@saasicat/nest 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/{chunk-LTT736P3.js → chunk-LLYVYRGJ.js}

@@ -1,18 +1,25 @@
+import {
+  EnforceMfa,
+  MfaGuard,
+  MfaService
+} from "./chunk-34XVPR6P.js";
+import {
+  AdminAuditService
+} from "./chunk-OOTEXP47.js";
 import {
   AUDIT_PORT_TOKEN,
-  AdminAuditService,
   MFA_PORT_TOKEN,
   RLS_BYPASS_PORT_TOKEN
-} from "./chunk-O2J2HDXA.js";
+} from "./chunk-SZ7RFPXA.js";
 import {
   SaaSiCatPublicRoute
 } from "./chunk-YSC46BGM.js";
 import {
-  codedError
-} from "./chunk-57V6ZTI6.js";
+  PLAN_CATALOG_SOURCE_TOKEN
+} from "./chunk-FEQZCWUL.js";
 import {
   asProvider
-} from "./chunk-SABTXESR.js";
+} from "./chunk-J7NJRK3K.js";
 import {
   __name
 } from "./chunk-SHUYVCID.js";
@@ -53,9 +60,10 @@ SuperAdminGuard = _ts_decorate([
   Injectable()
 ], SuperAdminGuard);
 
-// src/admin/mfa.service.ts
-import { Inject, Injectable as Injectable2, Logger } from "@nestjs/common";
-import { generateSecret, generateURI, verify as verifyTotpCode } from "otplib";
+// src/admin/admin-bypass-rls.interceptor.ts
+import { Inject, Injectable as Injectable2 } from "@nestjs/common";
+import { defer, from } from "rxjs";
+import { switchAll } from "rxjs/operators";
 function _ts_decorate2(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -73,205 +81,6 @@ function _ts_param(paramIndex, decorator) {
   };
 }
 __name(_ts_param, "_ts_param");
-var CLOCK_DRIFT_TOLERANCE_SECONDS = 30;
-var OTPLIB_TOKEN_ERROR_NAMES = /* @__PURE__ */ new Set([
-  "TokenError",
-  "TokenFormatError",
-  "TokenLengthError"
-]);
-function isOtplibTokenError(error) {
-  return error instanceof Error && OTPLIB_TOKEN_ERROR_NAMES.has(error.name);
-}
-__name(isOtplibTokenError, "isOtplibTokenError");
-var MfaService = class _MfaService {
-  static {
-    __name(this, "MfaService");
-  }
-  mfa;
-  logger = new Logger(_MfaService.name);
-  constructor(mfa) {
-    this.mfa = mfa;
-  }
-  /**
-   * Generates a new TOTP secret, persists it via `MfaPort.setSecret`
-   * and returns the secret + the otpauth URI for the QR code.
-   *
-   * `issuer` and `label` shape the display in the authenticator (e.g.
-   * "DemoApp:taci@example.com").
-   */
-  async setup(userId, label, issuer) {
-    const secret = generateSecret();
-    const otpauthUri = generateURI({
-      issuer,
-      label,
-      secret
-    });
-    await this.mfa.setSecret(userId, secret);
-    return {
-      secret,
-      otpauthUri
-    };
-  }
-  /**
-   * Verifies the entered code against the stored secret,
-   * clock-drift-tolerant by ±1 time step.
-   */
-  async verify(input) {
-    const secret = await this.mfa.getSecret(input.userId);
-    if (!secret) return false;
-    try {
-      const result = await verifyTotpCode({
-        secret,
-        token: input.code.trim(),
-        epochTolerance: CLOCK_DRIFT_TOLERANCE_SECONDS
-      });
-      return result.valid;
-    } catch (error) {
-      if (isOtplibTokenError(error)) {
-        return false;
-      }
-      const message = error instanceof Error ? error.message : String(error);
-      this.logger.warn(`TOTP verification for user ${input.userId} failed unexpectedly: ${message}`);
-      return false;
-    }
-  }
-  /**
-   * Deletes a user's secret — used by `ahp admin mfa-reset`.
-   */
-  async disable(userId) {
-    await this.mfa.setSecret(userId, null);
-  }
-  /** Delegates to `MfaPort.isEnabled`. */
-  async isEnabled(userId) {
-    return this.mfa.isEnabled(userId);
-  }
-};
-MfaService = _ts_decorate2([
-  Injectable2(),
-  _ts_param(0, Inject(MFA_PORT_TOKEN)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof MfaPort === "undefined" ? Object : MfaPort
-  ])
-], MfaService);
-
-// src/admin/mfa.guard.ts
-import { Inject as Inject2, Injectable as Injectable3, Logger as Logger2, SetMetadata, UnauthorizedException } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
-import { AUTH_ERROR_CODES as AUTH_ERROR_CODES2 } from "@saasicat/core";
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var REQUIRE_MFA_KEY = "saasicat/nest/require-mfa";
-var RequireMfa = /* @__PURE__ */ __name(() => SetMetadata(REQUIRE_MFA_KEY, true), "RequireMfa");
-var MfaGuard = class _MfaGuard {
-  static {
-    __name(this, "MfaGuard");
-  }
-  reflector;
-  mfaService;
-  logger = new Logger2(_MfaGuard.name);
-  constructor(reflector, mfaService) {
-    this.reflector = reflector;
-    this.mfaService = mfaService;
-  }
-  async canActivate(context) {
-    const required = this.reflector.getAllAndOverride(REQUIRE_MFA_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (!required) return true;
-    if (process.env.SAAS_PLATFORM_SKIP_MFA === "1" && process.env.NODE_ENV !== "production") {
-      return true;
-    }
-    const request = context.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user) {
-      throw new UnauthorizedException({
-        ...codedError(AUTH_ERROR_CODES2.NOT_AUTHENTICATED),
-        // `reason` is superseded by `code` and will be removed.
-        reason: "NOT_AUTHENTICATED"
-      });
-    }
-    const enabled = await this.mfaService.isEnabled(user.id);
-    if (!enabled) {
-      throw new UnauthorizedException({
-        code: AUTH_ERROR_CODES2.MFA_NOT_SET_UP,
-        // `reason` is superseded by `code` and will be removed.
-        reason: "MFA_NOT_SET_UP",
-        message: "Run the MFA setup via the CLI first."
-      });
-    }
-    const headerVal = request.headers?.["x-mfa-code"];
-    const code = Array.isArray(headerVal) ? headerVal[0] : headerVal;
-    if (!code) {
-      throw new UnauthorizedException({
-        code: AUTH_ERROR_CODES2.MFA_REQUIRED,
-        // `reason` is superseded by `code` and will be removed.
-        reason: "MFA_REQUIRED",
-        message: "TOTP code required in the X-Mfa-Code header."
-      });
-    }
-    const valid = await this.mfaService.verify({
-      userId: user.id,
-      code: String(code)
-    });
-    if (!valid) {
-      throw new UnauthorizedException({
-        code: AUTH_ERROR_CODES2.MFA_FAILED,
-        // `reason` is superseded by `code` and will be removed.
-        reason: "MFA_FAILED",
-        message: "Invalid TOTP code."
-      });
-    }
-    return true;
-  }
-};
-MfaGuard = _ts_decorate3([
-  Injectable3(),
-  _ts_param2(0, Inject2(Reflector)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof Reflector === "undefined" ? Object : Reflector,
-    typeof MfaService === "undefined" ? Object : MfaService
-  ])
-], MfaGuard);
-
-// src/admin/admin-bypass-rls.interceptor.ts
-import { Inject as Inject3, Injectable as Injectable4 } from "@nestjs/common";
-import { defer, from } from "rxjs";
-import { switchAll } from "rxjs/operators";
-function _ts_decorate4(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param3, "_ts_param");
 var AdminBypassRlsInterceptor = class {
   static {
     __name(this, "AdminBypassRlsInterceptor");
@@ -286,24 +95,24 @@ var AdminBypassRlsInterceptor = class {
     })).pipe(switchAll()));
   }
 };
-AdminBypassRlsInterceptor = _ts_decorate4([
-  Injectable4(),
-  _ts_param3(0, Inject3(RLS_BYPASS_PORT_TOKEN)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
+AdminBypassRlsInterceptor = _ts_decorate2([
+  Injectable2(),
+  _ts_param(0, Inject(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
     typeof RlsBypassPort === "undefined" ? Object : RlsBypassPort
   ])
 ], AdminBypassRlsInterceptor);
 
 // src/admin/admin.module.ts
 import { Module } from "@nestjs/common";
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate3(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
+__name(_ts_decorate3, "_ts_decorate");
 var AdminModule = class _AdminModule {
   static {
     __name(this, "AdminModule");
@@ -337,7 +146,7 @@ var AdminModule = class _AdminModule {
     };
   }
 };
-AdminModule = _ts_decorate5([
+AdminModule = _ts_decorate3([
   Module({})
 ], AdminModule);
 
@@ -345,56 +154,65 @@ AdminModule = _ts_decorate5([
 var ADMIN_MANIFEST_CONFIG = /* @__PURE__ */ Symbol.for("saasicat/nest/AdminManifestConfig");
 
 // src/admin/admin-manifest.service.ts
-import { Inject as Inject4, Injectable as Injectable5, Logger as Logger3, Optional } from "@nestjs/common";
+import { Inject as Inject2, Injectable as Injectable3, Logger, Optional } from "@nestjs/common";
 import { createHash } from "crypto";
-function _ts_decorate6(decorators, target, key, desc) {
+import { canonicalJson } from "@saasicat/core";
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate6, "_ts_decorate");
-function _ts_metadata4(k, v) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata2(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata4, "_ts_metadata");
-function _ts_param4(paramIndex, decorator) {
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param4, "_ts_param");
+__name(_ts_param2, "_ts_param");
 var PLATFORM_CORE_CONTRIBUTION_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PlatformCoreContribution");
 var AdminManifestService = class _AdminManifestService {
   static {
     __name(this, "AdminManifestService");
   }
   config;
-  logger = new Logger3(_AdminManifestService.name);
+  planCatalogs;
+  logger = new Logger(_AdminManifestService.name);
   contributions = [];
-  cached = null;
-  constructor(config, platformCore = null) {
+  merged = null;
+  lastHash = null;
+  constructor(config, planCatalogs, platformCore = null) {
     this.config = config;
+    this.planCatalogs = planCatalogs;
     if (platformCore) {
       this.contributions.push(platformCore);
     }
   }
   register(contribution) {
     this.contributions.push(contribution);
-    this.cached = null;
+    this.merged = null;
   }
-  getManifest() {
-    if (this.cached) return this.cached;
-    this.cached = this.build();
-    this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${this.cached.build.manifestHash.slice(0, 24)}\u2026`);
-    return this.cached;
+  async getManifest() {
+    const manifest = this.build(await this.planCatalogs.current());
+    const hash = manifest.build.manifestHash;
+    if (hash !== this.lastHash) {
+      this.lastHash = hash;
+      this.logger.log(`Manifest built: ${this.contributions.length} contribution(s), hash=${hash.slice(0, 24)}\u2026`);
+    }
+    return manifest;
   }
-  rebuild() {
-    this.cached = null;
+  /** Merges the contributions again, then serves the manifest as `getManifest` does. */
+  async rebuild() {
+    this.merged = null;
     return this.getManifest();
   }
-  build() {
-    const merged = this.mergeContributions(this.contributions);
+  build(catalog) {
+    this.merged ??= this.mergeContributions(this.contributions);
+    const merged = this.merged;
     const draft = {
       schemaVersion: 1,
       project: this.config.project,
@@ -402,7 +220,7 @@ var AdminManifestService = class _AdminManifestService {
         ...this.config.build,
         manifestHash: "sha256-pending"
       },
-      planCatalogSnapshot: this.config.planCatalogSnapshot,
+      planCatalogSnapshot: planCatalogSnapshotOf(catalog, this.planCatalogs.origin),
       capabilities: merged.capabilities,
       navigation: merged.navigation,
       dashboard: merged.dashboard,
@@ -472,17 +290,34 @@ var AdminManifestService = class _AdminManifestService {
     return `sha256-${digest}`;
   }
 };
-AdminManifestService = _ts_decorate6([
-  Injectable5(),
-  _ts_param4(0, Inject4(ADMIN_MANIFEST_CONFIG)),
-  _ts_param4(1, Optional()),
-  _ts_param4(1, Inject4(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
-  _ts_metadata4("design:type", Function),
-  _ts_metadata4("design:paramtypes", [
+AdminManifestService = _ts_decorate4([
+  Injectable3(),
+  _ts_param2(0, Inject2(ADMIN_MANIFEST_CONFIG)),
+  _ts_param2(1, Inject2(PLAN_CATALOG_SOURCE_TOKEN)),
+  _ts_param2(2, Optional()),
+  _ts_param2(2, Inject2(PLATFORM_CORE_CONTRIBUTION_TOKEN)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
     typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig,
+    typeof PlanCatalogSource === "undefined" ? Object : PlanCatalogSource,
     Object
   ])
 ], AdminManifestService);
+function planCatalogSnapshotOf(catalog, origin) {
+  const carried = {
+    currency: catalog.currency,
+    vatRate: catalog.vatRate,
+    plans: catalog.plans ?? [],
+    features: catalog.features ?? []
+  };
+  const digest = createHash("sha256").update(canonicalJson(carried)).digest("base64url");
+  return {
+    source: origin,
+    hash: `sha256-${digest}`,
+    ...carried
+  };
+}
+__name(planCatalogSnapshotOf, "planCatalogSnapshotOf");
 function stableStringify(value) {
   if (value === null) return "null";
   if (value === void 0) return "null";
@@ -502,24 +337,24 @@ function stableStringify(value) {
 __name(stableStringify, "stableStringify");
 
 // src/admin/admin-public-boot.controller.ts
-import { Controller, Get, Inject as Inject5 } from "@nestjs/common";
-function _ts_decorate7(decorators, target, key, desc) {
+import { Controller, Get, Inject as Inject3 } from "@nestjs/common";
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate7, "_ts_decorate");
-function _ts_metadata5(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata5, "_ts_metadata");
-function _ts_param5(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param5, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var AdminPublicBootController = class {
   static {
     __name(this, "AdminPublicBootController");
@@ -541,18 +376,18 @@ var AdminPublicBootController = class {
     };
   }
 };
-_ts_decorate7([
+_ts_decorate5([
   Get("boot"),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", []),
-  _ts_metadata5("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", []),
+  _ts_metadata3("design:returntype", typeof PublicBootResponse === "undefined" ? Object : PublicBootResponse)
 ], AdminPublicBootController.prototype, "getBoot", null);
-AdminPublicBootController = _ts_decorate7([
+AdminPublicBootController = _ts_decorate5([
   Controller("admin"),
   SaaSiCatPublicRoute(),
-  _ts_param5(0, Inject5(ADMIN_MANIFEST_CONFIG)),
-  _ts_metadata5("design:type", Function),
-  _ts_metadata5("design:paramtypes", [
+  _ts_param3(0, Inject3(ADMIN_MANIFEST_CONFIG)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
     typeof AdminManifestConfig === "undefined" ? Object : AdminManifestConfig
   ])
 ], AdminPublicBootController);
@@ -631,6 +466,14 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
       platformEmailHistory: {
         enabled: true,
         requiredCapability: "platformEmailHistory.read"
+      },
+      // The applied configuration, read-only. The platform grants
+      // `settings.read` unconditionally — see `compose/manifest.ts` —
+      // because the page is mounted and the route answers either way;
+      // `includeSettingsController` only says who serves it.
+      settings: {
+        enabled: true,
+        requiredCapability: "settings.read"
       }
     }
   },
@@ -809,24 +652,24 @@ var PLATFORM_CORE_MANIFEST_CONTRIBUTION = {
 };
 
 // src/admin/admin-manifest.module.ts
-import { Controller as Controller2, Get as Get2, Header, Headers, HttpCode, HttpStatus, Inject as Inject6, Module as Module2, Post, Res, UseGuards } from "@nestjs/common";
-function _ts_decorate8(decorators, target, key, desc) {
+import { Controller as Controller2, Get as Get2, Header, Headers, HttpCode, HttpStatus, Inject as Inject4, Module as Module2, Post, Res, UseGuards } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate8, "_ts_decorate");
-function _ts_metadata6(k, v) {
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata6, "_ts_metadata");
-function _ts_param6(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param6, "_ts_param");
+__name(_ts_param4, "_ts_param");
 function asConfigProvider(impl) {
   if (typeof impl === "object" && impl !== null && "useFactory" in impl && typeof impl.useFactory === "function") {
     return {
@@ -857,8 +700,8 @@ function buildManifestController(guards, reloadGuards) {
     constructor(manifest) {
       this.manifest = manifest;
     }
-    getManifest(ifNoneMatch, res) {
-      const m = this.manifest.getManifest();
+    async getManifest(ifNoneMatch, res) {
+      const m = await this.manifest.getManifest();
       const etag = `"${m.build.manifestHash}"`;
       res.header("ETag", etag);
       if (ifNoneMatch && ifNoneMatch === etag) {
@@ -867,42 +710,42 @@ function buildManifestController(guards, reloadGuards) {
       }
       return m;
     }
-    reload() {
-      const m = this.manifest.rebuild();
+    async reload() {
+      const m = await this.manifest.rebuild();
       return {
         manifestHash: m.build.manifestHash,
         reloadedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
     }
   };
-  _ts_decorate8([
+  _ts_decorate6([
     Get2("manifest"),
     Header("Cache-Control", "private, max-age=60, must-revalidate"),
-    _ts_param6(0, Headers("if-none-match")),
-    _ts_param6(1, Res({
+    _ts_param4(0, Headers("if-none-match")),
+    _ts_param4(1, Res({
       passthrough: true
     })),
-    _ts_metadata6("design:type", Function),
-    _ts_metadata6("design:paramtypes", [
+    _ts_metadata4("design:type", Function),
+    _ts_metadata4("design:paramtypes", [
       Object,
       typeof HttpResponseLike === "undefined" ? Object : HttpResponseLike
     ]),
-    _ts_metadata6("design:returntype", void 0)
+    _ts_metadata4("design:returntype", Promise)
   ], GeneratedAdminManifestController.prototype, "getManifest", null);
-  _ts_decorate8([
+  _ts_decorate6([
     Post("manifest/reload"),
     UseGuards(...reloadChain),
     HttpCode(HttpStatus.OK),
-    _ts_metadata6("design:type", Function),
-    _ts_metadata6("design:paramtypes", []),
-    _ts_metadata6("design:returntype", void 0)
+    _ts_metadata4("design:type", Function),
+    _ts_metadata4("design:paramtypes", []),
+    _ts_metadata4("design:returntype", Promise)
   ], GeneratedAdminManifestController.prototype, "reload", null);
-  GeneratedAdminManifestController = _ts_decorate8([
+  GeneratedAdminManifestController = _ts_decorate6([
     Controller2("admin"),
     UseGuards(...guards),
-    _ts_param6(0, Inject6(AdminManifestService)),
-    _ts_metadata6("design:type", Function),
-    _ts_metadata6("design:paramtypes", [
+    _ts_param4(0, Inject4(AdminManifestService)),
+    _ts_metadata4("design:type", Function),
+    _ts_metadata4("design:paramtypes", [
       typeof AdminManifestService === "undefined" ? Object : AdminManifestService
     ])
   ], GeneratedAdminManifestController);
@@ -949,7 +792,7 @@ var AdminManifestModule = class _AdminManifestModule {
     };
   }
 };
-AdminManifestModule = _ts_decorate8([
+AdminManifestModule = _ts_decorate6([
   Module2({})
 ], AdminManifestModule);
 
@@ -960,24 +803,24 @@ var AUDIT_STATS_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/AuditStat
 var ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/AdminStatsAuditWindowDays");
 
 // src/admin/admin-stats.service.ts
-import { Inject as Inject7, Injectable as Injectable6, Optional as Optional2 } from "@nestjs/common";
-function _ts_decorate9(decorators, target, key, desc) {
+import { Inject as Inject5, Injectable as Injectable4, Optional as Optional2 } from "@nestjs/common";
+function _ts_decorate7(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata5(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
+__name(_ts_metadata5, "_ts_metadata");
+function _ts_param5(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param7, "_ts_param");
+__name(_ts_param5, "_ts_param");
 var DAY_MS = 864e5;
 var DEFAULT_AUDIT_WINDOW_DAYS = 7;
 var AdminStatsService = class {
@@ -1011,15 +854,15 @@ var AdminStatsService = class {
     };
   }
 };
-AdminStatsService = _ts_decorate9([
-  Injectable6(),
-  _ts_param7(0, Inject7(SUBSCRIPTION_STATS_PORT_TOKEN)),
-  _ts_param7(1, Inject7(PROMO_CODE_STATS_PORT_TOKEN)),
-  _ts_param7(2, Inject7(AUDIT_STATS_PORT_TOKEN)),
-  _ts_param7(3, Optional2()),
-  _ts_param7(3, Inject7(ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+AdminStatsService = _ts_decorate7([
+  Injectable4(),
+  _ts_param5(0, Inject5(SUBSCRIPTION_STATS_PORT_TOKEN)),
+  _ts_param5(1, Inject5(PROMO_CODE_STATS_PORT_TOKEN)),
+  _ts_param5(2, Inject5(AUDIT_STATS_PORT_TOKEN)),
+  _ts_param5(3, Optional2()),
+  _ts_param5(3, Inject5(ADMIN_STATS_AUDIT_WINDOW_DAYS_TOKEN)),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
     typeof SubscriptionStatsPort === "undefined" ? Object : SubscriptionStatsPort,
     typeof PromoCodeStatsPort === "undefined" ? Object : PromoCodeStatsPort,
     typeof AuditStatsPort === "undefined" ? Object : AuditStatsPort,
@@ -1028,24 +871,24 @@ AdminStatsService = _ts_decorate9([
 ], AdminStatsService);
 
 // src/admin/admin-stats.controller.ts
-import { Controller as Controller3, Get as Get3, Inject as Inject8, UseGuards as UseGuards2 } from "@nestjs/common";
-function _ts_decorate10(decorators, target, key, desc) {
+import { Controller as Controller3, Get as Get3, Inject as Inject6, UseGuards as UseGuards2 } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param8(paramIndex, decorator) {
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param8, "_ts_param");
+__name(_ts_param6, "_ts_param");
 var AdminStatsController = class {
   static {
     __name(this, "AdminStatsController");
@@ -1061,18 +904,18 @@ var AdminStatsController = class {
     return this.stats.getSnapshot();
   }
 };
-_ts_decorate10([
+_ts_decorate8([
   Get3("dashboard"),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", []),
-  _ts_metadata8("design:returntype", Promise)
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", []),
+  _ts_metadata6("design:returntype", Promise)
 ], AdminStatsController.prototype, "getDashboardSnapshot", null);
-AdminStatsController = _ts_decorate10([
+AdminStatsController = _ts_decorate8([
   Controller3("admin/stats"),
   UseGuards2(SuperAdminGuard),
-  _ts_param8(0, Inject8(AdminStatsService)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
+  _ts_param6(0, Inject6(AdminStatsService)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
     typeof AdminStatsService === "undefined" ? Object : AdminStatsService
   ])
 ], AdminStatsController);
@@ -1089,18 +932,18 @@ function buildAdminStatsController(guards) {
       return this.stats.getSnapshot();
     }
   };
-  _ts_decorate10([
+  _ts_decorate8([
     Get3("dashboard"),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", []),
-    _ts_metadata8("design:returntype", Promise)
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", []),
+    _ts_metadata6("design:returntype", Promise)
   ], GeneratedAdminStatsController.prototype, "getDashboardSnapshot", null);
-  GeneratedAdminStatsController = _ts_decorate10([
+  GeneratedAdminStatsController = _ts_decorate8([
     Controller3("admin/stats"),
     UseGuards2(...guards),
-    _ts_param8(0, Inject8(AdminStatsService)),
-    _ts_metadata8("design:type", Function),
-    _ts_metadata8("design:paramtypes", [
+    _ts_param6(0, Inject6(AdminStatsService)),
+    _ts_metadata6("design:type", Function),
+    _ts_metadata6("design:paramtypes", [
       typeof AdminStatsService === "undefined" ? Object : AdminStatsService
     ])
   ], GeneratedAdminStatsController);
@@ -1110,13 +953,13 @@ __name(buildAdminStatsController, "buildAdminStatsController");
 
 // src/admin/admin-stats.module.ts
 import { Module as Module3 } from "@nestjs/common";
-function _ts_decorate11(decorators, target, key, desc) {
+function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate11, "_ts_decorate");
+__name(_ts_decorate9, "_ts_decorate");
 var AdminStatsModule = class _AdminStatsModule {
   static {
     __name(this, "AdminStatsModule");
@@ -1151,31 +994,31 @@ var AdminStatsModule = class _AdminStatsModule {
     };
   }
 };
-AdminStatsModule = _ts_decorate11([
+AdminStatsModule = _ts_decorate9([
   Module3({})
 ], AdminStatsModule);
 
 // src/admin/admin-resources.module.ts
-import { Body, Controller as Controller4, Get as Get4, Inject as Inject9, Injectable as Injectable7, Module as Module4, NotFoundException, Param, Post as Post2, Query, Req, UseGuards as UseGuards3 } from "@nestjs/common";
+import { Body, Controller as Controller4, Get as Get4, Inject as Inject7, Injectable as Injectable5, Module as Module4, NotFoundException, Param, Post as Post2, Query, Req, UseGuards as UseGuards3 } from "@nestjs/common";
 import { IsOptional, IsString, MaxLength } from "class-validator";
 import { BILLING_ERROR_CODES } from "@saasicat/core";
-function _ts_decorate12(decorators, target, key, desc) {
+function _ts_decorate10(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate12, "_ts_decorate");
-function _ts_metadata9(k, v) {
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata7(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata9, "_ts_metadata");
-function _ts_param9(paramIndex, decorator) {
+__name(_ts_metadata7, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param9, "_ts_param");
+__name(_ts_param7, "_ts_param");
 var ADMIN_RESOURCES_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/AdminResourcesPort");
 var SuspendTenantDto = class {
   static {
@@ -1183,11 +1026,11 @@ var SuspendTenantDto = class {
   }
   reason;
 };
-_ts_decorate12([
+_ts_decorate10([
   IsOptional(),
   IsString(),
   MaxLength(500),
-  _ts_metadata9("design:type", String)
+  _ts_metadata7("design:type", String)
 ], SuspendTenantDto.prototype, "reason", void 0);
 var AdminResourcesService = class {
   static {
@@ -1260,12 +1103,12 @@ var AdminResourcesService = class {
     return result;
   }
 };
-AdminResourcesService = _ts_decorate12([
-  Injectable7(),
-  _ts_param9(0, Inject9(ADMIN_RESOURCES_PORT_TOKEN)),
-  _ts_param9(1, Inject9(AdminAuditService)),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
+AdminResourcesService = _ts_decorate10([
+  Injectable5(),
+  _ts_param7(0, Inject7(ADMIN_RESOURCES_PORT_TOKEN)),
+  _ts_param7(1, Inject7(AdminAuditService)),
+  _ts_metadata7("design:type", Function),
+  _ts_metadata7("design:paramtypes", [
     typeof AdminResourcesPort === "undefined" ? Object : AdminResourcesPort,
     typeof AdminAuditService === "undefined" ? Object : AdminAuditService
   ])
@@ -1317,78 +1160,80 @@ function buildAdminResourcesController(guards) {
       return this.resources.listSubscriptions();
     }
   };
-  _ts_decorate12([
+  _ts_decorate10([
     Get4("tenants"),
-    _ts_param9(0, Query()),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    _ts_param7(0, Query()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       Object
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "listTenants", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Get4("tenants/:slug"),
-    _ts_param9(0, Param("slug")),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    _ts_param7(0, Param("slug")),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       String
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "getTenant", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Post2("tenants/:slug/suspend"),
-    _ts_param9(0, Req()),
-    _ts_param9(1, Param("slug")),
-    _ts_param9(2, Body()),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    EnforceMfa(),
+    _ts_param7(0, Req()),
+    _ts_param7(1, Param("slug")),
+    _ts_param7(2, Body()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       typeof AdminRequest === "undefined" ? Object : AdminRequest,
       String,
       typeof SuspendTenantDto === "undefined" ? Object : SuspendTenantDto
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "suspendTenant", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Post2("tenants/:slug/reactivate"),
-    _ts_param9(0, Req()),
-    _ts_param9(1, Param("slug")),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    EnforceMfa(),
+    _ts_param7(0, Req()),
+    _ts_param7(1, Param("slug")),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       typeof AdminRequest === "undefined" ? Object : AdminRequest,
       String
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "reactivateTenant", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Get4("users"),
-    _ts_param9(0, Query()),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    _ts_param7(0, Query()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       Object
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "listUsers", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Get4("audit"),
-    _ts_param9(0, Query()),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    _ts_param7(0, Query()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       Object
     ]),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "listAudit", null);
-  _ts_decorate12([
+  _ts_decorate10([
     Get4("subscriptions"),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", []),
-    _ts_metadata9("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", []),
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
   ], GeneratedAdminResourcesController.prototype, "listSubscriptions", null);
-  GeneratedAdminResourcesController = _ts_decorate12([
+  GeneratedAdminResourcesController = _ts_decorate10([
     Controller4("admin"),
     UseGuards3(...guards),
-    _ts_param9(0, Inject9(AdminResourcesService)),
-    _ts_metadata9("design:type", Function),
-    _ts_metadata9("design:paramtypes", [
+    _ts_param7(0, Inject7(AdminResourcesService)),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
       typeof AdminResourcesService === "undefined" ? Object : AdminResourcesService
     ])
   ], GeneratedAdminResourcesController);
@@ -1418,16 +1263,12 @@ var AdminResourcesModule = class _AdminResourcesModule {
     };
   }
 };
-AdminResourcesModule = _ts_decorate12([
+AdminResourcesModule = _ts_decorate10([
   Module4({})
 ], AdminResourcesModule);
 
 export {
   SuperAdminGuard,
-  MfaService,
-  REQUIRE_MFA_KEY,
-  RequireMfa,
-  MfaGuard,
   AdminBypassRlsInterceptor,
   AdminModule,
   ADMIN_MANIFEST_CONFIG,