@saasicat/nest 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/admin/index.d.cts

@@ -1,13 +1,14 @@
-import { f as AdminStatsService, g as AdminStatsSnapshot } from '../admin-stats.service-DfKupywR.cjs';
-export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, M as MfaGuard, h as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, i as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.service-DfKupywR.cjs';
+import { f as AdminStatsService, g as AdminStatsSnapshot } from '../admin-stats.service-DrZrU8IJ.cjs';
+export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, h as MfaGuard, M as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, i as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.service-DrZrU8IJ.cjs';
 export { A as AdminAuditService } from '../admin-audit.service-4P3Djdxk.cjs';
-import { b as AdminManifestConfig } from '../admin-resources.module-CpvzcfCc.cjs';
-export { A as ADMIN_MANIFEST_CONFIG, a as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, f as AdminStatsModule, g as AdminStatsModuleOptions, S as SuspendTenantDto } from '../admin-resources.module-CpvzcfCc.cjs';
+import { b as AdminManifestConfig } from '../admin-resources.module-B4XNvdH-.cjs';
+export { c as ADMIN_MANIFEST_CONFIG, d as ADMIN_RESOURCES_PORT_TOKEN, e as AdminResourcesModule, A as AdminResourcesModuleOptions, f as AdminResourcesService, g as AdminStatsModule, a as AdminStatsModuleOptions, S as SuspendTenantDto } from '../admin-resources.module-B4XNvdH-.cjs';
 import { PublicBootResponse, ManifestContribution } from '@saasicat/core';
 import { Type, CanActivate } from '@nestjs/common';
 import '@nestjs/core';
 import 'rxjs';
 import '../di-CcNeq9v-.cjs';
+import '../plan-catalog-source-DWe-BGY1.cjs';
 
 declare const MFA_PORT_TOKEN: unique symbol;
 declare const AUDIT_PORT_TOKEN: unique symbol;

package/dist/admin/index.d.ts

@@ -1,13 +1,14 @@
-import { f as AdminStatsService, g as AdminStatsSnapshot } from '../admin-stats.service-TYiSUwIR.js';
-export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, M as MfaGuard, h as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, i as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.service-TYiSUwIR.js';
+import { f as AdminStatsService, g as AdminStatsSnapshot } from '../admin-stats.service-CsLNt19Z.js';
+export { A as AdminBypassRlsInterceptor, a as AdminManifestModule, b as AdminManifestModuleOptions, c as AdminManifestService, d as AdminModule, e as AdminModuleOptions, h as MfaGuard, M as MfaService, P as PLATFORM_CORE_CONTRIBUTION_TOKEN, R as REQUIRE_MFA_KEY, i as RequireMfa, S as SuperAdminGuard, T as TotpSetupResult, V as VerifyTotpInput } from '../admin-stats.service-CsLNt19Z.js';
 export { A as AdminAuditService } from '../admin-audit.service-4P3Djdxk.js';
-import { b as AdminManifestConfig } from '../admin-resources.module-DF5_Q7RD.js';
-export { A as ADMIN_MANIFEST_CONFIG, a as ADMIN_RESOURCES_PORT_TOKEN, c as AdminResourcesModule, d as AdminResourcesModuleOptions, e as AdminResourcesService, f as AdminStatsModule, g as AdminStatsModuleOptions, S as SuspendTenantDto } from '../admin-resources.module-DF5_Q7RD.js';
+import { b as AdminManifestConfig } from '../admin-resources.module-CWqdI9BV.js';
+export { c as ADMIN_MANIFEST_CONFIG, d as ADMIN_RESOURCES_PORT_TOKEN, e as AdminResourcesModule, A as AdminResourcesModuleOptions, f as AdminResourcesService, g as AdminStatsModule, a as AdminStatsModuleOptions, S as SuspendTenantDto } from '../admin-resources.module-CWqdI9BV.js';
 import { PublicBootResponse, ManifestContribution } from '@saasicat/core';
 import { Type, CanActivate } from '@nestjs/common';
 import '@nestjs/core';
 import 'rxjs';
 import '../di-CcNeq9v-.js';
+import '../plan-catalog-source-DWe-BGY1.js';
 
 declare const MFA_PORT_TOKEN: unique symbol;
 declare const AUDIT_PORT_TOKEN: unique symbol;

package/dist/admin/index.js

@@ -14,27 +14,31 @@ import {
   AdminStatsController,
   AdminStatsModule,
   AdminStatsService,
-  MfaGuard,
-  MfaService,
   PLATFORM_CORE_CONTRIBUTION_TOKEN,
   PLATFORM_CORE_MANIFEST_CONTRIBUTION,
   PROMO_CODE_STATS_PORT_TOKEN,
-  REQUIRE_MFA_KEY,
-  RequireMfa,
   SUBSCRIPTION_STATS_PORT_TOKEN,
   SuperAdminGuard,
   SuspendTenantDto,
   buildAdminStatsController
-} from "../chunk-LTT736P3.js";
+} from "../chunk-LLYVYRGJ.js";
+import {
+  MfaGuard,
+  MfaService,
+  REQUIRE_MFA_KEY,
+  RequireMfa
+} from "../chunk-34XVPR6P.js";
+import {
+  AdminAuditService
+} from "../chunk-OOTEXP47.js";
 import {
   AUDIT_PORT_TOKEN,
-  AdminAuditService,
   MFA_PORT_TOKEN,
   RLS_BYPASS_PORT_TOKEN
-} from "../chunk-O2J2HDXA.js";
+} from "../chunk-SZ7RFPXA.js";
 import "../chunk-YSC46BGM.js";
-import "../chunk-57V6ZTI6.js";
-import "../chunk-SABTXESR.js";
+import "../chunk-FEQZCWUL.js";
+import "../chunk-J7NJRK3K.js";
 import "../chunk-SHUYVCID.js";
 export {
   ADMIN_MANIFEST_CONFIG,

package/dist/{admin-resources.module-CpvzcfCc.d.cts → admin-resources.module-B4XNvdH-.d.cts}

@@ -7,7 +7,6 @@ declare const ADMIN_MANIFEST_CONFIG: unique symbol;
 interface AdminManifestConfig {
     project: AdminManifest['project'];
     build: Omit<AdminManifest['build'], 'manifestHash'>;
-    planCatalogSnapshot: AdminManifest['planCatalogSnapshot'];
 }
 
 interface AdminStatsModuleOptions {
@@ -63,4 +62,4 @@ declare class AdminResourcesModule {
     static forRoot(options: AdminResourcesModuleOptions): DynamicModule;
 }
 
-export { ADMIN_MANIFEST_CONFIG as A, SuspendTenantDto as S, ADMIN_RESOURCES_PORT_TOKEN as a, type AdminManifestConfig as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e, AdminStatsModule as f, type AdminStatsModuleOptions as g };
+export { type AdminResourcesModuleOptions as A, SuspendTenantDto as S, type AdminStatsModuleOptions as a, type AdminManifestConfig as b, ADMIN_MANIFEST_CONFIG as c, ADMIN_RESOURCES_PORT_TOKEN as d, AdminResourcesModule as e, AdminResourcesService as f, AdminStatsModule as g };

package/dist/{admin-resources.module-DF5_Q7RD.d.ts → admin-resources.module-CWqdI9BV.d.ts}

@@ -7,7 +7,6 @@ declare const ADMIN_MANIFEST_CONFIG: unique symbol;
 interface AdminManifestConfig {
     project: AdminManifest['project'];
     build: Omit<AdminManifest['build'], 'manifestHash'>;
-    planCatalogSnapshot: AdminManifest['planCatalogSnapshot'];
 }
 
 interface AdminStatsModuleOptions {
@@ -63,4 +62,4 @@ declare class AdminResourcesModule {
     static forRoot(options: AdminResourcesModuleOptions): DynamicModule;
 }
 
-export { ADMIN_MANIFEST_CONFIG as A, SuspendTenantDto as S, ADMIN_RESOURCES_PORT_TOKEN as a, type AdminManifestConfig as b, AdminResourcesModule as c, type AdminResourcesModuleOptions as d, AdminResourcesService as e, AdminStatsModule as f, type AdminStatsModuleOptions as g };
+export { type AdminResourcesModuleOptions as A, SuspendTenantDto as S, type AdminStatsModuleOptions as a, type AdminManifestConfig as b, ADMIN_MANIFEST_CONFIG as c, ADMIN_RESOURCES_PORT_TOKEN as d, AdminResourcesModule as e, AdminResourcesService as f, AdminStatsModule as g };

package/dist/{admin-stats.service-TYiSUwIR.d.ts → admin-stats.service-CsLNt19Z.d.ts}

@@ -3,7 +3,8 @@ import { Reflector } from '@nestjs/core';
 import { MfaPort, RlsBypassPort, AuditPort, ManifestContribution, AdminManifest, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/core';
 import { Observable } from 'rxjs';
 import { P as ProviderSpec } from './di-CcNeq9v-.js';
-import { b as AdminManifestConfig } from './admin-resources.module-DF5_Q7RD.js';
+import { P as PlanCatalogSource } from './plan-catalog-source-DWe-BGY1.js';
+import { b as AdminManifestConfig } from './admin-resources.module-CWqdI9BV.js';
 
 declare class SuperAdminGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
@@ -87,13 +88,16 @@ declare class AdminModule {
 declare const PLATFORM_CORE_CONTRIBUTION_TOKEN: unique symbol;
 declare class AdminManifestService {
     private readonly config;
+    private readonly planCatalogs;
     private readonly logger;
     private readonly contributions;
-    private cached;
-    constructor(config: AdminManifestConfig, platformCore?: ManifestContribution | null);
+    private merged;
+    private lastHash;
+    constructor(config: AdminManifestConfig, planCatalogs: PlanCatalogSource, platformCore?: ManifestContribution | null);
     register(contribution: ManifestContribution): void;
-    getManifest(): AdminManifest;
-    rebuild(): AdminManifest;
+    getManifest(): Promise<AdminManifest>;
+    /** Merges the contributions again, then serves the manifest as `getManifest` does. */
+    rebuild(): Promise<AdminManifest>;
     private build;
     private mergeContributions;
     /**
@@ -108,7 +112,7 @@ declare class AdminManifestService {
 
 type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
 interface AdminManifestModuleOptions {
-    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
+    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_SETTINGS_TOKEN inject). */
     config: ConfigSpec;
     /**
      * Default `true`. Set to `false` when the consumer registers its own
@@ -177,4 +181,4 @@ declare class AdminStatsService {
     getSnapshot(): Promise<AdminStatsSnapshot>;
 }
 
-export { AdminBypassRlsInterceptor as A, MfaGuard as M, PLATFORM_CORE_CONTRIBUTION_TOKEN as P, REQUIRE_MFA_KEY as R, SuperAdminGuard as S, type TotpSetupResult as T, type VerifyTotpInput as V, AdminManifestModule as a, type AdminManifestModuleOptions as b, AdminManifestService as c, AdminModule as d, type AdminModuleOptions as e, AdminStatsService as f, type AdminStatsSnapshot as g, MfaService as h, RequireMfa as i };
+export { AdminBypassRlsInterceptor as A, MfaService as M, PLATFORM_CORE_CONTRIBUTION_TOKEN as P, REQUIRE_MFA_KEY as R, SuperAdminGuard as S, type TotpSetupResult as T, type VerifyTotpInput as V, AdminManifestModule as a, type AdminManifestModuleOptions as b, AdminManifestService as c, AdminModule as d, type AdminModuleOptions as e, AdminStatsService as f, type AdminStatsSnapshot as g, MfaGuard as h, RequireMfa as i };

package/dist/{admin-stats.service-DfKupywR.d.cts → admin-stats.service-DrZrU8IJ.d.cts}

@@ -3,7 +3,8 @@ import { Reflector } from '@nestjs/core';
 import { MfaPort, RlsBypassPort, AuditPort, ManifestContribution, AdminManifest, SubscriptionStatsPort, PromoCodeStatsPort, AuditStatsPort, SubscriptionStatsSnapshot, PromoCodeStatsSnapshot, AuditStatsSnapshot } from '@saasicat/core';
 import { Observable } from 'rxjs';
 import { P as ProviderSpec } from './di-CcNeq9v-.cjs';
-import { b as AdminManifestConfig } from './admin-resources.module-CpvzcfCc.cjs';
+import { P as PlanCatalogSource } from './plan-catalog-source-DWe-BGY1.cjs';
+import { b as AdminManifestConfig } from './admin-resources.module-B4XNvdH-.cjs';
 
 declare class SuperAdminGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
@@ -87,13 +88,16 @@ declare class AdminModule {
 declare const PLATFORM_CORE_CONTRIBUTION_TOKEN: unique symbol;
 declare class AdminManifestService {
     private readonly config;
+    private readonly planCatalogs;
     private readonly logger;
     private readonly contributions;
-    private cached;
-    constructor(config: AdminManifestConfig, platformCore?: ManifestContribution | null);
+    private merged;
+    private lastHash;
+    constructor(config: AdminManifestConfig, planCatalogs: PlanCatalogSource, platformCore?: ManifestContribution | null);
     register(contribution: ManifestContribution): void;
-    getManifest(): AdminManifest;
-    rebuild(): AdminManifest;
+    getManifest(): Promise<AdminManifest>;
+    /** Merges the contributions again, then serves the manifest as `getManifest` does. */
+    rebuild(): Promise<AdminManifest>;
     private build;
     private mergeContributions;
     /**
@@ -108,7 +112,7 @@ declare class AdminManifestService {
 
 type ConfigSpec = AdminManifestConfig | Pick<FactoryProvider<AdminManifestConfig>, 'useFactory' | 'inject'>;
 interface AdminManifestModuleOptions {
-    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_TOKEN inject). */
+    /** AdminManifestConfig as a value or via a factory (e.g. with a PLAN_CATALOG_SETTINGS_TOKEN inject). */
     config: ConfigSpec;
     /**
      * Default `true`. Set to `false` when the consumer registers its own
@@ -177,4 +181,4 @@ declare class AdminStatsService {
     getSnapshot(): Promise<AdminStatsSnapshot>;
 }
 
-export { AdminBypassRlsInterceptor as A, MfaGuard as M, PLATFORM_CORE_CONTRIBUTION_TOKEN as P, REQUIRE_MFA_KEY as R, SuperAdminGuard as S, type TotpSetupResult as T, type VerifyTotpInput as V, AdminManifestModule as a, type AdminManifestModuleOptions as b, AdminManifestService as c, AdminModule as d, type AdminModuleOptions as e, AdminStatsService as f, type AdminStatsSnapshot as g, MfaService as h, RequireMfa as i };
+export { AdminBypassRlsInterceptor as A, MfaService as M, PLATFORM_CORE_CONTRIBUTION_TOKEN as P, REQUIRE_MFA_KEY as R, SuperAdminGuard as S, type TotpSetupResult as T, type VerifyTotpInput as V, AdminManifestModule as a, type AdminManifestModuleOptions as b, AdminManifestService as c, AdminModule as d, type AdminModuleOptions as e, AdminStatsService as f, type AdminStatsSnapshot as g, MfaGuard as h, RequireMfa as i };

package/dist/{aggregation-B3CD0v_d.d.cts → aggregation-ChpZDh0g.d.ts}

@@ -1,5 +1,6 @@
-import { PlanId, QuotaKey, FeatureKey, PlanCatalog, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionBundleRepository, BundleRepository, SubscriptionContractRepository, DiscoverySnapshot, SubscriptionRecord, TransactionContext, ContractLineItemRecord, SubscriptionContractRecord } from '@saasicat/core';
-import { E as EntitlementResolutionConfig } from './plan-resolution-Cgo_TR1H.cjs';
+import { PlanId, QuotaKey, FeatureKey, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionBundleRepository, BundleRepository, SubscriptionContractRepository, DiscoverySnapshot, PlanCatalog, SubscriptionRecord, TransactionContext, ContractLineItemRecord, SubscriptionContractRecord } from '@saasicat/core';
+import { P as PlanCatalogSource } from './plan-catalog-source-DWe-BGY1.js';
+import { E as EntitlementResolutionConfig } from './plan-resolution-CwUy_OqC.js';
 
 /**
  * Snapshot of the binding `PlanVersion` of a subscription. Quotas are
@@ -113,7 +114,7 @@ interface EnforceLimitInput<T> {
     now?: Date;
 }
 declare class EntitlementService {
-    private readonly catalog;
+    private readonly catalogs;
     private readonly subscriptions;
     private readonly planVersions;
     private readonly tx;
@@ -124,8 +125,16 @@ declare class EntitlementService {
     private readonly discoverySnapshot;
     private readonly cache;
     private replacedByIndex;
-    constructor(catalog: PlanCatalog, subscriptions: SubscriptionRepository, planVersions: PlanVersionRepository, tx: TransactionRunner, resolutionConfig?: EntitlementResolutionConfig | null, subscriptionBundles?: SubscriptionBundleRepository | null, bundles?: BundleRepository | null, subscriptionContracts?: SubscriptionContractRepository | null, discoverySnapshot?: DiscoverySnapshot | null);
-    computeLimits(tenantId: string, now?: Date): Promise<EffectiveLimits>;
+    constructor(catalogs: PlanCatalogSource, subscriptions: SubscriptionRepository, planVersions: PlanVersionRepository, tx: TransactionRunner, resolutionConfig?: EntitlementResolutionConfig | null, subscriptionBundles?: SubscriptionBundleRepository | null, bundles?: BundleRepository | null, subscriptionContracts?: SubscriptionContractRepository | null, discoverySnapshot?: DiscoverySnapshot | null);
+    /**
+     * The tenant's effective limits, answered from the cache for up to
+     * `CACHE_TTL_MS`. A caller that has already read the catalogue for its own
+     * operation passes it as `catalog`: the answer is then computed against
+     * that reading and kept out of the cache in both directions — not taken
+     * from it, and not written to it, since a reading the caller holds may be
+     * older than the one everybody else should be answered from.
+     */
+    computeLimits(tenantId: string, now?: Date, catalog?: PlanCatalog): Promise<EffectiveLimits>;
     /**
      * Clears a tenant's cache entry. MUST be called as soon as a mutation
      * changes the subscription, a bundle booking, or a PlanVersion binding —
@@ -140,12 +149,36 @@ declare class EntitlementService {
      * have a `SubscriptionRecord` (e.g. within a transaction).
      */
     deriveLimits(sub: SubscriptionRecord, now: Date, tx?: TransactionContext): Promise<EffectiveLimits>;
+    /**
+     * `deriveLimits` against a catalogue already read. The catalogue decides
+     * which features are `plannedOnly`, and it is read outside any transaction
+     * a caller holds, so that checking a limit does not wait for a second
+     * connection while the subscription row is locked.
+     */
+    private limitsFor;
+    /**
+     * The last thing every path does, so that no path can skip it.
+     *
+     * Two steps, in this order. Grandfathering (#39): granted old feature keys
+     * transitively grant their successors from the `replaces` chains of the
+     * discovery snapshot — a no-op without a snapshot or without replaces
+     * declarations. Then `plannedOnly` features come out.
+     *
+     * The filter sits here rather than in each branch because it used to sit
+     * in each branch and one of them did not have it: limits read from a
+     * frozen contract were handed over as they stood, so a feature the
+     * catalogue says has no code behind it was granted to whoever had signed
+     * before it was marked. A successor pulled in by an alias could arrive the
+     * same way. `SC-ENTL-003` says "never … wherever it comes from", and one
+     * place is what makes that answerable.
+     */
+    private asGrantable;
     /**
      * Grandfathering (#39): granted old feature keys transitively grant
      * their successors from the `replaces` chains of the discovery snapshot.
      * A no-op without a snapshot or without replaces declarations.
      */
-    private withReplacedFeatureAliases;
+    private replaceFeatureAliases;
     private findActiveContract;
     /**
      * Loads a subscription's active bundle bookings and resolves the

package/dist/{aggregation-BFzW07DE.d.ts → aggregation-OpnhwzF5.d.cts}

@@ -1,5 +1,6 @@
-import { PlanId, QuotaKey, FeatureKey, PlanCatalog, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionBundleRepository, BundleRepository, SubscriptionContractRepository, DiscoverySnapshot, SubscriptionRecord, TransactionContext, ContractLineItemRecord, SubscriptionContractRecord } from '@saasicat/core';
-import { E as EntitlementResolutionConfig } from './plan-resolution-Cgo_TR1H.js';
+import { PlanId, QuotaKey, FeatureKey, SubscriptionRepository, PlanVersionRepository, TransactionRunner, SubscriptionBundleRepository, BundleRepository, SubscriptionContractRepository, DiscoverySnapshot, PlanCatalog, SubscriptionRecord, TransactionContext, ContractLineItemRecord, SubscriptionContractRecord } from '@saasicat/core';
+import { P as PlanCatalogSource } from './plan-catalog-source-DWe-BGY1.cjs';
+import { E as EntitlementResolutionConfig } from './plan-resolution-CwUy_OqC.cjs';
 
 /**
  * Snapshot of the binding `PlanVersion` of a subscription. Quotas are
@@ -113,7 +114,7 @@ interface EnforceLimitInput<T> {
     now?: Date;
 }
 declare class EntitlementService {
-    private readonly catalog;
+    private readonly catalogs;
     private readonly subscriptions;
     private readonly planVersions;
     private readonly tx;
@@ -124,8 +125,16 @@ declare class EntitlementService {
     private readonly discoverySnapshot;
     private readonly cache;
     private replacedByIndex;
-    constructor(catalog: PlanCatalog, subscriptions: SubscriptionRepository, planVersions: PlanVersionRepository, tx: TransactionRunner, resolutionConfig?: EntitlementResolutionConfig | null, subscriptionBundles?: SubscriptionBundleRepository | null, bundles?: BundleRepository | null, subscriptionContracts?: SubscriptionContractRepository | null, discoverySnapshot?: DiscoverySnapshot | null);
-    computeLimits(tenantId: string, now?: Date): Promise<EffectiveLimits>;
+    constructor(catalogs: PlanCatalogSource, subscriptions: SubscriptionRepository, planVersions: PlanVersionRepository, tx: TransactionRunner, resolutionConfig?: EntitlementResolutionConfig | null, subscriptionBundles?: SubscriptionBundleRepository | null, bundles?: BundleRepository | null, subscriptionContracts?: SubscriptionContractRepository | null, discoverySnapshot?: DiscoverySnapshot | null);
+    /**
+     * The tenant's effective limits, answered from the cache for up to
+     * `CACHE_TTL_MS`. A caller that has already read the catalogue for its own
+     * operation passes it as `catalog`: the answer is then computed against
+     * that reading and kept out of the cache in both directions — not taken
+     * from it, and not written to it, since a reading the caller holds may be
+     * older than the one everybody else should be answered from.
+     */
+    computeLimits(tenantId: string, now?: Date, catalog?: PlanCatalog): Promise<EffectiveLimits>;
     /**
      * Clears a tenant's cache entry. MUST be called as soon as a mutation
      * changes the subscription, a bundle booking, or a PlanVersion binding —
@@ -140,12 +149,36 @@ declare class EntitlementService {
      * have a `SubscriptionRecord` (e.g. within a transaction).
      */
     deriveLimits(sub: SubscriptionRecord, now: Date, tx?: TransactionContext): Promise<EffectiveLimits>;
+    /**
+     * `deriveLimits` against a catalogue already read. The catalogue decides
+     * which features are `plannedOnly`, and it is read outside any transaction
+     * a caller holds, so that checking a limit does not wait for a second
+     * connection while the subscription row is locked.
+     */
+    private limitsFor;
+    /**
+     * The last thing every path does, so that no path can skip it.
+     *
+     * Two steps, in this order. Grandfathering (#39): granted old feature keys
+     * transitively grant their successors from the `replaces` chains of the
+     * discovery snapshot — a no-op without a snapshot or without replaces
+     * declarations. Then `plannedOnly` features come out.
+     *
+     * The filter sits here rather than in each branch because it used to sit
+     * in each branch and one of them did not have it: limits read from a
+     * frozen contract were handed over as they stood, so a feature the
+     * catalogue says has no code behind it was granted to whoever had signed
+     * before it was marked. A successor pulled in by an alias could arrive the
+     * same way. `SC-ENTL-003` says "never … wherever it comes from", and one
+     * place is what makes that answerable.
+     */
+    private asGrantable;
     /**
      * Grandfathering (#39): granted old feature keys transitively grant
      * their successors from the `replaces` chains of the discovery snapshot.
      * A no-op without a snapshot or without replaces declarations.
      */
-    private withReplacedFeatureAliases;
+    private replaceFeatureAliases;
     private findActiveContract;
     /**
      * Loads a subscription's active bundle bookings and resolves the