@saasicat/nest 0.9.0 → 0.10.0

package/dist/admin/index.d.cts

@@ -1,145 +1,24 @@
-import { CanActivate, ExecutionContext, NestInterceptor, CallHandler, Type, DynamicModule, ForwardReference, FactoryProvider, Provider } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { MfaPort, RlsBypassPort, AuditPort, PublicBootResponse, ManifestContribution, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/types';
+import { h as AdminStatsService, i as AdminStatsSnapshot } from '../admin-stats.module-v4SVvWzj.cjs';
+export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, f as AdminStatsModule, g as AdminStatsModuleOptions, M as MfaGuard, j as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, k as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.module-v4SVvWzj.cjs';
 export { A as AdminAuditService } from '../admin-audit.service-9IqXMlZm.cjs';
-import { Observable } from 'rxjs';
-import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
-import { A as AdminManifestConfig } from '../admin-resources.module-BybEjZs-.cjs';
-export { a as ADMIN_MANIFEST_CONFIG, b as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, S as SuspendTenantDto } from '../admin-resources.module-BybEjZs-.cjs';
-export { A as AdminManifestService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN } from '../admin-manifest.service-StAQe6QO.cjs';
+import { b as AdminManifestConfig } from '../admin-resources.module-BZN_yBFj.cjs';
+export { A as ADMIN_MANIFEST_CONFIG, a as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, S as SuspendTenantDto } from '../admin-resources.module-BZN_yBFj.cjs';
+import { PublicBootResponse, ManifestContribution } from '@saasicat/types';
+import '@nestjs/common';
+import '@nestjs/core';
+import 'rxjs';
+import '../di-CcNeq9v-.cjs';
 
 declare const MFA_PORT_TOKEN: unique symbol;
 declare const AUDIT_PORT_TOKEN: unique symbol;
 declare const RLS_BYPASS_PORT_TOKEN: unique symbol;
 
-declare class SuperAdminGuard implements CanActivate {
-    canActivate(context: ExecutionContext): boolean;
-}
-
-interface TotpSetupResult {
-    /** Base32-encoded TOTP secret (persisted in the MfaPort). */
-    secret: string;
-    /** otpauth:// URI for the QR code generator (authenticator app). */
-    otpauthUri: string;
-}
-interface VerifyTotpInput {
-    userId: string;
-    code: string;
-}
-declare class MfaService {
-    private readonly mfa;
-    private readonly logger;
-    constructor(mfa: MfaPort);
-    /**
-     * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
-     * and returns the secret + the otpauth URI for the QR code.
-     *
-     * `issuer` and `label` shape the display in the authenticator (e.g.
-     * "DemoApp:taci@example.com").
-     */
-    setup(userId: string, label: string, issuer: string): Promise<TotpSetupResult>;
-    /**
-     * Verifies the entered code against the stored secret,
-     * clock-drift-tolerant by ±1 time step.
-     */
-    verify(input: VerifyTotpInput): Promise<boolean>;
-    /**
-     * Deletes a user's secret — used by `ahp admin mfa-reset`.
-     */
-    disable(userId: string): Promise<void>;
-    /** Delegates to `MfaPort.isEnabled`. */
-    isEnabled(userId: string): Promise<boolean>;
-}
-
-declare const REQUIRE_MFA_KEY = "saas-platform/require-mfa";
-/**
- * Marks an endpoint as MFA-required. The frontend sends the TOTP code
- * in the `X-Mfa-Code` header.
- */
-declare const RequireMfa: () => MethodDecorator & ClassDecorator;
-declare class MfaGuard implements CanActivate {
-    private readonly reflector;
-    private readonly mfaService;
-    private readonly logger;
-    constructor(reflector: Reflector, mfaService: MfaService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-
-declare class AdminBypassRlsInterceptor implements NestInterceptor {
-    private readonly port;
-    constructor(port: RlsBypassPort);
-    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
-}
-
-interface AdminModuleOptions {
-    mfaPort: ProviderSpec<MfaPort>;
-    auditPort: ProviderSpec<AuditPort>;
-    rlsBypassPort: ProviderSpec<RlsBypassPort>;
-    /** Modules required by adapter factory `inject` tokens. */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminModule {
-    static forRoot(options: AdminModuleOptions): DynamicModule;
-}
-
 declare class AdminPublicBootController {
     private readonly config;
     constructor(config: AdminManifestConfig);
     getBoot(): PublicBootResponse;
 }
 
-type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
-interface AdminManifestModuleOptions {
-    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
-    config: ConfigSpec;
-    /**
-     * Default `true`. Set to `false` when the consumer registers its own
-     * manifest controller with app-specific guards entirely on its own.
-     */
-    includeManifestController?: boolean;
-    /**
-     * Class-level guards for GET /admin/manifest and POST /admin/manifest/reload,
-     * when `includeManifestController === true`. REQUIRED — otherwise
-     * `forRoot()` throws at boot.
-     *
-     * Pass `[]` explicitly when the endpoint should intentionally be auth-free
-     * (e.g. CI smoke tests, public demo). This makes the choice visible in the
-     * code rather than a silent default.
-     */
-    guards?: Array<Type<CanActivate>>;
-    /**
-     * Additional guards that apply ONLY to POST /admin/manifest/reload
-     * (typically `MfaGuard`). Placed after `guards` in the chain. Must be made
-     * available by the consumer as a provider.
-     */
-    reloadGuards?: Array<Type<CanActivate>>;
-    /**
-     * Default `true`. When active, the module automatically hooks
-     * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` (StandardPage spine, generic tenant
-     * actions, platform audit action labels) into the `AdminManifestService` —
-     * before all app `register()` calls from `onModuleInit`. Consumers without
-     * a SuperAdmin need set this to `false`.
-     */
-    registerPlatformCore?: boolean;
-    /**
-     * Modules whose providers must be visible in the DI scope of this
-     * DynamicModule — typically: the app module that registers the
-     * factory-inject provider (e.g. `AdminManifestConfigFactory`). Without this
-     * entry, NestJS 11.1.19 cannot resolve the `inject:[...]` of the config
-     * factory (UnknownDependenciesException for ADMIN_MANIFEST_CONFIG).
-     */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Additional providers that are registered in the DynamicModule itself. */
-    extraProviders?: Provider[];
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminManifestModule {
-    static forRoot(options: AdminManifestModuleOptions): DynamicModule;
-}
-
 declare const PLATFORM_CORE_MANIFEST_CONTRIBUTION: ManifestContribution;
 
 declare const SUBSCRIPTION_STATS_PORT_TOKEN: unique symbol;
@@ -148,52 +27,10 @@ declare const AUDIT_STATS_PORT_TOKEN: unique symbol;
 /** Default audit window in days for the dashboard KPI. Override via forRoot. */
 declare const ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN: unique symbol;
 
-/**
- * Platform stats for the SuperAdmin dashboard page.
- *
- * Contains subscription/promo/audit aggregates that are equally meaningful
- * across all consuming apps. App-specific KPIs (e.g. DATEV or Bundles/Members)
- * remain extra endpoints in the respective app.
- */
-interface AdminStatsSnapshot {
-    subscriptions: SubscriptionStatsSnapshot;
-    promos: PromoCodeStatsSnapshot;
-    audit: AuditStatsSnapshot;
-}
-declare class AdminStatsService {
-    private readonly subscriptions;
-    private readonly promos;
-    private readonly audit;
-    private readonly auditWindowDays;
-    constructor(subscriptions: SubscriptionStatsPort, promos: PromoCodeStatsPort, audit: AuditStatsPort, auditWindowDays?: number);
-    getSnapshot(): Promise<AdminStatsSnapshot>;
-}
-
 declare class AdminStatsController {
     private readonly stats;
     constructor(stats: AdminStatsService);
     getDashboardSnapshot(): Promise<AdminStatsSnapshot>;
 }
 
-interface AdminStatsModuleOptions {
-    subscriptionStatsPort: ProviderSpec<SubscriptionStatsPort>;
-    promoCodeStatsPort: ProviderSpec<PromoCodeStatsPort>;
-    auditStatsPort: ProviderSpec<AuditStatsPort>;
-    /** Audit window in days for the "last N days" KPI. Default 7. */
-    auditWindowDays?: number;
-    /**
-     * Modules whose providers must be visible in the DI scope of this
-     * DynamicModule — e.g. the app module that registers the adapter classes
-     * referenced by the factory `inject` lists.
-     */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Additional providers registered in the DynamicModule itself. */
-    extraProviders?: Provider[];
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminStatsModule {
-    static forRoot(options: AdminStatsModuleOptions): DynamicModule;
-}
-
-export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminBypassRlsInterceptor, AdminManifestConfig, AdminManifestModule, type AdminManifestModuleOptions, AdminModule, type AdminModuleOptions, AdminPublicBootController, AdminStatsController, AdminStatsModule, type AdminStatsModuleOptions, AdminStatsService, type AdminStatsSnapshot, MFA_PORT_TOKEN, MfaGuard, MfaService, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, REQUIRE_MFA_KEY, RLS_BYPASS_PORT_TOKEN, RequireMfa, SUBSCRIPTION_STATS_PORT_TOKEN, SuperAdminGuard, type TotpSetupResult, type VerifyTotpInput };
+export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminManifestConfig, AdminPublicBootController, AdminStatsController, AdminStatsService, AdminStatsSnapshot, MFA_PORT_TOKEN, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, RLS_BYPASS_PORT_TOKEN, SUBSCRIPTION_STATS_PORT_TOKEN };

package/dist/admin/index.d.ts

@@ -1,145 +1,24 @@
-import { CanActivate, ExecutionContext, NestInterceptor, CallHandler, Type, DynamicModule, ForwardReference, FactoryProvider, Provider } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { MfaPort, RlsBypassPort, AuditPort, PublicBootResponse, ManifestContribution, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/types';
+import { h as AdminStatsService, i as AdminStatsSnapshot } from '../admin-stats.module-15ac5KY3.js';
+export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, f as AdminStatsModule, g as AdminStatsModuleOptions, M as MfaGuard, j as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, k as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.module-15ac5KY3.js';
 export { A as AdminAuditService } from '../admin-audit.service-9IqXMlZm.js';
-import { Observable } from 'rxjs';
-import { P as ProviderSpec } from '../di-CcNeq9v-.js';
-import { A as AdminManifestConfig } from '../admin-resources.module-CUCLlUAi.js';
-export { a as ADMIN_MANIFEST_CONFIG, b as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, S as SuspendTenantDto } from '../admin-resources.module-CUCLlUAi.js';
-export { A as AdminManifestService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN } from '../admin-manifest.service-BMeSLRW4.js';
+import { b as AdminManifestConfig } from '../admin-resources.module-Cms8MY6h.js';
+export { A as ADMIN_MANIFEST_CONFIG, a as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, S as SuspendTenantDto } from '../admin-resources.module-Cms8MY6h.js';
+import { PublicBootResponse, ManifestContribution } from '@saasicat/types';
+import '@nestjs/common';
+import '@nestjs/core';
+import 'rxjs';
+import '../di-CcNeq9v-.js';
 
 declare const MFA_PORT_TOKEN: unique symbol;
 declare const AUDIT_PORT_TOKEN: unique symbol;
 declare const RLS_BYPASS_PORT_TOKEN: unique symbol;
 
-declare class SuperAdminGuard implements CanActivate {
-    canActivate(context: ExecutionContext): boolean;
-}
-
-interface TotpSetupResult {
-    /** Base32-encoded TOTP secret (persisted in the MfaPort). */
-    secret: string;
-    /** otpauth:// URI for the QR code generator (authenticator app). */
-    otpauthUri: string;
-}
-interface VerifyTotpInput {
-    userId: string;
-    code: string;
-}
-declare class MfaService {
-    private readonly mfa;
-    private readonly logger;
-    constructor(mfa: MfaPort);
-    /**
-     * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
-     * and returns the secret + the otpauth URI for the QR code.
-     *
-     * `issuer` and `label` shape the display in the authenticator (e.g.
-     * "DemoApp:taci@example.com").
-     */
-    setup(userId: string, label: string, issuer: string): Promise<TotpSetupResult>;
-    /**
-     * Verifies the entered code against the stored secret,
-     * clock-drift-tolerant by ±1 time step.
-     */
-    verify(input: VerifyTotpInput): Promise<boolean>;
-    /**
-     * Deletes a user's secret — used by `ahp admin mfa-reset`.
-     */
-    disable(userId: string): Promise<void>;
-    /** Delegates to `MfaPort.isEnabled`. */
-    isEnabled(userId: string): Promise<boolean>;
-}
-
-declare const REQUIRE_MFA_KEY = "saas-platform/require-mfa";
-/**
- * Marks an endpoint as MFA-required. The frontend sends the TOTP code
- * in the `X-Mfa-Code` header.
- */
-declare const RequireMfa: () => MethodDecorator & ClassDecorator;
-declare class MfaGuard implements CanActivate {
-    private readonly reflector;
-    private readonly mfaService;
-    private readonly logger;
-    constructor(reflector: Reflector, mfaService: MfaService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-
-declare class AdminBypassRlsInterceptor implements NestInterceptor {
-    private readonly port;
-    constructor(port: RlsBypassPort);
-    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
-}
-
-interface AdminModuleOptions {
-    mfaPort: ProviderSpec<MfaPort>;
-    auditPort: ProviderSpec<AuditPort>;
-    rlsBypassPort: ProviderSpec<RlsBypassPort>;
-    /** Modules required by adapter factory `inject` tokens. */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminModule {
-    static forRoot(options: AdminModuleOptions): DynamicModule;
-}
-
 declare class AdminPublicBootController {
     private readonly config;
     constructor(config: AdminManifestConfig);
     getBoot(): PublicBootResponse;
 }
 
-type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
-interface AdminManifestModuleOptions {
-    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
-    config: ConfigSpec;
-    /**
-     * Default `true`. Set to `false` when the consumer registers its own
-     * manifest controller with app-specific guards entirely on its own.
-     */
-    includeManifestController?: boolean;
-    /**
-     * Class-level guards for GET /admin/manifest and POST /admin/manifest/reload,
-     * when `includeManifestController === true`. REQUIRED — otherwise
-     * `forRoot()` throws at boot.
-     *
-     * Pass `[]` explicitly when the endpoint should intentionally be auth-free
-     * (e.g. CI smoke tests, public demo). This makes the choice visible in the
-     * code rather than a silent default.
-     */
-    guards?: Array<Type<CanActivate>>;
-    /**
-     * Additional guards that apply ONLY to POST /admin/manifest/reload
-     * (typically `MfaGuard`). Placed after `guards` in the chain. Must be made
-     * available by the consumer as a provider.
-     */
-    reloadGuards?: Array<Type<CanActivate>>;
-    /**
-     * Default `true`. When active, the module automatically hooks
-     * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` (StandardPage spine, generic tenant
-     * actions, platform audit action labels) into the `AdminManifestService` —
-     * before all app `register()` calls from `onModuleInit`. Consumers without
-     * a SuperAdmin need set this to `false`.
-     */
-    registerPlatformCore?: boolean;
-    /**
-     * Modules whose providers must be visible in the DI scope of this
-     * DynamicModule — typically: the app module that registers the
-     * factory-inject provider (e.g. `AdminManifestConfigFactory`). Without this
-     * entry, NestJS 11.1.19 cannot resolve the `inject:[...]` of the config
-     * factory (UnknownDependenciesException for ADMIN_MANIFEST_CONFIG).
-     */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Additional providers that are registered in the DynamicModule itself. */
-    extraProviders?: Provider[];
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminManifestModule {
-    static forRoot(options: AdminManifestModuleOptions): DynamicModule;
-}
-
 declare const PLATFORM_CORE_MANIFEST_CONTRIBUTION: ManifestContribution;
 
 declare const SUBSCRIPTION_STATS_PORT_TOKEN: unique symbol;
@@ -148,52 +27,10 @@ declare const AUDIT_STATS_PORT_TOKEN: unique symbol;
 /** Default audit window in days for the dashboard KPI. Override via forRoot. */
 declare const ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN: unique symbol;
 
-/**
- * Platform stats for the SuperAdmin dashboard page.
- *
- * Contains subscription/promo/audit aggregates that are equally meaningful
- * across all consuming apps. App-specific KPIs (e.g. DATEV or Bundles/Members)
- * remain extra endpoints in the respective app.
- */
-interface AdminStatsSnapshot {
-    subscriptions: SubscriptionStatsSnapshot;
-    promos: PromoCodeStatsSnapshot;
-    audit: AuditStatsSnapshot;
-}
-declare class AdminStatsService {
-    private readonly subscriptions;
-    private readonly promos;
-    private readonly audit;
-    private readonly auditWindowDays;
-    constructor(subscriptions: SubscriptionStatsPort, promos: PromoCodeStatsPort, audit: AuditStatsPort, auditWindowDays?: number);
-    getSnapshot(): Promise<AdminStatsSnapshot>;
-}
-
 declare class AdminStatsController {
     private readonly stats;
     constructor(stats: AdminStatsService);
     getDashboardSnapshot(): Promise<AdminStatsSnapshot>;
 }
 
-interface AdminStatsModuleOptions {
-    subscriptionStatsPort: ProviderSpec<SubscriptionStatsPort>;
-    promoCodeStatsPort: ProviderSpec<PromoCodeStatsPort>;
-    auditStatsPort: ProviderSpec<AuditStatsPort>;
-    /** Audit window in days for the "last N days" KPI. Default 7. */
-    auditWindowDays?: number;
-    /**
-     * Modules whose providers must be visible in the DI scope of this
-     * DynamicModule — e.g. the app module that registers the adapter classes
-     * referenced by the factory `inject` lists.
-     */
-    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
-    /** Additional providers registered in the DynamicModule itself. */
-    extraProviders?: Provider[];
-    /** Register the module globally — default `false`. */
-    global?: boolean;
-}
-declare class AdminStatsModule {
-    static forRoot(options: AdminStatsModuleOptions): DynamicModule;
-}
-
-export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminBypassRlsInterceptor, AdminManifestConfig, AdminManifestModule, type AdminManifestModuleOptions, AdminModule, type AdminModuleOptions, AdminPublicBootController, AdminStatsController, AdminStatsModule, type AdminStatsModuleOptions, AdminStatsService, type AdminStatsSnapshot, MFA_PORT_TOKEN, MfaGuard, MfaService, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, REQUIRE_MFA_KEY, RLS_BYPASS_PORT_TOKEN, RequireMfa, SUBSCRIPTION_STATS_PORT_TOKEN, SuperAdminGuard, type TotpSetupResult, type VerifyTotpInput };
+export { ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN, AUDIT_PORT_TOKEN, AUDIT_STATS_PORT_TOKEN, AdminManifestConfig, AdminPublicBootController, AdminStatsController, AdminStatsService, AdminStatsSnapshot, MFA_PORT_TOKEN, PLATFORM_CORE_MANIFEST_CONTRIBUTION, PROMO_CODE_STATS_PORT_TOKEN, RLS_BYPASS_PORT_TOKEN, SUBSCRIPTION_STATS_PORT_TOKEN };

package/dist/admin/index.js

@@ -1,3 +1,4 @@
+import "../chunk-UF53DWWR.js";
 import {
   ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN,
   AUDIT_STATS_PORT_TOKEN,
@@ -6,7 +7,7 @@ import {
   AdminStatsService,
   PROMO_CODE_STATS_PORT_TOKEN,
   SUBSCRIPTION_STATS_PORT_TOKEN
-} from "../chunk-WGVTXSYW.js";
+} from "../chunk-LZHLGUQI.js";
 import {
   ADMIN_MANIFEST_CONFIG,
   ADMIN_RESOURCES_PORT_TOKEN,
@@ -25,7 +26,7 @@ import {
   RequireMfa,
   SuperAdminGuard,
   SuspendTenantDto
-} from "../chunk-3M6VLT5N.js";
+} from "../chunk-FVT7KTUI.js";
 import {
   AUDIT_PORT_TOKEN,
   AdminAuditService,

package/dist/{admin-resources.module-BybEjZs-.d.cts → admin-resources.module-BZN_yBFj.d.cts}

@@ -37,4 +37,4 @@ declare class AdminResourcesModule {
     static forRoot(options: AdminResourcesModuleOptions): DynamicModule;
 }
 
-export { type AdminManifestConfig as A, SuspendTenantDto as S, ADMIN_MANIFEST_CONFIG as a, ADMIN_RESOURCES_PORT_TOKEN as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e };
+export { ADMIN_MANIFEST_CONFIG as A, SuspendTenantDto as S, ADMIN_RESOURCES_PORT_TOKEN as a, type AdminManifestConfig as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e };

package/dist/{admin-resources.module-CUCLlUAi.d.ts → admin-resources.module-Cms8MY6h.d.ts}

@@ -37,4 +37,4 @@ declare class AdminResourcesModule {
     static forRoot(options: AdminResourcesModuleOptions): DynamicModule;
 }
 
-export { type AdminManifestConfig as A, SuspendTenantDto as S, ADMIN_MANIFEST_CONFIG as a, ADMIN_RESOURCES_PORT_TOKEN as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e };
+export { ADMIN_MANIFEST_CONFIG as A, SuspendTenantDto as S, ADMIN_RESOURCES_PORT_TOKEN as a, type AdminManifestConfig as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e };

package/dist/admin-stats.module-15ac5KY3.d.ts

@@ -0,0 +1,201 @@
+import { CanActivate, ExecutionContext, NestInterceptor, CallHandler, Type, DynamicModule, ForwardReference, FactoryProvider, Provider } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { MfaPort, RlsBypassPort, AuditPort, ManifestContribution, AdminManifest, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/types';
+import { Observable } from 'rxjs';
+import { P as ProviderSpec } from './di-CcNeq9v-.js';
+import { b as AdminManifestConfig } from './admin-resources.module-Cms8MY6h.js';
+
+declare class SuperAdminGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+
+interface TotpSetupResult {
+    /** Base32-encoded TOTP secret (persisted in the MfaPort). */
+    secret: string;
+    /** otpauth:// URI for the QR code generator (authenticator app). */
+    otpauthUri: string;
+}
+interface VerifyTotpInput {
+    userId: string;
+    code: string;
+}
+declare class MfaService {
+    private readonly mfa;
+    private readonly logger;
+    constructor(mfa: MfaPort);
+    /**
+     * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
+     * and returns the secret + the otpauth URI for the QR code.
+     *
+     * `issuer` and `label` shape the display in the authenticator (e.g.
+     * "DemoApp:taci@example.com").
+     */
+    setup(userId: string, label: string, issuer: string): Promise<TotpSetupResult>;
+    /**
+     * Verifies the entered code against the stored secret,
+     * clock-drift-tolerant by ±1 time step.
+     */
+    verify(input: VerifyTotpInput): Promise<boolean>;
+    /**
+     * Deletes a user's secret — used by `ahp admin mfa-reset`.
+     */
+    disable(userId: string): Promise<void>;
+    /** Delegates to `MfaPort.isEnabled`. */
+    isEnabled(userId: string): Promise<boolean>;
+}
+
+declare const REQUIRE_MFA_KEY = "saas-platform/require-mfa";
+/**
+ * Marks an endpoint as MFA-required. The frontend sends the TOTP code
+ * in the `X-Mfa-Code` header.
+ */
+declare const RequireMfa: () => MethodDecorator & ClassDecorator;
+declare class MfaGuard implements CanActivate {
+    private readonly reflector;
+    private readonly mfaService;
+    private readonly logger;
+    constructor(reflector: Reflector, mfaService: MfaService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+
+declare class AdminBypassRlsInterceptor implements NestInterceptor {
+    private readonly port;
+    constructor(port: RlsBypassPort);
+    intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+
+interface AdminModuleOptions {
+    mfaPort: ProviderSpec<MfaPort>;
+    auditPort: ProviderSpec<AuditPort>;
+    rlsBypassPort: ProviderSpec<RlsBypassPort>;
+    /** Modules required by adapter factory `inject` tokens. */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminModule {
+    static forRoot(options: AdminModuleOptions): DynamicModule;
+}
+
+/**
+ * DI token for the platform core contribution. When `AdminManifestModule` is
+ * configured with `registerPlatformCore: true` (default), the module provides
+ * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` under this token. The service
+ * registers the contribution in the constructor — before all app `register()`
+ * calls from `onModuleInit`.
+ */
+declare const PLATFORM_CORE_CONTRIBUTION_TOKEN: unique symbol;
+declare class AdminManifestService {
+    private readonly config;
+    private readonly logger;
+    private readonly contributions;
+    private cached;
+    constructor(config: AdminManifestConfig, platformCore?: ManifestContribution | null);
+    register(contribution: ManifestContribution): void;
+    getManifest(): AdminManifest;
+    rebuild(): AdminManifest;
+    private build;
+    private mergeContributions;
+    /**
+     * Deterministic SHA-256 hash over the manifest. Uses the insertion
+     * order of the object keys — so that semantically meaningful reorders (e.g.
+     * the order of the sidebar items in `navigation.standardPages`) change the
+     * hash and invalidate the browser ETag cache. The manifest's own
+     * `manifestHash` field is hidden before serialization.
+     */
+    private computeHash;
+}
+
+type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
+interface AdminManifestModuleOptions {
+    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
+    config: ConfigSpec;
+    /**
+     * Default `true`. Set to `false` when the consumer registers its own
+     * manifest controller with app-specific guards entirely on its own.
+     */
+    includeManifestController?: boolean;
+    /**
+     * Class-level guards for GET /admin/manifest and POST /admin/manifest/reload,
+     * when `includeManifestController === true`. REQUIRED — otherwise
+     * `forRoot()` throws at boot.
+     *
+     * Pass `[]` explicitly when the endpoint should intentionally be auth-free
+     * (e.g. CI smoke tests, public demo). This makes the choice visible in the
+     * code rather than a silent default.
+     */
+    guards?: Array<Type<CanActivate>>;
+    /**
+     * Additional guards that apply ONLY to POST /admin/manifest/reload
+     * (typically `MfaGuard`). Placed after `guards` in the chain. Must be made
+     * available by the consumer as a provider.
+     */
+    reloadGuards?: Array<Type<CanActivate>>;
+    /**
+     * Default `true`. When active, the module automatically hooks
+     * `PLATFORM_CORE_MANIFEST_CONTRIBUTION` (StandardPage spine, generic tenant
+     * actions, platform audit action labels) into the `AdminManifestService` —
+     * before all app `register()` calls from `onModuleInit`. Consumers without
+     * a SuperAdmin need set this to `false`.
+     */
+    registerPlatformCore?: boolean;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — typically: the app module that registers the
+     * factory-inject provider (e.g. `AdminManifestConfigFactory`). Without this
+     * entry, NestJS 11.1.19 cannot resolve the `inject:[...]` of the config
+     * factory (UnknownDependenciesException for ADMIN_MANIFEST_CONFIG).
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers that are registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminManifestModule {
+    static forRoot(options: AdminManifestModuleOptions): DynamicModule;
+}
+
+/**
+ * Platform stats for the SuperAdmin dashboard page.
+ *
+ * Contains subscription/promo/audit aggregates that are equally meaningful
+ * across all consuming apps. App-specific KPIs (e.g. DATEV or Bundles/Members)
+ * remain extra endpoints in the respective app.
+ */
+interface AdminStatsSnapshot {
+    subscriptions: SubscriptionStatsSnapshot;
+    promos: PromoCodeStatsSnapshot;
+    audit: AuditStatsSnapshot;
+}
+declare class AdminStatsService {
+    private readonly subscriptions;
+    private readonly promos;
+    private readonly audit;
+    private readonly auditWindowDays;
+    constructor(subscriptions: SubscriptionStatsPort, promos: PromoCodeStatsPort, audit: AuditStatsPort, auditWindowDays?: number);
+    getSnapshot(): Promise<AdminStatsSnapshot>;
+}
+
+interface AdminStatsModuleOptions {
+    subscriptionStatsPort: ProviderSpec<SubscriptionStatsPort>;
+    promoCodeStatsPort: ProviderSpec<PromoCodeStatsPort>;
+    auditStatsPort: ProviderSpec<AuditStatsPort>;
+    /** Audit window in days for the "last N days" KPI. Default 7. */
+    auditWindowDays?: number;
+    /**
+     * Modules whose providers must be visible in the DI scope of this
+     * DynamicModule — e.g. the app module that registers the adapter classes
+     * referenced by the factory `inject` lists.
+     */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    /** Additional providers registered in the DynamicModule itself. */
+    extraProviders?: Provider[];
+    /** Register the module globally — default `false`. */
+    global?: boolean;
+}
+declare class AdminStatsModule {
+    static forRoot(options: AdminStatsModuleOptions): DynamicModule;
+}
+
+export { AdminBypassRlsInterceptor as A, MfaGuard as M, PLATFORM_CORE_CONTRIBUTION_TOKEN as P, REQUIRE_MFA_KEY as R, SuperAdminGuard as S, type TotpSetupResult as T, type VerifyTotpInput as V, AdminManifestModule as a, type AdminManifestModuleOptions as b, AdminManifestService as c, AdminModule as d, type AdminModuleOptions as e, AdminStatsModule as f, type AdminStatsModuleOptions as g, AdminStatsService as h, type AdminStatsSnapshot as i, MfaService as j, RequireMfa as k };