@saasicat/nest 0.8.0 → 0.10.0

package/dist/registration/index.cjs

@@ -1,1655 +1,4 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/registration/index.ts
-var registration_exports = {};
-__export(registration_exports, {
-  ACTIVATION_ORCHESTRATOR_TOKEN: () => ACTIVATION_ORCHESTRATOR_TOKEN,
-  BaseIpRateLimitGuard: () => BaseIpRateLimitGuard,
-  ContinueRegistrationDto: () => ContinueRegistrationDto,
-  CronExpression: () => import_schedule.CronExpression,
-  PASSWORD_HASHER_TOKEN: () => PASSWORD_HASHER_TOKEN,
-  PAYMENT_EVENT_LOG_TOKEN: () => PAYMENT_EVENT_LOG_TOKEN,
-  PAYMENT_PROVIDER_TOKEN: () => PAYMENT_PROVIDER_TOKEN,
-  PENDING_REGISTRATION_REPOSITORY_TOKEN: () => PENDING_REGISTRATION_REPOSITORY_TOKEN,
-  PLAN_CATALOG_LOOKUP_TOKEN: () => PLAN_CATALOG_LOOKUP_TOKEN,
-  PaymentWebhookDto: () => PaymentWebhookDto,
-  PendingRegistrationService: () => PendingRegistrationService,
-  PreviewRegistrationPromoDto: () => PreviewRegistrationPromoDto,
-  REGISTRATION_AUDIT_LOGGER_TOKEN: () => REGISTRATION_AUDIT_LOGGER_TOKEN,
-  REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN: () => REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN,
-  REGISTRATION_CONFIG_TOKEN: () => REGISTRATION_CONFIG_TOKEN,
-  REGISTRATION_OTP_DELIVERY_TOKEN: () => REGISTRATION_OTP_DELIVERY_TOKEN,
-  REGISTRATION_PROMO_PREVIEW_TOKEN: () => REGISTRATION_PROMO_PREVIEW_TOKEN,
-  REGISTRATION_RESUME_BASE_URL_TOKEN: () => REGISTRATION_RESUME_BASE_URL_TOKEN,
-  REGISTRATION_RESUME_DELIVERY_TOKEN: () => REGISTRATION_RESUME_DELIVERY_TOKEN,
-  REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN: () => REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN,
-  RegisterStartDto: () => RegisterStartDto,
-  RegistrationCleanupCron: () => RegistrationCleanupCron,
-  RegistrationModule: () => RegistrationModule,
-  ResendRegistrationOtpDto: () => ResendRegistrationOtpDto,
-  SLUG_AVAILABILITY_CHECK_TOKEN: () => SLUG_AVAILABILITY_CHECK_TOKEN,
-  SaveRegistrationConfigDto: () => SaveRegistrationConfigDto,
-  SaveRegistrationConfigSelectionDto: () => SaveRegistrationConfigSelectionDto,
-  SelectRegistrationPlanDto: () => SelectRegistrationPlanDto,
-  StartRegistrationCheckoutDto: () => StartRegistrationCheckoutDto,
-  USER_ACCOUNT_LOOKUP_TOKEN: () => USER_ACCOUNT_LOOKUP_TOKEN,
-  VerifyRegistrationOtpDto: () => VerifyRegistrationOtpDto,
-  computeBreakdown: () => computeBreakdown,
-  generateOtpCode: () => generateOtpCode,
-  hashOtpCode: () => hashOtpCode,
-  resolveModel: () => resolveModel,
-  slugify: () => slugify,
-  verifyOtpCode: () => verifyOtpCode
-});
-module.exports = __toCommonJS(registration_exports);
-
-// src/registration/helpers.ts
-var import_node_crypto = require("crypto");
-function generateOtpCode() {
-  return String((0, import_node_crypto.randomInt)(1e5, 1e6));
-}
-__name(generateOtpCode, "generateOtpCode");
-function hashOtpCode(code) {
-  return (0, import_node_crypto.createHash)("sha256").update(code).digest("hex");
-}
-__name(hashOtpCode, "hashOtpCode");
-function verifyOtpCode(expectedHash, code) {
-  const actual = hashOtpCode(code);
-  if (actual.length !== expectedHash.length) {
-    return false;
-  }
-  try {
-    return (0, import_node_crypto.timingSafeEqual)(Buffer.from(actual, "hex"), Buffer.from(expectedHash, "hex"));
-  } catch {
-    return false;
-  }
-}
-__name(verifyOtpCode, "verifyOtpCode");
-function slugify(name) {
-  const transliterated = name.toLowerCase().replace(/ß/g, "ss").replace(/ä/g, "ae").replace(/ö/g, "oe").replace(/ü/g, "ue").normalize("NFKD").replace(/[̀-ͯ]/g, "");
-  const slug = transliterated.replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return slug || "verein";
-}
-__name(slugify, "slugify");
-
-// src/registration/tokens.ts
-var PENDING_REGISTRATION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol("PENDING_REGISTRATION_REPOSITORY");
-var REGISTRATION_OTP_DELIVERY_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_OTP_DELIVERY");
-var USER_ACCOUNT_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("USER_ACCOUNT_LOOKUP");
-var SLUG_AVAILABILITY_CHECK_TOKEN = /* @__PURE__ */ Symbol("SLUG_AVAILABILITY_CHECK");
-var PASSWORD_HASHER_TOKEN = /* @__PURE__ */ Symbol("PASSWORD_HASHER");
-var PLAN_CATALOG_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("PLAN_CATALOG_LOOKUP");
-var PAYMENT_PROVIDER_TOKEN = /* @__PURE__ */ Symbol("PAYMENT_PROVIDER");
-var PAYMENT_EVENT_LOG_TOKEN = /* @__PURE__ */ Symbol("PAYMENT_EVENT_LOG");
-var ACTIVATION_ORCHESTRATOR_TOKEN = /* @__PURE__ */ Symbol("ACTIVATION_ORCHESTRATOR");
-var REGISTRATION_AUDIT_LOGGER_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_AUDIT_LOGGER");
-var REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_TOKEN_SIGNER");
-var REGISTRATION_RESUME_DELIVERY_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_DELIVERY");
-var REGISTRATION_RESUME_BASE_URL_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_RESUME_BASE_URL");
-var REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_CONFIGURATOR_LOOKUP");
-var REGISTRATION_PROMO_PREVIEW_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_PROMO_PREVIEW");
-var REGISTRATION_CONFIG_TOKEN = /* @__PURE__ */ Symbol("REGISTRATION_CONFIG");
-
-// src/registration/pending-registration.service.ts
-var import_common = require("@nestjs/common");
-var import_types = require("@saasicat/types");
-var import_types2 = require("@saasicat/types");
-
-// src/registration/pricing.ts
-function round2(value) {
-  return Math.round(value * 100) / 100;
-}
-__name(round2, "round2");
-function computeBreakdown(catalog, selection, promo) {
-  const model = catalog.models.find((m) => m.id === selection.modelId);
-  if (!model) {
-    throw new Error(`Unknown model: ${selection.modelId}`);
-  }
-  const modelMonthlyNet = round2(model.monthlyNet);
-  const effectiveQuotas = {
-    ...model.quotaBase
-  };
-  const subtotalMonthlyNet = modelMonthlyNet;
-  const factor = selection.billingCycle === "YEARLY" ? catalog.cycleDiscount : 1;
-  const subtotalNet = round2(subtotalMonthlyNet * factor);
-  const discountAmount = promo ? Math.min(round2(promo.discountAmount), subtotalNet) : 0;
-  const totalNet = Math.max(0, round2(subtotalNet - discountAmount));
-  const totalGross = round2(totalNet * (1 + catalog.vatRate / 100));
-  const yearlySavings = selection.billingCycle === "YEARLY" ? round2(subtotalMonthlyNet * 12 - subtotalMonthlyNet * catalog.cycleDiscount) : 0;
-  return {
-    cycle: selection.billingCycle,
-    effectiveQuotas,
-    modelMonthlyNet,
-    subtotalMonthlyNet,
-    subtotalNet,
-    discountAmount,
-    totalNet,
-    vatRate: catalog.vatRate,
-    totalGross,
-    yearlySavings,
-    appliedPromo: promo ? {
-      code: "",
-      label: promo.label,
-      percent: promo.percent
-    } : void 0
-  };
-}
-__name(computeBreakdown, "computeBreakdown");
-function resolveModel(catalog, modelId) {
-  const model = catalog.models.find((m) => m.id === modelId);
-  if (!model) throw new Error(`Unknown model: ${modelId}`);
-  return {
-    planId: model.planId,
-    monthlyNet: model.monthlyNet,
-    yearlyNet: model.yearlyNet
-  };
-}
-__name(resolveModel, "resolveModel");
-
-// src/registration/pending-registration.service.ts
-function _ts_decorate(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate, "_ts_decorate");
-function _ts_metadata(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param, "_ts_param");
-var PendingRegistrationService = class _PendingRegistrationService {
-  static {
-    __name(this, "PendingRegistrationService");
-  }
-  repo;
-  otpDelivery;
-  userLookup;
-  slugCheck;
-  passwordHasher;
-  planCatalog;
-  paymentProvider;
-  paymentEventLog;
-  activationOrchestrator;
-  audit;
-  resumeTokenSigner;
-  resumeDelivery;
-  resumeBaseUrl;
-  configuratorLookup;
-  promoPreview;
-  logger = new import_common.Logger(_PendingRegistrationService.name);
-  constructor(repo, otpDelivery, userLookup, slugCheck, passwordHasher, planCatalog, paymentProvider, paymentEventLog, activationOrchestrator, audit, resumeTokenSigner, resumeDelivery, resumeBaseUrl, configuratorLookup, promoPreview) {
-    this.repo = repo;
-    this.otpDelivery = otpDelivery;
-    this.userLookup = userLookup;
-    this.slugCheck = slugCheck;
-    this.passwordHasher = passwordHasher;
-    this.planCatalog = planCatalog;
-    this.paymentProvider = paymentProvider;
-    this.paymentEventLog = paymentEventLog;
-    this.activationOrchestrator = activationOrchestrator;
-    this.audit = audit;
-    this.resumeTokenSigner = resumeTokenSigner;
-    this.resumeDelivery = resumeDelivery;
-    this.resumeBaseUrl = resumeBaseUrl;
-    this.configuratorLookup = configuratorLookup;
-    this.promoPreview = promoPreview;
-  }
-  async record(eventType, pendingRegistrationId, context, metadata) {
-    try {
-      await this.audit.log({
-        eventType,
-        pendingRegistrationId,
-        context,
-        metadata
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.warn(`Audit-Log fehlgeschlagen (${eventType}): ${message}`);
-    }
-  }
-  /** Public signup plan list for step 3 (frontend `usePublicPlans()`). */
-  async listPublicPlans() {
-    return this.planCatalog.listPublicSignupPlans();
-  }
-  async selectPlan(input, context) {
-    const pending = await this.repo.findById(input.pendingRegistrationId);
-    if (!pending) {
-      throw new import_common.NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
-    }
-    if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common.BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
-    }
-    if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common.BadRequestException({
-        code: "INVALID_REGISTRATION_STATE"
-      });
-    }
-    const plan = await this.planCatalog.findPublicSignupPlan(input.planId);
-    if (!plan) {
-      throw new import_common.BadRequestException({
-        code: "PLAN_NOT_AVAILABLE"
-      });
-    }
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types2.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
-    const updated = await this.repo.update(pending.id, {
-      status: "PLAN_SELECTED",
-      currentStep: 4,
-      selectedPlanId: plan.id,
-      expiresAt
-    });
-    await this.record("PLAN_SELECTED", updated.id, context, {
-      planId: plan.id
-    });
-    return {
-      pendingRegistrationId: updated.id,
-      status: updated.status,
-      nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[updated.status],
-      selectedPlanId: updated.selectedPlanId ?? plan.id
-    };
-  }
-  async startCheckout(input, context) {
-    const pending = await this.repo.findById(input.pendingRegistrationId);
-    if (!pending) {
-      throw new import_common.NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
-    }
-    if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common.BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
-    }
-    if (pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common.BadRequestException({
-        code: "PLAN_NOT_SELECTED"
-      });
-    }
-    if (!pending.selectedPlanId) {
-      throw new import_common.BadRequestException({
-        code: "PLAN_NOT_SELECTED"
-      });
-    }
-    const plan = await this.planCatalog.findPublicSignupPlan(pending.selectedPlanId);
-    if (!plan) {
-      throw new import_common.BadRequestException({
-        code: "PLAN_NOT_AVAILABLE"
-      });
-    }
-    const session = await this.paymentProvider.createCheckoutSession({
-      pendingRegistrationId: pending.id,
-      planId: pending.selectedPlanId,
-      email: pending.email,
-      successUrl: input.successUrl,
-      cancelUrl: input.cancelUrl
-    });
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types2.PENDING_CHECKOUT_TTL_DAYS * 24 * 60 * 60 * 1e3);
-    const updated = await this.repo.update(pending.id, {
-      status: "CHECKOUT_STARTED",
-      currentStep: 4,
-      checkoutSessionId: session.sessionId,
-      checkoutStartedAt: now,
-      expiresAt
-    });
-    await this.record("CHECKOUT_STARTED", updated.id, context, {
-      sessionId: session.sessionId,
-      provider: session.provider
-    });
-    return {
-      pendingRegistrationId: updated.id,
-      status: updated.status,
-      nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[updated.status],
-      checkoutSessionId: session.sessionId,
-      checkoutUrl: session.checkoutUrl
-    };
-  }
-  /**
-   * Processes a payment webhook idempotently:
-   *  1. `tryClaim` pins the event ID via a @unique INSERT. Duplicates are
-   *     dropped silently (`ALREADY_PROCESSED`).
-   *  2. On status `SUCCEEDED` the PendingRegistration is resolved from the
-   *     checkout session and the ActivationOrchestrator triggers the final
-   *     user+tenant+subscription creation in a single transaction.
-   *  3. After activation the PendingRegistration is deleted.
-   *
-   * On errors in step 2/3 the EventLog entry remains — provider retries then
-   * run into ALREADY_PROCESSED. Operational repair is done manually (status
-   * inspection + cleanup).
-   */
-  async handlePaymentEvent(input, context) {
-    const claimed = await this.paymentEventLog.tryClaim(input.eventId, {
-      provider: input.provider,
-      sessionId: input.sessionId,
-      status: input.status,
-      rawPayload: input.rawPayload
-    });
-    if (!claimed) {
-      this.logger.warn(`Idempotenz: PaymentEvent ${input.eventId} bereits verarbeitet \u2014 Duplikat verworfen.`);
-      await this.record("PAYMENT_DUPLICATE_IGNORED", null, context, {
-        eventId: input.eventId,
-        sessionId: input.sessionId
-      });
-      return {
-        activated: false,
-        reason: "ALREADY_PROCESSED"
-      };
-    }
-    if (input.status !== "SUCCEEDED") {
-      await this.record("PAYMENT_FAILED", null, context, {
-        eventId: input.eventId,
-        sessionId: input.sessionId
-      });
-      return {
-        activated: false,
-        reason: "PAYMENT_NOT_SUCCEEDED"
-      };
-    }
-    if (!input.sessionId) {
-      return {
-        activated: false,
-        reason: "MISSING_SESSION_ID"
-      };
-    }
-    const pending = await this.repo.findByCheckoutSession(input.sessionId);
-    if (!pending) {
-      return {
-        activated: false,
-        reason: "PENDING_REGISTRATION_NOT_FOUND"
-      };
-    }
-    if (pending.status !== "CHECKOUT_STARTED" && pending.status !== "PLAN_SELECTED") {
-      return {
-        activated: false,
-        reason: "INVALID_STATE"
-      };
-    }
-    await this.record("PAYMENT_RECEIVED", pending.id, context, {
-      eventId: input.eventId,
-      sessionId: input.sessionId
-    });
-    const result = await this.activationOrchestrator.activate(pending);
-    await this.repo.delete(pending.id);
-    await this.record("ACTIVATION_COMPLETED", pending.id, context, {
-      userId: result.userId,
-      tenantId: result.tenantId,
-      subscriptionId: result.subscriptionId
-    });
-    this.logger.log(`Aktivierung erfolgreich: pending=${pending.id} \u2192 user=${result.userId} tenant=${result.tenantId} subscription=${result.subscriptionId}`);
-    return {
-      activated: true,
-      result
-    };
-  }
-  /**
-   * Deletes all PendingRegistration records with `expiresAt < now`.
-   * Full deletion (no anonymization path) is the simpler option: the schema
-   * holds `email`, `firstName`, `lastName`, `passwordHash` as NOT NULL, and
-   * the unique email is exactly what needs to become free again after expiry.
-   *
-   * The batch `limit` guards against memory spikes on large backlogs — the
-   * caller (cron) keeps calling until `moreAvailable === false`.
-   */
-  async runCleanup(now, limit = 500) {
-    if (limit <= 0) {
-      return {
-        deleted: 0,
-        moreAvailable: false
-      };
-    }
-    const expired = await this.repo.findExpired(now, limit);
-    for (const pending of expired) {
-      try {
-        await this.repo.delete(pending.id);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        this.logger.warn(`Cleanup: PendingRegistration ${pending.id} konnte nicht geloescht werden (${message}).`);
-      }
-    }
-    if (expired.length > 0) {
-      this.logger.log(`Cleanup: ${expired.length} abgelaufene PendingRegistrations geloescht.`);
-    }
-    return {
-      deleted: expired.length,
-      moreAvailable: expired.length >= limit
-    };
-  }
-  async start(input, context) {
-    const email = normalizeEmail(input.email);
-    if (await this.userLookup.hasActiveUser(email)) {
-      this.logger.log(`register/start fuer aktiven Account ignoriert (${email}).`);
-      await this.record("REGISTRATION_NEUTRAL_ACTIVE_USER", null, context);
-      return {
-        neutral: true
-      };
-    }
-    const existing = await this.repo.findByEmail(email);
-    if (existing) {
-      if (existing.expiresAt.getTime() < Date.now()) {
-        await this.repo.delete(existing.id);
-        await this.record("REGISTRATION_NEUTRAL_EXPIRED", existing.id, context);
-      } else if (existing.status === "PENDING_EMAIL_VERIFICATION") {
-        await this.regenerateOtp(existing);
-        await this.record("REGISTRATION_NEUTRAL_REPLAY", existing.id, context, {
-          status: existing.status
-        });
-        return {
-          neutral: true
-        };
-      } else {
-        if (this.resumeTokenSigner && this.resumeDelivery) {
-          await this.sendResumeLink(existing);
-        } else {
-          await this.regenerateOtp(existing);
-        }
-        await this.record("REGISTRATION_NEUTRAL_REPLAY", existing.id, context, {
-          status: existing.status
-        });
-        return {
-          neutral: true
-        };
-      }
-    }
-    const slug = await this.resolveSlug(input.tenantName, input.tenantSlug);
-    const passwordHash = await this.passwordHasher.hash(input.password);
-    const code = generateOtpCode();
-    const otpHash = hashOtpCode(code);
-    const now = /* @__PURE__ */ new Date();
-    const otpExpiresAt = new Date(now.getTime() + import_types2.OTP_TTL_MINUTES * 60 * 1e3);
-    const expiresAt = new Date(now.getTime() + import_types2.PENDING_EMAIL_TTL_HOURS * 60 * 60 * 1e3);
-    const pending = await this.repo.create({
-      tenantName: input.tenantName.trim(),
-      tenantSlug: slug,
-      salutation: nullable(input.salutation),
-      firstName: input.firstName.trim(),
-      lastName: input.lastName.trim(),
-      email,
-      passwordHash,
-      locale: input.locale ?? "de",
-      otpHash,
-      otpExpiresAt,
-      expiresAt
-    });
-    await this.deliverOtp(pending, code);
-    await this.record("REGISTRATION_STARTED", pending.id, context);
-    return {
-      neutral: true
-    };
-  }
-  async verifyOtp(emailRaw, code, context) {
-    const email = normalizeEmail(emailRaw);
-    const pending = await this.repo.findByEmail(email);
-    if (!pending) {
-      await this.record("OTP_VERIFY_FAILED", null, context, {
-        reason: "unknown_email"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_INVALID"
-      });
-    }
-    if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
-      return {
-        status: pending.status,
-        nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[pending.status],
-        pendingRegistrationId: pending.id
-      };
-    }
-    if (!pending.otpHash || !pending.otpExpiresAt) {
-      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
-        reason: "no_otp_set"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_INVALID"
-      });
-    }
-    if (pending.otpExpiresAt.getTime() < Date.now()) {
-      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
-        reason: "expired"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_EXPIRED"
-      });
-    }
-    const maxAttempts = resolveOtpVerifyMaxAttempts();
-    if (pending.otpAttemptCount >= maxAttempts) {
-      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
-        reason: "locked"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_LOCKED"
-      });
-    }
-    const attemptCount = await this.repo.incrementOtpAttemptCount(pending.id);
-    if (attemptCount > maxAttempts) {
-      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
-        reason: "locked"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_LOCKED"
-      });
-    }
-    if (!verifyOtpCode(pending.otpHash, code)) {
-      await this.record("OTP_VERIFY_FAILED", pending.id, context, {
-        reason: "wrong_code"
-      });
-      throw new import_common.BadRequestException({
-        code: "OTP_INVALID"
-      });
-    }
-    const now = /* @__PURE__ */ new Date();
-    const updated = await this.repo.update(pending.id, {
-      status: "EMAIL_VERIFIED",
-      currentStep: 3,
-      emailVerifiedAt: now,
-      otpHash: null,
-      otpExpiresAt: null,
-      expiresAt: new Date(now.getTime() + import_types2.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3)
-    });
-    await this.record("OTP_VERIFIED", updated.id, context);
-    return {
-      status: updated.status,
-      nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[updated.status],
-      pendingRegistrationId: updated.id
-    };
-  }
-  async resendOtp(emailRaw, context) {
-    const email = normalizeEmail(emailRaw);
-    const pending = await this.repo.findByEmail(email);
-    if (!pending) {
-      return {
-        neutral: true
-      };
-    }
-    if (pending.status !== "PENDING_EMAIL_VERIFICATION") {
-      return {
-        neutral: true
-      };
-    }
-    await this.regenerateOtp(pending);
-    await this.record("OTP_RESEND_REQUESTED", pending.id, context);
-    return {
-      neutral: true
-    };
-  }
-  async regenerateOtp(pending) {
-    const now = /* @__PURE__ */ new Date();
-    const windowMs = import_types2.OTP_RATE_LIMIT_WINDOW_MINUTES * 60 * 1e3;
-    const withinWindow = pending.lastOtpSentAt !== null && now.getTime() - pending.lastOtpSentAt.getTime() < windowMs;
-    if (withinWindow && pending.otpSendCount >= import_types2.OTP_RATE_LIMIT_MAX_SENDS) {
-      this.logger.warn(`OTP-Rate-Limit erreicht fuer ${pending.email} \u2014 Send wird still verworfen.`);
-      return;
-    }
-    const code = generateOtpCode();
-    const otpHash = hashOtpCode(code);
-    const otpExpiresAt = new Date(now.getTime() + import_types2.OTP_TTL_MINUTES * 60 * 1e3);
-    const otpSendCount = withinWindow ? pending.otpSendCount + 1 : 1;
-    await this.repo.update(pending.id, {
-      otpHash,
-      otpExpiresAt,
-      otpSendCount,
-      lastOtpSentAt: now,
-      // New code = fresh attempt budget. Overall throughput stays capped
-      // by the send rate limit above.
-      otpAttemptCount: 0
-    });
-    await this.deliverOtp(pending, code);
-  }
-  async deliverOtp(pending, code) {
-    try {
-      await this.otpDelivery.sendVerificationOtp({
-        to: pending.email,
-        code,
-        firstName: pending.firstName,
-        locale: pending.locale
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`OTP-Mail an ${pending.email} fehlgeschlagen: ${message}`);
-    }
-  }
-  /**
-   * Creates a signed resume token (60 min TTL) and sends a magic link to the
-   * stored email. Mail send errors are logged but not escalated
-   * (account-enumeration protection).
-   */
-  async sendResumeLink(pending) {
-    if (!this.resumeTokenSigner || !this.resumeDelivery) {
-      return;
-    }
-    const token = await this.resumeTokenSigner.sign({
-      pendingRegistrationId: pending.id,
-      ttlMinutes: import_types.REGISTRATION_RESUME_TTL_MINUTES
-    });
-    const base = (this.resumeBaseUrl ?? "http://localhost").replace(/\/+$/, "");
-    const url = `${base}/login?resume=${encodeURIComponent(token)}`;
-    try {
-      await this.resumeDelivery.sendResumeEmail({
-        to: pending.email,
-        firstName: pending.firstName,
-        locale: pending.locale,
-        resumeUrl: url
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.error(`Resume-Mail an ${pending.email} fehlgeschlagen: ${message}`);
-    }
-  }
-  /**
-   * Resolves a resume token to the matching onboarding step. Called by the
-   * frontend from `/register?resume=<jwt>`. On an invalid token the method
-   * throws `RESUME_TOKEN_INVALID`.
-   *
-   * Also returns a public-safe snapshot of the PendingRegistration so the
-   * frontend can prefill completed steps with the existing data (first name /
-   * last name, organization name, plan selection ...).
-   */
-  async resumeWithToken(input, context) {
-    if (!this.resumeTokenSigner) {
-      throw new import_common.BadRequestException({
-        code: "RESUME_NOT_CONFIGURED"
-      });
-    }
-    let decoded;
-    try {
-      decoded = await this.resumeTokenSigner.verify(input.token);
-    } catch {
-      throw new import_common.BadRequestException({
-        code: "RESUME_TOKEN_INVALID"
-      });
-    }
-    const pending = await this.repo.findById(decoded.pendingRegistrationId);
-    if (!pending) {
-      throw new import_common.BadRequestException({
-        code: "RESUME_TOKEN_INVALID"
-      });
-    }
-    if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common.BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
-    }
-    await this.record("REGISTRATION_NEUTRAL_REPLAY", pending.id, context, {
-      via: "resume_token",
-      status: pending.status
-    });
-    return {
-      pendingRegistrationId: pending.id,
-      status: pending.status,
-      nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[pending.status],
-      snapshot: toSnapshot(pending)
-    };
-  }
-  /**
-   * Signs a short-lived resume token for an existing PendingRegistration —
-   * the login endpoint uses this to send the user into the wizard with
-   * prefill after successful password verification.
-   */
-  async signResumeToken(pendingRegistrationId) {
-    if (!this.resumeTokenSigner) return null;
-    return this.resumeTokenSigner.sign({
-      pendingRegistrationId
-    });
-  }
-  /* ─── Configurator (Step 3) ────────────────────────────────────────── */
-  /** Returns the (app-specific) configurator catalog. */
-  async getConfiguratorCatalog() {
-    if (!this.configuratorLookup) {
-      throw new import_common.BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
-    }
-    return this.configuratorLookup.getCatalog();
-  }
-  /**
-   * Saves the configurator selection (model + cycle + promo) and returns the
-   * full price breakdown.
-   *
-   * Sets:
-   *  - `status = PLAN_SELECTED`
-   *  - `currentStep = 4`
-   *  - `selectedPlanId = <planId from the chosen model>`
-   *  - `configJson` / `billingCycle` / `appliedPromoCode`
-   *  - `expiresAt = now + ONBOARDING_TTL`
-   */
-  async saveConfiguration(input, context) {
-    if (!this.configuratorLookup) {
-      throw new import_common.BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
-    }
-    const pending = await this.repo.findById(input.pendingRegistrationId);
-    if (!pending) {
-      throw new import_common.NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
-    }
-    if (pending.expiresAt.getTime() < Date.now()) {
-      throw new import_common.BadRequestException({
-        code: "PENDING_REGISTRATION_EXPIRED"
-      });
-    }
-    if (pending.status !== "EMAIL_VERIFIED" && pending.status !== "PLAN_SELECTED" && pending.status !== "CHECKOUT_STARTED") {
-      throw new import_common.BadRequestException({
-        code: "INVALID_REGISTRATION_STATE"
-      });
-    }
-    const catalog = await this.configuratorLookup.getCatalog();
-    const model = catalog.models.find((m) => m.id === input.selection.modelId);
-    if (!model) {
-      throw new import_common.BadRequestException({
-        code: "MODEL_NOT_AVAILABLE"
-      });
-    }
-    let promoEval;
-    if (input.selection.appliedPromoCode && this.promoPreview) {
-      const dryRun = computeBreakdown(catalog, {
-        ...input.selection,
-        appliedPromoCode: null
-      });
-      const previewResult = await this.promoPreview.preview({
-        code: input.selection.appliedPromoCode,
-        planId: model.planId,
-        billingCycle: input.selection.billingCycle,
-        subtotalGross: dryRun.totalGross,
-        email: pending.email
-      });
-      if (previewResult.valid && previewResult.discountAmount && previewResult.percent !== void 0 && previewResult.label) {
-        promoEval = {
-          discountAmount: previewResult.discountAmount,
-          percent: previewResult.percent,
-          label: previewResult.label
-        };
-      }
-    }
-    const breakdown = computeBreakdown(catalog, input.selection, promoEval);
-    if (promoEval) {
-      breakdown.appliedPromo = {
-        code: input.selection.appliedPromoCode,
-        label: promoEval.label,
-        percent: promoEval.percent
-      };
-    }
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + import_types2.PENDING_ONBOARDING_TTL_DAYS * 24 * 60 * 60 * 1e3);
-    const updated = await this.repo.update(pending.id, {
-      status: "PLAN_SELECTED",
-      currentStep: 4,
-      selectedPlanId: model.planId,
-      configJson: input.selection,
-      billingCycle: input.selection.billingCycle,
-      appliedPromoCode: input.selection.appliedPromoCode ?? null,
-      expiresAt
-    });
-    await this.record("PLAN_SELECTED", updated.id, context, {
-      modelId: model.id,
-      planId: model.planId,
-      cycle: input.selection.billingCycle,
-      hasPromo: !!promoEval
-    });
-    return {
-      pendingRegistrationId: updated.id,
-      status: updated.status,
-      nextStep: import_types2.REGISTRATION_STEP_BY_STATUS[updated.status],
-      selection: input.selection,
-      breakdown
-    };
-  }
-  /**
-   * Validates a promo code against the currently stored configuration and
-   * returns a new breakdown. Does NOT modify the pending — for live preview
-   * in the frontend. If `null` is passed as `code`, the promo effect is
-   * removed.
-   */
-  async previewConfigPromo(pendingRegistrationId, code) {
-    if (!this.configuratorLookup) {
-      throw new import_common.BadRequestException({
-        code: "CONFIGURATOR_NOT_CONFIGURED"
-      });
-    }
-    const pending = await this.repo.findById(pendingRegistrationId);
-    if (!pending) {
-      throw new import_common.NotFoundException({
-        code: "PENDING_REGISTRATION_NOT_FOUND"
-      });
-    }
-    const config = pending.configJson;
-    if (!config) {
-      throw new import_common.BadRequestException({
-        code: "CONFIG_NOT_SAVED"
-      });
-    }
-    const catalog = await this.configuratorLookup.getCatalog();
-    const model = catalog.models.find((m) => m.id === config.modelId);
-    if (!model) {
-      throw new import_common.BadRequestException({
-        code: "MODEL_NOT_AVAILABLE"
-      });
-    }
-    let promoEval;
-    if (code && this.promoPreview) {
-      const dryRun = computeBreakdown(catalog, {
-        ...config,
-        appliedPromoCode: null
-      });
-      const previewResult = await this.promoPreview.preview({
-        code,
-        planId: model.planId,
-        billingCycle: config.billingCycle,
-        subtotalGross: dryRun.totalGross,
-        email: pending.email
-      });
-      if (previewResult.valid && previewResult.discountAmount && previewResult.percent !== void 0 && previewResult.label) {
-        promoEval = {
-          discountAmount: previewResult.discountAmount,
-          percent: previewResult.percent,
-          label: previewResult.label
-        };
-      }
-    }
-    const breakdown = computeBreakdown(catalog, config, promoEval);
-    if (promoEval && code) {
-      breakdown.appliedPromo = {
-        code,
-        label: promoEval.label,
-        percent: promoEval.percent
-      };
-    }
-    return breakdown;
-  }
-  /**
-   * Helper for step 3 resume: the frontend needs the current breakdown when
-   * the pending already has a configuration. Pure recomputation against the
-   * catalog (without promo validation, since promos should be freshly checked
-   * anyway).
-   */
-  async getCurrentBreakdown(pendingRegistrationId) {
-    if (!this.configuratorLookup) return null;
-    const pending = await this.repo.findById(pendingRegistrationId);
-    if (!pending || !pending.configJson) return null;
-    const catalog = await this.configuratorLookup.getCatalog();
-    return computeBreakdown(catalog, pending.configJson);
-  }
-  async resolveSlug(tenantName, requested) {
-    const requestedSlug = requested?.trim().toLowerCase() ?? "";
-    const base = requestedSlug.length > 0 ? requestedSlug : slugify(tenantName);
-    if (await this.slugCheck.isSlugAvailable(base)) {
-      return base;
-    }
-    for (let i = 2; i < 1e3; i++) {
-      const candidate = `${base}-${i}`;
-      if (await this.slugCheck.isSlugAvailable(candidate)) {
-        return candidate;
-      }
-    }
-    throw new Error(`Konnte keinen freien Slug fuer "${tenantName}" finden.`);
-  }
-};
-PendingRegistrationService = _ts_decorate([
-  (0, import_common.Injectable)(),
-  _ts_param(0, (0, import_common.Inject)(PENDING_REGISTRATION_REPOSITORY_TOKEN)),
-  _ts_param(1, (0, import_common.Inject)(REGISTRATION_OTP_DELIVERY_TOKEN)),
-  _ts_param(2, (0, import_common.Inject)(USER_ACCOUNT_LOOKUP_TOKEN)),
-  _ts_param(3, (0, import_common.Inject)(SLUG_AVAILABILITY_CHECK_TOKEN)),
-  _ts_param(4, (0, import_common.Inject)(PASSWORD_HASHER_TOKEN)),
-  _ts_param(5, (0, import_common.Inject)(PLAN_CATALOG_LOOKUP_TOKEN)),
-  _ts_param(6, (0, import_common.Inject)(PAYMENT_PROVIDER_TOKEN)),
-  _ts_param(7, (0, import_common.Inject)(PAYMENT_EVENT_LOG_TOKEN)),
-  _ts_param(8, (0, import_common.Inject)(ACTIVATION_ORCHESTRATOR_TOKEN)),
-  _ts_param(9, (0, import_common.Inject)(REGISTRATION_AUDIT_LOGGER_TOKEN)),
-  _ts_param(10, (0, import_common.Optional)()),
-  _ts_param(10, (0, import_common.Inject)(REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN)),
-  _ts_param(11, (0, import_common.Optional)()),
-  _ts_param(11, (0, import_common.Inject)(REGISTRATION_RESUME_DELIVERY_TOKEN)),
-  _ts_param(12, (0, import_common.Optional)()),
-  _ts_param(12, (0, import_common.Inject)(REGISTRATION_RESUME_BASE_URL_TOKEN)),
-  _ts_param(13, (0, import_common.Optional)()),
-  _ts_param(13, (0, import_common.Inject)(REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN)),
-  _ts_param(14, (0, import_common.Optional)()),
-  _ts_param(14, (0, import_common.Inject)(REGISTRATION_PROMO_PREVIEW_TOKEN)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof PendingRegistrationRepository === "undefined" ? Object : PendingRegistrationRepository,
-    typeof RegistrationOtpDelivery === "undefined" ? Object : RegistrationOtpDelivery,
-    typeof UserAccountLookup === "undefined" ? Object : UserAccountLookup,
-    typeof SlugAvailabilityCheck === "undefined" ? Object : SlugAvailabilityCheck,
-    typeof PasswordHasher === "undefined" ? Object : PasswordHasher,
-    typeof PlanCatalogLookup === "undefined" ? Object : PlanCatalogLookup,
-    typeof PaymentProvider === "undefined" ? Object : PaymentProvider,
-    typeof PaymentEventLog === "undefined" ? Object : PaymentEventLog,
-    typeof ActivationOrchestrator === "undefined" ? Object : ActivationOrchestrator,
-    typeof RegistrationAuditLogger === "undefined" ? Object : RegistrationAuditLogger,
-    typeof RegistrationResumeTokenSigner === "undefined" ? Object : RegistrationResumeTokenSigner,
-    typeof RegistrationResumeDelivery === "undefined" ? Object : RegistrationResumeDelivery,
-    String,
-    typeof RegistrationConfiguratorLookup === "undefined" ? Object : RegistrationConfiguratorLookup,
-    typeof RegistrationPromoPreview === "undefined" ? Object : RegistrationPromoPreview
-  ])
-], PendingRegistrationService);
-function normalizeEmail(value) {
-  return value.trim().toLowerCase();
-}
-__name(normalizeEmail, "normalizeEmail");
-function resolveOtpVerifyMaxAttempts() {
-  const raw = process.env.SAAS_PLATFORM_OTP_VERIFY_MAX_ATTEMPTS;
-  if (!raw) return import_types2.OTP_VERIFY_MAX_ATTEMPTS;
-  const parsed = Number.parseInt(raw, 10);
-  return Number.isInteger(parsed) && parsed > 0 ? parsed : import_types2.OTP_VERIFY_MAX_ATTEMPTS;
-}
-__name(resolveOtpVerifyMaxAttempts, "resolveOtpVerifyMaxAttempts");
-function toSnapshot(pending) {
-  return {
-    tenantName: pending.tenantName,
-    tenantSlug: pending.tenantSlug,
-    salutation: pending.salutation,
-    firstName: pending.firstName,
-    lastName: pending.lastName,
-    email: pending.email,
-    locale: pending.locale,
-    status: pending.status,
-    currentStep: pending.currentStep,
-    emailVerifiedAt: pending.emailVerifiedAt?.toISOString() ?? null,
-    selectedPlanId: pending.selectedPlanId,
-    config: pending.configJson,
-    billingCycle: pending.billingCycle,
-    appliedPromoCode: pending.appliedPromoCode,
-    checkoutSessionId: pending.checkoutSessionId
-  };
-}
-__name(toSnapshot, "toSnapshot");
-function nullable(value) {
-  const trimmed = value?.trim();
-  return trimmed && trimmed.length > 0 ? trimmed : null;
-}
-__name(nullable, "nullable");
-
-// src/registration/cleanup.cron.ts
-var import_common2 = require("@nestjs/common");
-var import_schedule = require("@nestjs/schedule");
-function _ts_decorate2(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-var RegistrationCleanupCron = class _RegistrationCleanupCron {
-  static {
-    __name(this, "RegistrationCleanupCron");
-  }
-  service;
-  logger = new import_common2.Logger(_RegistrationCleanupCron.name);
-  constructor(service) {
-    this.service = service;
-  }
-  async runDaily() {
-    await this.runCleanup();
-  }
-  /**
-   * Public API: can be triggered manually from an admin endpoint /
-   * `/admin/registration/run-cleanup` (same pattern as
-   * `PromoCodeExpirer.run` in the consuming apps).
-   */
-  async runCleanup(now = /* @__PURE__ */ new Date(), batchSize = 500) {
-    let totalDeleted = 0;
-    let iterations = 0;
-    const MAX_ITERATIONS = 50;
-    while (iterations < MAX_ITERATIONS) {
-      const result = await this.service.runCleanup(now, batchSize);
-      totalDeleted += result.deleted;
-      iterations++;
-      if (!result.moreAvailable) {
-        break;
-      }
-    }
-    if (totalDeleted > 0) {
-      this.logger.log(`PendingRegistration-Cleanup abgeschlossen: ${totalDeleted} geloescht in ${iterations} Batches.`);
-    }
-  }
-};
-_ts_decorate2([
-  (0, import_schedule.Cron)("15 4 * * *", {
-    timeZone: "Europe/Berlin"
-  }),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", []),
-  _ts_metadata2("design:returntype", Promise)
-], RegistrationCleanupCron.prototype, "runDaily", null);
-RegistrationCleanupCron = _ts_decorate2([
-  (0, import_common2.Injectable)(),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof PendingRegistrationService === "undefined" ? Object : PendingRegistrationService
-  ])
-], RegistrationCleanupCron);
-
-// src/registration/ip-rate-limit.guard.ts
-var import_common3 = require("@nestjs/common");
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-var BaseIpRateLimitGuard = class {
-  static {
-    __name(this, "BaseIpRateLimitGuard");
-  }
-  options;
-  buckets = /* @__PURE__ */ new Map();
-  constructor(options) {
-    this.options = options;
-  }
-  canActivate(context) {
-    if (process.env.SAAS_PLATFORM_SKIP_RATE_LIMITS === "1" && process.env.NODE_ENV !== "production") {
-      return true;
-    }
-    const req = context.switchToHttp().getRequest();
-    const key = ipFingerprint(req);
-    if (this.exceeded(key)) {
-      throw new import_common3.HttpException({
-        code: "RATE_LIMITED",
-        reason: this.options.name,
-        retryAfterSeconds: Math.ceil(this.options.windowMs / 1e3)
-      }, import_common3.HttpStatus.TOO_MANY_REQUESTS);
-    }
-    return true;
-  }
-  exceeded(key) {
-    const now = Date.now();
-    const bucket = this.buckets.get(key);
-    if (!bucket || now - bucket.windowStart > this.options.windowMs) {
-      this.buckets.set(key, {
-        count: 1,
-        windowStart: now
-      });
-      return false;
-    }
-    bucket.count += 1;
-    return bucket.count > this.options.limit;
-  }
-};
-BaseIpRateLimitGuard = _ts_decorate3([
-  (0, import_common3.Injectable)(),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    Object
-  ])
-], BaseIpRateLimitGuard);
-function ipFingerprint(req) {
-  const fwd = req.headers["x-forwarded-for"];
-  const first = Array.isArray(fwd) ? fwd[0] : fwd?.split(",")[0]?.trim();
-  return first || req.ip || "unknown";
-}
-__name(ipFingerprint, "ipFingerprint");
-
-// src/registration/module.ts
-var import_common4 = require("@nestjs/common");
-
-// src/core/di.ts
-function asProvider(token, impl) {
-  if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
-    const factory = impl;
-    return {
-      provide: token,
-      useFactory: factory.useFactory,
-      inject: factory.inject
-    };
-  }
-  return {
-    provide: token,
-    useValue: impl
-  };
-}
-__name(asProvider, "asProvider");
-
-// src/registration/module.ts
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-var RegistrationModule = class _RegistrationModule {
-  static {
-    __name(this, "RegistrationModule");
-  }
-  static forRoot(options) {
-    const providers = [
-      ...options.extraProviders ?? [],
-      asProvider(PENDING_REGISTRATION_REPOSITORY_TOKEN, options.pendingRegistrationRepository),
-      asProvider(REGISTRATION_OTP_DELIVERY_TOKEN, options.otpDelivery),
-      asProvider(USER_ACCOUNT_LOOKUP_TOKEN, options.userAccountLookup),
-      asProvider(SLUG_AVAILABILITY_CHECK_TOKEN, options.slugAvailabilityCheck),
-      asProvider(PASSWORD_HASHER_TOKEN, options.passwordHasher),
-      asProvider(PLAN_CATALOG_LOOKUP_TOKEN, options.planCatalogLookup),
-      asProvider(PAYMENT_PROVIDER_TOKEN, options.paymentProvider),
-      asProvider(PAYMENT_EVENT_LOG_TOKEN, options.paymentEventLog),
-      asProvider(ACTIVATION_ORCHESTRATOR_TOKEN, options.activationOrchestrator),
-      asProvider(REGISTRATION_AUDIT_LOGGER_TOKEN, options.auditLogger),
-      PendingRegistrationService
-    ];
-    if (options.resumeTokenSigner) {
-      providers.push(asProvider(REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, options.resumeTokenSigner));
-    }
-    if (options.resumeDelivery) {
-      providers.push(asProvider(REGISTRATION_RESUME_DELIVERY_TOKEN, options.resumeDelivery));
-    }
-    if (options.resumeBaseUrl !== void 0) {
-      providers.push({
-        provide: REGISTRATION_RESUME_BASE_URL_TOKEN,
-        useValue: options.resumeBaseUrl
-      });
-    }
-    if (options.configuratorLookup) {
-      providers.push(asProvider(REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, options.configuratorLookup));
-    }
-    if (options.promoPreview) {
-      providers.push(asProvider(REGISTRATION_PROMO_PREVIEW_TOKEN, options.promoPreview));
-    }
-    const includeCleanupCron = options.includeCleanupCron ?? true;
-    if (includeCleanupCron) {
-      providers.push(RegistrationCleanupCron);
-    }
-    return {
-      module: _RegistrationModule,
-      global: options.global ?? false,
-      imports: options.imports ?? [],
-      providers,
-      exports: includeCleanupCron ? [
-        PendingRegistrationService,
-        RegistrationCleanupCron
-      ] : [
-        PendingRegistrationService
-      ]
-    };
-  }
-};
-RegistrationModule = _ts_decorate4([
-  (0, import_common4.Module)({})
-], RegistrationModule);
-
-// src/registration/dto/register-start.dto.ts
-var import_class_validator = require("class-validator");
-function _ts_decorate5(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata4, "_ts_metadata");
-var RegisterStartDto = class {
-  static {
-    __name(this, "RegisterStartDto");
-  }
-  /** Association/tenant name (required). */
-  tenantName;
-  /** Optional slug. If left empty, it is generated from `tenantName`. */
-  tenantSlug;
-  /** Salutation of the administrator (optional). */
-  salutation;
-  firstName;
-  lastName;
-  email;
-  password;
-  /** Terms / privacy / data processing — mandatory acceptance (must be `true`). */
-  termsAccepted;
-  locale;
-};
-_ts_decorate5([
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.MinLength)(2),
-  (0, import_class_validator.MaxLength)(120),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "tenantName", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsOptional)(),
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.Matches)(/^[a-z0-9-]+$/, {
-    message: "tenantSlug darf nur Kleinbuchstaben, Ziffern und Bindestriche enthalten."
-  }),
-  (0, import_class_validator.MaxLength)(60),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "tenantSlug", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsOptional)(),
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.MaxLength)(40),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "salutation", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.MinLength)(1),
-  (0, import_class_validator.MaxLength)(60),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "firstName", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.MinLength)(1),
-  (0, import_class_validator.MaxLength)(60),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "lastName", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsEmail)(),
-  (0, import_class_validator.MaxLength)(160),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "email", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsString)(),
-  (0, import_class_validator.MinLength)(8),
-  (0, import_class_validator.MaxLength)(160),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "password", void 0);
-_ts_decorate5([
-  (0, import_class_validator.Equals)(true, {
-    message: "AGB, Datenschutzerklaerung und Auftragsverarbeitung muessen zugestimmt werden."
-  }),
-  _ts_metadata4("design:type", Boolean)
-], RegisterStartDto.prototype, "termsAccepted", void 0);
-_ts_decorate5([
-  (0, import_class_validator.IsOptional)(),
-  (0, import_class_validator.IsIn)([
-    "de",
-    "tr"
-  ]),
-  _ts_metadata4("design:type", String)
-], RegisterStartDto.prototype, "locale", void 0);
-
-// src/registration/dto/verify-registration-otp.dto.ts
-var import_class_validator2 = require("class-validator");
-function _ts_decorate6(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata5, "_ts_metadata");
-var VerifyRegistrationOtpDto = class {
-  static {
-    __name(this, "VerifyRegistrationOtpDto");
-  }
-  email;
-  otp;
-};
-_ts_decorate6([
-  (0, import_class_validator2.IsEmail)(),
-  _ts_metadata5("design:type", String)
-], VerifyRegistrationOtpDto.prototype, "email", void 0);
-_ts_decorate6([
-  (0, import_class_validator2.IsString)(),
-  (0, import_class_validator2.Matches)(/^\d{6}$/, {
-    message: "OTP muss 6 Ziffern sein."
-  }),
-  _ts_metadata5("design:type", String)
-], VerifyRegistrationOtpDto.prototype, "otp", void 0);
-
-// src/registration/dto/resend-registration-otp.dto.ts
-var import_class_validator3 = require("class-validator");
-function _ts_decorate7(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata6, "_ts_metadata");
-var ResendRegistrationOtpDto = class {
-  static {
-    __name(this, "ResendRegistrationOtpDto");
-  }
-  email;
-};
-_ts_decorate7([
-  (0, import_class_validator3.IsEmail)(),
-  _ts_metadata6("design:type", String)
-], ResendRegistrationOtpDto.prototype, "email", void 0);
-
-// src/registration/dto/select-plan.dto.ts
-var import_class_validator4 = require("class-validator");
-function _ts_decorate8(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata7(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata7, "_ts_metadata");
-var SelectRegistrationPlanDto = class {
-  static {
-    __name(this, "SelectRegistrationPlanDto");
-  }
-  pendingRegistrationId;
-  planId;
-};
-_ts_decorate8([
-  (0, import_class_validator4.IsString)(),
-  (0, import_class_validator4.MinLength)(1),
-  (0, import_class_validator4.MaxLength)(80),
-  _ts_metadata7("design:type", String)
-], SelectRegistrationPlanDto.prototype, "pendingRegistrationId", void 0);
-_ts_decorate8([
-  (0, import_class_validator4.IsString)(),
-  (0, import_class_validator4.MinLength)(1),
-  (0, import_class_validator4.MaxLength)(40),
-  _ts_metadata7("design:type", String)
-], SelectRegistrationPlanDto.prototype, "planId", void 0);
-
-// src/registration/dto/start-checkout.dto.ts
-var import_class_validator5 = require("class-validator");
-function _ts_decorate9(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata8(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata8, "_ts_metadata");
-var StartRegistrationCheckoutDto = class {
-  static {
-    __name(this, "StartRegistrationCheckoutDto");
-  }
-  pendingRegistrationId;
-  successUrl;
-  cancelUrl;
-};
-_ts_decorate9([
-  (0, import_class_validator5.IsString)(),
-  (0, import_class_validator5.MinLength)(1),
-  (0, import_class_validator5.MaxLength)(80),
-  _ts_metadata8("design:type", String)
-], StartRegistrationCheckoutDto.prototype, "pendingRegistrationId", void 0);
-_ts_decorate9([
-  (0, import_class_validator5.IsUrl)({
-    require_tld: false
-  }),
-  (0, import_class_validator5.MaxLength)(500),
-  _ts_metadata8("design:type", String)
-], StartRegistrationCheckoutDto.prototype, "successUrl", void 0);
-_ts_decorate9([
-  (0, import_class_validator5.IsUrl)({
-    require_tld: false
-  }),
-  (0, import_class_validator5.MaxLength)(500),
-  _ts_metadata8("design:type", String)
-], StartRegistrationCheckoutDto.prototype, "cancelUrl", void 0);
-
-// src/registration/dto/payment-webhook.dto.ts
-var import_class_validator6 = require("class-validator");
-function _ts_decorate10(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata9(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata9, "_ts_metadata");
-var PaymentWebhookDto = class {
-  static {
-    __name(this, "PaymentWebhookDto");
-  }
-  eventId;
-  sessionId;
-  provider;
-  status;
-  payload;
-};
-_ts_decorate10([
-  (0, import_class_validator6.IsString)(),
-  (0, import_class_validator6.MinLength)(1),
-  (0, import_class_validator6.MaxLength)(120),
-  _ts_metadata9("design:type", String)
-], PaymentWebhookDto.prototype, "eventId", void 0);
-_ts_decorate10([
-  (0, import_class_validator6.IsOptional)(),
-  (0, import_class_validator6.IsString)(),
-  (0, import_class_validator6.MaxLength)(120),
-  _ts_metadata9("design:type", String)
-], PaymentWebhookDto.prototype, "sessionId", void 0);
-_ts_decorate10([
-  (0, import_class_validator6.IsString)(),
-  (0, import_class_validator6.MaxLength)(40),
-  _ts_metadata9("design:type", String)
-], PaymentWebhookDto.prototype, "provider", void 0);
-_ts_decorate10([
-  (0, import_class_validator6.IsIn)([
-    "SUCCEEDED",
-    "FAILED"
-  ]),
-  _ts_metadata9("design:type", String)
-], PaymentWebhookDto.prototype, "status", void 0);
-_ts_decorate10([
-  (0, import_class_validator6.IsOptional)(),
-  (0, import_class_validator6.IsObject)(),
-  _ts_metadata9("design:type", typeof Record === "undefined" ? Object : Record)
-], PaymentWebhookDto.prototype, "payload", void 0);
-
-// src/registration/dto/continue-registration.dto.ts
-var import_class_validator7 = require("class-validator");
-function _ts_decorate11(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata10(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata10, "_ts_metadata");
-var ContinueRegistrationDto = class {
-  static {
-    __name(this, "ContinueRegistrationDto");
-  }
-  token;
-};
-_ts_decorate11([
-  (0, import_class_validator7.IsString)(),
-  (0, import_class_validator7.MinLength)(10),
-  (0, import_class_validator7.MaxLength)(2e3),
-  _ts_metadata10("design:type", String)
-], ContinueRegistrationDto.prototype, "token", void 0);
-
-// src/registration/dto/save-configuration.dto.ts
-var import_class_validator8 = require("class-validator");
-var import_class_transformer = require("class-transformer");
-function _ts_decorate12(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate12, "_ts_decorate");
-function _ts_metadata11(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata11, "_ts_metadata");
-var SaveRegistrationConfigSelectionDto = class {
-  static {
-    __name(this, "SaveRegistrationConfigSelectionDto");
-  }
-  modelId;
-  billingCycle;
-  appliedPromoCode;
-  /**
-   * METAMODELL §17a — Bundle consistency. ID of the `CheckoutOffer` that was
-   * created on the pricing page (`<app>/register?offer=<id>`). Passed
-   * through unchanged in `configJson`; the ActivationOrchestrator freezes it
-   * as `packageSnapshot` when the subscription is created and sets the offer
-   * to `consumed`. `null` = direct registration without a website offer.
-   */
-  offerId;
-};
-_ts_decorate12([
-  (0, import_class_validator8.IsString)(),
-  (0, import_class_validator8.MinLength)(1),
-  (0, import_class_validator8.MaxLength)(40),
-  _ts_metadata11("design:type", String)
-], SaveRegistrationConfigSelectionDto.prototype, "modelId", void 0);
-_ts_decorate12([
-  (0, import_class_validator8.IsIn)([
-    "MONTHLY",
-    "YEARLY"
-  ]),
-  _ts_metadata11("design:type", String)
-], SaveRegistrationConfigSelectionDto.prototype, "billingCycle", void 0);
-_ts_decorate12([
-  (0, import_class_validator8.IsOptional)(),
-  (0, import_class_validator8.IsString)(),
-  (0, import_class_validator8.MaxLength)(60),
-  _ts_metadata11("design:type", Object)
-], SaveRegistrationConfigSelectionDto.prototype, "appliedPromoCode", void 0);
-_ts_decorate12([
-  (0, import_class_validator8.IsOptional)(),
-  (0, import_class_validator8.ValidateIf)((_o, value) => value !== null),
-  (0, import_class_validator8.IsUUID)(),
-  _ts_metadata11("design:type", Object)
-], SaveRegistrationConfigSelectionDto.prototype, "offerId", void 0);
-var SaveRegistrationConfigDto = class {
-  static {
-    __name(this, "SaveRegistrationConfigDto");
-  }
-  pendingRegistrationId;
-  selection;
-};
-_ts_decorate12([
-  (0, import_class_validator8.IsString)(),
-  (0, import_class_validator8.MinLength)(1),
-  (0, import_class_validator8.MaxLength)(80),
-  _ts_metadata11("design:type", String)
-], SaveRegistrationConfigDto.prototype, "pendingRegistrationId", void 0);
-_ts_decorate12([
-  (0, import_class_validator8.ValidateNested)(),
-  (0, import_class_transformer.Type)(() => SaveRegistrationConfigSelectionDto),
-  _ts_metadata11("design:type", typeof SaveRegistrationConfigSelectionDto === "undefined" ? Object : SaveRegistrationConfigSelectionDto)
-], SaveRegistrationConfigDto.prototype, "selection", void 0);
-
-// src/registration/dto/preview-promo.dto.ts
-var import_class_validator9 = require("class-validator");
-function _ts_decorate13(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate13, "_ts_decorate");
-function _ts_metadata12(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata12, "_ts_metadata");
-var PreviewRegistrationPromoDto = class {
-  static {
-    __name(this, "PreviewRegistrationPromoDto");
-  }
-  pendingRegistrationId;
-  code;
-};
-_ts_decorate13([
-  (0, import_class_validator9.IsString)(),
-  (0, import_class_validator9.MinLength)(1),
-  (0, import_class_validator9.MaxLength)(80),
-  _ts_metadata12("design:type", String)
-], PreviewRegistrationPromoDto.prototype, "pendingRegistrationId", void 0);
-_ts_decorate13([
-  (0, import_class_validator9.IsOptional)(),
-  (0, import_class_validator9.IsString)(),
-  (0, import_class_validator9.MaxLength)(60),
-  _ts_metadata12("design:type", String)
-], PreviewRegistrationPromoDto.prototype, "code", void 0);
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  ACTIVATION_ORCHESTRATOR_TOKEN,
-  BaseIpRateLimitGuard,
-  ContinueRegistrationDto,
-  CronExpression,
-  PASSWORD_HASHER_TOKEN,
-  PAYMENT_EVENT_LOG_TOKEN,
-  PAYMENT_PROVIDER_TOKEN,
-  PENDING_REGISTRATION_REPOSITORY_TOKEN,
-  PLAN_CATALOG_LOOKUP_TOKEN,
-  PaymentWebhookDto,
-  PendingRegistrationService,
-  PreviewRegistrationPromoDto,
-  REGISTRATION_AUDIT_LOGGER_TOKEN,
-  REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN,
-  REGISTRATION_CONFIG_TOKEN,
-  REGISTRATION_OTP_DELIVERY_TOKEN,
-  REGISTRATION_PROMO_PREVIEW_TOKEN,
-  REGISTRATION_RESUME_BASE_URL_TOKEN,
-  REGISTRATION_RESUME_DELIVERY_TOKEN,
-  REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN,
-  RegisterStartDto,
-  RegistrationCleanupCron,
-  RegistrationModule,
-  ResendRegistrationOtpDto,
-  SLUG_AVAILABILITY_CHECK_TOKEN,
-  SaveRegistrationConfigDto,
-  SaveRegistrationConfigSelectionDto,
-  SelectRegistrationPlanDto,
-  StartRegistrationCheckoutDto,
-  USER_ACCOUNT_LOOKUP_TOKEN,
-  VerifyRegistrationOtpDto,
-  computeBreakdown,
-  generateOtpCode,
-  hashOtpCode,
-  resolveModel,
-  slugify,
-  verifyOtpCode
-});
+'use strict';
+// Generated by scripts/build-cjs-stubs.mjs — do not edit.
+// Thin re-export so every entry shares one set of class objects.
+module.exports = require('../_entries.cjs').registrationNs;