@saasicat/nest 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/registration/index.d.cts

@@ -1,8 +1,14 @@
-import { PendingRegistrationRepository, RegistrationOtpDelivery, UserAccountLookup, SlugAvailabilityCheck, PasswordHasher, PlanCatalogLookup, PaymentProvider, PaymentEventLog, ActivationOrchestrator, RegistrationAuditLogger, RegistrationResumeTokenSigner, RegistrationResumeDelivery, RegistrationConfiguratorLookup, RegistrationPromoPreview, PublicSignupPlan, SelectPlanInput, RegistrationAuditContext, SelectPlanResult, StartCheckoutInput, StartCheckoutResult, HandlePaymentEventInput, HandlePaymentEventResult, CleanupResult, StartRegistrationInput, StartRegistrationResult, VerifyRegistrationOtpResult, ResumeRegistrationInput, ResumeRegistrationResult, ConfiguratorCatalog, SaveRegistrationConfigInput, SaveRegistrationConfigResult, ConfiguratorPriceBreakdown, RegistrationConfigSelection } from '@saasicat/core';
+import { PendingRegistrationRepository, ActivationOrchestrator, RegistrationAuditLogger, SubscriberPaymentMethodRepository, PendingRegistration, RegistrationBillingDetails, PaymentGatewayCallback, RegistrationOtpDelivery, UserAccountLookup, SlugAvailabilityCheck, PasswordHasher, PlanCatalogLookup, RegistrationResumeTokenSigner, RegistrationResumeDelivery, RegistrationConfiguratorLookup, RegistrationPromoPreview, PublicSignupPlan, SelectPlanInput, RegistrationAuditContext, SelectPlanResult, StartCheckoutInput, StartCheckoutResult, CleanupResult, StartRegistrationInput, StartRegistrationResult, VerifyRegistrationOtpResult, ResumeRegistrationInput, ResumeRegistrationResult, ConfiguratorCatalog, SaveRegistrationConfigInput, SaveRegistrationConfigResult, ConfiguratorPriceBreakdown, RegistrationConfigSelection } from '@saasicat/core';
 export { PasswordHasher } from '@saasicat/core';
-import { CanActivate, ExecutionContext, Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { b as CheckoutOfferService } from '../checkout-offer.service-CCVxG9b2.cjs';
+import { OnModuleInit, OnApplicationBootstrap, CanActivate, ExecutionContext, Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { P as PaymentGatewayRegistry, a as PaymentCallbackService } from '../payment-callback.service-CR84Xw1Z.cjs';
 import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
 export { CronExpression } from '@nestjs/schedule';
+import '../subscription-contract.service-CfNApLuP.cjs';
+import '../subscriber.service-5W6Gi-1B.cjs';
+import '../promo.service-BYBu6dy3.cjs';
+import '../plan-catalog-source-DWe-BGY1.cjs';
 
 /** 6-digit numeric OTP code, uniformly distributed from 100000..999999. */
 declare function generateOtpCode(): string;
@@ -27,8 +33,6 @@ declare const USER_ACCOUNT_LOOKUP_TOKEN: unique symbol;
 declare const SLUG_AVAILABILITY_CHECK_TOKEN: unique symbol;
 declare const PASSWORD_HASHER_TOKEN: unique symbol;
 declare const PLAN_CATALOG_LOOKUP_TOKEN: unique symbol;
-declare const PAYMENT_PROVIDER_TOKEN: unique symbol;
-declare const PAYMENT_EVENT_LOG_TOKEN: unique symbol;
 declare const ACTIVATION_ORCHESTRATOR_TOKEN: unique symbol;
 declare const REGISTRATION_AUDIT_LOGGER_TOKEN: unique symbol;
 declare const REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN: unique symbol;
@@ -39,6 +43,65 @@ declare const REGISTRATION_PROMO_PREVIEW_TOKEN: unique symbol;
 /** Optionally injectable configuration — falls back to default TTLs from @saasicat/core. */
 declare const REGISTRATION_CONFIG_TOKEN: unique symbol;
 
+interface RegistrationSetupUrls {
+    successUrl: string;
+    cancelUrl: string;
+}
+interface RegistrationSetupStarted {
+    updated: PendingRegistration;
+    sessionRef: string;
+    redirectUrl: string;
+    /** The last moment a confirmation of this session can arrive, as the gateway reports it. */
+    confirmableUntil: Date | null;
+    /** A confirmation the gateway already holds, for `confirm`. */
+    immediate: {
+        account: string;
+        callback: PaymentGatewayCallback;
+    } | null;
+}
+/**
+ * Step 4 of a sign-up: the billing address and the payment method, and the
+ * activation once the gateway confirmed it.
+ *
+ * The confirmation arrives as a gateway callback, claimed on a transaction the
+ * platform opens. The application's `ActivationOrchestrator` writes the user,
+ * the tenant, the subscriber and the subscription on that transaction, and the
+ * payment method is recorded for the subscriber on it too — all of it, the
+ * claim included, or none of it.
+ */
+declare class RegistrationPaymentService implements OnModuleInit, OnApplicationBootstrap {
+    private readonly repo;
+    private readonly orchestrator;
+    private readonly audit;
+    private readonly registry;
+    private readonly callbacks;
+    private readonly methods;
+    private readonly logger;
+    constructor(repo: PendingRegistrationRepository, orchestrator: ActivationOrchestrator, audit: RegistrationAuditLogger, registry?: PaymentGatewayRegistry | null, callbacks?: PaymentCallbackService | null, methods?: SubscriberPaymentMethodRepository | null);
+    onModuleInit(): void;
+    onApplicationBootstrap(): Promise<void>;
+    /**
+     * Records the billing details and opens the gateway's form. Returns the
+     * record as it now stands, where to send the person, and what `confirm`
+     * hands on when the gateway confirmed on the spot. The checkout expires
+     * `PENDING_CHECKOUT_TTL_DAYS` after `startedAt`.
+     */
+    startSetup(pending: PendingRegistration, billingDetails: RegistrationBillingDetails, urls: RegistrationSetupUrls, startedAt: Date): Promise<RegistrationSetupStarted>;
+    /** Handles a confirmation the gateway gave when the setup started, like any callback. */
+    confirm(started: RegistrationSetupStarted): Promise<void>;
+    private activate;
+    private noteFailure;
+    /**
+     * The sign-up a setup event is about, found by the session its account
+     * opened. `null` — and nothing done — when there is none waiting: it was
+     * activated already, or expired and was cleaned up, or the event names a
+     * different sign-up than the session belongs to.
+     */
+    private pendingFor;
+    private payments;
+    private record;
+}
+
 /**
  * Orchestrates step 1 (capture registration data) and step 2 (OTP verification)
  * of the multi-step registration flow.
@@ -61,36 +124,32 @@ declare class PendingRegistrationService {
     private readonly slugCheck;
     private readonly passwordHasher;
     private readonly planCatalog;
-    private readonly paymentProvider;
-    private readonly paymentEventLog;
-    private readonly activationOrchestrator;
+    private readonly payments;
     private readonly audit;
     private readonly resumeTokenSigner?;
     private readonly resumeDelivery?;
     private readonly resumeBaseUrl?;
     private readonly configuratorLookup?;
     private readonly promoPreview?;
+    private readonly checkoutOffers?;
     private readonly logger;
-    constructor(repo: PendingRegistrationRepository, otpDelivery: RegistrationOtpDelivery, userLookup: UserAccountLookup, slugCheck: SlugAvailabilityCheck, passwordHasher: PasswordHasher, planCatalog: PlanCatalogLookup, paymentProvider: PaymentProvider, paymentEventLog: PaymentEventLog, activationOrchestrator: ActivationOrchestrator, audit: RegistrationAuditLogger, resumeTokenSigner?: RegistrationResumeTokenSigner | undefined, resumeDelivery?: RegistrationResumeDelivery | undefined, resumeBaseUrl?: string | undefined, configuratorLookup?: RegistrationConfiguratorLookup | undefined, promoPreview?: RegistrationPromoPreview | undefined);
+    constructor(repo: PendingRegistrationRepository, otpDelivery: RegistrationOtpDelivery, userLookup: UserAccountLookup, slugCheck: SlugAvailabilityCheck, passwordHasher: PasswordHasher, planCatalog: PlanCatalogLookup, payments: RegistrationPaymentService, audit: RegistrationAuditLogger, resumeTokenSigner?: RegistrationResumeTokenSigner | undefined, resumeDelivery?: RegistrationResumeDelivery | undefined, resumeBaseUrl?: string | undefined, configuratorLookup?: RegistrationConfiguratorLookup | undefined, promoPreview?: RegistrationPromoPreview | undefined, checkoutOffers?: CheckoutOfferService | undefined);
     private record;
     /** Public signup plan list for step 3 (frontend `usePublicPlans()`). */
     listPublicPlans(): Promise<PublicSignupPlan[]>;
     selectPlan(input: SelectPlanInput, context?: RegistrationAuditContext): Promise<SelectPlanResult>;
     startCheckout(input: StartCheckoutInput, context?: RegistrationAuditContext): Promise<StartCheckoutResult>;
     /**
-     * Processes a payment webhook idempotently:
-     *  1. `tryClaim` pins the event ID via a @unique INSERT. Duplicates are
-     *     dropped silently (`ALREADY_PROCESSED`).
-     *  2. On status `SUCCEEDED` the PendingRegistration is resolved from the
-     *     checkout session and the ActivationOrchestrator triggers the final
-     *     user+tenant+subscription creation in a single transaction.
-     *  3. After activation the PendingRegistration is deleted.
-     *
-     * On errors in step 2/3 the EventLog entry remains — provider retries then
-     * run into ALREADY_PROCESSED. Operational repair is done manually (status
-     * inspection + cleanup).
+     * Gives back the slot a failed start took: its form did not open, or its
+     * slot could not be moved to the form's end. The failure is the answer the
+     * caller gets; a slot that cannot be given back here lapses with its short
+     * hold, so this failure is logged rather than put in the way of that answer.
+     */
+    private giveBackHoldOf;
+    /**
+     * Holds the promo code of the offer the sign-up concludes until `until`.
      */
-    handlePaymentEvent(input: HandlePaymentEventInput, context?: RegistrationAuditContext): Promise<HandlePaymentEventResult>;
+    private holdPromoCodeOf;
     /**
      * Deletes all PendingRegistration records with `expiresAt < now`.
      * Full deletion (no anonymization path) is the simpler option: the schema
@@ -234,8 +293,6 @@ interface RegistrationModuleOptions {
     slugAvailabilityCheck: ProviderSpec<SlugAvailabilityCheck>;
     passwordHasher: ProviderSpec<PasswordHasher>;
     planCatalogLookup: ProviderSpec<PlanCatalogLookup>;
-    paymentProvider: ProviderSpec<PaymentProvider>;
-    paymentEventLog: ProviderSpec<PaymentEventLog>;
     activationOrchestrator: ProviderSpec<ActivationOrchestrator>;
     auditLogger: ProviderSpec<RegistrationAuditLogger>;
     /**
@@ -326,35 +383,32 @@ declare class SelectRegistrationPlanDto {
     planId: string;
 }
 
+/** The billing address and tax identifiers step 4 asks for, which the subscriber is created with. */
+declare class RegistrationBillingDetailsDto {
+    addressLine1: string;
+    addressLine2?: string | null;
+    postalCode: string;
+    city: string;
+    /** ISO 3166-1 alpha-2, e.g. `DE`. */
+    country: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+}
 /**
- * Input for step 4 (start checkout) — `POST /auth/register/start-checkout`.
- * The frontend passes the PendingRegistration ID and the redirect URLs
- * (success / cancel) that the payment provider redirects to after the payment
- * action.
+ * Input for step 4 — `POST /auth/register/start-checkout`: the billing details,
+ * and where the payment gateway's form sends the person once the payment method
+ * is set up, or when they leave it.
  */
 declare class StartRegistrationCheckoutDto {
     pendingRegistrationId: string;
+    billingDetails: RegistrationBillingDetailsDto;
     successUrl: string;
     cancelUrl: string;
-}
-
-/**
- * Webhook contract for `POST /webhooks/payment`.
- *
- * Provider-agnostic: the Stripe adapter (phase 2.4) maps Stripe's
- * `checkout.session.completed` → `{ eventId, sessionId, status: 'SUCCEEDED' }`,
- * `payment_intent.payment_failed` → `{ status: 'FAILED' }`, etc.
- *
- * In production the signature verification (Stripe `Stripe-Signature`
- * header) should run BEFORE the DTO validation — see StripeWebhookGuard in
- * the app module.
- */
-declare class PaymentWebhookDto {
-    eventId: string;
-    sessionId?: string;
-    provider: string;
-    status: 'SUCCEEDED' | 'FAILED';
-    payload?: Record<string, unknown>;
+    /**
+     * The checkout offer the sign-up concludes; its promo code is held until a
+     * confirmation of the payment form can no longer arrive.
+     */
+    checkoutOfferId?: string | null;
 }
 
 /**
@@ -401,7 +455,10 @@ declare class PreviewRegistrationPromoDto {
 }
 
 interface PromoEvaluation {
-    /** Discount in EUR on the subtotal (gross or net depending on catalog convention; here on net). */
+    /**
+     * The discount in gross, as the promo preview reckons it against the gross
+     * subtotal. `computeBreakdown` converts it to net before taking it off.
+     */
     discountAmount: number;
     /** Percentage for UI display. */
     percent: number;
@@ -420,4 +477,4 @@ declare function resolveModel(catalog: ConfiguratorCatalog, modelId: string): {
     yearlyNet: number;
 };
 
-export { ACTIVATION_ORCHESTRATOR_TOKEN, BaseIpRateLimitGuard, ContinueRegistrationDto, PASSWORD_HASHER_TOKEN, PAYMENT_EVENT_LOG_TOKEN, PAYMENT_PROVIDER_TOKEN, PENDING_REGISTRATION_REPOSITORY_TOKEN, PLAN_CATALOG_LOOKUP_TOKEN, PaymentWebhookDto, PendingRegistrationService, PreviewRegistrationPromoDto, type PromoEvaluation, REGISTRATION_AUDIT_LOGGER_TOKEN, REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, REGISTRATION_CONFIG_TOKEN, REGISTRATION_OTP_DELIVERY_TOKEN, REGISTRATION_PROMO_PREVIEW_TOKEN, REGISTRATION_RESUME_BASE_URL_TOKEN, REGISTRATION_RESUME_DELIVERY_TOKEN, REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, RegisterStartDto, RegistrationCleanupCron, RegistrationModule, type RegistrationModuleOptions, ResendRegistrationOtpDto, SLUG_AVAILABILITY_CHECK_TOKEN, SaveRegistrationConfigDto, SaveRegistrationConfigSelectionDto, SelectRegistrationPlanDto, StartRegistrationCheckoutDto, USER_ACCOUNT_LOOKUP_TOKEN, VerifyRegistrationOtpDto, computeBreakdown, generateOtpCode, hashOtpCode, resolveModel, slugify, verifyOtpCode };
+export { ACTIVATION_ORCHESTRATOR_TOKEN, BaseIpRateLimitGuard, ContinueRegistrationDto, PASSWORD_HASHER_TOKEN, PENDING_REGISTRATION_REPOSITORY_TOKEN, PLAN_CATALOG_LOOKUP_TOKEN, PendingRegistrationService, PreviewRegistrationPromoDto, type PromoEvaluation, REGISTRATION_AUDIT_LOGGER_TOKEN, REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, REGISTRATION_CONFIG_TOKEN, REGISTRATION_OTP_DELIVERY_TOKEN, REGISTRATION_PROMO_PREVIEW_TOKEN, REGISTRATION_RESUME_BASE_URL_TOKEN, REGISTRATION_RESUME_DELIVERY_TOKEN, REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, RegisterStartDto, RegistrationBillingDetailsDto, RegistrationCleanupCron, RegistrationModule, type RegistrationModuleOptions, ResendRegistrationOtpDto, SLUG_AVAILABILITY_CHECK_TOKEN, SaveRegistrationConfigDto, SaveRegistrationConfigSelectionDto, SelectRegistrationPlanDto, StartRegistrationCheckoutDto, USER_ACCOUNT_LOOKUP_TOKEN, VerifyRegistrationOtpDto, computeBreakdown, generateOtpCode, hashOtpCode, resolveModel, slugify, verifyOtpCode };

package/dist/registration/index.d.ts

@@ -1,8 +1,14 @@
-import { PendingRegistrationRepository, RegistrationOtpDelivery, UserAccountLookup, SlugAvailabilityCheck, PasswordHasher, PlanCatalogLookup, PaymentProvider, PaymentEventLog, ActivationOrchestrator, RegistrationAuditLogger, RegistrationResumeTokenSigner, RegistrationResumeDelivery, RegistrationConfiguratorLookup, RegistrationPromoPreview, PublicSignupPlan, SelectPlanInput, RegistrationAuditContext, SelectPlanResult, StartCheckoutInput, StartCheckoutResult, HandlePaymentEventInput, HandlePaymentEventResult, CleanupResult, StartRegistrationInput, StartRegistrationResult, VerifyRegistrationOtpResult, ResumeRegistrationInput, ResumeRegistrationResult, ConfiguratorCatalog, SaveRegistrationConfigInput, SaveRegistrationConfigResult, ConfiguratorPriceBreakdown, RegistrationConfigSelection } from '@saasicat/core';
+import { PendingRegistrationRepository, ActivationOrchestrator, RegistrationAuditLogger, SubscriberPaymentMethodRepository, PendingRegistration, RegistrationBillingDetails, PaymentGatewayCallback, RegistrationOtpDelivery, UserAccountLookup, SlugAvailabilityCheck, PasswordHasher, PlanCatalogLookup, RegistrationResumeTokenSigner, RegistrationResumeDelivery, RegistrationConfiguratorLookup, RegistrationPromoPreview, PublicSignupPlan, SelectPlanInput, RegistrationAuditContext, SelectPlanResult, StartCheckoutInput, StartCheckoutResult, CleanupResult, StartRegistrationInput, StartRegistrationResult, VerifyRegistrationOtpResult, ResumeRegistrationInput, ResumeRegistrationResult, ConfiguratorCatalog, SaveRegistrationConfigInput, SaveRegistrationConfigResult, ConfiguratorPriceBreakdown, RegistrationConfigSelection } from '@saasicat/core';
 export { PasswordHasher } from '@saasicat/core';
-import { CanActivate, ExecutionContext, Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { b as CheckoutOfferService } from '../checkout-offer.service-BeHgYikI.js';
+import { OnModuleInit, OnApplicationBootstrap, CanActivate, ExecutionContext, Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { P as PaymentGatewayRegistry, a as PaymentCallbackService } from '../payment-callback.service-CR84Xw1Z.js';
 import { P as ProviderSpec } from '../di-CcNeq9v-.js';
 export { CronExpression } from '@nestjs/schedule';
+import '../subscription-contract.service-CPZrTM9C.js';
+import '../subscriber.service-5W6Gi-1B.js';
+import '../promo.service-CFjfF0Xm.js';
+import '../plan-catalog-source-DWe-BGY1.js';
 
 /** 6-digit numeric OTP code, uniformly distributed from 100000..999999. */
 declare function generateOtpCode(): string;
@@ -27,8 +33,6 @@ declare const USER_ACCOUNT_LOOKUP_TOKEN: unique symbol;
 declare const SLUG_AVAILABILITY_CHECK_TOKEN: unique symbol;
 declare const PASSWORD_HASHER_TOKEN: unique symbol;
 declare const PLAN_CATALOG_LOOKUP_TOKEN: unique symbol;
-declare const PAYMENT_PROVIDER_TOKEN: unique symbol;
-declare const PAYMENT_EVENT_LOG_TOKEN: unique symbol;
 declare const ACTIVATION_ORCHESTRATOR_TOKEN: unique symbol;
 declare const REGISTRATION_AUDIT_LOGGER_TOKEN: unique symbol;
 declare const REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN: unique symbol;
@@ -39,6 +43,65 @@ declare const REGISTRATION_PROMO_PREVIEW_TOKEN: unique symbol;
 /** Optionally injectable configuration — falls back to default TTLs from @saasicat/core. */
 declare const REGISTRATION_CONFIG_TOKEN: unique symbol;
 
+interface RegistrationSetupUrls {
+    successUrl: string;
+    cancelUrl: string;
+}
+interface RegistrationSetupStarted {
+    updated: PendingRegistration;
+    sessionRef: string;
+    redirectUrl: string;
+    /** The last moment a confirmation of this session can arrive, as the gateway reports it. */
+    confirmableUntil: Date | null;
+    /** A confirmation the gateway already holds, for `confirm`. */
+    immediate: {
+        account: string;
+        callback: PaymentGatewayCallback;
+    } | null;
+}
+/**
+ * Step 4 of a sign-up: the billing address and the payment method, and the
+ * activation once the gateway confirmed it.
+ *
+ * The confirmation arrives as a gateway callback, claimed on a transaction the
+ * platform opens. The application's `ActivationOrchestrator` writes the user,
+ * the tenant, the subscriber and the subscription on that transaction, and the
+ * payment method is recorded for the subscriber on it too — all of it, the
+ * claim included, or none of it.
+ */
+declare class RegistrationPaymentService implements OnModuleInit, OnApplicationBootstrap {
+    private readonly repo;
+    private readonly orchestrator;
+    private readonly audit;
+    private readonly registry;
+    private readonly callbacks;
+    private readonly methods;
+    private readonly logger;
+    constructor(repo: PendingRegistrationRepository, orchestrator: ActivationOrchestrator, audit: RegistrationAuditLogger, registry?: PaymentGatewayRegistry | null, callbacks?: PaymentCallbackService | null, methods?: SubscriberPaymentMethodRepository | null);
+    onModuleInit(): void;
+    onApplicationBootstrap(): Promise<void>;
+    /**
+     * Records the billing details and opens the gateway's form. Returns the
+     * record as it now stands, where to send the person, and what `confirm`
+     * hands on when the gateway confirmed on the spot. The checkout expires
+     * `PENDING_CHECKOUT_TTL_DAYS` after `startedAt`.
+     */
+    startSetup(pending: PendingRegistration, billingDetails: RegistrationBillingDetails, urls: RegistrationSetupUrls, startedAt: Date): Promise<RegistrationSetupStarted>;
+    /** Handles a confirmation the gateway gave when the setup started, like any callback. */
+    confirm(started: RegistrationSetupStarted): Promise<void>;
+    private activate;
+    private noteFailure;
+    /**
+     * The sign-up a setup event is about, found by the session its account
+     * opened. `null` — and nothing done — when there is none waiting: it was
+     * activated already, or expired and was cleaned up, or the event names a
+     * different sign-up than the session belongs to.
+     */
+    private pendingFor;
+    private payments;
+    private record;
+}
+
 /**
  * Orchestrates step 1 (capture registration data) and step 2 (OTP verification)
  * of the multi-step registration flow.
@@ -61,36 +124,32 @@ declare class PendingRegistrationService {
     private readonly slugCheck;
     private readonly passwordHasher;
     private readonly planCatalog;
-    private readonly paymentProvider;
-    private readonly paymentEventLog;
-    private readonly activationOrchestrator;
+    private readonly payments;
     private readonly audit;
     private readonly resumeTokenSigner?;
     private readonly resumeDelivery?;
     private readonly resumeBaseUrl?;
     private readonly configuratorLookup?;
     private readonly promoPreview?;
+    private readonly checkoutOffers?;
     private readonly logger;
-    constructor(repo: PendingRegistrationRepository, otpDelivery: RegistrationOtpDelivery, userLookup: UserAccountLookup, slugCheck: SlugAvailabilityCheck, passwordHasher: PasswordHasher, planCatalog: PlanCatalogLookup, paymentProvider: PaymentProvider, paymentEventLog: PaymentEventLog, activationOrchestrator: ActivationOrchestrator, audit: RegistrationAuditLogger, resumeTokenSigner?: RegistrationResumeTokenSigner | undefined, resumeDelivery?: RegistrationResumeDelivery | undefined, resumeBaseUrl?: string | undefined, configuratorLookup?: RegistrationConfiguratorLookup | undefined, promoPreview?: RegistrationPromoPreview | undefined);
+    constructor(repo: PendingRegistrationRepository, otpDelivery: RegistrationOtpDelivery, userLookup: UserAccountLookup, slugCheck: SlugAvailabilityCheck, passwordHasher: PasswordHasher, planCatalog: PlanCatalogLookup, payments: RegistrationPaymentService, audit: RegistrationAuditLogger, resumeTokenSigner?: RegistrationResumeTokenSigner | undefined, resumeDelivery?: RegistrationResumeDelivery | undefined, resumeBaseUrl?: string | undefined, configuratorLookup?: RegistrationConfiguratorLookup | undefined, promoPreview?: RegistrationPromoPreview | undefined, checkoutOffers?: CheckoutOfferService | undefined);
     private record;
     /** Public signup plan list for step 3 (frontend `usePublicPlans()`). */
     listPublicPlans(): Promise<PublicSignupPlan[]>;
     selectPlan(input: SelectPlanInput, context?: RegistrationAuditContext): Promise<SelectPlanResult>;
     startCheckout(input: StartCheckoutInput, context?: RegistrationAuditContext): Promise<StartCheckoutResult>;
     /**
-     * Processes a payment webhook idempotently:
-     *  1. `tryClaim` pins the event ID via a @unique INSERT. Duplicates are
-     *     dropped silently (`ALREADY_PROCESSED`).
-     *  2. On status `SUCCEEDED` the PendingRegistration is resolved from the
-     *     checkout session and the ActivationOrchestrator triggers the final
-     *     user+tenant+subscription creation in a single transaction.
-     *  3. After activation the PendingRegistration is deleted.
-     *
-     * On errors in step 2/3 the EventLog entry remains — provider retries then
-     * run into ALREADY_PROCESSED. Operational repair is done manually (status
-     * inspection + cleanup).
+     * Gives back the slot a failed start took: its form did not open, or its
+     * slot could not be moved to the form's end. The failure is the answer the
+     * caller gets; a slot that cannot be given back here lapses with its short
+     * hold, so this failure is logged rather than put in the way of that answer.
+     */
+    private giveBackHoldOf;
+    /**
+     * Holds the promo code of the offer the sign-up concludes until `until`.
      */
-    handlePaymentEvent(input: HandlePaymentEventInput, context?: RegistrationAuditContext): Promise<HandlePaymentEventResult>;
+    private holdPromoCodeOf;
     /**
      * Deletes all PendingRegistration records with `expiresAt < now`.
      * Full deletion (no anonymization path) is the simpler option: the schema
@@ -234,8 +293,6 @@ interface RegistrationModuleOptions {
     slugAvailabilityCheck: ProviderSpec<SlugAvailabilityCheck>;
     passwordHasher: ProviderSpec<PasswordHasher>;
     planCatalogLookup: ProviderSpec<PlanCatalogLookup>;
-    paymentProvider: ProviderSpec<PaymentProvider>;
-    paymentEventLog: ProviderSpec<PaymentEventLog>;
     activationOrchestrator: ProviderSpec<ActivationOrchestrator>;
     auditLogger: ProviderSpec<RegistrationAuditLogger>;
     /**
@@ -326,35 +383,32 @@ declare class SelectRegistrationPlanDto {
     planId: string;
 }
 
+/** The billing address and tax identifiers step 4 asks for, which the subscriber is created with. */
+declare class RegistrationBillingDetailsDto {
+    addressLine1: string;
+    addressLine2?: string | null;
+    postalCode: string;
+    city: string;
+    /** ISO 3166-1 alpha-2, e.g. `DE`. */
+    country: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+}
 /**
- * Input for step 4 (start checkout) — `POST /auth/register/start-checkout`.
- * The frontend passes the PendingRegistration ID and the redirect URLs
- * (success / cancel) that the payment provider redirects to after the payment
- * action.
+ * Input for step 4 — `POST /auth/register/start-checkout`: the billing details,
+ * and where the payment gateway's form sends the person once the payment method
+ * is set up, or when they leave it.
  */
 declare class StartRegistrationCheckoutDto {
     pendingRegistrationId: string;
+    billingDetails: RegistrationBillingDetailsDto;
     successUrl: string;
     cancelUrl: string;
-}
-
-/**
- * Webhook contract for `POST /webhooks/payment`.
- *
- * Provider-agnostic: the Stripe adapter (phase 2.4) maps Stripe's
- * `checkout.session.completed` → `{ eventId, sessionId, status: 'SUCCEEDED' }`,
- * `payment_intent.payment_failed` → `{ status: 'FAILED' }`, etc.
- *
- * In production the signature verification (Stripe `Stripe-Signature`
- * header) should run BEFORE the DTO validation — see StripeWebhookGuard in
- * the app module.
- */
-declare class PaymentWebhookDto {
-    eventId: string;
-    sessionId?: string;
-    provider: string;
-    status: 'SUCCEEDED' | 'FAILED';
-    payload?: Record<string, unknown>;
+    /**
+     * The checkout offer the sign-up concludes; its promo code is held until a
+     * confirmation of the payment form can no longer arrive.
+     */
+    checkoutOfferId?: string | null;
 }
 
 /**
@@ -401,7 +455,10 @@ declare class PreviewRegistrationPromoDto {
 }
 
 interface PromoEvaluation {
-    /** Discount in EUR on the subtotal (gross or net depending on catalog convention; here on net). */
+    /**
+     * The discount in gross, as the promo preview reckons it against the gross
+     * subtotal. `computeBreakdown` converts it to net before taking it off.
+     */
     discountAmount: number;
     /** Percentage for UI display. */
     percent: number;
@@ -420,4 +477,4 @@ declare function resolveModel(catalog: ConfiguratorCatalog, modelId: string): {
     yearlyNet: number;
 };
 
-export { ACTIVATION_ORCHESTRATOR_TOKEN, BaseIpRateLimitGuard, ContinueRegistrationDto, PASSWORD_HASHER_TOKEN, PAYMENT_EVENT_LOG_TOKEN, PAYMENT_PROVIDER_TOKEN, PENDING_REGISTRATION_REPOSITORY_TOKEN, PLAN_CATALOG_LOOKUP_TOKEN, PaymentWebhookDto, PendingRegistrationService, PreviewRegistrationPromoDto, type PromoEvaluation, REGISTRATION_AUDIT_LOGGER_TOKEN, REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, REGISTRATION_CONFIG_TOKEN, REGISTRATION_OTP_DELIVERY_TOKEN, REGISTRATION_PROMO_PREVIEW_TOKEN, REGISTRATION_RESUME_BASE_URL_TOKEN, REGISTRATION_RESUME_DELIVERY_TOKEN, REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, RegisterStartDto, RegistrationCleanupCron, RegistrationModule, type RegistrationModuleOptions, ResendRegistrationOtpDto, SLUG_AVAILABILITY_CHECK_TOKEN, SaveRegistrationConfigDto, SaveRegistrationConfigSelectionDto, SelectRegistrationPlanDto, StartRegistrationCheckoutDto, USER_ACCOUNT_LOOKUP_TOKEN, VerifyRegistrationOtpDto, computeBreakdown, generateOtpCode, hashOtpCode, resolveModel, slugify, verifyOtpCode };
+export { ACTIVATION_ORCHESTRATOR_TOKEN, BaseIpRateLimitGuard, ContinueRegistrationDto, PASSWORD_HASHER_TOKEN, PENDING_REGISTRATION_REPOSITORY_TOKEN, PLAN_CATALOG_LOOKUP_TOKEN, PendingRegistrationService, PreviewRegistrationPromoDto, type PromoEvaluation, REGISTRATION_AUDIT_LOGGER_TOKEN, REGISTRATION_CONFIGURATOR_LOOKUP_TOKEN, REGISTRATION_CONFIG_TOKEN, REGISTRATION_OTP_DELIVERY_TOKEN, REGISTRATION_PROMO_PREVIEW_TOKEN, REGISTRATION_RESUME_BASE_URL_TOKEN, REGISTRATION_RESUME_DELIVERY_TOKEN, REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN, RegisterStartDto, RegistrationBillingDetailsDto, RegistrationCleanupCron, RegistrationModule, type RegistrationModuleOptions, ResendRegistrationOtpDto, SLUG_AVAILABILITY_CHECK_TOKEN, SaveRegistrationConfigDto, SaveRegistrationConfigSelectionDto, SelectRegistrationPlanDto, StartRegistrationCheckoutDto, USER_ACCOUNT_LOOKUP_TOKEN, VerifyRegistrationOtpDto, computeBreakdown, generateOtpCode, hashOtpCode, resolveModel, slugify, verifyOtpCode };

package/dist/registration/index.js

@@ -4,11 +4,8 @@ import {
   ContinueRegistrationDto,
   CronExpression,
   PASSWORD_HASHER_TOKEN,
-  PAYMENT_EVENT_LOG_TOKEN,
-  PAYMENT_PROVIDER_TOKEN,
   PENDING_REGISTRATION_REPOSITORY_TOKEN,
   PLAN_CATALOG_LOOKUP_TOKEN,
-  PaymentWebhookDto,
   PendingRegistrationService,
   PreviewRegistrationPromoDto,
   REGISTRATION_AUDIT_LOGGER_TOKEN,
@@ -20,6 +17,7 @@ import {
   REGISTRATION_RESUME_DELIVERY_TOKEN,
   REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN,
   RegisterStartDto,
+  RegistrationBillingDetailsDto,
   RegistrationCleanupCron,
   RegistrationModule,
   ResendRegistrationOtpDto,
@@ -36,9 +34,19 @@ import {
   resolveModel,
   slugify,
   verifyOtpCode
-} from "../chunk-SEPN52AD.js";
-import "../chunk-57V6ZTI6.js";
-import "../chunk-SABTXESR.js";
+} from "../chunk-JBCC6C3M.js";
+import "../chunk-55QEDAMX.js";
+import "../chunk-3RLWML2S.js";
+import "../chunk-NDLC5GYK.js";
+import "../chunk-KPEMTBOP.js";
+import "../chunk-TBBZWZQT.js";
+import "../chunk-VBRYPU7V.js";
+import "../chunk-6PJE7EWO.js";
+import "../chunk-3QVGA6JX.js";
+import "../chunk-7NJKVC5X.js";
+import "../chunk-LF6J4YYN.js";
+import "../chunk-FEQZCWUL.js";
+import "../chunk-J7NJRK3K.js";
 import "../chunk-SHUYVCID.js";
 export {
   ACTIVATION_ORCHESTRATOR_TOKEN,
@@ -46,11 +54,8 @@ export {
   ContinueRegistrationDto,
   CronExpression,
   PASSWORD_HASHER_TOKEN,
-  PAYMENT_EVENT_LOG_TOKEN,
-  PAYMENT_PROVIDER_TOKEN,
   PENDING_REGISTRATION_REPOSITORY_TOKEN,
   PLAN_CATALOG_LOOKUP_TOKEN,
-  PaymentWebhookDto,
   PendingRegistrationService,
   PreviewRegistrationPromoDto,
   REGISTRATION_AUDIT_LOGGER_TOKEN,
@@ -62,6 +67,7 @@ export {
   REGISTRATION_RESUME_DELIVERY_TOKEN,
   REGISTRATION_RESUME_TOKEN_SIGNER_TOKEN,
   RegisterStartDto,
+  RegistrationBillingDetailsDto,
   RegistrationCleanupCron,
   RegistrationModule,
   ResendRegistrationOtpDto,

package/dist/subscriber/index.cjs

@@ -0,0 +1,4 @@
+'use strict';
+// Generated by scripts/build-cjs-stubs.mjs — do not edit.
+// Thin re-export so every entry shares one set of class objects.
+module.exports = require('../_entries.cjs').subscriberNs;

package/dist/subscriber/index.d.cts

@@ -0,0 +1,28 @@
+export { S as SubscriberService } from '../subscriber.service-5W6Gi-1B.cjs';
+import { Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { SubscriberRepository } from '@saasicat/core';
+import { P as ProviderSpec } from '../di-CcNeq9v-.cjs';
+
+interface SubscriberModuleOptions {
+    subscriberRepository: ProviderSpec<SubscriberRepository>;
+    /** Modules that provide dependencies used by the repository factory. */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    extraProviders?: Provider[];
+    global?: boolean;
+}
+/**
+ * `SubscriberService` on its own. `SubscriptionContractModule` provides it as
+ * well, because a contract cannot be written without it; this module is for an
+ * application that creates tenants in a module of its own.
+ *
+ * Reads the customer number prefix from `PLAN_CATALOG_SETTINGS_TOKEN`, which
+ * `SaaSiCatModule.forRoot` provides globally.
+ */
+declare class SubscriberModule {
+    static forRoot(options: SubscriberModuleOptions): DynamicModule;
+}
+
+/** Repository for `subscribers`, their tenant links and their corrections. */
+declare const SUBSCRIBER_REPOSITORY_TOKEN: unique symbol;
+
+export { SUBSCRIBER_REPOSITORY_TOKEN, SubscriberModule, type SubscriberModuleOptions };

package/dist/subscriber/index.d.ts

@@ -0,0 +1,28 @@
+export { S as SubscriberService } from '../subscriber.service-5W6Gi-1B.js';
+import { Type, DynamicModule, ForwardReference, Provider } from '@nestjs/common';
+import { SubscriberRepository } from '@saasicat/core';
+import { P as ProviderSpec } from '../di-CcNeq9v-.js';
+
+interface SubscriberModuleOptions {
+    subscriberRepository: ProviderSpec<SubscriberRepository>;
+    /** Modules that provide dependencies used by the repository factory. */
+    imports?: Array<Type<unknown> | DynamicModule | Promise<DynamicModule> | ForwardReference>;
+    extraProviders?: Provider[];
+    global?: boolean;
+}
+/**
+ * `SubscriberService` on its own. `SubscriptionContractModule` provides it as
+ * well, because a contract cannot be written without it; this module is for an
+ * application that creates tenants in a module of its own.
+ *
+ * Reads the customer number prefix from `PLAN_CATALOG_SETTINGS_TOKEN`, which
+ * `SaaSiCatModule.forRoot` provides globally.
+ */
+declare class SubscriberModule {
+    static forRoot(options: SubscriberModuleOptions): DynamicModule;
+}
+
+/** Repository for `subscribers`, their tenant links and their corrections. */
+declare const SUBSCRIBER_REPOSITORY_TOKEN: unique symbol;
+
+export { SUBSCRIBER_REPOSITORY_TOKEN, SubscriberModule, type SubscriberModuleOptions };

package/dist/subscriber/index.js

@@ -0,0 +1,16 @@
+import "../chunk-DU56UKEH.js";
+import {
+  SubscriberModule
+} from "../chunk-WOEJ6K7M.js";
+import {
+  SUBSCRIBER_REPOSITORY_TOKEN,
+  SubscriberService
+} from "../chunk-LF6J4YYN.js";
+import "../chunk-FEQZCWUL.js";
+import "../chunk-J7NJRK3K.js";
+import "../chunk-SHUYVCID.js";
+export {
+  SUBSCRIBER_REPOSITORY_TOKEN,
+  SubscriberModule,
+  SubscriberService
+};