,
-    enforcedBy: [
-      ...enforcedByQuota.get(q.quotaKey) ?? /* @__PURE__ */ new Set()
-    ].sort((a, b) => a.localeCompare(b))
-  }));
-}
-__name(decorateQuotasWithEnforcers, "decorateQuotasWithEnforcers");
-function sortByKey(items, keyFn) {
-  return [
-    ...items
-  ].sort((a, b) => keyFn(a).localeCompare(keyFn(b)));
-}
-__name(sortByKey, "sortByKey");
-function computeSnapshotHash(snapshot) {
-  const stableInput = {
-    schemaVersion: snapshot.schemaVersion,
-    appKey: snapshot.app.key,
-    capabilities: snapshot.capabilities.map((c) => ({
-      ...c
-    })),
-    features: snapshot.features,
-    quotas: snapshot.quotas
-  };
-  const json = canonicalStringify(stableInput);
-  return `sha256-${(0, import_node_crypto2.createHash)("sha256").update(json).digest("hex")}`;
-}
-__name(computeSnapshotHash, "computeSnapshotHash");
-function canonicalStringify(value) {
-  return JSON.stringify(value, (_key, val) => {
-    if (val && typeof val === "object" && !Array.isArray(val)) {
-      const sorted = {};
-      for (const k of Object.keys(val).sort()) {
-        sorted[k] = val[k];
-      }
-      return sorted;
-    }
-    return val;
-  });
-}
-__name(canonicalStringify, "canonicalStringify");
-
-// src/discovery/discovery.controller.ts
-function _ts_decorate12(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate12, "_ts_decorate");
-function _ts_metadata9(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata9, "_ts_metadata");
-function _ts_param9(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param9, "_ts_param");
-function buildDiscoveryController(guards) {
-  let GeneratedDiscoveryController = class GeneratedDiscoveryController {
-    static {
-      __name(this, "GeneratedDiscoveryController");
-    }
-    scanner;
-    // Explicit @Inject instead of type reflection: tsup/esbuild do not emit
-    // any `design:paramtypes` metadata, so otherwise Nest cannot resolve the
-    // service type on the constructor.
-    constructor(scanner) {
-      this.scanner = scanner;
-    }
-    getDiscovery(ifNoneMatch, res) {
-      const snapshot = this.scanner.getSnapshot();
-      const etag = `"${snapshot.hash}-${snapshot.scannedAt}"`;
-      res.header("ETag", etag);
-      if (ifNoneMatch && ifNoneMatch === etag) {
-        res.status(import_common12.HttpStatus.NOT_MODIFIED);
-        return null;
-      }
-      return snapshot;
-    }
-    /**
-     * Forces a fresh code scan and returns the new snapshot.
-     * `scannedAt` is updated; the Capability/Feature/Quota data
-     * are identical within the running process (code is stable at runtime).
-     */
-    rescanDiscovery() {
-      return this.scanner.rebuildSnapshot();
-    }
-  };
-  _ts_decorate12([
-    (0, import_common12.Get)("discovery"),
-    (0, import_common12.Header)("Cache-Control", "private, no-cache"),
-    _ts_param9(0, (0, import_common12.Headers)("if-none-match")),
-    _ts_param9(1, (0, import_common12.Res)({
-      passthrough: true
-    })),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
-      Object,
-      typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
-    ]),
-    _ts_metadata9("design:returntype", Object)
-  ], GeneratedDiscoveryController.prototype, "getDiscovery", null);
-  _ts_decorate12([
-    (0, import_common12.Post)("discovery/rescan"),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", []),
-    _ts_metadata9("design:returntype", typeof DiscoverySnapshot === "undefined" ? Object : DiscoverySnapshot)
-  ], GeneratedDiscoveryController.prototype, "rescanDiscovery", null);
-  GeneratedDiscoveryController = _ts_decorate12([
-    (0, import_common12.Controller)("admin"),
-    (0, import_common12.UseGuards)(...guards),
-    _ts_param9(0, (0, import_common12.Inject)(DiscoveryScanner)),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
-      typeof DiscoveryScanner === "undefined" ? Object : DiscoveryScanner
-    ])
-  ], GeneratedDiscoveryController);
-  return GeneratedDiscoveryController;
-}
-__name(buildDiscoveryController, "buildDiscoveryController");
-
-// src/discovery/discovery.module.ts
-function _ts_decorate13(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate13, "_ts_decorate");
-var DiscoveryModule = class _DiscoveryModule {
-  static {
-    __name(this, "DiscoveryModule");
-  }
-  static forRoot(options) {
-    const isGlobal = options.isGlobal ?? true;
-    const controllers = [];
-    if (options.controller) {
-      controllers.push(buildDiscoveryController(options.controller.guards));
-    }
-    const providers = [
-      {
-        provide: DISCOVERY_APP_INFO_TOKEN,
-        useValue: options.app
-      },
-      {
-        provide: DISCOVERY_SNAPSHOT_PATH_TOKEN,
-        useValue: options.snapshotPath ?? null
-      },
-      DiscoveryScanner,
-      {
-        provide: DISCOVERY_SNAPSHOT_TOKEN,
-        useFactory: /* @__PURE__ */ __name((scanner) => scanner.getSnapshot(), "useFactory"),
-        inject: [
-          DiscoveryScanner
-        ]
-      }
-    ];
-    return {
-      module: _DiscoveryModule,
-      imports: [
-        import_core3.DiscoveryModule,
-        ...options.imports ?? []
-      ],
-      controllers,
-      providers,
-      exports: [
-        DiscoveryScanner,
-        DISCOVERY_SNAPSHOT_TOKEN
-      ],
-      global: isGlobal
-    };
-  }
-};
-DiscoveryModule = _ts_decorate13([
-  (0, import_common13.Module)({})
-], DiscoveryModule);
-
-// src/entitlement/module.ts
-var import_common15 = require("@nestjs/common");
-
-// src/entitlement/service.ts
-var import_common14 = require("@nestjs/common");
-
-// src/catalog/tokens.ts
-var BUNDLE_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol("BUNDLE_REPOSITORY");
-
-// src/billing/subscription-bundles.tokens.ts
-var SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionBundleRepository");
-
-// src/subscription-contract/tokens.ts
-var SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionContractRepository");
-
-// src/billing/plan-helpers.ts
-function isFeaturePlannedOnly(catalog, featureKey) {
-  const def = (catalog.features ?? []).find((f) => f.key === featureKey);
-  return def?.plannedOnly === true;
-}
-__name(isFeaturePlannedOnly, "isFeaturePlannedOnly");
-
-// src/entitlement/aggregation.ts
-function filterActiveSubscriptionBundles(bundles, now) {
-  return bundles.filter((b) => b.canceledEffectiveAt === null || b.canceledEffectiveAt > now);
-}
-__name(filterActiveSubscriptionBundles, "filterActiveSubscriptionBundles");
-function aggregateSubscriptionBundleQuotas(bundles) {
-  const sums = {};
-  for (const bundle of bundles) {
-    for (const [key, value] of Object.entries(bundle.quotas)) {
-      if (sums[key] === -1 || value === -1) {
-        sums[key] = -1;
-      } else {
-        sums[key] = (sums[key] ?? 0) + value;
-      }
-    }
-  }
-  return sums;
-}
-__name(aggregateSubscriptionBundleQuotas, "aggregateSubscriptionBundleQuotas");
-function collectSubscriptionBundleFeatures(bundles) {
-  const set = /* @__PURE__ */ new Set();
-  for (const bundle of bundles) {
-    for (const f of bundle.features) set.add(f);
-  }
-  return Array.from(set);
-}
-__name(collectSubscriptionBundleFeatures, "collectSubscriptionBundleFeatures");
-function aggregateContractLineItemEntitlements(lineItems, fallbackPlan = "UNKNOWN") {
-  const planItem = lineItems.find((item) => item.kind === "plan");
-  const plan = planItem?.sourceKey ?? fallbackPlan;
-  const quotas = {};
-  const features = /* @__PURE__ */ new Set();
-  for (const item of lineItems) {
-    for (const feature of item.featuresSnapshot) {
-      features.add(feature);
-    }
-    for (const [key, value] of Object.entries(item.quotaEffectsSnapshot)) {
-      if (quotas[key] === -1 || value === -1) {
-        quotas[key] = -1;
-      } else {
-        quotas[key] = (quotas[key] ?? 0) + value;
-      }
-    }
-  }
-  return {
-    plan,
-    quotas,
-    features
-  };
-}
-__name(aggregateContractLineItemEntitlements, "aggregateContractLineItemEntitlements");
-function filterPlannedOnlyFeatures(features, catalog) {
-  const out = /* @__PURE__ */ new Set();
-  for (const f of features) {
-    if (!isFeaturePlannedOnly(catalog, f)) {
-      out.add(f);
-    }
-  }
-  return out;
-}
-__name(filterPlannedOnlyFeatures, "filterPlannedOnlyFeatures");
-function applyCustomLimits(base, custom) {
-  if (!custom) return base;
-  const quotas = {
-    ...base.quotas
-  };
-  if (custom.quotas) {
-    for (const [k, v] of Object.entries(custom.quotas)) {
-      quotas[k] = v;
-    }
-  }
-  const features = new Set(base.features);
-  if (custom.features) {
-    for (const f of custom.features) features.add(f);
-  }
-  return {
-    plan: base.plan,
-    quotas,
-    features
-  };
-}
-__name(applyCustomLimits, "applyCustomLimits");
-function aggregateLimits(input, catalog, now) {
-  const activeBundles = filterActiveSubscriptionBundles(input.subscriptionBundles ?? [], now);
-  const subBundleQuotas = aggregateSubscriptionBundleQuotas(activeBundles);
-  const subBundleFeatures = collectSubscriptionBundleFeatures(activeBundles);
-  const quotas = {};
-  for (const [k, v] of Object.entries(input.planVersion.quotas)) {
-    quotas[k] = v;
-  }
-  for (const [k, v] of Object.entries(subBundleQuotas)) {
-    if (quotas[k] === -1 || v === -1) {
-      quotas[k] = -1;
-    } else {
-      quotas[k] = (quotas[k] ?? 0) + v;
-    }
-  }
-  const features = /* @__PURE__ */ new Set([
-    ...input.planVersion.features,
-    ...subBundleFeatures
-  ]);
-  const withCustom = applyCustomLimits({
-    plan: input.plan,
-    quotas,
-    features
-  }, input.customLimits);
-  const filteredFeatures = filterPlannedOnlyFeatures(withCustom.features, catalog);
-  return {
-    plan: withCustom.plan,
-    quotas: withCustom.quotas,
-    features: filteredFeatures
-  };
-}
-__name(aggregateLimits, "aggregateLimits");
-
-// src/entitlement/feature-aliases.ts
-function buildReplacedByIndex(features) {
-  const index = /* @__PURE__ */ new Map();
-  for (const feature of features) {
-    for (const oldKey of feature.replaces ?? []) {
-      if (oldKey === feature.featureKey) continue;
-      const list = index.get(oldKey) ?? [];
-      list.push(feature.featureKey);
-      index.set(oldKey, list);
-    }
-  }
-  for (const list of index.values()) list.sort((a, b) => a.localeCompare(b));
-  assertNoReplacesCycle(index);
-  return index;
-}
-__name(buildReplacedByIndex, "buildReplacedByIndex");
-function expandReplacedFeatures(granted, index) {
-  const expanded = new Set(granted);
-  const worklist = [
-    ...granted
-  ];
-  while (worklist.length > 0) {
-    const key = worklist.pop();
-    for (const successor of index.get(key) ?? []) {
-      if (expanded.has(successor)) continue;
-      expanded.add(successor);
-      worklist.push(successor);
-    }
-  }
-  return expanded;
-}
-__name(expandReplacedFeatures, "expandReplacedFeatures");
-function assertNoReplacesCycle(index) {
-  const DONE = 2;
-  const IN_PROGRESS = 1;
-  const state = /* @__PURE__ */ new Map();
-  const visit = /* @__PURE__ */ __name((key, path) => {
-    const s = state.get(key);
-    if (s === DONE) return;
-    if (s === IN_PROGRESS) {
-      const cycleStart = path.indexOf(key);
-      const cycle = [
-        ...path.slice(cycleStart),
-        key
-      ].join(" \u2192 ");
-      throw new Error(`replaces-Zyklus in den Discovery-Metadaten: ${cycle}. Feature-Ersetzungen m\xFCssen azyklisch sein \u2014 replaces-Deklarationen im Code korrigieren (#39).`);
-    }
-    state.set(key, IN_PROGRESS);
-    for (const successor of index.get(key) ?? []) {
-      visit(successor, [
-        ...path,
-        key
-      ]);
-    }
-    state.set(key, DONE);
-  }, "visit");
-  for (const key of index.keys()) visit(key, []);
-}
-__name(assertNoReplacesCycle, "assertNoReplacesCycle");
-
-// src/entitlement/limit-exceeded-error.ts
-var LIMIT_EXCEEDED = "LIMIT_EXCEEDED";
-var LimitExceededError = class extends Error {
-  static {
-    __name(this, "LimitExceededError");
-  }
-  dimension;
-  max;
-  used;
-  code = LIMIT_EXCEEDED;
-  constructor(dimension, max, used) {
-    super(`Limit f\xFCr ${dimension} erreicht: ${used}/${max}.`), this.dimension = dimension, this.max = max, this.used = used;
-    this.name = "LimitExceededError";
-  }
-};
-
-// src/entitlement/plan-resolution.ts
-function resolveEntitlementPlan(input, config, now) {
-  if (input.isPilot && config.pilotEntitlementPlan !== void 0) {
-    return config.pilotEntitlementPlan;
-  }
-  if (input.status === "TRIAL") {
-    return input.trialEntitlementPlan ?? config.defaultTrialEntitlementPlan ?? input.plan;
-  }
-  if (input.status === "PENDING_SALES" && config.pendingSalesEntitlementPlan !== void 0) {
-    return config.pendingSalesEntitlementPlan;
-  }
-  if (input.pendingPlan && input.pendingEffectiveAt && input.pendingEffectiveAt <= now) {
-    return input.pendingPlan;
-  }
-  return input.plan;
-}
-__name(resolveEntitlementPlan, "resolveEntitlementPlan");
-
-// src/entitlement/tokens.ts
-var ENTITLEMENT_SERVICE_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/EntitlementService");
-var SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SubscriptionRepository");
-var PLAN_VERSION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/PlanVersionRepository");
-var TRANSACTION_RUNNER_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/TransactionRunner");
-var ENTITLEMENT_RESOLUTION_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/EntitlementResolutionConfig");
-
-// src/entitlement/service.ts
-function _ts_decorate14(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate14, "_ts_decorate");
-function _ts_metadata10(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata10, "_ts_metadata");
-function _ts_param10(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param10, "_ts_param");
-var CACHE_TTL_MS = 6e4;
-var CACHE_MAX_ENTRIES = 1e3;
-var EntitlementService = class {
-  static {
-    __name(this, "EntitlementService");
-  }
-  catalog;
-  subscriptions;
-  planVersions;
-  tx;
-  resolutionConfig;
-  subscriptionBundles;
-  bundles;
-  subscriptionContracts;
-  discoverySnapshot;
-  // Map preserves insert order — on a hit the entry is removed and
-  // re-inserted (LRU). The TTL is a safety net for forgotten
-  // invalidations — 60s is enough, because limits generally only change
-  // through mutations, not through time (a pending plan's effective date
-  // is day-granular).
-  cache = /* @__PURE__ */ new Map();
-  // #39 — replaces alias index, built lazily from the boot-static snapshot;
-  // throws on replaces cycles (a clear error instead of an infinite loop).
-  replacedByIndex = null;
-  constructor(catalog, subscriptions, planVersions, tx, resolutionConfig = null, subscriptionBundles = null, bundles = null, subscriptionContracts = null, discoverySnapshot = null) {
-    this.catalog = catalog;
-    this.subscriptions = subscriptions;
-    this.planVersions = planVersions;
-    this.tx = tx;
-    this.resolutionConfig = resolutionConfig;
-    this.subscriptionBundles = subscriptionBundles;
-    this.bundles = bundles;
-    this.subscriptionContracts = subscriptionContracts;
-    this.discoverySnapshot = discoverySnapshot;
-  }
-  // ---------------------------------------------------------------------
-  // Read path — for FeatureGuard, sidebar hooks, GET /billing/entitlement
-  // ---------------------------------------------------------------------
-  async computeLimits(tenantId, now = /* @__PURE__ */ new Date()) {
-    const cached = this.readCache(tenantId, now.getTime());
-    if (cached) return cached;
-    const sub = await this.subscriptions.findByTenantId(tenantId);
-    if (!sub) {
-      throw new import_common14.NotFoundException(`Keine Subscription f\xFCr Tenant ${tenantId}`);
-    }
-    const limits = await this.deriveLimits(sub, now);
-    this.writeCache(tenantId, limits, now.getTime());
-    return limits;
-  }
-  /**
-   * Clears a tenant's cache entry. MUST be called as soon as a mutation
-   * changes the subscription, a bundle booking, or a PlanVersion binding —
-   * otherwise FeatureGuard and the sidebar stay on stale state for up to
-   * 60s.
-   */
-  invalidateTenant(tenantId) {
-    this.cache.delete(tenantId);
-  }
-  /** Clears the entire cache. Only for tests / bootstrap. */
-  invalidateAll() {
-    this.cache.clear();
-  }
-  /**
-   * Aggregator path — also callable directly by consumers that already
-   * have a `SubscriptionRecord` (e.g. within a transaction).
-   */
-  async deriveLimits(sub, now, tx) {
-    const contractLimits = await this.deriveLimitsFromContract(sub.tenantId, now);
-    if (contractLimits) return this.withReplacedFeatureAliases(contractLimits);
-    const effectivePlan = resolveEntitlementPlan(sub, this.resolutionConfig ?? {}, now);
-    const planVersion = effectivePlan === sub.plan ? sub.planVersion : await this.findActivePlanVersionOrFallback(effectivePlan, now, tx);
-    const subscriptionBundles = await this.loadSubscriptionBundleSnapshots(sub.id, now);
-    return this.withReplacedFeatureAliases(aggregateLimits({
-      plan: effectivePlan,
-      planVersion,
-      subscriptionBundles,
-      customLimits: sub.customLimits ?? null
-    }, this.catalog, now));
-  }
-  /**
-   * Grandfathering (#39): granted old feature keys transitively grant
-   * their successors from the `replaces` chains of the discovery snapshot.
-   * A no-op without a snapshot or without replaces declarations.
-   */
-  withReplacedFeatureAliases(limits) {
-    if (!this.discoverySnapshot) return limits;
-    if (!this.replacedByIndex) {
-      this.replacedByIndex = buildReplacedByIndex(this.discoverySnapshot.features);
-    }
-    if (this.replacedByIndex.size === 0) return limits;
-    return {
-      ...limits,
-      features: expandReplacedFeatures(limits.features, this.replacedByIndex)
-    };
-  }
-  async deriveLimitsFromContract(tenantId, now) {
-    if (!this.subscriptionContracts) return null;
-    const contract = await this.subscriptionContracts.findActiveByTenantId(tenantId, now);
-    if (!contract) return null;
-    if (contract.entitlementSnapshot) {
-      return {
-        plan: contract.entitlementSnapshot.plan,
-        quotas: {
-          ...contract.entitlementSnapshot.quotas
-        },
-        features: new Set(contract.entitlementSnapshot.features)
-      };
-    }
-    return aggregateContractLineItemEntitlements(contract.lineItems);
-  }
-  /**
-   * Loads a subscription's active bundle bookings and resolves the
-   * `BundleVersion` features/quotas per entry. Without a registered
-   * `SubscriptionBundleRepository` or `BundleRepository` the method
-   * returns an empty list — apps without a bundle schema stay unchanged
-   * (plan-only aggregation).
-   */
-  async loadSubscriptionBundleSnapshots(subscriptionId, now) {
-    if (!this.subscriptionBundles || !this.bundles) return [];
-    const active = await this.subscriptionBundles.listActiveBySubscription(subscriptionId, now);
-    if (active.length === 0) return [];
-    return Promise.all(active.map(async (booking) => {
-      const bv = await this.bundles.findVersionById(booking.bundleVersionId);
-      if (!bv) {
-        throw new Error(`BundleVersion '${booking.bundleVersionId}' aus aktiver SubscriptionBundle nicht gefunden`);
-      }
-      return {
-        bundleKey: bv.bundleKey,
-        features: bv.features,
-        quotas: bv.quotas,
-        canceledEffectiveAt: booking.canceledEffectiveAt
-      };
-    }));
-  }
-  // ---------------------------------------------------------------------
-  // Write/consumption path — row lock + count + insert in the same
-  // transaction. Protects against race conditions on concurrent creations
-  // for the same tenant.
-  // ---------------------------------------------------------------------
-  async enforceLimit(input) {
-    const now = input.now ?? /* @__PURE__ */ new Date();
-    const delta = input.delta ?? 1;
-    return this.tx.run(async (tx) => {
-      const sub = await this.subscriptions.findByTenantIdLocked(input.tenantId, tx);
-      if (!sub) {
-        throw new import_common14.NotFoundException(`Keine Subscription f\xFCr Tenant ${input.tenantId}`);
-      }
-      const limits = await this.deriveLimits(sub, now, tx);
-      const max = limits.quotas[input.dimension];
-      if (max === void 0) {
-        throw new Error(`Quota-Dimension "${input.dimension}" nicht im PlanCatalog (${this.catalog.projectKey}).`);
-      }
-      const used = await input.currentUsage(tx, input.tenantId);
-      if (max !== -1 && used + delta > max) {
-        throw new LimitExceededError(input.dimension, max, used);
-      }
-      return input.insert(tx);
-    });
-  }
-  // ---------------------------------------------------------------------
-  // Helpers
-  // ---------------------------------------------------------------------
-  /**
-   * Plan fallback for TRIAL/PENDING_SALES: returns the PlanVersion active
-   * as of `asOf` (SPEC_V2 §4.2). If the repo does not implement
-   * `findActive`, we fall back to `findLatestLive` (backward compat for
-   * adapters without `validFrom` columns).
-   */
-  async findActivePlanVersionOrFallback(planId, asOf, tx) {
-    const v = this.planVersions.findActive ? await this.planVersions.findActive(planId, asOf, tx) : await this.planVersions.findLatestLive(planId, tx);
-    if (!v) {
-      throw new import_common14.NotFoundException(`Keine zu ${asOf.toISOString().slice(0, 10)} aktive PlanVersion f\xFCr ${planId} \u2014 weder validFrom-window erf\xFCllt noch latest-live verf\xFCgbar.`);
-    }
-    return v;
-  }
-  readCache(tenantId, nowMs) {
-    const entry = this.cache.get(tenantId);
-    if (!entry) return null;
-    if (entry.expiresAt < nowMs) {
-      this.cache.delete(tenantId);
-      return null;
-    }
-    this.cache.delete(tenantId);
-    this.cache.set(tenantId, entry);
-    return entry.value;
-  }
-  writeCache(tenantId, value, nowMs) {
-    if (this.cache.has(tenantId)) this.cache.delete(tenantId);
-    this.cache.set(tenantId, {
-      value,
-      expiresAt: nowMs + CACHE_TTL_MS
-    });
-    while (this.cache.size > CACHE_MAX_ENTRIES) {
-      const oldest = this.cache.keys().next().value;
-      if (oldest === void 0) break;
-      this.cache.delete(oldest);
-    }
-  }
-};
-EntitlementService = _ts_decorate14([
-  (0, import_common14.Injectable)(),
-  _ts_param10(0, (0, import_common14.Inject)(PLAN_CATALOG_TOKEN)),
-  _ts_param10(1, (0, import_common14.Inject)(SUBSCRIPTION_REPOSITORY_TOKEN)),
-  _ts_param10(2, (0, import_common14.Inject)(PLAN_VERSION_REPOSITORY_TOKEN)),
-  _ts_param10(3, (0, import_common14.Inject)(TRANSACTION_RUNNER_TOKEN)),
-  _ts_param10(4, (0, import_common14.Optional)()),
-  _ts_param10(4, (0, import_common14.Inject)(ENTITLEMENT_RESOLUTION_CONFIG_TOKEN)),
-  _ts_param10(5, (0, import_common14.Optional)()),
-  _ts_param10(5, (0, import_common14.Inject)(SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN)),
-  _ts_param10(6, (0, import_common14.Optional)()),
-  _ts_param10(6, (0, import_common14.Inject)(BUNDLE_REPOSITORY_TOKEN)),
-  _ts_param10(7, (0, import_common14.Optional)()),
-  _ts_param10(7, (0, import_common14.Inject)(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN)),
-  _ts_param10(8, (0, import_common14.Optional)()),
-  _ts_param10(8, (0, import_common14.Inject)(DISCOVERY_SNAPSHOT_TOKEN)),
-  _ts_metadata10("design:type", Function),
-  _ts_metadata10("design:paramtypes", [
-    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
-    typeof SubscriptionRepository === "undefined" ? Object : SubscriptionRepository,
-    typeof PlanVersionRepository === "undefined" ? Object : PlanVersionRepository,
-    typeof TransactionRunner === "undefined" ? Object : TransactionRunner,
-    Object,
-    Object,
-    Object,
-    Object,
-    Object
-  ])
-], EntitlementService);
-
-// src/entitlement/module.ts
-function _ts_decorate15(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate15, "_ts_decorate");
-var EntitlementModule = class _EntitlementModule {
-  static {
-    __name(this, "EntitlementModule");
-  }
-  static forRoot(options) {
-    const providers = [
-      asProvider(SUBSCRIPTION_REPOSITORY_TOKEN, options.subscriptionRepository),
-      asProvider(PLAN_VERSION_REPOSITORY_TOKEN, options.planVersionRepository),
-      asProvider(TRANSACTION_RUNNER_TOKEN, options.transactionRunner),
-      EntitlementService,
-      // Cross-bundle-stable alias so consumers in other subpath bundles
-      // (billing/TenantBillingModule) can inject the same instance.
-      {
-        provide: ENTITLEMENT_SERVICE_TOKEN,
-        useExisting: EntitlementService
-      }
-    ];
-    if (options.resolutionConfig) {
-      providers.push({
-        provide: ENTITLEMENT_RESOLUTION_CONFIG_TOKEN,
-        useValue: options.resolutionConfig
-      });
-    }
-    if (options.subscriptionContractRepository) {
-      providers.push(asProvider(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN, options.subscriptionContractRepository));
-    }
-    if (options.subscriptionBundleRepository) {
-      providers.push(asProvider(SUBSCRIPTION_BUNDLE_REPOSITORY_TOKEN, options.subscriptionBundleRepository));
-    }
-    if (options.bundleRepository) {
-      providers.push(asProvider(BUNDLE_REPOSITORY_TOKEN, options.bundleRepository));
-    }
-    return {
-      module: _EntitlementModule,
-      global: options.global ?? false,
-      providers,
-      exports: [
-        EntitlementService,
-        ENTITLEMENT_SERVICE_TOKEN,
-        SUBSCRIPTION_REPOSITORY_TOKEN
-      ]
-    };
-  }
-};
-EntitlementModule = _ts_decorate15([
-  (0, import_common15.Module)({})
-], EntitlementModule);
-
-// src/platform/plan-resolver.port.ts
-var PLAN_RESOLVER_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/PlanResolverPort");
-var StaticPlanResolver = class {
-  static {
-    __name(this, "StaticPlanResolver");
-  }
-  planId;
-  constructor(planId) {
-    this.planId = planId;
-  }
-  async getPlanIdForTenant() {
-    return this.planId;
-  }
-};
-
-// src/platform/static-entitlement.service.ts
-var import_common16 = require("@nestjs/common");
-function _ts_decorate16(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate16, "_ts_decorate");
-function _ts_metadata11(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata11, "_ts_metadata");
-function _ts_param11(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param11, "_ts_param");
-var StaticEntitlementService = class {
-  static {
-    __name(this, "StaticEntitlementService");
-  }
-  catalog;
-  resolver;
-  constructor(catalog, resolver) {
-    this.catalog = catalog;
-    this.resolver = resolver;
-  }
-  /**
-   * Returns the effective features + quotas of a tenant from the
-   * plan catalog. When the plan is missing: an empty snapshot (no feature,
-   * all quotas at 0).
-   */
-  async snapshot(tenantId) {
-    const planId = await this.resolver.getPlanIdForTenant(tenantId);
-    if (!planId) {
-      return {
-        planId: null,
-        features: [],
-        quotas: {}
-      };
-    }
-    const plan = this.findPlan(planId);
-    if (!plan) {
-      return {
-        planId,
-        features: [],
-        quotas: {}
-      };
-    }
-    return {
-      planId,
-      features: plan.features ?? [],
-      quotas: plan.quotas ?? {}
-    };
-  }
-  /** Convenience helper for tests / synchronous checks in the UI manifest. */
-  async hasFeature(tenantId, featureKey) {
-    const snap = await this.snapshot(tenantId);
-    return snap.features.includes(featureKey);
-  }
-  async quotaLimit(tenantId, quotaKey) {
-    const snap = await this.snapshot(tenantId);
-    const value = snap.quotas[quotaKey];
-    return value === void 0 ? null : value;
-  }
-  findPlan(planId) {
-    return (this.catalog.plans ?? []).find((p) => p.id === planId);
-  }
-};
-StaticEntitlementService = _ts_decorate16([
-  (0, import_common16.Injectable)(),
-  _ts_param11(0, (0, import_common16.Inject)(PLAN_CATALOG_TOKEN)),
-  _ts_param11(1, (0, import_common16.Inject)(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata11("design:type", Function),
-  _ts_metadata11("design:paramtypes", [
-    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
-    typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
-  ])
-], StaticEntitlementService);
-
-// src/platform/static-feature.guard.ts
-var import_common18 = require("@nestjs/common");
-var import_core4 = require("@nestjs/core");
-
-// src/billing/require-feature.decorator.ts
-var import_common17 = require("@nestjs/common");
-var REQUIRE_FEATURE_KEY = "require-feature";
-
-// src/platform/static-feature.guard.ts
-function _ts_decorate17(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate17, "_ts_decorate");
-function _ts_metadata12(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata12, "_ts_metadata");
-function _ts_param12(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param12, "_ts_param");
-var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/StaticFeatureGuardConfig");
-var StaticFeatureGuard = class {
-  static {
-    __name(this, "StaticFeatureGuard");
-  }
-  reflector;
-  entitlements;
-  config;
-  constructor(reflector, entitlements, config = null) {
-    this.reflector = reflector;
-    this.entitlements = entitlements;
-    this.config = config;
-  }
-  async canActivate(context) {
-    const required = this.reflector.getAllAndOverride(REQUIRE_FEATURE_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!required || required.length === 0) return true;
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) throw new import_common18.ForbiddenException("Nicht authentifiziert");
-    const role = this.config?.userRoleResolver ? this.config.userRoleResolver(user) : user.role ?? user.platformRole;
-    if (role === "SUPER_ADMIN") return true;
-    const tenantId = this.config?.tenantIdResolver ? this.config.tenantIdResolver(request) : request.tenantId ?? user.tenantId;
-    if (!tenantId) throw new import_common18.ForbiddenException("Kein Mandant zugeordnet");
-    const snap = await this.entitlements.snapshot(tenantId);
-    const allowed = required.some((f) => snap.features.includes(f));
-    if (!allowed) {
-      throw new import_common18.ForbiddenException(`Feature ${required.join(" / ")} nicht im aktuellen Plan enthalten.`);
-    }
-    return true;
-  }
-};
-StaticFeatureGuard = _ts_decorate17([
-  (0, import_common18.Injectable)(),
-  _ts_param12(0, (0, import_common18.Inject)(import_core4.Reflector)),
-  _ts_param12(1, (0, import_common18.Inject)(StaticEntitlementService)),
-  _ts_param12(2, (0, import_common18.Optional)()),
-  _ts_param12(2, (0, import_common18.Inject)(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata12("design:type", Function),
-  _ts_metadata12("design:paramtypes", [
-    typeof import_core4.Reflector === "undefined" ? Object : import_core4.Reflector,
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
-    Object
-  ])
-], StaticFeatureGuard);
-
-// src/platform/enforce-quota.interceptor.ts
-var import_common19 = require("@nestjs/common");
-var import_core5 = require("@nestjs/core");
-var import_rxjs2 = require("rxjs");
-var import_operators2 = require("rxjs/operators");
-function _ts_decorate18(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate18, "_ts_decorate");
-function _ts_metadata13(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata13, "_ts_metadata");
-function _ts_param13(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param13, "_ts_param");
-var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform-nest/QuotaProviders");
-var EnforceQuotaInterceptor = class {
-  static {
-    __name(this, "EnforceQuotaInterceptor");
-  }
-  reflector;
-  entitlements;
-  providers;
-  constructor(reflector, entitlements, providers = null) {
-    this.reflector = reflector;
-    this.entitlements = entitlements;
-    this.providers = providers;
-  }
-  intercept(context, next) {
-    const meta = this.reflector.getAllAndOverride(ENFORCE_QUOTA_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!meta?.quotaKey) return next.handle();
-    return (0, import_rxjs2.from)(this.check(context, meta)).pipe((0, import_operators2.switchMap)(() => next.handle()));
-  }
-  async check(context, meta) {
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) return;
-    const role = user.role ?? user.platformRole;
-    if (role === "SUPER_ADMIN") return;
-    const tenantId = request.tenantId ?? user.tenantId;
-    if (!tenantId) return;
-    const provider = (this.providers ?? []).find((p) => p.key === meta.quotaKey);
-    if (!provider) {
-      return;
-    }
-    const limit = await this.entitlements.quotaLimit(tenantId, meta.quotaKey);
-    if (limit === null || limit === -1) return;
-    const current = await provider.count(tenantId);
-    const delta = meta.incrementBy ?? 1;
-    if (current + delta > limit) {
-      throw new LimitExceededError(meta.quotaKey, limit, current);
-    }
-  }
-};
-EnforceQuotaInterceptor = _ts_decorate18([
-  (0, import_common19.Injectable)(),
-  _ts_param13(0, (0, import_common19.Inject)(import_core5.Reflector)),
-  _ts_param13(1, (0, import_common19.Inject)(StaticEntitlementService)),
-  _ts_param13(2, (0, import_common19.Optional)()),
-  _ts_param13(2, (0, import_common19.Inject)(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata13("design:type", Function),
-  _ts_metadata13("design:paramtypes", [
-    typeof import_core5.Reflector === "undefined" ? Object : import_core5.Reflector,
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
-    Object
-  ])
-], EnforceQuotaInterceptor);
-
-// src/platform/tenant-manifest.service.ts
-var import_common20 = require("@nestjs/common");
-function _ts_decorate19(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate19, "_ts_decorate");
-function _ts_metadata14(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata14, "_ts_metadata");
-var TenantManifestService = class {
-  static {
-    __name(this, "TenantManifestService");
-  }
-  entitlements;
-  navItems = [];
-  constructor(entitlements) {
-    this.entitlements = entitlements;
-  }
-  /**
-   * Call in the app's `OnModuleInit`: registers app navigation for the
-   * Tenant UI. Idempotent: the same `id` overwrites.
-   */
-  registerNavItem(item) {
-    const existing = this.navItems.findIndex((i) => i.id === item.id);
-    if (existing >= 0) this.navItems[existing] = item;
-    else this.navItems.push(item);
-  }
-  /** Bulk variant. */
-  registerNavItems(items) {
-    for (const item of items) this.registerNavItem(item);
-  }
-  /**
-   * Returns the filtered manifest for a Tenant. NavItems with
-   * `requiresFeature` are filtered out server-side as soon as none of the
-   * required features are present in the entitlement snapshot.
-   */
-  async getManifest(tenantId) {
-    const snap = await this.entitlements.snapshot(tenantId);
-    const featureSet = new Set(snap.features);
-    const visible = this.navItems.filter((item) => isVisible(item, featureSet)).map((item) => ({
-      ...item
-    })).sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
-    return {
-      schemaVersion: 1,
-      tenant: {
-        id: tenantId
-      },
-      planId: snap.planId,
-      features: snap.features,
-      quotas: snap.quotas,
-      navigation: visible
-    };
-  }
-};
-TenantManifestService = _ts_decorate19([
-  (0, import_common20.Injectable)(),
-  _ts_metadata14("design:type", Function),
-  _ts_metadata14("design:paramtypes", [
-    typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
-  ])
-], TenantManifestService);
-function isVisible(item, features) {
-  if (!item.requiresFeature) return true;
-  const required = Array.isArray(item.requiresFeature) ? item.requiresFeature : [
-    item.requiresFeature
-  ];
-  return required.some((f) => features.has(f));
-}
-__name(isVisible, "isVisible");
-
-// src/platform/tenant-manifest.controller.ts
-var import_common21 = require("@nestjs/common");
-function _ts_decorate20(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate20, "_ts_decorate");
-function _ts_metadata15(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata15, "_ts_metadata");
-function _ts_param14(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param14, "_ts_param");
-function buildTenantManifestController(options) {
-  const path = options.path ?? "tenant/manifest";
-  let GeneratedTenantManifestController = class GeneratedTenantManifestController {
-    static {
-      __name(this, "GeneratedTenantManifestController");
-    }
-    svc;
-    constructor(svc) {
-      this.svc = svc;
-    }
-    async get(req) {
-      const tenantId = req.user?.tenantId ?? req.tenantId;
-      if (!tenantId) {
-        throw new Error("Kein Mandant im Request \u2014 TenantManifest braucht user.tenantId.");
-      }
-      return this.svc.getManifest(tenantId);
-    }
-  };
-  _ts_decorate20([
-    (0, import_common21.Get)(),
-    _ts_param14(0, (0, import_common21.Req)()),
-    _ts_metadata15("design:type", Function),
-    _ts_metadata15("design:paramtypes", [
-      typeof RequestWithUser === "undefined" ? Object : RequestWithUser
-    ]),
-    _ts_metadata15("design:returntype", Promise)
-  ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate20([
-    (0, import_common21.Controller)(path),
-    (0, import_common21.UseGuards)(...options.guards),
-    _ts_param14(0, (0, import_common21.Inject)(TenantManifestService)),
-    _ts_metadata15("design:type", Function),
-    _ts_metadata15("design:paramtypes", [
-      typeof TenantManifestService === "undefined" ? Object : TenantManifestService
-    ])
-  ], GeneratedTenantManifestController);
-  return GeneratedTenantManifestController;
-}
-__name(buildTenantManifestController, "buildTenantManifestController");
-
-// src/platform/saas-platform.module.ts
-function _ts_decorate21(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate21, "_ts_decorate");
-function buildMinimalManifestConfig() {
-  return {
-    useFactory: /* @__PURE__ */ __name((catalog) => ({
-      project: {
-        key: catalog.projectKey,
-        displayName: catalog.app?.name ?? catalog.projectKey,
-        label: catalog.app?.label,
-        icon: catalog.app?.icon,
-        logoUrl: catalog.app?.logoUrl,
-        environment: process.env.NODE_ENV === "production" ? "production" : "development",
-        availableLocales: catalog.marketing?.availableLocales,
-        defaultLocale: catalog.marketing?.availableLocales?.[0]
-      },
-      build: {
-        platformPackageVersion: "0.0.0",
-        appVersion: "0.0.0"
-      },
-      planCatalogSnapshot: {
-        source: "saas-platform-module",
-        hash: "sha256-quickstart",
-        currency: catalog.currency,
-        vatRate: catalog.vatRate,
-        plans: catalog.plans ?? [],
-        features: catalog.features ?? []
-      }
-    }), "useFactory"),
-    inject: [
-      PLAN_CATALOG_TOKEN
-    ]
-  };
-}
-__name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
-var SaasPlatformModule = class _SaasPlatformModule {
-  static {
-    __name(this, "SaasPlatformModule");
-  }
-  static forRoot(options) {
-    const explicit = options.adapters ?? {};
-    const persistence = options.persistence;
-    const adapters = {
-      mfa: explicit.mfa ?? persistence?.core.mfa,
-      audit: explicit.audit ?? persistence?.core.audit,
-      rlsBypass: explicit.rlsBypass ?? persistence?.core.rlsBypass,
-      planCatalogReadSink: explicit.planCatalogReadSink ?? persistence?.planCatalogReadSink,
-      planResolver: explicit.planResolver,
-      subscriptionRepository: explicit.subscriptionRepository ?? persistence?.entitlement?.subscriptionRepository,
-      planVersionRepository: explicit.planVersionRepository ?? persistence?.entitlement?.planVersionRepository,
-      transactionRunner: explicit.transactionRunner ?? persistence?.core.transactionRunner
-    };
-    const missingCore = [
-      "mfa",
-      "audit",
-      "rlsBypass"
-    ].filter((key) => adapters[key] === void 0);
-    if (missingCore.length) {
-      throw new Error(`SaasPlatformModule.forRoot: adapters missing (provide them via \`adapters\` or a \`persistence\` bundle): ${missingCore.join(", ")}`);
-    }
-    const mfaPort = adapters.mfa;
-    const auditPort = adapters.audit;
-    const rlsBypassPort = adapters.rlsBypass;
-    if (!options.planCatalog && (!adapters.planCatalogReadSink || !options.dbCatalog)) {
-      throw new Error("SaasPlatformModule.forRoot: either set `planCatalog` (quickstart YAML path) or, for DB hydration, BOTH a planCatalogReadSink (`adapters`/`persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }).");
-    }
-    if (options.entitlement) {
-      const missing = [];
-      if (!adapters.subscriptionRepository) missing.push("subscriptionRepository");
-      if (!adapters.planVersionRepository) missing.push("planVersionRepository");
-      if (!adapters.transactionRunner) missing.push("transactionRunner");
-      if (missing.length) {
-        throw new Error(`SaasPlatformModule.forRoot: entitlement active, but adapters are missing: ${missing.join(", ")}`);
-      }
-      if (persistence) {
-        (0, import_types.assertPersistenceCapabilities)(persistence.capabilities, {
-          transactions: true,
-          pessimisticLocking: true
-        }, "SaasPlatformModule entitlement (transactional enforceLimit)");
-      }
-    }
-    const dbCatalog = options.dbCatalog;
-    const planCatalogModule = options.planCatalog ? PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
-      global: true
-    }) : PlanCatalogModule.forRoot({
-      projectKey: dbCatalog.projectKey,
-      app: dbCatalog.app,
-      currency: dbCatalog.currency,
-      vatRate: dbCatalog.vatRate,
-      marketing: dbCatalog.marketing,
-      sink: adapters.planCatalogReadSink,
-      imports: options.imports
-    });
-    const appInfo = options.app ?? {
-      key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
-      version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
-    };
-    const imports = [
-      planCatalogModule,
-      DiscoveryModule.forRoot({
-        app: appInfo,
-        controller: {
-          guards: options.controller.guards
-        },
-        imports: options.imports,
-        snapshotPath: options.discoverySnapshotPath === void 0 ? "var/discovery-snapshot.json" : options.discoverySnapshotPath
-      }),
-      AdminModule.forRoot({
-        mfaPort,
-        auditPort,
-        rlsBypassPort,
-        global: true
-      }),
-      AdminManifestModule.forRoot({
-        config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
-        guards: options.controller.guards,
-        reloadGuards: options.reloadGuards,
-        // Global like AdminModule above: apps register their manifest
-        // contribution by injecting AdminManifestService into one of
-        // their own modules (handbook §6.6). Re-exporting the module
-        // from here does not make that injection resolvable.
-        global: true
-      })
-    ];
-    if (options.entitlement) {
-      imports.push(EntitlementModule.forRoot({
-        subscriptionRepository: adapters.subscriptionRepository,
-        planVersionRepository: adapters.planVersionRepository,
-        transactionRunner: adapters.transactionRunner,
-        resolutionConfig: options.entitlement.resolutionConfig,
-        subscriptionContractRepository: persistence?.entitlement?.subscriptionContractRepository,
-        subscriptionBundleRepository: persistence?.entitlement?.subscriptionBundleRepository,
-        bundleRepository: persistence?.entitlement?.bundleRepository
-      }));
-    }
-    const lightweightProviders = [];
-    const lightweightExports = [];
-    const hasResolver = !!adapters.planResolver;
-    const hasFallback = !!options.defaultPlanId;
-    if (hasResolver || hasFallback) {
-      lightweightProviders.push(hasResolver ? asProvider(PLAN_RESOLVER_PORT_TOKEN, adapters.planResolver) : {
-        provide: PLAN_RESOLVER_PORT_TOKEN,
-        useValue: new StaticPlanResolver(options.defaultPlanId)
-      }, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, ...options.quotaProviders ?? [], {
-        provide: QUOTA_PROVIDERS_TOKEN,
-        useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
-        inject: options.quotaProviders ?? []
-      }, {
-        provide: import_core6.APP_GUARD,
-        useExisting: StaticFeatureGuard
-      }, {
-        provide: import_core6.APP_INTERCEPTOR,
-        useExisting: EnforceQuotaInterceptor
-      });
-      lightweightExports.push(PLAN_RESOLVER_PORT_TOKEN, StaticEntitlementService, StaticFeatureGuard, EnforceQuotaInterceptor, QUOTA_PROVIDERS_TOKEN);
-    }
-    const tenantControllers = [];
-    if (options.tenantManifest) {
-      if (!hasResolver && !hasFallback) {
-        throw new Error("SaasPlatformModule.forRoot: tenantManifest erfordert defaultPlanId oder adapters.planResolver, sonst kann das Manifest keine Features aufl\xF6sen.");
-      }
-      lightweightProviders.push(TenantManifestService);
-      lightweightExports.push(TenantManifestService);
-      tenantControllers.push(buildTenantManifestController(options.tenantManifest));
-    }
-    return {
-      module: _SaasPlatformModule,
-      imports,
-      providers: lightweightProviders,
-      controllers: tenantControllers,
-      exports: [
-        PlanCatalogModule,
-        DiscoveryModule,
-        AdminModule,
-        // ADMIN_MANIFEST_CONFIG travels transitively: re-exporting an
-        // imported module's token directly is an UnknownExportException
-        // at boot — the module export below already carries it.
-        AdminManifestModule,
-        ...options.entitlement ? [
-          EntitlementModule
-        ] : [],
-        ...lightweightExports
-      ],
-      global: true
-    };
-  }
-};
-SaasPlatformModule = _ts_decorate21([
-  (0, import_common22.Module)({})
-], SaasPlatformModule);
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  AdminManifestService,
-  EnforceQuotaInterceptor,
-  PLAN_RESOLVER_PORT_TOKEN,
-  QUOTA_PROVIDERS_TOKEN,
-  STATIC_FEATURE_GUARD_CONFIG_TOKEN,
-  SaasPlatformModule,
-  StaticEntitlementService,
-  StaticFeatureGuard,
-  StaticPlanResolver,
-  TenantManifestService,
-  buildTenantManifestController
-});
+'use strict';
+// Generated by scripts/build-cjs-stubs.mjs — do not edit.
+// Thin re-export so every entry shares one set of class objects.
+module.exports = require('../_entries.cjs').platformNs;