@saasicat/nest 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/{chunk-RUNZ3X4C.js → chunk-AOS2JPDD.js}

@@ -1,61 +1,86 @@
 import {
   PromoCodesModule
-} from "./chunk-TXC3LHHB.js";
+} from "./chunk-4SDSYV4A.js";
 import {
   SubscriptionContractModule
-} from "./chunk-AU3OOREM.js";
+} from "./chunk-XSSWYPP5.js";
 import {
   AdminManifestModule,
   AdminManifestService,
   AdminModule,
   AdminResourcesModule,
   AdminStatsModule,
-  MfaService,
   SuperAdminGuard
-} from "./chunk-LTT736P3.js";
+} from "./chunk-LLYVYRGJ.js";
 import {
   FEATURE_GUARD_MARKER,
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
   SubscriptionBundleModule,
   TenantBillingModule,
-  isPlatformFeatureGuard
-} from "./chunk-6Z7JR4EW.js";
+  catalogSource,
+  isPlatformFeatureGuard,
+  loadPlanCatalogFromFile
+} from "./chunk-M47BNEY2.js";
 import {
-  CatalogModule
-} from "./chunk-WOVQPXV4.js";
+  CatalogModule,
+  WebAuditLogger,
+  actorTagOf,
+  defaultActorFromRequest
+} from "./chunk-CQ2ZZMTD.js";
+import {
+  MfaService
+} from "./chunk-34XVPR6P.js";
 import {
   CheckoutOfferModule
-} from "./chunk-WUDYIPYH.js";
+} from "./chunk-TOEFN7DN.js";
 import {
-  SaaSiCatPublicRoute
-} from "./chunk-YSC46BGM.js";
+  DiscoveryModule
+} from "./chunk-S33SO5XX.js";
 import {
   EntitlementModule
-} from "./chunk-7ZEGFL42.js";
+} from "./chunk-WHJSYKNC.js";
 import {
-  LimitExceededError
-} from "./chunk-VIJ5NJWC.js";
+  LimitExceededError,
+  cancellationHasLanded
+} from "./chunk-G6EZWECL.js";
 import {
-  PLAN_CATALOG_TOKEN,
-  PlanCatalogModule
-} from "./chunk-DQKCK7DX.js";
-import {
-  codedError
-} from "./chunk-57V6ZTI6.js";
+  findPlan
+} from "./chunk-TBBZWZQT.js";
 import {
-  asProvider
-} from "./chunk-SABTXESR.js";
-import {
-  DiscoveryModule
-} from "./chunk-XBYAFEOR.js";
+  SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN
+} from "./chunk-VBRYPU7V.js";
 import {
   ENFORCE_QUOTA_KEY
 } from "./chunk-QUZU2M33.js";
+import {
+  PaymentsModule
+} from "./chunk-QPVDCKYS.js";
+import {
+  PaymentGatewayRegistry
+} from "./chunk-7NJKVC5X.js";
+import {
+  RLS_BYPASS_PORT_TOKEN
+} from "./chunk-SZ7RFPXA.js";
+import {
+  SaaSiCatPublicRoute
+} from "./chunk-YSC46BGM.js";
+import {
+  PLAN_CATALOG_SETTINGS_TOKEN,
+  PLAN_CATALOG_SOURCE_TOKEN,
+  PlanCatalogModule
+} from "./chunk-FEQZCWUL.js";
+import {
+  asProvider,
+  codedError
+} from "./chunk-J7NJRK3K.js";
 import {
   __name
 } from "./chunk-SHUYVCID.js";
 
+// src/core/email.tokens.ts
+var EMAIL_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/EmailPort");
+
 // src/setup/setup.tokens.ts
 var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/SetupProvisioningPort");
 var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/SetupConfig");
@@ -352,9 +377,9 @@ SetupModule = _ts_decorate3([
   Module({})
 ], SetupModule);
 
-// src/platform/enforcement-chain.check.ts
-import { Inject as Inject2, Injectable as Injectable2, Optional } from "@nestjs/common";
-import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+// src/settings/settings-change-notifier.ts
+import { Inject as Inject2, Injectable as Injectable2, Logger, Optional } from "@nestjs/common";
+import { diffSettings } from "@saasicat/core";
 function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -372,6 +397,527 @@ function _ts_param3(paramIndex, decorator) {
   };
 }
 __name(_ts_param3, "_ts_param");
+var MAIL_SEND_TIMEOUT_MS = 3e4;
+function withinTime(promise, ms, to) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`no answer from the email port within ${ms} ms for ${to}`)), ms);
+    timer.unref();
+    promise.then((value) => {
+      clearTimeout(timer);
+      resolve(value);
+    }, (error) => {
+      clearTimeout(timer);
+      reject(error instanceof Error ? error : new Error(String(error)));
+    });
+  });
+}
+__name(withinTime, "withinTime");
+var SettingsChangeNotifier = class _SettingsChangeNotifier {
+  static {
+    __name(this, "SettingsChangeNotifier");
+  }
+  settings;
+  email;
+  logger = new Logger(_SettingsChangeNotifier.name);
+  constructor(settings, email = null) {
+    this.settings = settings;
+    this.email = email;
+  }
+  /** The addresses `config/saas.yaml` names under `notifications.settingsChanged`. */
+  get addresses() {
+    return this.settings.notifications?.settingsChanged ?? [];
+  }
+  /**
+   * Which of the two it is, said once at boot — and only where the question
+   * arises. An installation naming nobody asked for in-app only, and a line
+   * about it would be a warning at a correct configuration.
+   */
+  reportModeAtBoot() {
+    if (this.addresses.length === 0) return;
+    if (this.email) {
+      this.logger.log(`Settings changes are mailed to ${this.addresses.length} address(es) from config/saas.yaml#notifications.settingsChanged, and recorded in the application.`);
+      return;
+    }
+    this.logger.warn(`config/saas.yaml#notifications.settingsChanged names ${this.addresses.length} address(es), but no email port is bound (\`adapters.email\`). Changes are recorded in the application only; nobody is mailed.`);
+  }
+  /**
+   * Mails everybody the change concerns: the addresses the file names now,
+   * and — when the list itself is what moved — the ones it named before. An
+   * address taken off the list is told that once; otherwise whoever can edit
+   * the file could point the channel elsewhere and the people it pointed at
+   * would go quiet without a word, which is the failure this exists to
+   * prevent. Never throws: a mail that fails is logged.
+   */
+  async notify(change) {
+    const addresses = recipientsOf(this.addresses, change.previous);
+    if (addresses.length === 0) return {
+      kind: "nobody-to-tell"
+    };
+    if (!this.email) return {
+      kind: "no-email-port",
+      addresses
+    };
+    const message = describeChange(this.settings.app.name, change);
+    const failed = [];
+    for (const to of addresses) {
+      try {
+        await withinTime(this.email.send({
+          to,
+          ...message
+        }), MAIL_SEND_TIMEOUT_MS, to);
+      } catch (error) {
+        failed.push(to);
+        this.logger.error(`The settings-change mail to ${to} could not be sent; the change is recorded in the application regardless.`, error instanceof Error ? error.stack : String(error));
+      }
+    }
+    return {
+      kind: "sent",
+      addresses,
+      failed
+    };
+  }
+};
+SettingsChangeNotifier = _ts_decorate4([
+  Injectable2(),
+  _ts_param3(0, Inject2(PLAN_CATALOG_SETTINGS_TOKEN)),
+  _ts_param3(1, Optional()),
+  _ts_param3(1, Inject2(EMAIL_PORT_TOKEN)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof PlanCatalogSettings === "undefined" ? Object : PlanCatalogSettings,
+    Object
+  ])
+], SettingsChangeNotifier);
+function recipientsOf(running, previous) {
+  return [
+    .../* @__PURE__ */ new Set([
+      ...running,
+      ...addressListIn(previous)
+    ])
+  ];
+}
+__name(recipientsOf, "recipientsOf");
+function addressListIn(settings) {
+  const notifications = settings.notifications;
+  if (typeof notifications !== "object" || notifications === null) return [];
+  const list2 = notifications.settingsChanged;
+  return Array.isArray(list2) ? list2.filter((a) => typeof a === "string") : [];
+}
+__name(addressListIn, "addressListIn");
+function describeChange(appName, change) {
+  const lines = diffSettings(change.previous, change.current).map((d) => `  ${d.path}: ${JSON.stringify(d.before)} \u2192 ${JSON.stringify(d.after)}`);
+  return {
+    subject: `[${appName}] The configuration changed at the last start`,
+    text: [
+      `${appName} started at ${change.noticedAt.toISOString()} and found its settings changed`,
+      `since the previous start. The new values are running. What moved:`,
+      "",
+      ...lines,
+      "",
+      `Source: ${change.source}`,
+      "The change is recorded in the administration under Settings until somebody acknowledges it."
+    ].join("\n")
+  };
+}
+__name(describeChange, "describeChange");
+
+// src/settings/settings-fingerprint.ts
+import { createHash } from "crypto";
+import { canonicalJson } from "@saasicat/core";
+function fingerprintOf(settings) {
+  return `sha256-${createHash("sha256").update(canonicalJson(settings)).digest("hex")}`;
+}
+__name(fingerprintOf, "fingerprintOf");
+
+// src/settings/settings.tokens.ts
+var APPLIED_SETTINGS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/AppliedSettingsPort");
+var SETTINGS_SOURCE_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/SettingsSource");
+
+// src/settings/applied-settings.recorder.ts
+import { Inject as Inject3, Injectable as Injectable3, Logger as Logger2, Optional as Optional2 } from "@nestjs/common";
+import { diffSettings as diffSettings2, settingsSubtreeOf } from "@saasicat/core";
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param4, "_ts_param");
+var MAIL_BOOT_BUDGET_MS = 2e3;
+var RECORD_ATTEMPTS = 5;
+function pause(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms).unref());
+}
+__name(pause, "pause");
+var AppliedSettingsRecorder = class _AppliedSettingsRecorder {
+  static {
+    __name(this, "AppliedSettingsRecorder");
+  }
+  settings;
+  source;
+  port;
+  notifier;
+  logger = new Logger2(_AppliedSettingsRecorder.name);
+  constructor(settings, source, port = null, notifier = null) {
+    this.settings = settings;
+    this.source = source;
+    this.port = port;
+    this.notifier = notifier;
+  }
+  /** Whether this installation keeps a record at all. */
+  get recording() {
+    return this.port !== null;
+  }
+  async onApplicationBootstrap() {
+    if (!this.port) {
+      this.logger.warn("The applied settings are not recorded: the persistence adapter provides no `core.appliedSettings` port, so the platform cannot say when its configuration was applied or notice that it changed.");
+      return;
+    }
+    this.notifier?.reportModeAtBoot();
+    try {
+      const outcome = await this.record(this.port, () => /* @__PURE__ */ new Date());
+      this.report(outcome);
+      if (outcome.kind === "changed" && this.notifier) {
+        await this.tellSomebody(this.notifier, outcome.change);
+      }
+    } catch (error) {
+      this.logger.error(`The applied settings could not be recorded \u2014 the configuration in ${this.source} is running, but the record of it is stale.`, error instanceof Error ? error.stack : String(error));
+    }
+  }
+  /**
+   * Mails the change without holding the boot for it.
+   *
+   * Nest resolves `app.listen()` only once every bootstrap hook has settled,
+   * and an SMTP host that does not answer would otherwise turn a changed
+   * setting into an installation that does not start. So the boot waits a
+   * moment — long enough for a working adapter to hand the mail over, so
+   * the log reads in order — and then goes on; a slow adapter finishes on
+   * its own, and `notify()` bounds each send and logs what timed out.
+   */
+  async tellSomebody(notifier, change) {
+    await Promise.race([
+      notifier.notify(change),
+      pause(MAIL_BOOT_BUDGET_MS)
+    ]);
+  }
+  /**
+   * Compares the running settings with the record and writes what follows.
+   *
+   * `clock` is read once per attempt, after the record has been read and
+   * right before it is written, so the moment a row carries is the moment
+   * of the write that produced it. Read once when the start began, it would
+   * date a write by its start — and a start whose write landed after
+   * another's could carry the earlier moment, listing the changes in an
+   * order the record never went through.
+   */
+  async record(port, clock) {
+    const settings = settingsSubtreeOf(this.settings);
+    const fingerprint = fingerprintOf(settings);
+    for (let attempt = 1; attempt <= RECORD_ATTEMPTS; attempt++) {
+      const previous = await port.readApplied();
+      const running = {
+        fingerprint,
+        settings,
+        source: this.source,
+        appliedAt: clock()
+      };
+      const outcome = await this.reconcile(port, previous, running);
+      if (outcome) return outcome;
+    }
+    throw new Error(`The applied settings record moved ${RECORD_ATTEMPTS} times while this start was writing it. Either concurrent starts are running different configuration files, or the persistence adapter never confirms the guarded write: \`writeApplied\` must answer true, and \`recordChange\` the change, while the record still carries the fingerprint that was read.`);
+  }
+  /**
+   * What one read of the record calls for, written. `null` means the write
+   * found the record moved since `previous` was read, and wrote nothing.
+   */
+  async reconcile(port, previous, running) {
+    if (previous?.fingerprint === running.fingerprint) {
+      if (previous.source === running.source) return {
+        kind: "unchanged",
+        record: previous
+      };
+      const relocated = {
+        ...previous,
+        source: running.source
+      };
+      const written = await port.writeApplied(relocated, previous.fingerprint);
+      return written ? {
+        kind: "unchanged",
+        record: relocated
+      } : null;
+    }
+    if (!previous) {
+      const written = await port.writeApplied(running, null);
+      return written ? {
+        kind: "first-record",
+        record: running
+      } : null;
+    }
+    const change = await port.recordChange({
+      noticedAt: running.appliedAt,
+      source: running.source,
+      previous: previous.settings,
+      current: running.settings
+    }, running, previous.fingerprint);
+    return change ? {
+      kind: "changed",
+      record: running,
+      change
+    } : null;
+  }
+  report(outcome) {
+    switch (outcome.kind) {
+      case "first-record":
+        this.logger.log(`Applied settings recorded for the first time, from ${this.source}.`);
+        return;
+      case "changed": {
+        const lines = diffSettings2(outcome.change.previous, outcome.change.current).map((d) => `${d.path}: ${JSON.stringify(d.before)} \u2192 ${JSON.stringify(d.after)}`);
+        this.logger.warn(`The settings changed since the last start (${this.source}):
+  ` + lines.join("\n  "));
+        return;
+      }
+      default:
+        return;
+    }
+  }
+};
+AppliedSettingsRecorder = _ts_decorate5([
+  Injectable3(),
+  _ts_param4(0, Inject3(PLAN_CATALOG_SETTINGS_TOKEN)),
+  _ts_param4(1, Inject3(SETTINGS_SOURCE_TOKEN)),
+  _ts_param4(2, Optional2()),
+  _ts_param4(2, Inject3(APPLIED_SETTINGS_PORT_TOKEN)),
+  _ts_param4(3, Optional2()),
+  _ts_param4(3, Inject3(SettingsChangeNotifier)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof PlanCatalogSettings === "undefined" ? Object : PlanCatalogSettings,
+    String,
+    Object,
+    Object
+  ])
+], AppliedSettingsRecorder);
+
+// src/settings/settings.controller.ts
+import { Controller as Controller2, Get as Get2, Inject as Inject4, NotFoundException, Optional as Optional3, Param, Post as Post2, Req, UseGuards } from "@nestjs/common";
+import { SETTINGS_ERROR_CODES } from "@saasicat/core";
+import { diffSettings as diffSettings3, settingsSubtreeOf as settingsSubtreeOf2 } from "@saasicat/core";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param5, "_ts_param");
+var RECENT_CHANGES = 20;
+function buildSettingsController(guards) {
+  let GeneratedSettingsController = class GeneratedSettingsController {
+    static {
+      __name(this, "GeneratedSettingsController");
+    }
+    settings;
+    source;
+    port;
+    audit;
+    // Explicit @Inject: tsup/esbuild emit no `design:paramtypes`.
+    constructor(settings, source, port, audit = null) {
+      this.settings = settings;
+      this.source = source;
+      this.port = port;
+      this.audit = audit;
+    }
+    async getSettings() {
+      const settings = settingsSubtreeOf2(this.settings);
+      const fingerprint = fingerprintOf(settings);
+      const base = {
+        source: this.source,
+        fingerprint,
+        settings
+      };
+      if (!this.port) return {
+        ...base,
+        recorded: false,
+        appliedAt: null,
+        changes: []
+      };
+      const [applied, changes] = await Promise.all([
+        this.port.readApplied(),
+        this.port.listChanges({
+          limit: RECENT_CHANGES
+        })
+      ]);
+      return {
+        ...base,
+        recorded: true,
+        appliedAt: applied?.fingerprint === fingerprint ? applied.appliedAt.toISOString() : null,
+        changes: changes.map(toChangeView)
+      };
+    }
+    /**
+     * Marks a change as seen. The record survives until this is called —
+     * that is what makes it a record rather than a log line — and the
+     * acknowledgement keeps its first author: a second call changes nothing
+     * and answers the record as it stands.
+     */
+    async acknowledge(id, request) {
+      if (!this.port) {
+        throw new NotFoundException(codedError(SETTINGS_ERROR_CODES.SETTINGS_CHANGE_NOT_FOUND));
+      }
+      const acknowledged = await this.port.acknowledgeChange(id, this.audit?.actorTagFromRequest(request) ?? actorTagOf(defaultActorFromRequest(request)), /* @__PURE__ */ new Date());
+      if (!acknowledged) {
+        throw new NotFoundException(codedError(SETTINGS_ERROR_CODES.SETTINGS_CHANGE_NOT_FOUND));
+      }
+      await this.audit?.logFromRequest(request, "SettingsChange", id, "SETTINGS_CHANGE_ACKNOWLEDGE");
+      return toChangeView(acknowledged);
+    }
+  };
+  _ts_decorate6([
+    Get2("settings"),
+    _ts_metadata5("design:type", Function),
+    _ts_metadata5("design:paramtypes", []),
+    _ts_metadata5("design:returntype", Promise)
+  ], GeneratedSettingsController.prototype, "getSettings", null);
+  _ts_decorate6([
+    Post2("settings/changes/:id/acknowledge"),
+    _ts_param5(0, Param("id")),
+    _ts_param5(1, Req()),
+    _ts_metadata5("design:type", Function),
+    _ts_metadata5("design:paramtypes", [
+      String,
+      Object
+    ]),
+    _ts_metadata5("design:returntype", Promise)
+  ], GeneratedSettingsController.prototype, "acknowledge", null);
+  GeneratedSettingsController = _ts_decorate6([
+    Controller2("admin"),
+    UseGuards(...guards),
+    _ts_param5(0, Inject4(PLAN_CATALOG_SETTINGS_TOKEN)),
+    _ts_param5(1, Inject4(SETTINGS_SOURCE_TOKEN)),
+    _ts_param5(2, Inject4(APPLIED_SETTINGS_PORT_TOKEN)),
+    _ts_param5(3, Optional3()),
+    _ts_param5(3, Inject4(WebAuditLogger)),
+    _ts_metadata5("design:type", Function),
+    _ts_metadata5("design:paramtypes", [
+      typeof PlanCatalogSettings === "undefined" ? Object : PlanCatalogSettings,
+      String,
+      Object,
+      Object
+    ])
+  ], GeneratedSettingsController);
+  return GeneratedSettingsController;
+}
+__name(buildSettingsController, "buildSettingsController");
+function toChangeView(change) {
+  return {
+    id: change.id,
+    noticedAt: change.noticedAt.toISOString(),
+    source: change.source,
+    differences: diffSettings3(change.previous, change.current),
+    acknowledgedAt: change.acknowledgedAt?.toISOString() ?? null,
+    acknowledgedBy: change.acknowledgedBy
+  };
+}
+__name(toChangeView, "toChangeView");
+
+// src/settings/settings.module.ts
+import { Module as Module2 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+var SettingsModule = class _SettingsModule {
+  static {
+    __name(this, "SettingsModule");
+  }
+  static forRoot(options) {
+    const providers = [
+      {
+        provide: SETTINGS_SOURCE_TOKEN,
+        useValue: options.source
+      },
+      // Bound to null rather than left unbound: the controller and the
+      // recorder then read one shape, and `@Optional()` is not asked to
+      // paper over a provider that is sometimes there.
+      options.port ? asProvider(APPLIED_SETTINGS_PORT_TOKEN, options.port) : {
+        provide: APPLIED_SETTINGS_PORT_TOKEN,
+        useValue: null
+      },
+      options.email ? asProvider(EMAIL_PORT_TOKEN, options.email) : {
+        provide: EMAIL_PORT_TOKEN,
+        useValue: null
+      },
+      SettingsChangeNotifier,
+      AppliedSettingsRecorder,
+      // The acknowledgement is an operator's action and is audited like
+      // one. Best-effort: the logger writes nothing where the admin core
+      // is not in scope, and never fails the request.
+      WebAuditLogger
+    ];
+    return {
+      module: _SettingsModule,
+      imports: options.imports ?? [],
+      controllers: options.includeController === false ? [] : [
+        buildSettingsController(options.controller.guards)
+      ],
+      providers,
+      exports: [
+        AppliedSettingsRecorder,
+        SettingsChangeNotifier,
+        WebAuditLogger,
+        APPLIED_SETTINGS_PORT_TOKEN,
+        EMAIL_PORT_TOKEN,
+        SETTINGS_SOURCE_TOKEN
+      ]
+    };
+  }
+};
+SettingsModule = _ts_decorate7([
+  Module2({})
+], SettingsModule);
+
+// src/platform/enforcement-chain.check.ts
+import { Inject as Inject5, Injectable as Injectable4, Optional as Optional4 } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param6, "_ts_param");
 var GUARDS_METADATA = "__guards__";
 var METHOD_METADATA = "method";
 var ENFORCEMENT_CHAIN_STATE_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/EnforcementChainState");
@@ -460,14 +1006,14 @@ Two things this cannot see, and the way out of each: a guard of your own that wr
     return annotated;
   }
 };
-EnforcementChainCheck = _ts_decorate4([
-  Injectable2(),
-  _ts_param3(0, Inject2(DiscoveryService)),
-  _ts_param3(1, Inject2(MetadataScanner)),
-  _ts_param3(2, Optional()),
-  _ts_param3(2, Inject2(ENFORCEMENT_CHAIN_STATE_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+EnforcementChainCheck = _ts_decorate8([
+  Injectable4(),
+  _ts_param6(0, Inject5(DiscoveryService)),
+  _ts_param6(1, Inject5(MetadataScanner)),
+  _ts_param6(2, Optional4()),
+  _ts_param6(2, Inject5(ENFORCEMENT_CHAIN_STATE_TOKEN)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
     typeof MetadataScanner === "undefined" ? Object : MetadataScanner,
     typeof EnforcementChainState === "undefined" ? Object : EnforcementChainState
@@ -504,8 +1050,367 @@ function readGuards(target) {
 }
 __name(readGuards, "readGuards");
 
+// src/platform/issuer-identity.check.ts
+import { Inject as Inject6, Injectable as Injectable5, Logger as Logger3, Optional as Optional5 } from "@nestjs/common";
+import { classifyIssuerChange, recordedIssuerIdentity } from "@saasicat/core";
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+var CONTRACTS_NAMED = 5;
+var NOT_RECORDED = "this installation records no applied settings";
+var ISSUER_BLOCK_KEYS = [
+  "legalName",
+  "addressLine1",
+  "addressLine2",
+  "postalCode",
+  "city",
+  "country",
+  "vatId",
+  "taxNumber"
+];
+var IssuerIdentityInspector = class _IssuerIdentityInspector {
+  static {
+    __name(this, "IssuerIdentityInspector");
+  }
+  fileSettings;
+  source;
+  settings;
+  contracts;
+  rlsBypass;
+  logger = new Logger3(_IssuerIdentityInspector.name);
+  /** This start's answer, settled the first time anything asks for it. */
+  verdict = null;
+  constructor(fileSettings, source, settings = null, contracts = null, rlsBypass = null) {
+    this.fileSettings = fileSettings;
+    this.source = source;
+    this.settings = settings;
+    this.contracts = contracts;
+    this.rlsBypass = rlsBypass;
+  }
+  /**
+   * What the issuer in the file is, against the identity the record holds.
+   *
+   * Answered once per process, and the cached answer is the point rather than
+   * the saved query: `AppliedSettingsRecorder` replaces the record moments
+   * later, in a bootstrap hook, so a second comparison would find the file
+   * agreeing with what this very start wrote. A reader asking afterwards —
+   * `<app> doctor`, a health endpoint — would then be told that nothing had
+   * moved, on a start that had just carried a correction through. What this
+   * start found is a fact about this start, so it is settled when the start
+   * asks and does not change afterwards.
+   */
+  inspect() {
+    return this.verdict ??= this.compare();
+  }
+  /**
+   * How many contracts are running, for a report that says what changing the
+   * identity would cost. A query of its own rather than a field on the
+   * verdict: a start needs this only to name the contracts in a refusal, and
+   * no boot should pay for a number nobody reads. `null` where they are not
+   * known.
+   */
+  async runningContractCount() {
+    const running = await this.readRunning(0);
+    return running.known ? running.contracts.total : null;
+  }
+  async compare() {
+    if (!this.settings) return {
+      kind: "not-compared",
+      why: NOT_RECORDED
+    };
+    const recorded = await this.readRecorded();
+    if (!recorded.read) return {
+      kind: "not-compared",
+      why: recorded.why
+    };
+    const change = classifyIssuerChange(recordedIssuerIdentity(recorded.settings), this.fileSettings.issuer);
+    if (change.kind !== "undeclared") return {
+      kind: "settled",
+      change
+    };
+    const running = await this.readRunning();
+    return {
+      kind: "refused",
+      change,
+      running: running.known ? running.contracts : null,
+      refusal: refusalFor(change, running, this.source, recorded.settings?.issuer)
+    };
+  }
+  /**
+   * The settings of the last start, or what stopped this from reading them.
+   *
+   * A read that fails while the file names an issuer takes the boot down: a
+   * guard that cannot see is not a guard that saw nothing, and an installation
+   * that puts a legal entity on every contract it concludes should not conclude
+   * one while nothing can tell whether that entity is still the recorded one.
+   *
+   * Where the file names no issuer, the same failure is only a warning. There
+   * is then no entity to conclude a contract on behalf of, and the promise the
+   * record makes — an installation whose record cannot be kept still runs the
+   * right configuration — is worth more than a boot refused over a comparison
+   * with nothing on one side. What that leaves uncaught is narrow and worth
+   * naming: an operator who removes the issuer block while contracts run, in
+   * the same start where the record cannot be read.
+   */
+  async readRecorded() {
+    try {
+      const record = await this.settings.readApplied();
+      return {
+        read: true,
+        settings: record?.settings ?? null
+      };
+    } catch (error) {
+      const why = `the applied settings could not be read: ${messageOf(error)}`;
+      if (this.fileSettings.issuer) {
+        throw new Error(`The issuer named in ${this.source} could not be compared with the one this installation recorded, because ${why}`, {
+          cause: error
+        });
+      }
+      return {
+        read: false,
+        why
+      };
+    }
+  }
+  /**
+   * The contracts a refusal is about. Best effort on purpose: the refusal is
+   * already decided, and losing it because the list behind it could not be
+   * read would replace a message an operator can act on with one they cannot.
+   * Where they are not known, the message says which of the two it is —
+   * "nothing here writes contracts" and "the query failed" send an operator
+   * looking in different places.
+   */
+  async readRunning(named = CONTRACTS_NAMED) {
+    if (!this.contracts) {
+      return {
+        known: false,
+        why: "This installation writes no contracts."
+      };
+    }
+    try {
+      const listed = await this.withBypass(() => this.contracts.listRunningIssuers(named));
+      return {
+        known: true,
+        contracts: listed
+      };
+    } catch (error) {
+      const why = `The contracts still running could not be read: ${messageOf(error)}`;
+      this.logger.warn(why);
+      return {
+        known: false,
+        why
+      };
+    }
+  }
+  /**
+   * Inside the bypass frame where one is bound, and plainly where none is.
+   *
+   * An installation without row-level security binds a port that only calls
+   * through; one that has it cannot be read platform-wide without this.
+   * `@Optional()` rather than required because a hand-wired application may
+   * have no `AdminModule` in scope, and a boot check is not the place to
+   * refuse to construct over a message.
+   */
+  withBypass(read) {
+    return this.rlsBypass ? this.rlsBypass.runWithBypass(read) : read();
+  }
+  /**
+   * The line a start that continues is worth, and nothing where it is worth
+   * none. Public because the hook beside this class calls it; not an offer.
+   *
+   * @internal
+   */
+  report(verdict) {
+    if (verdict.kind === "not-compared") {
+      this.logger.warn(`The issuer in the configuration is compared with nothing \u2014 ${verdict.why} \u2014 so a start that names another legal entity than the last one is not refused.`);
+      return;
+    }
+    const change = verdict.change;
+    if (change.kind === "first-naming") {
+      this.logger.log(`The issuer of every contract concluded from now on is '${change.identity.legalName}'.`);
+      return;
+    }
+    if (change.kind === "corrected") {
+      this.logger.log(`The issuer's ${listFields(change.moved)} changed as a declared correction of the same legal entity: ${change.reason}. Contracts already concluded keep the copy they name; what is issued from now on carries the corrected identity.`);
+    }
+  }
+};
+IssuerIdentityInspector = _ts_decorate9([
+  Injectable5(),
+  _ts_param7(0, Inject6(PLAN_CATALOG_SETTINGS_TOKEN)),
+  _ts_param7(1, Inject6(SETTINGS_SOURCE_TOKEN)),
+  _ts_param7(2, Optional5()),
+  _ts_param7(2, Inject6(APPLIED_SETTINGS_PORT_TOKEN)),
+  _ts_param7(3, Optional5()),
+  _ts_param7(3, Inject6(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN)),
+  _ts_param7(4, Optional5()),
+  _ts_param7(4, Inject6(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof PlanCatalogSettings === "undefined" ? Object : PlanCatalogSettings,
+    String,
+    Object,
+    Object,
+    Object
+  ])
+], IssuerIdentityInspector);
+var IssuerIdentityCheck = class {
+  static {
+    __name(this, "IssuerIdentityCheck");
+  }
+  inspector;
+  constructor(inspector) {
+    this.inspector = inspector;
+  }
+  async onModuleInit() {
+    const verdict = await this.inspector.inspect();
+    if (verdict.kind === "refused") throw new Error(verdict.refusal);
+    this.inspector.report(verdict);
+  }
+};
+IssuerIdentityCheck = _ts_decorate9([
+  Injectable5(),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
+    typeof IssuerIdentityInspector === "undefined" ? Object : IssuerIdentityInspector
+  ])
+], IssuerIdentityCheck);
+function refusalFor(change, running, source, recordedIssuer) {
+  return [
+    `The issuer in ${source} is not the legal entity this installation recorded.`,
+    `  recorded: ${describe2(change.recorded)}`,
+    `  in the file: ${change.current ? describe2(change.current) : "no issuer is named at all"}`,
+    faultSentence(change.fault),
+    contractsSentence(running),
+    ...wayOut(change, source, recordedIssuer)
+  ].join("\n");
+}
+__name(refusalFor, "refusalFor");
+function wayOut(change, source, recordedIssuer) {
+  if (change.fault.kind === "names-no-issuer") {
+    return [
+      `Write the issuer block again as this installation recorded it \u2014 replacing the one in ${source} where there is still one there, because a second \`issuer:\` key is a file YAML refuses to read. Where that entity has since been corrected, declare the correction beside the corrected values. A declaration on its own cannot help here: there is nothing in the file for it to be about.`,
+      issuerBlockFor(recordedIssuer)
+    ];
+  }
+  return [
+    "Moving a contract to another legal entity is a transfer, not an edit of a setting. Where this is the same entity under a new name, or with a tax identifier that was wrong or missing, declare it beside the values it replaces and start again:",
+    declarationFor(change.recorded, change.moved)
+  ];
+}
+__name(wayOut, "wayOut");
+function issuerBlockFor(recordedIssuer) {
+  const source = recordedIssuer && typeof recordedIssuer === "object" && !Array.isArray(recordedIssuer) ? recordedIssuer : {};
+  const lines = ISSUER_BLOCK_KEYS.filter((key) => typeof source[key] === "string").map((key) => `    ${key}: ${JSON.stringify(source[key])}`);
+  return [
+    "issuer:",
+    ...lines
+  ].join("\n");
+}
+__name(issuerBlockFor, "issuerBlockFor");
+function faultSentence(fault) {
+  switch (fault.kind) {
+    case "absent":
+      return "`issuer.correctionOf` declares nothing, so nothing says this is the same entity.";
+    case "names-no-issuer":
+      return "The file names no issuer for a declaration to be about, so there is no entity here for the recorded one to be the same as.";
+    case "names-another-value":
+      return `\`issuer.correctionOf.${fault.field}\` names ${quote(fault.declared)}, which is not what the record holds (${quote(fault.recorded)}). A declaration names the values it replaces, so one left over from a correction already applied does not cover this one.`;
+    case "leaves-a-field-out":
+      return `\`issuer.correctionOf\` says nothing about \`${fault.field}\`, which the file moves away from ${quote(fault.recorded)}. Every identity field that moves is named, or the declaration covers only half the change.`;
+  }
+}
+__name(faultSentence, "faultSentence");
+function contractsSentence(running) {
+  if (!running.known) return running.why;
+  const { total, contracts } = running.contracts;
+  if (total === 0) return "No contract is running.";
+  const rest = total - contracts.length;
+  return [
+    `${total} contract(s) are still running:`,
+    ...contracts.map(describeContract),
+    ...rest > 0 ? [
+      `  \u2026 and ${rest} more.`
+    ] : []
+  ].join("\n");
+}
+__name(contractsSentence, "contractsSentence");
+function describeContract(contract) {
+  const under = contract.issuerLegalName ? `concluded under ${quote(contract.issuerLegalName)}` : "names no issuer";
+  const from2 = contract.effectiveFrom instanceof Date ? contract.effectiveFrom.toISOString().slice(0, 10) : "an unreadable date";
+  return `  ${contract.id} (tenant ${contract.tenantId}, from ${from2}, ${under})`;
+}
+__name(describeContract, "describeContract");
+function declarationFor(recorded, moved) {
+  const lines = moved.map((field) => `        ${field}: ${recorded[field] === null ? "null" : JSON.stringify(recorded[field])}`);
+  return [
+    "issuer:",
+    "    correctionOf:",
+    ...lines,
+    "        reason: <why the same entity now reads differently>"
+  ].join("\n");
+}
+__name(declarationFor, "declarationFor");
+function describe2(identity) {
+  return `${quote(identity.legalName)} (VAT id ${quote(identity.vatId)}, tax number ${quote(identity.taxNumber)})`;
+}
+__name(describe2, "describe");
+function listFields(fields) {
+  return fields.map((field) => `\`${field}\``).join(", ");
+}
+__name(listFields, "listFields");
+function quote(value) {
+  return value === null ? "none" : `'${value}'`;
+}
+__name(quote, "quote");
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+__name(messageOf, "messageOf");
+
+// src/platform/module-options.ts
+var DB_CATALOG_MEMBERS = [
+  "path",
+  "env"
+];
+function dbCatalogNamesAPath(dbCatalog) {
+  return typeof dbCatalog?.path === "string" && dbCatalog.path.trim() !== "";
+}
+__name(dbCatalogNamesAPath, "dbCatalogNamesAPath");
+function dbCatalogLeftovers(dbCatalog) {
+  const taken = new Set(DB_CATALOG_MEMBERS);
+  return Object.entries(dbCatalog).filter(([key, value]) => !taken.has(key) && value !== void 0).map(([key]) => key);
+}
+__name(dbCatalogLeftovers, "dbCatalogLeftovers");
+function dbCatalogNamesAFile(dbCatalog) {
+  return dbCatalogNamesAPath(dbCatalog) && dbCatalogLeftovers(dbCatalog).length === 0;
+}
+__name(dbCatalogNamesAFile, "dbCatalogNamesAFile");
+
 // src/platform/validation/rules.ts
 import { assertPersistenceCapabilities } from "@saasicat/core";
+
+// src/platform/compose/bundle-repository-source.ts
+function resolveBundleRepository(persistence) {
+  return persistence?.catalog?.bundleRepository ?? persistence?.entitlement?.bundleRepository;
+}
+__name(resolveBundleRepository, "resolveBundleRepository");
+
+// src/platform/validation/rules.ts
 var DOCS_BASE = "https://github.com/uelker70/saasicat/blob/main/docs/reference/options.md";
 var headingSlug = /* @__PURE__ */ __name((text) => text.trim().toLowerCase().replace(/[^a-z0-9 -]/g, "").replace(/ /g, "-"), "headingSlug");
 var docsUrlFor = /* @__PURE__ */ __name((id) => `${DOCS_BASE}#${headingSlug(id)}`, "docsUrlFor");
@@ -521,6 +1426,7 @@ function absent(required) {
 }
 __name(absent, "absent");
 var list = /* @__PURE__ */ __name((names) => names.join(", "), "list");
+var catalogOf = /* @__PURE__ */ __name((c) => c.catalog ?? c.options.planCatalog, "catalogOf");
 var RULE_SPECS = [
   {
     id: "core.adapters-bound",
@@ -532,7 +1438,42 @@ var RULE_SPECS = [
     id: "catalog.identity-or-sink",
     when: /* @__PURE__ */ __name((c) => !c.options.planCatalog, "when"),
     assert: /* @__PURE__ */ __name((c) => Boolean(c.adapters.planCatalogReadSink && c.options.dbCatalog), "assert"),
-    message: "no plan catalogue is reachable. Either set `planCatalog` (the quickstart YAML path) or, for DB hydration, BOTH a `planCatalogReadSink` (via `adapters` or `persistence`) AND `dbCatalog` ({ projectKey, currency, vatRate }). Without the identity the sink loads with projectKey '' and the app boots with a silently empty catalogue."
+    message: "no plan catalogue is reachable. Either set `planCatalog` (the quickstart YAML path) or, for DB hydration, BOTH a `planCatalogReadSink` (via `adapters` or `persistence`) AND `dbCatalog` ({ path: 'config/saas.yaml' }, the file the settings are read from). Without the file the app boots with a silently empty catalogue and no settings."
+  },
+  {
+    id: "catalog.db-catalog-names-the-file",
+    when: /* @__PURE__ */ __name((c) => c.options.dbCatalog !== void 0, "when"),
+    assert: /* @__PURE__ */ __name((c) => dbCatalogNamesAFile(c.options.dbCatalog), "assert"),
+    message: /* @__PURE__ */ __name((c) => {
+      const given = c.options.dbCatalog;
+      const leftovers = dbCatalogNamesAPath(given) ? dbCatalogLeftovers(given) : [];
+      if (leftovers.length > 0) {
+        return `\`dbCatalog\` names the file and nothing else, and this one still carries ${list(leftovers)}. Delete that here; the platform reads the settings from the file it names, and a value left beside the path would be ignored while looking like the one that runs. See docs/guides/upgrade-to-1.0.md.`;
+      }
+      return "`dbCatalog` names the file: `dbCatalog: { path: 'config/saas.yaml' }`. It used to take `app`, `currency`, `vatRate` and `tenantBilling` as values, and that was a second place a setting could live. Delete the values here; the platform reads them from the file it names \u2014 the same one they were forwarded from. See docs/guides/upgrade-to-1.0.md.";
+    }, "message")
+  },
+  {
+    id: "catalog.db-catalog-file-loads",
+    // Only where a file was named at all. On the quickstart path the
+    // consumer calls the loader themselves, and their own stack says where.
+    when: /* @__PURE__ */ __name((c) => c.options.dbCatalog !== void 0, "when"),
+    assert: /* @__PURE__ */ __name((c) => c.catalogFailure === void 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => {
+      const given = c.options.dbCatalog;
+      const named = dbCatalogNamesAPath(given) ? given.path : "config/saas.yaml";
+      const why = c.catalogFailure ? `: ${c.catalogFailure.message}` : "";
+      return `\`dbCatalog\` names '${named}' and the file did not load${why}. A relative path is resolved against the directory the process was started in, not against the file the option is written in. See docs/guides/wire-the-backend.md.`;
+    }, "message")
+  },
+  {
+    id: "catalog.app-is-named",
+    // Only where a catalogue is reachable at all — otherwise
+    // `catalog.identity-or-sink` is the finding, and reporting both would
+    // name the same omission twice.
+    when: /* @__PURE__ */ __name((c) => catalogOf(c) !== void 0, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(catalogOf(c)?.app?.name?.trim()), "assert"),
+    message: "the catalogue names no application. `app.name` is the one place an installation names itself \u2014 it is the manifest display name, the login-page brand and the discovery snapshot key \u2014 so an absent one is not a default to fill in: the app would boot identified by an empty string. Set `app: { name: \u2026 }` in config/saas.yaml."
   },
   {
     id: "catalog.requires-persistence",
@@ -576,6 +1517,24 @@ var RULE_SPECS = [
     assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.subscriptionContract)?.subscriptionContractRepository ?? bundle(c)?.entitlement?.subscriptionContractRepository), "assert"),
     message: "subscriptionContract is enabled, but no repository is available. Set `subscriptionContract.subscriptionContractRepository` or use a compatible persistence bundle."
   },
+  {
+    id: "subscription-contract.requires-subscriber-repository",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionContract), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.subscriptionContract)?.subscriberRepository ?? bundle(c)?.entitlement?.subscriberRepository), "assert"),
+    message: "subscriptionContract is enabled, but no subscriber repository is available: every contract names the subscriber it is concluded with. Set `subscriptionContract.subscriberRepository` or use a persistence bundle providing `persistence.entitlement.subscriberRepository`."
+  },
+  {
+    id: "payments.requires-persistence",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.payments), "when"),
+    assert: /* @__PURE__ */ __name((c) => absent(paymentStores(c)).length === 0, "assert"),
+    message: /* @__PURE__ */ __name((c) => `payments is enabled, but these adapters are missing: ${list(absent(paymentStores(c)))}. A gateway event is claimed and its effect written on one transaction, so all of them come from one persistence bundle.`, "message")
+  },
+  {
+    id: "payments.requires-accounts-in-the-file",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.payments) && catalogOf(c) !== void 0, "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(catalogOf(c)?.payments), "assert"),
+    message: "payments is enabled, and config/saas.yaml has no `payments` block naming the gateway accounts the bound gateways belong to."
+  },
   {
     id: "promo-codes.public-preview-requires-first-time-check",
     when: /* @__PURE__ */ __name((c) => {
@@ -650,9 +1609,15 @@ var tenantBillingPorts = /* @__PURE__ */ __name((c) => {
     subscriptionWritePort: config?.subscriptionWritePort
   };
 }, "tenantBillingPorts");
+var paymentStores = /* @__PURE__ */ __name((c) => ({
+  paymentEventLog: bundle(c)?.payments?.paymentEventLog,
+  subscriberPaymentMethodRepository: bundle(c)?.payments?.subscriberPaymentMethodRepository,
+  subscriberRepository: bundle(c)?.entitlement?.subscriberRepository,
+  transactionRunner: c.adapters.transactionRunner
+}), "paymentStores");
 var bundleRepositories = /* @__PURE__ */ __name((c) => ({
   subscriptionBundleRepository: bundle(c)?.entitlement?.subscriptionBundleRepository,
-  bundleRepository: bundle(c)?.catalog?.bundleRepository
+  bundleRepository: resolveBundleRepository(bundle(c))
 }), "bundleRepositories");
 var entitlementAdapters = /* @__PURE__ */ __name((c) => ({
   subscriptionRepository: c.adapters.subscriptionRepository,
@@ -727,6 +1692,13 @@ var QuotaProvidersUsageSnapshot = class {
 };
 
 // src/platform/compose/context.ts
+function operatorGuards(options) {
+  return [
+    ...options.controller.guards,
+    SuperAdminGuard
+  ];
+}
+__name(operatorGuards, "operatorGuards");
 function optionsOf2(slot) {
   return typeof slot === "object" ? slot : {};
 }
@@ -739,10 +1711,7 @@ function composeAdminResources({ options, persistence }) {
   return [
     AdminResourcesModule.forRoot({
       resources: config.resources ?? persistence?.adminResources?.resources,
-      guards: config.guards ?? [
-        ...options.controller.guards,
-        SuperAdminGuard
-      ],
+      guards: config.guards ?? operatorGuards(options),
       imports: config.imports ?? options.imports
     })
   ];
@@ -750,7 +1719,7 @@ function composeAdminResources({ options, persistence }) {
 __name(composeAdminResources, "composeAdminResources");
 
 // src/platform/compose/catalog.ts
-function composeCatalog({ options, persistence, appInfo }) {
+function composeCatalog({ options, persistence }) {
   const config = options.catalog;
   if (!config) return [];
   const catalog = persistence?.catalog;
@@ -763,7 +1732,7 @@ function composeCatalog({ options, persistence, appInfo }) {
       promotionRepository: catalog.promotionRepository,
       marketingSettingsRepository: catalog.marketingSettingsRepository,
       controller: config.adminControllers === false ? void 0 : {
-        guards: options.controller.guards
+        guards: operatorGuards(options)
       },
       imports: config.imports ?? options.imports,
       extraProviders: config.extraProviders,
@@ -771,13 +1740,18 @@ function composeCatalog({ options, persistence, appInfo }) {
       autoSyncDiscoveryAtBoot: config.autoSyncDiscoveryAtBoot,
       marketedOnlyFeatures: config.marketedOnlyFeatures,
       featureUiRegistry: config.featureUiRegistry,
-      publicMarketingCatalog: config.publicMarketingCatalog
+      // What the public catalogue says about payment methods comes from
+      // the same option that wires the gateways, so the two cannot
+      // disagree: no `payments`, nothing takes new payment methods.
+      publicMarketingCatalog: config.publicMarketingCatalog && {
+        ...config.publicMarketingCatalog,
+        newPaymentMethodsFrom: config.publicMarketingCatalog.newPaymentMethodsFrom ?? (options.payments ? PaymentGatewayRegistry : null)
+      }
     })
   ];
   if (config.publicCatalog !== false) {
     modules.push(PublicCatalogModule.forRoot({
       featureUiRegistry: config.featureUiRegistry,
-      projectKey: appInfo.key,
       bundleRepository: catalog.bundleRepository,
       marketingRepository: catalog.marketingProjectionRepository,
       catalogEntryRepository: catalog.catalogEntryRepository,
@@ -826,25 +1800,34 @@ function composeAdminStats({ options, persistence }) {
   return [
     AdminStatsModule.forRoot({
       ...config,
-      guards: config.guards ?? [
-        ...options.controller.guards,
-        SuperAdminGuard
-      ],
+      guards: config.guards ?? operatorGuards(options),
       auditStatsPort: config.auditStatsPort ?? persistence?.core.auditStats,
       imports: config.imports ?? options.imports
     })
   ];
 }
 __name(composeAdminStats, "composeAdminStats");
-function composeCheckoutOffer({ options, persistence }) {
+function composeCheckoutOffer({ options, adapters, persistence }) {
   const config = options.checkoutOffer;
   if (!config) return [];
+  const contractRepository = config.conclusion?.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository;
+  const subscriberRepository = config.conclusion?.subscriberRepository ?? persistence?.entitlement?.subscriberRepository;
+  const transactionRunner = config.conclusion?.transactionRunner ?? adapters.transactionRunner;
   return [
     CheckoutOfferModule.forRoot({
       ...config,
-      bundleRepository: config.bundleRepository ?? persistence?.catalog?.bundleRepository,
+      bundleRepository: config.bundleRepository ?? resolveBundleRepository(persistence),
       planRepository: config.planRepository ?? persistence?.catalog?.planRepository,
+      promotionRepository: config.promotionRepository ?? persistence?.catalog?.promotionRepository,
       catalogEntryRepository: config.catalogEntryRepository ?? persistence?.catalog?.catalogEntryRepository,
+      // Named by hand, it is passed on even when part of it resolves to
+      // nothing, so the module refuses to start the same way it does when
+      // wired directly; derived from the bundle, it is wired when all exist.
+      conclusion: config.conclusion || contractRepository && subscriberRepository && transactionRunner ? {
+        subscriptionContractRepository: contractRepository,
+        subscriberRepository,
+        transactionRunner
+      } : void 0,
       imports: config.imports ?? options.imports
     })
   ];
@@ -857,12 +1840,39 @@ function composeSubscriptionContract({ options, persistence }) {
     SubscriptionContractModule.forRoot({
       ...config,
       subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
+      subscriberRepository: config.subscriberRepository ?? persistence?.entitlement?.subscriberRepository,
       imports: config.imports ?? options.imports
     })
   ];
 }
 __name(composeSubscriptionContract, "composeSubscriptionContract");
 
+// src/platform/compose/payments.ts
+function composePayments(ctx) {
+  const config = ctx.options.payments;
+  if (!config) return [];
+  const tenantBilling = optionsOf2(ctx.options.tenantBilling);
+  const authGuards = ctx.shared.authGuards;
+  return [
+    PaymentsModule.forRoot({
+      gateways: config.gateways,
+      paymentEventLog: ctx.persistence?.payments?.paymentEventLog,
+      subscriberPaymentMethodRepository: ctx.persistence?.payments?.subscriberPaymentMethodRepository,
+      subscriberRepository: ctx.persistence?.entitlement?.subscriberRepository,
+      transactionRunner: ctx.adapters.transactionRunner,
+      tenantRoutes: authGuards ? {
+        authGuards,
+        billingPermissionGuards: config.billingPermissionGuards,
+        tenantIdResolver: tenantBilling.tenantIdResolver,
+        userEmailResolver: tenantBilling.userEmailResolver
+      } : void 0,
+      imports: config.imports ?? ctx.options.imports,
+      extraProviders: config.extraProviders
+    })
+  ];
+}
+__name(composePayments, "composePayments");
+
 // src/platform/compose/promo-codes.ts
 function composePromoCodes({ options, adapters, persistence }) {
   if (!options.promoCodes) return [];
@@ -877,18 +1887,19 @@ function composePromoCodes({ options, adapters, persistence }) {
       validationLogRepository: promo.validationLogRepository,
       subscriptionLookup: promo.subscriptionLookup,
       revenueAggregator: promo.revenueAggregator,
+      holdRepository: promo.holdRepository,
       transactionRunner: adapters.transactionRunner,
       firstTimeCustomerCheck: firstTimeCustomerCheck ?? {
         hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
       },
       includePublicController: includePublicController ?? false,
       adminController: adminController === false ? false : {
-        guards: adminGuards ?? [
-          ...options.controller.guards,
-          SuperAdminGuard
-        ]
+        guards: adminGuards ?? operatorGuards(options)
       },
-      imports: promoImports ?? options.imports
+      imports: promoImports ?? options.imports,
+      // A checkout offer prices a promo code through `PromoCodesService`,
+      // from a module that does not import this one.
+      global: Boolean(options.checkoutOffer)
     })
   ];
 }
@@ -927,6 +1938,12 @@ function composeTenantBilling(ctx) {
     TenantBillingModule.forRoot({
       ...tenantOptions,
       authGuards: ctx.shared.authGuards,
+      // The same adapter `SubscriptionBundleModule` gets. That module
+      // exports the token, but it is a sibling import here rather than an
+      // ancestor, so its exports never reach this module's providers —
+      // and the plan-change rule that reads bookings would resolve to
+      // "none" and allow the move it exists to refuse.
+      subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
       subscriptionUsagePort: ctx.shared.subscriptionUsagePort,
       usageSnapshotPort: usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(quotaProviders),
       subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
@@ -951,7 +1968,7 @@ function composeSubscriptionBundles(ctx) {
     SubscriptionBundleModule.forRoot({
       ...bundleOptions,
       subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
-      bundleRepository: ctx.persistence?.catalog?.bundleRepository,
+      bundleRepository: resolveBundleRepository(ctx.persistence),
       controller: controller === false ? void 0 : {
         ...controller ?? {},
         authGuards: ctx.shared.authGuards,
@@ -976,6 +1993,8 @@ var FEATURE_COMPOSERS = [
   // Before the bundles — see the note above.
   composeTenantBilling,
   composeSubscriptionBundles,
+  // After tenant billing too: its tenant routes share the guards.
+  composePayments,
   composeSetup,
   composeAdminStats,
   composeCheckoutOffer,
@@ -1069,32 +2088,32 @@ var StaticPlanResolver = class {
 };
 
 // src/platform/static-entitlement.service.ts
-import { Inject as Inject3, Injectable as Injectable3 } from "@nestjs/common";
-function _ts_decorate5(decorators, target, key, desc) {
+import { Inject as Inject7, Injectable as Injectable6 } from "@nestjs/common";
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata8(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param8(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param8, "_ts_param");
 var StaticEntitlementService = class {
   static {
     __name(this, "StaticEntitlementService");
   }
-  catalog;
+  catalogs;
   resolver;
-  constructor(catalog, resolver) {
-    this.catalog = catalog;
+  constructor(catalogs, resolver) {
+    this.catalogs = catalogs;
     this.resolver = resolver;
   }
   /**
@@ -1111,7 +2130,7 @@ var StaticEntitlementService = class {
         quotas: {}
       };
     }
-    const plan = this.findPlan(planId);
+    const plan = findPlan(await this.catalogs.current(), planId);
     if (!plan) {
       return {
         planId,
@@ -1135,34 +2154,31 @@ var StaticEntitlementService = class {
     const value = snap.quotas[quotaKey];
     return value === void 0 ? null : value;
   }
-  findPlan(planId) {
-    return (this.catalog.plans ?? []).find((p) => p.id === planId);
-  }
 };
-StaticEntitlementService = _ts_decorate5([
-  Injectable3(),
-  _ts_param4(0, Inject3(PLAN_CATALOG_TOKEN)),
-  _ts_param4(1, Inject3(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
-    typeof PlanCatalog === "undefined" ? Object : PlanCatalog,
+StaticEntitlementService = _ts_decorate10([
+  Injectable6(),
+  _ts_param8(0, Inject7(PLAN_CATALOG_SOURCE_TOKEN)),
+  _ts_param8(1, Inject7(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof PlanCatalogSource === "undefined" ? Object : PlanCatalogSource,
     typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
   ])
 ], StaticEntitlementService);
 
 // src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable4 } from "@nestjs/common";
-function _ts_decorate6(decorators, target, key, desc) {
+import { Injectable as Injectable7 } from "@nestjs/common";
+function _ts_decorate11(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata9(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
+__name(_ts_metadata9, "_ts_metadata");
 var TenantManifestService = class {
   static {
     __name(this, "TenantManifestService");
@@ -1208,10 +2224,10 @@ var TenantManifestService = class {
     };
   }
 };
-TenantManifestService = _ts_decorate6([
-  Injectable4(),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+TenantManifestService = _ts_decorate11([
+  Injectable7(),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
   ])
 ], TenantManifestService);
@@ -1225,24 +2241,24 @@ function isVisible(item, features) {
 __name(isVisible, "isVisible");
 
 // src/platform/tenant-manifest.controller.ts
-import { Controller as Controller2, Get as Get2, Inject as Inject4, Req, UseGuards } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
+import { Controller as Controller3, Get as Get3, Inject as Inject8, Req as Req2, UseGuards as UseGuards2 } from "@nestjs/common";
+function _ts_decorate12(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate12, "_ts_decorate");
+function _ts_metadata10(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
+__name(_ts_metadata10, "_ts_metadata");
+function _ts_param9(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param5, "_ts_param");
+__name(_ts_param9, "_ts_param");
 function buildTenantManifestController(options) {
   const path = options.path ?? "tenant/manifest";
   let GeneratedTenantManifestController = class GeneratedTenantManifestController {
@@ -1261,21 +2277,21 @@ function buildTenantManifestController(options) {
       return this.svc.getManifest(tenantId);
     }
   };
-  _ts_decorate7([
-    Get2(),
-    _ts_param5(0, Req()),
-    _ts_metadata6("design:type", Function),
-    _ts_metadata6("design:paramtypes", [
+  _ts_decorate12([
+    Get3(),
+    _ts_param9(0, Req2()),
+    _ts_metadata10("design:type", Function),
+    _ts_metadata10("design:paramtypes", [
       typeof RequestWithUser === "undefined" ? Object : RequestWithUser
     ]),
-    _ts_metadata6("design:returntype", Promise)
+    _ts_metadata10("design:returntype", Promise)
   ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate7([
-    Controller2(path),
-    UseGuards(...options.guards),
-    _ts_param5(0, Inject4(TenantManifestService)),
-    _ts_metadata6("design:type", Function),
-    _ts_metadata6("design:paramtypes", [
+  GeneratedTenantManifestController = _ts_decorate12([
+    Controller3(path),
+    UseGuards2(...options.guards),
+    _ts_param9(0, Inject8(TenantManifestService)),
+    _ts_metadata10("design:type", Function),
+    _ts_metadata10("design:paramtypes", [
       typeof TenantManifestService === "undefined" ? Object : TenantManifestService
     ])
   ], GeneratedTenantManifestController);
@@ -1284,27 +2300,27 @@ function buildTenantManifestController(options) {
 __name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/enforce-quota.interceptor.ts
-import { Inject as Inject5, Injectable as Injectable5, Optional as Optional2 } from "@nestjs/common";
+import { Inject as Inject9, Injectable as Injectable8, Optional as Optional6 } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
 import { from } from "rxjs";
 import { switchMap } from "rxjs/operators";
-function _ts_decorate8(decorators, target, key, desc) {
+function _ts_decorate13(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata11(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata11, "_ts_metadata");
+function _ts_param10(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param10, "_ts_param");
 var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/QuotaProviders");
 var EnforceQuotaInterceptor = class {
   static {
@@ -1347,14 +2363,14 @@ var EnforceQuotaInterceptor = class {
     }
   }
 };
-EnforceQuotaInterceptor = _ts_decorate8([
-  Injectable5(),
-  _ts_param6(0, Inject5(Reflector)),
-  _ts_param6(1, Inject5(StaticEntitlementService)),
-  _ts_param6(2, Optional2()),
-  _ts_param6(2, Inject5(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+EnforceQuotaInterceptor = _ts_decorate13([
+  Injectable8(),
+  _ts_param10(0, Inject9(Reflector)),
+  _ts_param10(1, Inject9(StaticEntitlementService)),
+  _ts_param10(2, Optional6()),
+  _ts_param10(2, Inject9(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
     typeof Reflector === "undefined" ? Object : Reflector,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -1362,26 +2378,26 @@ EnforceQuotaInterceptor = _ts_decorate8([
 ], EnforceQuotaInterceptor);
 
 // src/platform/static-feature.guard.ts
-import { ForbiddenException as ForbiddenException2, Inject as Inject6, Injectable as Injectable6, Optional as Optional3 } from "@nestjs/common";
+import { ForbiddenException as ForbiddenException2, Inject as Inject10, Injectable as Injectable9, Optional as Optional7 } from "@nestjs/common";
 import { Reflector as Reflector2 } from "@nestjs/core";
 import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/core";
-function _ts_decorate9(decorators, target, key, desc) {
+function _ts_decorate14(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate14, "_ts_decorate");
+function _ts_metadata12(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
+__name(_ts_metadata12, "_ts_metadata");
+function _ts_param11(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param7, "_ts_param");
+__name(_ts_param11, "_ts_param");
 var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StaticFeatureGuardConfig");
 var StaticFeatureGuard = class {
   static {
@@ -1435,14 +2451,14 @@ var StaticFeatureGuard = class {
     return true;
   }
 };
-StaticFeatureGuard = _ts_decorate9([
-  Injectable6(),
-  _ts_param7(0, Inject6(Reflector2)),
-  _ts_param7(1, Inject6(StaticEntitlementService)),
-  _ts_param7(2, Optional3()),
-  _ts_param7(2, Inject6(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
+StaticFeatureGuard = _ts_decorate14([
+  Injectable9(),
+  _ts_param11(0, Inject10(Reflector2)),
+  _ts_param11(1, Inject10(StaticEntitlementService)),
+  _ts_param11(2, Optional7()),
+  _ts_param11(2, Inject10(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
     typeof Reflector2 === "undefined" ? Object : Reflector2,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
@@ -1460,27 +2476,37 @@ var SubscriptionPlanResolver = class {
   }
   subscriptions;
   activeStatuses;
-  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES) {
+  canceledEntitlementPlan;
+  constructor(subscriptions, activeStatuses = DEFAULT_ACTIVE_STATUSES, canceledEntitlementPlan = null) {
     this.subscriptions = subscriptions;
     this.activeStatuses = activeStatuses;
+    this.canceledEntitlementPlan = canceledEntitlementPlan;
   }
   async getPlanIdForTenant(tenantId) {
     const subscription = await this.subscriptions.findByTenantId(tenantId);
-    if (!subscription || !this.activeStatuses.has(subscription.status)) return null;
+    if (!subscription) return null;
+    if (cancellationHasLanded(subscription, /* @__PURE__ */ new Date())) {
+      return this.canceledEntitlementPlan;
+    }
+    if (!this.activeStatuses.has(subscription.status)) return null;
     return subscription.plan;
   }
 };
 
 // src/platform/saasicat.module.ts
-import { Logger, Module as Module2 } from "@nestjs/common";
+import { Logger as Logger4, Module as Module3 } from "@nestjs/common";
 import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
 
+// src/platform/compose/base.ts
+import { planCatalogSettingsOf } from "@saasicat/core";
+
 // src/platform/compose/manifest.ts
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StandardManifestRegistration");
 function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
   const capabilities = {
-    "discovery.read": true
+    "discovery.read": true,
+    "settings.read": true
   };
   if (catalog && catalog.adminControllers !== false) {
     Object.assign(capabilities, {
@@ -1532,32 +2558,25 @@ function buildStandardManifestContribution(catalog, adminResources, promoCodes)
 __name(buildStandardManifestContribution, "buildStandardManifestContribution");
 function buildMinimalManifestConfig() {
   return {
-    useFactory: /* @__PURE__ */ __name((catalog) => ({
+    useFactory: /* @__PURE__ */ __name((settings) => ({
       project: {
-        key: catalog.projectKey,
-        displayName: catalog.app?.name ?? catalog.projectKey,
-        label: catalog.app?.label,
-        icon: catalog.app?.icon,
-        logoUrl: catalog.app?.logoUrl,
+        // One name, from the one place an installation carries it.
+        key: settings.app.name,
+        displayName: settings.app.name,
+        label: settings.app.label,
+        icon: settings.app.icon,
+        logoUrl: settings.app.logoUrl,
         environment: process.env.NODE_ENV === "production" ? "production" : "development",
-        availableLocales: catalog.marketing?.availableLocales,
-        defaultLocale: catalog.marketing?.availableLocales?.[0]
+        availableLocales: settings.marketing?.availableLocales,
+        defaultLocale: settings.marketing?.availableLocales?.[0]
       },
       build: {
         platformPackageVersion: "0.0.0",
         appVersion: "0.0.0"
-      },
-      planCatalogSnapshot: {
-        source: "saasicat-module",
-        hash: "sha256-quickstart",
-        currency: catalog.currency,
-        vatRate: catalog.vatRate,
-        plans: catalog.plans ?? [],
-        features: catalog.features ?? []
       }
     }), "useFactory"),
     inject: [
-      PLAN_CATALOG_TOKEN
+      PLAN_CATALOG_SETTINGS_TOKEN
     ]
   };
 }
@@ -1565,43 +2584,61 @@ __name(buildMinimalManifestConfig, "buildMinimalManifestConfig");
 
 // src/platform/compose/base.ts
 var DEFAULT_SNAPSHOT_PATH = "var/discovery-snapshot.json";
-function resolveAppInfo(options) {
-  return options.app ?? {
-    key: options.planCatalog?.projectKey ?? options.dbCatalog?.projectKey ?? "app",
-    version: options.planCatalog?.app?.version ?? options.dbCatalog?.app?.version ?? "0.0.0"
+var SOURCE_IN_CODE = "the object passed to SaaSiCatModule.forRoot({ planCatalog })";
+function resolveCatalog(options) {
+  if (options.planCatalog) return {
+    catalog: options.planCatalog
+  };
+  if (!dbCatalogNamesAFile(options.dbCatalog)) return {};
+  try {
+    return {
+      catalog: loadPlanCatalogFromFile(options.dbCatalog)
+    };
+  } catch (failure) {
+    return {
+      failure: failure instanceof Error ? failure : new Error(String(failure))
+    };
+  }
+}
+__name(resolveCatalog, "resolveCatalog");
+function resolveSettingsSource(catalog) {
+  return catalogSource(catalog) ?? SOURCE_IN_CODE;
+}
+__name(resolveSettingsSource, "resolveSettingsSource");
+function resolveAppInfo(options, catalog) {
+  if (options.app) return options.app;
+  return {
+    key: catalog.app.name,
+    version: catalog.app.version ?? "0.0.0"
   };
 }
 __name(resolveAppInfo, "resolveAppInfo");
-function composePlanCatalog(options, sink) {
+function composePlanCatalog(options, catalog, sink) {
   if (options.planCatalog) {
     return PlanCatalogModule.forRootWithCatalog(options.planCatalog, {
       global: true
     });
   }
-  const dbCatalog = options.dbCatalog;
   return PlanCatalogModule.forRoot({
-    projectKey: dbCatalog.projectKey,
-    app: dbCatalog.app,
-    currency: dbCatalog.currency,
-    vatRate: dbCatalog.vatRate,
-    marketing: dbCatalog.marketing,
+    ...planCatalogSettingsOf(catalog),
     sink,
     imports: options.imports
   });
 }
 __name(composePlanCatalog, "composePlanCatalog");
-function composeBaseModules(options, appInfo, ports) {
+function composeBaseModules(options, catalog, appInfo, ports) {
+  const { appliedSettingsPort, emailPort, ...adminPorts } = ports;
   return [
     DiscoveryModule.forRoot({
       app: appInfo,
       controller: {
-        guards: options.controller.guards
+        guards: operatorGuards(options)
       },
       imports: options.imports,
       snapshotPath: options.discoverySnapshotPath === void 0 ? DEFAULT_SNAPSHOT_PATH : options.discoverySnapshotPath
     }),
     AdminModule.forRoot({
-      ...ports,
+      ...adminPorts,
       imports: options.imports,
       global: true
     }),
@@ -1609,14 +2646,25 @@ function composeBaseModules(options, appInfo, ports) {
       config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
       extraProviders: options.adminManifestExtraProviders,
       includeManifestController: options.includeManifestController,
-      guards: options.controller.guards,
+      guards: operatorGuards(options),
       reloadGuards: options.reloadGuards,
       imports: options.imports,
       // Global like AdminModule above: apps register their manifest
       // contribution by injecting AdminManifestService into one of their
-      // own modules (handbook §6.6). Re-exporting the module from here
+      // own modules (docs/guides/wire-the-backend.md, "Manifest
+      // Contributions"). Re-exporting the module from here
       // does not make that injection resolvable.
       global: true
+    }),
+    SettingsModule.forRoot({
+      port: appliedSettingsPort,
+      email: emailPort,
+      source: resolveSettingsSource(catalog),
+      controller: {
+        guards: operatorGuards(options)
+      },
+      includeController: options.includeSettingsController,
+      imports: options.imports
     })
   ];
 }
@@ -1716,7 +2764,15 @@ function planResolverProvider(ctx, resolution) {
   if (resolution.viaSubscriptions) {
     return {
       provide: PLAN_RESOLVER_PORT_TOKEN,
-      useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(subscriptions), "useFactory"),
+      useFactory: /* @__PURE__ */ __name((subscriptions) => new SubscriptionPlanResolver(
+        subscriptions,
+        void 0,
+        // The same floor `EntitlementService` applies, read from the
+        // same option: two enforcement paths that disagree about
+        // what a cancelled subscription keeps would be worse than
+        // either answer on its own.
+        ctx.options.entitlement?.resolutionConfig?.canceledEntitlementPlan ?? null
+      ), "useFactory"),
       inject: [
         PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN
       ]
@@ -1730,14 +2786,14 @@ function planResolverProvider(ctx, resolution) {
 __name(planResolverProvider, "planResolverProvider");
 
 // src/platform/saasicat.module.ts
-function _ts_decorate10(decorators, target, key, desc) {
+function _ts_decorate15(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
-var PLATFORM_LOGGER = new Logger("SaaSiCat");
+__name(_ts_decorate15, "_ts_decorate");
+var PLATFORM_LOGGER = new Logger4("SaaSiCat");
 function enforcementChainState(state) {
   return {
     provide: ENFORCEMENT_CHAIN_STATE_TOKEN,
@@ -1762,29 +2818,37 @@ var SaaSiCatModule = class _SaaSiCatModule {
       mfa: explicit.mfa ?? persistence?.core.mfa,
       audit: explicit.audit ?? persistence?.core.audit,
       rlsBypass: explicit.rlsBypass ?? persistence?.core.rlsBypass,
+      appliedSettings: explicit.appliedSettings ?? persistence?.core.appliedSettings,
+      email: explicit.email,
       planCatalogReadSink: explicit.planCatalogReadSink ?? persistence?.planCatalogReadSink,
       planResolver: explicit.planResolver,
       subscriptionRepository: explicit.subscriptionRepository ?? persistence?.entitlement?.subscriptionRepository,
       planVersionRepository: explicit.planVersionRepository ?? persistence?.entitlement?.planVersionRepository,
       transactionRunner: explicit.transactionRunner ?? persistence?.core.transactionRunner
     };
+    const { catalog, failure: catalogFailure } = resolveCatalog(options);
     assertConfiguration({
       options,
-      adapters
+      adapters,
+      catalog,
+      catalogFailure
     });
     const mfaPort = adapters.mfa;
     const auditPort = adapters.audit;
     const rlsBypassPort = adapters.rlsBypass;
-    const appInfo = resolveAppInfo(options);
+    const running = catalog;
+    const appInfo = resolveAppInfo(options, running);
     const imports = [
       // Make injected client/auth providers visible to the high-level
       // module's own quota providers and automatic plan resolver too.
       ...options.imports ?? [],
-      composePlanCatalog(options, adapters.planCatalogReadSink),
-      ...composeBaseModules(options, appInfo, {
+      composePlanCatalog(options, running, adapters.planCatalogReadSink),
+      ...composeBaseModules(options, running, appInfo, {
         mfaPort,
         auditPort,
-        rlsBypassPort
+        rlsBypassPort,
+        appliedSettingsPort: adapters.appliedSettings,
+        emailPort: adapters.email
       })
     ];
     const composition = {
@@ -1833,6 +2897,8 @@ var SaaSiCatModule = class _SaaSiCatModule {
       }));
     }
     if (options.enforcementChainCheck !== false) imports.push(NestDiscoveryModule);
+    lightweightProviders.push(IssuerIdentityInspector, IssuerIdentityCheck);
+    lightweightExports.push(IssuerIdentityInspector, IssuerIdentityCheck);
     const tenantManifest = composeTenantManifest(composition);
     lightweightProviders.push(...tenantManifest.providers);
     lightweightExports.push(...tenantManifest.exports);
@@ -1846,18 +2912,30 @@ var SaaSiCatModule = class _SaaSiCatModule {
     };
   }
 };
-SaaSiCatModule = _ts_decorate10([
-  Module2({})
+SaaSiCatModule = _ts_decorate15([
+  Module3({})
 ], SaaSiCatModule);
 
 export {
+  EMAIL_PORT_TOKEN,
   SETUP_PROVISIONING_PORT_TOKEN,
   SETUP_CONFIG_TOKEN,
   SetupService,
   SetupController,
   SetupModule,
+  SettingsChangeNotifier,
+  describeChange,
+  fingerprintOf,
+  APPLIED_SETTINGS_PORT_TOKEN,
+  SETTINGS_SOURCE_TOKEN,
+  AppliedSettingsRecorder,
+  buildSettingsController,
+  SettingsModule,
   ENFORCEMENT_CHAIN_STATE_TOKEN,
   EnforcementChainCheck,
+  IssuerIdentityInspector,
+  IssuerIdentityCheck,
+  DB_CATALOG_MEMBERS,
   headingSlug,
   docsUrlFor,
   PLATFORM_RULES,