@saasicat/nest 1.0.0-rc.21 → 1.0.0-rc.23

package/dist/{chunk-AOS2JPDD.js → chunk-5LL2554P.js}

@@ -1,64 +1,79 @@
 import {
   PromoCodesModule
-} from "./chunk-4SDSYV4A.js";
+} from "./chunk-PBL7N5J3.js";
+import {
+  MAINTENANCE_NOTIFICATION_PORT_TOKEN,
+  MAINTENANCE_WINDOW_PORT_TOKEN,
+  MaintenanceService
+} from "./chunk-UJZCESIC.js";
 import {
   SubscriptionContractModule
-} from "./chunk-XSSWYPP5.js";
+} from "./chunk-TR3L6FRF.js";
 import {
   AdminManifestModule,
   AdminManifestService,
   AdminModule,
-  AdminResourcesModule,
   AdminStatsModule,
   SuperAdminGuard
-} from "./chunk-LLYVYRGJ.js";
+} from "./chunk-QTJEZDKC.js";
 import {
   FEATURE_GUARD_MARKER,
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
+  SubscriberAccountModule,
   SubscriptionBundleModule,
   TenantBillingModule,
   catalogSource,
   isPlatformFeatureGuard,
   loadPlanCatalogFromFile
-} from "./chunk-M47BNEY2.js";
+} from "./chunk-7MLB6T5B.js";
+import {
+  AdminResourcesModule
+} from "./chunk-5MZH3VVU.js";
+import {
+  CatalogModule
+} from "./chunk-MU4O4EKX.js";
 import {
-  CatalogModule,
   WebAuditLogger,
   actorTagOf,
   defaultActorFromRequest
-} from "./chunk-CQ2ZZMTD.js";
+} from "./chunk-YZSILFW4.js";
 import {
+  EnforceMfa,
   MfaService
 } from "./chunk-34XVPR6P.js";
 import {
   CheckoutOfferModule
-} from "./chunk-TOEFN7DN.js";
+} from "./chunk-W6VNCMOQ.js";
 import {
   DiscoveryModule
-} from "./chunk-S33SO5XX.js";
+} from "./chunk-4OFJLVVH.js";
+import {
+  AllowDuringMaintenance,
+  isAllowedDuringMaintenance
+} from "./chunk-TSLGMPGZ.js";
 import {
   EntitlementModule
-} from "./chunk-WHJSYKNC.js";
+} from "./chunk-7LHUENAT.js";
 import {
   LimitExceededError,
   cancellationHasLanded
-} from "./chunk-G6EZWECL.js";
+} from "./chunk-2XBWYMOL.js";
 import {
   findPlan
 } from "./chunk-TBBZWZQT.js";
 import {
   SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN
-} from "./chunk-VBRYPU7V.js";
+} from "./chunk-E224LKO2.js";
 import {
   ENFORCE_QUOTA_KEY
 } from "./chunk-QUZU2M33.js";
 import {
   PaymentsModule
-} from "./chunk-QPVDCKYS.js";
+} from "./chunk-ESEWSAOV.js";
 import {
   PaymentGatewayRegistry
-} from "./chunk-7NJKVC5X.js";
+} from "./chunk-WQNOCOI2.js";
 import {
   RLS_BYPASS_PORT_TOKEN
 } from "./chunk-SZ7RFPXA.js";
@@ -325,6 +340,7 @@ _ts_decorate2([
 ], SetupController.prototype, "confirm", null);
 SetupController = _ts_decorate2([
   Controller("admin/setup"),
+  AllowDuringMaintenance(),
   SaaSiCatPublicRoute(),
   _ts_metadata2("design:type", Function),
   _ts_metadata2("design:paramtypes", [
@@ -810,6 +826,7 @@ function buildSettingsController(guards) {
   ], GeneratedSettingsController.prototype, "acknowledge", null);
   GeneratedSettingsController = _ts_decorate6([
     Controller2("admin"),
+    AllowDuringMaintenance(),
     UseGuards(...guards),
     _ts_param5(0, Inject4(PLAN_CATALOG_SETTINGS_TOKEN)),
     _ts_param5(1, Inject4(SETTINGS_SOURCE_TOKEN)),
@@ -898,9 +915,12 @@ SettingsModule = _ts_decorate7([
   Module2({})
 ], SettingsModule);
 
-// src/platform/enforcement-chain.check.ts
-import { Inject as Inject5, Injectable as Injectable4, Optional as Optional4 } from "@nestjs/common";
-import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+// src/maintenance/maintenance-admin.controller.ts
+import { BadRequestException as BadRequestException2, Body as Body2, Controller as Controller3, Get as Get3, Inject as Inject5, Param as Param2, Patch, Post as Post3, Req as Req2, UseGuards as UseGuards2 } from "@nestjs/common";
+import { MAINTENANCE_ERROR_CODES, MAINTENANCE_STATE_MAX_AGE_SECONDS, maintenanceWindowViewOf, parseZonedInstant } from "@saasicat/core";
+
+// src/maintenance/dto/maintenance.dto.ts
+import { IsOptional as IsOptional2, IsString as IsString2 } from "class-validator";
 function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -912,12 +932,498 @@ function _ts_metadata6(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 __name(_ts_metadata6, "_ts_metadata");
+var AnnounceMaintenanceDto = class {
+  static {
+    __name(this, "AnnounceMaintenanceDto");
+  }
+  startsAt;
+  endsAt;
+  message;
+};
+_ts_decorate8([
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], AnnounceMaintenanceDto.prototype, "startsAt", void 0);
+_ts_decorate8([
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], AnnounceMaintenanceDto.prototype, "endsAt", void 0);
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", Object)
+], AnnounceMaintenanceDto.prototype, "message", void 0);
+var RescheduleMaintenanceDto = class {
+  static {
+    __name(this, "RescheduleMaintenanceDto");
+  }
+  startsAt;
+  endsAt;
+  /** `null` takes the message away; left out, it stays. */
+  message;
+};
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], RescheduleMaintenanceDto.prototype, "startsAt", void 0);
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], RescheduleMaintenanceDto.prototype, "endsAt", void 0);
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", Object)
+], RescheduleMaintenanceDto.prototype, "message", void 0);
+var LockMaintenanceDto = class {
+  static {
+    __name(this, "LockMaintenanceDto");
+  }
+  /** The window the operator is looking at; left out, the open one or a new one. */
+  windowId;
+  endsAt;
+  message;
+};
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], LockMaintenanceDto.prototype, "windowId", void 0);
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], LockMaintenanceDto.prototype, "endsAt", void 0);
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", Object)
+], LockMaintenanceDto.prototype, "message", void 0);
+var UnlockMaintenanceDto = class {
+  static {
+    __name(this, "UnlockMaintenanceDto");
+  }
+  windowId;
+};
+_ts_decorate8([
+  IsOptional2(),
+  IsString2(),
+  _ts_metadata6("design:type", String)
+], UnlockMaintenanceDto.prototype, "windowId", void 0);
+
+// src/maintenance/maintenance-admin.controller.ts
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata7(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata7, "_ts_metadata");
 function _ts_param6(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
 __name(_ts_param6, "_ts_param");
+function instantOf(value, field) {
+  const moment = parseZonedInstant(value);
+  if (!moment) {
+    throw new BadRequestException2(codedError(MAINTENANCE_ERROR_CODES.MAINTENANCE_TIME_INVALID, {
+      field
+    }));
+  }
+  return moment;
+}
+__name(instantOf, "instantOf");
+function optionalInstantOf(value, field) {
+  return value === void 0 ? void 0 : instantOf(value, field);
+}
+__name(optionalInstantOf, "optionalInstantOf");
+var viewOf = /* @__PURE__ */ __name((window) => maintenanceWindowViewOf(window, /* @__PURE__ */ new Date()), "viewOf");
+function buildMaintenanceAdminController(guards) {
+  let GeneratedMaintenanceAdminController = class GeneratedMaintenanceAdminController {
+    static {
+      __name(this, "GeneratedMaintenanceAdminController");
+    }
+    maintenance;
+    audit;
+    // Explicit @Inject: tsup/esbuild emit no `design:paramtypes`.
+    constructor(maintenance, audit) {
+      this.maintenance = maintenance;
+      this.audit = audit;
+    }
+    overview() {
+      return this.maintenance.overview();
+    }
+    async announce(dto, request) {
+      const window = await this.maintenance.announce({
+        startsAt: instantOf(dto.startsAt, "startsAt"),
+        endsAt: instantOf(dto.endsAt, "endsAt"),
+        message: dto.message
+      }, this.audit.actorFromRequest(request));
+      return viewOf(window);
+    }
+    async reschedule(id, dto, request) {
+      const window = await this.maintenance.reschedule(id, {
+        startsAt: optionalInstantOf(dto.startsAt, "startsAt"),
+        endsAt: optionalInstantOf(dto.endsAt, "endsAt"),
+        message: dto.message
+      }, this.audit.actorFromRequest(request));
+      return viewOf(window);
+    }
+    async cancel(id, request) {
+      return viewOf(await this.maintenance.cancel(id, this.audit.actorFromRequest(request)));
+    }
+    async lock(dto, request) {
+      const outcome = await this.maintenance.lock({
+        windowId: dto.windowId,
+        endsAt: optionalInstantOf(dto.endsAt, "endsAt"),
+        message: dto.message
+      }, this.audit.actorFromRequest(request));
+      return {
+        window: viewOf(outcome.window),
+        alreadyLocked: outcome.alreadyLocked,
+        takesEffectWithinSeconds: MAINTENANCE_STATE_MAX_AGE_SECONDS
+      };
+    }
+    async unlock(dto, request) {
+      const outcome = await this.maintenance.unlock({
+        windowId: dto.windowId
+      }, this.audit.actorFromRequest(request));
+      return {
+        window: outcome.window ? viewOf(outcome.window) : null,
+        wasLocked: outcome.wasLocked
+      };
+    }
+  };
+  _ts_decorate9([
+    Get3("maintenance"),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", []),
+    _ts_metadata7("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "overview", null);
+  _ts_decorate9([
+    Post3("maintenance"),
+    _ts_param6(0, Body2()),
+    _ts_param6(1, Req2()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof AnnounceMaintenanceDto === "undefined" ? Object : AnnounceMaintenanceDto,
+      Object
+    ]),
+    _ts_metadata7("design:returntype", Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "announce", null);
+  _ts_decorate9([
+    Patch("maintenance/:id"),
+    _ts_param6(0, Param2("id")),
+    _ts_param6(1, Body2()),
+    _ts_param6(2, Req2()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      String,
+      typeof RescheduleMaintenanceDto === "undefined" ? Object : RescheduleMaintenanceDto,
+      Object
+    ]),
+    _ts_metadata7("design:returntype", Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "reschedule", null);
+  _ts_decorate9([
+    Post3("maintenance/:id/cancel"),
+    _ts_param6(0, Param2("id")),
+    _ts_param6(1, Req2()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      String,
+      Object
+    ]),
+    _ts_metadata7("design:returntype", Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "cancel", null);
+  _ts_decorate9([
+    Post3("maintenance/lock"),
+    EnforceMfa(),
+    _ts_param6(0, Body2()),
+    _ts_param6(1, Req2()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof LockMaintenanceDto === "undefined" ? Object : LockMaintenanceDto,
+      Object
+    ]),
+    _ts_metadata7("design:returntype", Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "lock", null);
+  _ts_decorate9([
+    Post3("maintenance/unlock"),
+    EnforceMfa(),
+    _ts_param6(0, Body2()),
+    _ts_param6(1, Req2()),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof UnlockMaintenanceDto === "undefined" ? Object : UnlockMaintenanceDto,
+      Object
+    ]),
+    _ts_metadata7("design:returntype", Promise)
+  ], GeneratedMaintenanceAdminController.prototype, "unlock", null);
+  GeneratedMaintenanceAdminController = _ts_decorate9([
+    Controller3("admin"),
+    UseGuards2(...guards),
+    AllowDuringMaintenance(),
+    _ts_param6(0, Inject5(MaintenanceService)),
+    _ts_param6(1, Inject5(WebAuditLogger)),
+    _ts_metadata7("design:type", Function),
+    _ts_metadata7("design:paramtypes", [
+      typeof MaintenanceService === "undefined" ? Object : MaintenanceService,
+      typeof WebAuditLogger === "undefined" ? Object : WebAuditLogger
+    ])
+  ], GeneratedMaintenanceAdminController);
+  return GeneratedMaintenanceAdminController;
+}
+__name(buildMaintenanceAdminController, "buildMaintenanceAdminController");
+
+// src/maintenance/maintenance-status.controller.ts
+import { Controller as Controller4, Get as Get4, Inject as Inject6 } from "@nestjs/common";
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+function _ts_metadata8(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata8, "_ts_metadata");
+function _ts_param7(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param7, "_ts_param");
+var MaintenanceStatusController = class {
+  static {
+    __name(this, "MaintenanceStatusController");
+  }
+  maintenance;
+  // Explicit @Inject: tsup/esbuild emit no `design:paramtypes`.
+  constructor(maintenance) {
+    this.maintenance = maintenance;
+  }
+  status() {
+    return this.maintenance.status();
+  }
+};
+_ts_decorate10([
+  Get4("maintenance"),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", []),
+  _ts_metadata8("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], MaintenanceStatusController.prototype, "status", null);
+MaintenanceStatusController = _ts_decorate10([
+  Controller4("public"),
+  SaaSiCatPublicRoute(),
+  AllowDuringMaintenance(),
+  _ts_param7(0, Inject6(MaintenanceService)),
+  _ts_metadata8("design:type", Function),
+  _ts_metadata8("design:paramtypes", [
+    typeof MaintenanceService === "undefined" ? Object : MaintenanceService
+  ])
+], MaintenanceStatusController);
+
+// src/maintenance/maintenance.guard.ts
+import { Inject as Inject7, Injectable as Injectable4, ServiceUnavailableException } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { MAINTENANCE_ERROR_CODES as MAINTENANCE_ERROR_CODES2, maintenanceRetryAfterSeconds, maintenanceStatusOf, maintenanceWindowStatusOf } from "@saasicat/core";
+function _ts_decorate11(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate11, "_ts_decorate");
+function _ts_metadata9(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata9, "_ts_metadata");
+function _ts_param8(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param8, "_ts_param");
+function isPlatformAdministrator(user) {
+  return (user?.platformRole ?? user?.role) === "SUPER_ADMIN";
+}
+__name(isPlatformAdministrator, "isPlatformAdministrator");
+function setHeader(response, name, value) {
+  if (typeof response.header === "function") response.header(name, value);
+  else if (typeof response.setHeader === "function") response.setHeader(name, value);
+}
+__name(setHeader, "setHeader");
+var MaintenanceGuard = class {
+  static {
+    __name(this, "MaintenanceGuard");
+  }
+  reflector;
+  maintenance;
+  constructor(reflector, maintenance) {
+    this.reflector = reflector;
+    this.maintenance = maintenance;
+  }
+  async canActivate(context) {
+    if (context.getType() !== "http") return true;
+    if (isAllowedDuringMaintenance(this.reflector, context)) return true;
+    const open = await this.maintenance.openWindow();
+    if (!open || maintenanceWindowStatusOf(open) !== "locked") return true;
+    const http = context.switchToHttp();
+    if (isPlatformAdministrator(http.getRequest().user)) return true;
+    const now = /* @__PURE__ */ new Date();
+    setHeader(http.getResponse(), "Retry-After", String(maintenanceRetryAfterSeconds(open, now)));
+    throw new ServiceUnavailableException({
+      ...codedError(MAINTENANCE_ERROR_CODES2.MAINTENANCE, {
+        endsAt: open.endsAt?.toISOString() ?? null
+      }),
+      maintenance: maintenanceStatusOf(open, now)
+    });
+  }
+};
+MaintenanceGuard = _ts_decorate11([
+  Injectable4(),
+  _ts_param8(0, Inject7(Reflector)),
+  _ts_param8(1, Inject7(MaintenanceService)),
+  _ts_metadata9("design:type", Function),
+  _ts_metadata9("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof MaintenanceService === "undefined" ? Object : MaintenanceService
+  ])
+], MaintenanceGuard);
+
+// src/maintenance/maintenance.module.ts
+import { Module as Module3 } from "@nestjs/common";
+
+// src/maintenance/maintenance-manifest.ts
+import { MAINTENANCE_CAPABILITY } from "@saasicat/core";
+var MAINTENANCE_MANIFEST_CONTRIBUTION = {
+  capabilities: {
+    [MAINTENANCE_CAPABILITY]: true
+  },
+  audit: {
+    actions: [
+      {
+        key: "MAINTENANCE_WINDOW_ANNOUNCE",
+        label: "Maintenance window announced",
+        severity: "medium"
+      },
+      {
+        key: "MAINTENANCE_WINDOW_RESCHEDULE",
+        label: "Maintenance window moved",
+        severity: "low"
+      },
+      {
+        key: "MAINTENANCE_WINDOW_CANCEL",
+        label: "Maintenance window cancelled",
+        severity: "medium"
+      },
+      {
+        key: "MAINTENANCE_LOCK",
+        label: "Tenants locked out for maintenance",
+        severity: "high"
+      },
+      {
+        key: "MAINTENANCE_UNLOCK",
+        label: "Tenants let back in",
+        severity: "high"
+      }
+    ]
+  }
+};
+
+// src/maintenance/maintenance.module.ts
+function _ts_decorate12(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate12, "_ts_decorate");
+var MAINTENANCE_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/MaintenanceManifestRegistration");
+var MaintenanceModule = class _MaintenanceModule {
+  static {
+    __name(this, "MaintenanceModule");
+  }
+  static forRoot(options) {
+    const withAdmin = options.includeAdminController !== false;
+    const providers = [
+      asProvider(MAINTENANCE_WINDOW_PORT_TOKEN, options.windows),
+      options.notifications ? asProvider(MAINTENANCE_NOTIFICATION_PORT_TOKEN, options.notifications) : {
+        provide: MAINTENANCE_NOTIFICATION_PORT_TOKEN,
+        useValue: null
+      },
+      MaintenanceService,
+      MaintenanceGuard,
+      WebAuditLogger
+    ];
+    if (withAdmin) {
+      providers.push({
+        provide: MAINTENANCE_MANIFEST_REGISTRATION_TOKEN,
+        useFactory: /* @__PURE__ */ __name((manifest) => {
+          manifest?.register(MAINTENANCE_MANIFEST_CONTRIBUTION);
+          return MAINTENANCE_MANIFEST_CONTRIBUTION;
+        }, "useFactory"),
+        inject: [
+          {
+            token: AdminManifestService,
+            optional: true
+          }
+        ]
+      });
+    }
+    return {
+      module: _MaintenanceModule,
+      global: true,
+      imports: options.imports ?? [],
+      controllers: [
+        MaintenanceStatusController,
+        ...withAdmin ? [
+          buildMaintenanceAdminController(options.controller.guards)
+        ] : []
+      ],
+      providers,
+      exports: [
+        MaintenanceService,
+        MaintenanceGuard,
+        MAINTENANCE_WINDOW_PORT_TOKEN,
+        MAINTENANCE_NOTIFICATION_PORT_TOKEN
+      ]
+    };
+  }
+};
+MaintenanceModule = _ts_decorate12([
+  Module3({})
+], MaintenanceModule);
+
+// src/platform/enforcement-chain.check.ts
+import { Inject as Inject8, Injectable as Injectable5, Optional as Optional4 } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner } from "@nestjs/core";
+function _ts_decorate13(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate13, "_ts_decorate");
+function _ts_metadata10(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata10, "_ts_metadata");
+function _ts_param9(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param9, "_ts_param");
 var GUARDS_METADATA = "__guards__";
 var METHOD_METADATA = "method";
 var ENFORCEMENT_CHAIN_STATE_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/EnforcementChainState");
@@ -1006,14 +1512,14 @@ Two things this cannot see, and the way out of each: a guard of your own that wr
     return annotated;
   }
 };
-EnforcementChainCheck = _ts_decorate8([
-  Injectable4(),
-  _ts_param6(0, Inject5(DiscoveryService)),
-  _ts_param6(1, Inject5(MetadataScanner)),
-  _ts_param6(2, Optional4()),
-  _ts_param6(2, Inject5(ENFORCEMENT_CHAIN_STATE_TOKEN)),
-  _ts_metadata6("design:type", Function),
-  _ts_metadata6("design:paramtypes", [
+EnforcementChainCheck = _ts_decorate13([
+  Injectable5(),
+  _ts_param9(0, Inject8(DiscoveryService)),
+  _ts_param9(1, Inject8(MetadataScanner)),
+  _ts_param9(2, Optional4()),
+  _ts_param9(2, Inject8(ENFORCEMENT_CHAIN_STATE_TOKEN)),
+  _ts_metadata10("design:type", Function),
+  _ts_metadata10("design:paramtypes", [
     typeof DiscoveryService === "undefined" ? Object : DiscoveryService,
     typeof MetadataScanner === "undefined" ? Object : MetadataScanner,
     typeof EnforcementChainState === "undefined" ? Object : EnforcementChainState
@@ -1051,25 +1557,25 @@ function readGuards(target) {
 __name(readGuards, "readGuards");
 
 // src/platform/issuer-identity.check.ts
-import { Inject as Inject6, Injectable as Injectable5, Logger as Logger3, Optional as Optional5 } from "@nestjs/common";
+import { Inject as Inject9, Injectable as Injectable6, Logger as Logger3, Optional as Optional5 } from "@nestjs/common";
 import { classifyIssuerChange, recordedIssuerIdentity } from "@saasicat/core";
-function _ts_decorate9(decorators, target, key, desc) {
+function _ts_decorate14(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate9, "_ts_decorate");
-function _ts_metadata7(k, v) {
+__name(_ts_decorate14, "_ts_decorate");
+function _ts_metadata11(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata7, "_ts_metadata");
-function _ts_param7(paramIndex, decorator) {
+__name(_ts_metadata11, "_ts_metadata");
+function _ts_param10(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param7, "_ts_param");
+__name(_ts_param10, "_ts_param");
 var CONTRACTS_NAMED = 5;
 var NOT_RECORDED = "this installation records no applied settings";
 var ISSUER_BLOCK_KEYS = [
@@ -1249,18 +1755,18 @@ var IssuerIdentityInspector = class _IssuerIdentityInspector {
     }
   }
 };
-IssuerIdentityInspector = _ts_decorate9([
-  Injectable5(),
-  _ts_param7(0, Inject6(PLAN_CATALOG_SETTINGS_TOKEN)),
-  _ts_param7(1, Inject6(SETTINGS_SOURCE_TOKEN)),
-  _ts_param7(2, Optional5()),
-  _ts_param7(2, Inject6(APPLIED_SETTINGS_PORT_TOKEN)),
-  _ts_param7(3, Optional5()),
-  _ts_param7(3, Inject6(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN)),
-  _ts_param7(4, Optional5()),
-  _ts_param7(4, Inject6(RLS_BYPASS_PORT_TOKEN)),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+IssuerIdentityInspector = _ts_decorate14([
+  Injectable6(),
+  _ts_param10(0, Inject9(PLAN_CATALOG_SETTINGS_TOKEN)),
+  _ts_param10(1, Inject9(SETTINGS_SOURCE_TOKEN)),
+  _ts_param10(2, Optional5()),
+  _ts_param10(2, Inject9(APPLIED_SETTINGS_PORT_TOKEN)),
+  _ts_param10(3, Optional5()),
+  _ts_param10(3, Inject9(SUBSCRIPTION_CONTRACT_REPOSITORY_TOKEN)),
+  _ts_param10(4, Optional5()),
+  _ts_param10(4, Inject9(RLS_BYPASS_PORT_TOKEN)),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
     typeof PlanCatalogSettings === "undefined" ? Object : PlanCatalogSettings,
     String,
     Object,
@@ -1282,10 +1788,10 @@ var IssuerIdentityCheck = class {
     this.inspector.report(verdict);
   }
 };
-IssuerIdentityCheck = _ts_decorate9([
-  Injectable5(),
-  _ts_metadata7("design:type", Function),
-  _ts_metadata7("design:paramtypes", [
+IssuerIdentityCheck = _ts_decorate14([
+  Injectable6(),
+  _ts_metadata11("design:type", Function),
+  _ts_metadata11("design:paramtypes", [
     typeof IssuerIdentityInspector === "undefined" ? Object : IssuerIdentityInspector
   ])
 ], IssuerIdentityCheck);
@@ -1511,6 +2017,12 @@ var RULE_SPECS = [
     assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.adminStats)?.auditStatsPort ?? bundle(c)?.core.auditStats), "assert"),
     message: "adminStats is enabled, but no auditStatsPort is available. Set `adminStats.auditStatsPort` or use a bundle providing `persistence.core.auditStats`."
   },
+  {
+    id: "maintenance.requires-windows-port",
+    when: /* @__PURE__ */ __name((c) => Boolean(c.options.maintenance), "when"),
+    assert: /* @__PURE__ */ __name((c) => Boolean(optionsOf(c.options.maintenance)?.windows ?? bundle(c)?.core.maintenanceWindows), "assert"),
+    message: "maintenance is enabled, but there is nowhere to keep the windows. Set `maintenance.windows` or use a bundle providing `persistence.core.maintenanceWindows` \u2014 both shipped adapters do."
+  },
   {
     id: "subscription-contract.requires-repository",
     when: /* @__PURE__ */ __name((c) => Boolean(c.options.subscriptionContract), "when"),
@@ -1705,18 +2217,23 @@ function optionsOf2(slot) {
 __name(optionsOf2, "optionsOf");
 
 // src/platform/compose/admin-resources.ts
-function composeAdminResources({ options, persistence }) {
+function composeAdminResources({ options, persistence, shared }) {
   if (!options.adminResources) return [];
   const config = optionsOf2(options.adminResources);
+  shared.adminResourcesModule = AdminResourcesModule.forRoot({
+    resources: config.resources ?? persistence?.adminResources?.resources,
+    guards: adminResourceGuards(options),
+    imports: config.imports ?? options.imports
+  });
   return [
-    AdminResourcesModule.forRoot({
-      resources: config.resources ?? persistence?.adminResources?.resources,
-      guards: config.guards ?? operatorGuards(options),
-      imports: config.imports ?? options.imports
-    })
+    shared.adminResourcesModule
   ];
 }
 __name(composeAdminResources, "composeAdminResources");
+function adminResourceGuards(options) {
+  return optionsOf2(options.adminResources).guards ?? operatorGuards(options);
+}
+__name(adminResourceGuards, "adminResourceGuards");
 
 // src/platform/compose/catalog.ts
 function composeCatalog({ options, persistence }) {
@@ -1781,6 +2298,36 @@ function composeEntitlement({ options, adapters, persistence, requiresFullEntitl
 }
 __name(composeEntitlement, "composeEntitlement");
 
+// src/platform/compose/maintenance.ts
+import { APP_GUARD } from "@nestjs/core";
+function composeMaintenance({ options, persistence }) {
+  if (!options.maintenance) return [];
+  const config = optionsOf2(options.maintenance);
+  return [
+    MaintenanceModule.forRoot({
+      // `maintenance.requires-windows-port` has refused a configuration
+      // that reaches here without one.
+      windows: config.windows ?? persistence?.core.maintenanceWindows,
+      notifications: config.notifications,
+      controller: {
+        guards: operatorGuards(options)
+      },
+      includeAdminController: config.includeAdminController,
+      imports: options.imports
+    })
+  ];
+}
+__name(composeMaintenance, "composeMaintenance");
+function maintenanceGuardProviders({ options }) {
+  return options.maintenance ? [
+    {
+      provide: APP_GUARD,
+      useExisting: MaintenanceGuard
+    }
+  ] : [];
+}
+__name(maintenanceGuardProviders, "maintenanceGuardProviders");
+
 // src/platform/compose/optional-modules.ts
 function composeSetup({ options, persistence }) {
   if (!options.setup) return [];
@@ -1833,7 +2380,7 @@ function composeCheckoutOffer({ options, adapters, persistence }) {
   ];
 }
 __name(composeCheckoutOffer, "composeCheckoutOffer");
-function composeSubscriptionContract({ options, persistence }) {
+function composeSubscriptionContract({ options, adapters, persistence }) {
   if (!options.subscriptionContract) return [];
   const config = optionsOf2(options.subscriptionContract);
   return [
@@ -1841,6 +2388,7 @@ function composeSubscriptionContract({ options, persistence }) {
       ...config,
       subscriptionContractRepository: config.subscriptionContractRepository ?? persistence?.entitlement?.subscriptionContractRepository,
       subscriberRepository: config.subscriberRepository ?? persistence?.entitlement?.subscriberRepository,
+      transactionRunner: config.transactionRunner ?? adapters.transactionRunner,
       imports: config.imports ?? options.imports
     })
   ];
@@ -1905,6 +2453,29 @@ function composePromoCodes({ options, adapters, persistence }) {
 }
 __name(composePromoCodes, "composePromoCodes");
 
+// src/platform/compose/subscriber-account.ts
+function servesSubscriberAccounts(options) {
+  return Boolean(options.adminResources && optionsOf2(options.tenantBilling).chargeJournal);
+}
+__name(servesSubscriberAccounts, "servesSubscriberAccounts");
+function composeSubscriberAccount(ctx) {
+  const { adminResourcesModule, tenantBillingModule } = ctx.shared;
+  if (!servesSubscriberAccounts(ctx.options) || !adminResourcesModule || !tenantBillingModule) {
+    return [];
+  }
+  return [
+    SubscriberAccountModule.forRoot({
+      guards: adminResourceGuards(ctx.options),
+      imports: [
+        adminResourcesModule,
+        tenantBillingModule,
+        ...optionsOf2(ctx.options.adminResources).imports ?? ctx.options.imports ?? []
+      ]
+    })
+  ];
+}
+__name(composeSubscriberAccount, "composeSubscriberAccount");
+
 // src/platform/compose/tenant-bindings.ts
 function normalizeTenantAuthGuards(guards) {
   if (!Array.isArray(guards)) return guards;
@@ -1934,29 +2505,37 @@ function composeTenantBilling(ctx) {
   ctx.shared.quotaProvidersHostedByTenantBilling = quotaProviders.length > 0;
   ctx.shared.authGuards = normalizeTenantAuthGuards(authGuards);
   ctx.shared.subscriptionUsagePort = subscriptionUsagePort ?? tenantSlice?.subscriptionUsagePort;
+  ctx.shared.tenantBillingModule = TenantBillingModule.forRoot({
+    ...tenantOptions,
+    authGuards: ctx.shared.authGuards,
+    // The same adapter `SubscriptionBundleModule` gets. That module
+    // exports the token, but it is a sibling import here rather than an
+    // ancestor, so its exports never reach this module's providers —
+    // and the plan-change rule that reads bookings would resolve to
+    // "none" and allow the move it exists to refuse.
+    subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
+    subscriptionUsagePort: ctx.shared.subscriptionUsagePort,
+    usageSnapshotPort: usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(quotaProviders),
+    subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
+    // The platform's runner, unless the application names its own: a
+    // successor contract and the end of the one it replaces are written
+    // on one transaction.
+    contractFreeze: tenantOptions.contractFreeze && {
+      transactionRunner: ctx.adapters.transactionRunner,
+      ...tenantOptions.contractFreeze
+    },
+    imports: tenantImports ?? ctx.options.imports,
+    extraProviders: [
+      ...quotaProviders,
+      ...extraProviders ?? []
+    ],
+    extraExports: [
+      ...quotaProviders,
+      ...extraExports ?? []
+    ]
+  });
   return [
-    TenantBillingModule.forRoot({
-      ...tenantOptions,
-      authGuards: ctx.shared.authGuards,
-      // The same adapter `SubscriptionBundleModule` gets. That module
-      // exports the token, but it is a sibling import here rather than an
-      // ancestor, so its exports never reach this module's providers —
-      // and the plan-change rule that reads bookings would resolve to
-      // "none" and allow the move it exists to refuse.
-      subscriptionBundleRepository: ctx.persistence?.entitlement?.subscriptionBundleRepository,
-      subscriptionUsagePort: ctx.shared.subscriptionUsagePort,
-      usageSnapshotPort: usageSnapshotPort ?? tenantSlice?.usageSnapshotPort ?? quotaUsageSnapshotProvider(quotaProviders),
-      subscriptionWritePort: subscriptionWritePort ?? tenantSlice?.subscriptionWritePort,
-      imports: tenantImports ?? ctx.options.imports,
-      extraProviders: [
-        ...quotaProviders,
-        ...extraProviders ?? []
-      ],
-      extraExports: [
-        ...quotaProviders,
-        ...extraExports ?? []
-      ]
-    })
+    ctx.shared.tenantBillingModule
   ];
 }
 __name(composeTenantBilling, "composeTenantBilling");
@@ -1998,7 +2577,10 @@ var FEATURE_COMPOSERS = [
   composeSetup,
   composeAdminStats,
   composeCheckoutOffer,
-  composeSubscriptionContract
+  composeSubscriptionContract,
+  // After the admin resources and tenant billing: it imports both.
+  composeSubscriberAccount,
+  composeMaintenance
 ];
 function composeFeatures(ctx) {
   return FEATURE_COMPOSERS.flatMap((compose) => compose(ctx));
@@ -2056,6 +2638,10 @@ function optionalExports({ options, requiresFullEntitlement: requiresFullEntitle
     [
       options.subscriptionContract,
       SubscriptionContractModule
+    ],
+    [
+      options.maintenance,
+      MaintenanceModule
     ]
   ];
 }
@@ -2088,24 +2674,24 @@ var StaticPlanResolver = class {
 };
 
 // src/platform/static-entitlement.service.ts
-import { Inject as Inject7, Injectable as Injectable6 } from "@nestjs/common";
-function _ts_decorate10(decorators, target, key, desc) {
+import { Inject as Inject10, Injectable as Injectable7 } from "@nestjs/common";
+function _ts_decorate15(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate10, "_ts_decorate");
-function _ts_metadata8(k, v) {
+__name(_ts_decorate15, "_ts_decorate");
+function _ts_metadata12(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata8, "_ts_metadata");
-function _ts_param8(paramIndex, decorator) {
+__name(_ts_metadata12, "_ts_metadata");
+function _ts_param11(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param8, "_ts_param");
+__name(_ts_param11, "_ts_param");
 var StaticEntitlementService = class {
   static {
     __name(this, "StaticEntitlementService");
@@ -2155,30 +2741,30 @@ var StaticEntitlementService = class {
     return value === void 0 ? null : value;
   }
 };
-StaticEntitlementService = _ts_decorate10([
-  Injectable6(),
-  _ts_param8(0, Inject7(PLAN_CATALOG_SOURCE_TOKEN)),
-  _ts_param8(1, Inject7(PLAN_RESOLVER_PORT_TOKEN)),
-  _ts_metadata8("design:type", Function),
-  _ts_metadata8("design:paramtypes", [
+StaticEntitlementService = _ts_decorate15([
+  Injectable7(),
+  _ts_param11(0, Inject10(PLAN_CATALOG_SOURCE_TOKEN)),
+  _ts_param11(1, Inject10(PLAN_RESOLVER_PORT_TOKEN)),
+  _ts_metadata12("design:type", Function),
+  _ts_metadata12("design:paramtypes", [
     typeof PlanCatalogSource === "undefined" ? Object : PlanCatalogSource,
     typeof PlanResolverPort === "undefined" ? Object : PlanResolverPort
   ])
 ], StaticEntitlementService);
 
 // src/platform/tenant-manifest.service.ts
-import { Injectable as Injectable7 } from "@nestjs/common";
-function _ts_decorate11(decorators, target, key, desc) {
+import { Injectable as Injectable8 } from "@nestjs/common";
+function _ts_decorate16(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate11, "_ts_decorate");
-function _ts_metadata9(k, v) {
+__name(_ts_decorate16, "_ts_decorate");
+function _ts_metadata13(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata9, "_ts_metadata");
+__name(_ts_metadata13, "_ts_metadata");
 var TenantManifestService = class {
   static {
     __name(this, "TenantManifestService");
@@ -2224,10 +2810,10 @@ var TenantManifestService = class {
     };
   }
 };
-TenantManifestService = _ts_decorate11([
-  Injectable7(),
-  _ts_metadata9("design:type", Function),
-  _ts_metadata9("design:paramtypes", [
+TenantManifestService = _ts_decorate16([
+  Injectable8(),
+  _ts_metadata13("design:type", Function),
+  _ts_metadata13("design:paramtypes", [
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService
   ])
 ], TenantManifestService);
@@ -2241,24 +2827,24 @@ function isVisible(item, features) {
 __name(isVisible, "isVisible");
 
 // src/platform/tenant-manifest.controller.ts
-import { Controller as Controller3, Get as Get3, Inject as Inject8, Req as Req2, UseGuards as UseGuards2 } from "@nestjs/common";
-function _ts_decorate12(decorators, target, key, desc) {
+import { Controller as Controller5, Get as Get5, Inject as Inject11, Req as Req3, UseGuards as UseGuards3 } from "@nestjs/common";
+function _ts_decorate17(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate12, "_ts_decorate");
-function _ts_metadata10(k, v) {
+__name(_ts_decorate17, "_ts_decorate");
+function _ts_metadata14(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata10, "_ts_metadata");
-function _ts_param9(paramIndex, decorator) {
+__name(_ts_metadata14, "_ts_metadata");
+function _ts_param12(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param9, "_ts_param");
+__name(_ts_param12, "_ts_param");
 function buildTenantManifestController(options) {
   const path = options.path ?? "tenant/manifest";
   let GeneratedTenantManifestController = class GeneratedTenantManifestController {
@@ -2277,21 +2863,21 @@ function buildTenantManifestController(options) {
       return this.svc.getManifest(tenantId);
     }
   };
-  _ts_decorate12([
-    Get3(),
-    _ts_param9(0, Req2()),
-    _ts_metadata10("design:type", Function),
-    _ts_metadata10("design:paramtypes", [
+  _ts_decorate17([
+    Get5(),
+    _ts_param12(0, Req3()),
+    _ts_metadata14("design:type", Function),
+    _ts_metadata14("design:paramtypes", [
       typeof RequestWithUser === "undefined" ? Object : RequestWithUser
     ]),
-    _ts_metadata10("design:returntype", Promise)
+    _ts_metadata14("design:returntype", Promise)
   ], GeneratedTenantManifestController.prototype, "get", null);
-  GeneratedTenantManifestController = _ts_decorate12([
-    Controller3(path),
-    UseGuards2(...options.guards),
-    _ts_param9(0, Inject8(TenantManifestService)),
-    _ts_metadata10("design:type", Function),
-    _ts_metadata10("design:paramtypes", [
+  GeneratedTenantManifestController = _ts_decorate17([
+    Controller5(path),
+    UseGuards3(...options.guards),
+    _ts_param12(0, Inject11(TenantManifestService)),
+    _ts_metadata14("design:type", Function),
+    _ts_metadata14("design:paramtypes", [
       typeof TenantManifestService === "undefined" ? Object : TenantManifestService
     ])
   ], GeneratedTenantManifestController);
@@ -2300,27 +2886,27 @@ function buildTenantManifestController(options) {
 __name(buildTenantManifestController, "buildTenantManifestController");
 
 // src/platform/enforce-quota.interceptor.ts
-import { Inject as Inject9, Injectable as Injectable8, Optional as Optional6 } from "@nestjs/common";
-import { Reflector } from "@nestjs/core";
+import { Inject as Inject12, Injectable as Injectable9, Optional as Optional6 } from "@nestjs/common";
+import { Reflector as Reflector2 } from "@nestjs/core";
 import { from } from "rxjs";
 import { switchMap } from "rxjs/operators";
-function _ts_decorate13(decorators, target, key, desc) {
+function _ts_decorate18(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate13, "_ts_decorate");
-function _ts_metadata11(k, v) {
+__name(_ts_decorate18, "_ts_decorate");
+function _ts_metadata15(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata11, "_ts_metadata");
-function _ts_param10(paramIndex, decorator) {
+__name(_ts_metadata15, "_ts_metadata");
+function _ts_param13(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param10, "_ts_param");
+__name(_ts_param13, "_ts_param");
 var QUOTA_PROVIDERS_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/QuotaProviders");
 var EnforceQuotaInterceptor = class {
   static {
@@ -2363,41 +2949,41 @@ var EnforceQuotaInterceptor = class {
     }
   }
 };
-EnforceQuotaInterceptor = _ts_decorate13([
-  Injectable8(),
-  _ts_param10(0, Inject9(Reflector)),
-  _ts_param10(1, Inject9(StaticEntitlementService)),
-  _ts_param10(2, Optional6()),
-  _ts_param10(2, Inject9(QUOTA_PROVIDERS_TOKEN)),
-  _ts_metadata11("design:type", Function),
-  _ts_metadata11("design:paramtypes", [
-    typeof Reflector === "undefined" ? Object : Reflector,
+EnforceQuotaInterceptor = _ts_decorate18([
+  Injectable9(),
+  _ts_param13(0, Inject12(Reflector2)),
+  _ts_param13(1, Inject12(StaticEntitlementService)),
+  _ts_param13(2, Optional6()),
+  _ts_param13(2, Inject12(QUOTA_PROVIDERS_TOKEN)),
+  _ts_metadata15("design:type", Function),
+  _ts_metadata15("design:paramtypes", [
+    typeof Reflector2 === "undefined" ? Object : Reflector2,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
   ])
 ], EnforceQuotaInterceptor);
 
 // src/platform/static-feature.guard.ts
-import { ForbiddenException as ForbiddenException2, Inject as Inject10, Injectable as Injectable9, Optional as Optional7 } from "@nestjs/common";
-import { Reflector as Reflector2 } from "@nestjs/core";
+import { ForbiddenException as ForbiddenException2, Inject as Inject13, Injectable as Injectable10, Optional as Optional7 } from "@nestjs/common";
+import { Reflector as Reflector3 } from "@nestjs/core";
 import { AUTH_ERROR_CODES, FEATURE_NOT_LICENSED } from "@saasicat/core";
-function _ts_decorate14(decorators, target, key, desc) {
+function _ts_decorate19(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate14, "_ts_decorate");
-function _ts_metadata12(k, v) {
+__name(_ts_decorate19, "_ts_decorate");
+function _ts_metadata16(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata12, "_ts_metadata");
-function _ts_param11(paramIndex, decorator) {
+__name(_ts_metadata16, "_ts_metadata");
+function _ts_param14(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param11, "_ts_param");
+__name(_ts_param14, "_ts_param");
 var STATIC_FEATURE_GUARD_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StaticFeatureGuardConfig");
 var StaticFeatureGuard = class {
   static {
@@ -2451,15 +3037,15 @@ var StaticFeatureGuard = class {
     return true;
   }
 };
-StaticFeatureGuard = _ts_decorate14([
-  Injectable9(),
-  _ts_param11(0, Inject10(Reflector2)),
-  _ts_param11(1, Inject10(StaticEntitlementService)),
-  _ts_param11(2, Optional7()),
-  _ts_param11(2, Inject10(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
-  _ts_metadata12("design:type", Function),
-  _ts_metadata12("design:paramtypes", [
-    typeof Reflector2 === "undefined" ? Object : Reflector2,
+StaticFeatureGuard = _ts_decorate19([
+  Injectable10(),
+  _ts_param14(0, Inject13(Reflector3)),
+  _ts_param14(1, Inject13(StaticEntitlementService)),
+  _ts_param14(2, Optional7()),
+  _ts_param14(2, Inject13(STATIC_FEATURE_GUARD_CONFIG_TOKEN)),
+  _ts_metadata16("design:type", Function),
+  _ts_metadata16("design:paramtypes", [
+    typeof Reflector3 === "undefined" ? Object : Reflector3,
     typeof StaticEntitlementService === "undefined" ? Object : StaticEntitlementService,
     Object
   ])
@@ -2494,16 +3080,17 @@ var SubscriptionPlanResolver = class {
 };
 
 // src/platform/saasicat.module.ts
-import { Logger as Logger4, Module as Module3 } from "@nestjs/common";
+import { Logger as Logger4, Module as Module4 } from "@nestjs/common";
 import { DiscoveryModule as NestDiscoveryModule } from "@nestjs/core";
 
 // src/platform/compose/base.ts
 import { planCatalogSettingsOf } from "@saasicat/core";
 
 // src/platform/compose/manifest.ts
+import { SUBSCRIBER_ACCOUNT_CAPABILITY } from "@saasicat/core";
 var PLATFORM_SUBSCRIPTION_REPOSITORY_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/PlatformSubscriptionRepository");
 var STANDARD_MANIFEST_REGISTRATION_TOKEN = /* @__PURE__ */ Symbol.for("saasicat/nest/StandardManifestRegistration");
-function buildStandardManifestContribution(catalog, adminResources, promoCodes) {
+function buildStandardManifestContribution(catalog, adminResources, promoCodes, subscriberAccounts) {
   const capabilities = {
     "discovery.read": true,
     "settings.read": true
@@ -2536,6 +3123,7 @@ function buildStandardManifestContribution(catalog, adminResources, promoCodes)
       }
     };
   }
+  if (subscriberAccounts) capabilities[SUBSCRIBER_ACCOUNT_CAPABILITY] = true;
   if (promoCodes) {
     Object.assign(capabilities, {
       "promoCodes.read": true,
@@ -2697,7 +3285,7 @@ function composeTenantManifest(ctx) {
 __name(composeTenantManifest, "composeTenantManifest");
 
 // src/platform/compose/enforcement-runtime.ts
-import { APP_GUARD, APP_INTERCEPTOR } from "@nestjs/core";
+import { APP_GUARD as APP_GUARD2, APP_INTERCEPTOR } from "@nestjs/core";
 function resolvePlanResolution(ctx) {
   const explicit = !!ctx.adapters.planResolver;
   const viaSubscriptions = Boolean(ctx.options.tenantBilling && ctx.adapters.subscriptionRepository);
@@ -2733,7 +3321,7 @@ function composeEnforcementRuntime(ctx, resolution) {
     },
     ...options.globalFeatureGuard === false ? [] : [
       {
-        provide: APP_GUARD,
+        provide: APP_GUARD2,
         useExisting: StaticFeatureGuard
       }
     ],
@@ -2786,13 +3374,13 @@ function planResolverProvider(ctx, resolution) {
 __name(planResolverProvider, "planResolverProvider");
 
 // src/platform/saasicat.module.ts
-function _ts_decorate15(decorators, target, key, desc) {
+function _ts_decorate20(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate15, "_ts_decorate");
+__name(_ts_decorate20, "_ts_decorate");
 var PLATFORM_LOGGER = new Logger4("SaaSiCat");
 function enforcementChainState(state) {
   return {
@@ -2862,10 +3450,12 @@ var SaaSiCatModule = class _SaaSiCatModule {
       }
     };
     imports.push(...composeFeatures(composition));
-    const lightweightProviders = [];
+    const lightweightProviders = [
+      ...maintenanceGuardProviders(composition)
+    ];
     const lightweightExports = [];
     if (options.autoManifest !== false) {
-      const contribution = buildStandardManifestContribution(catalogConfig, adminResourcesConfig, promoCodesConfig);
+      const contribution = buildStandardManifestContribution(catalogConfig, adminResourcesConfig, promoCodesConfig, servesSubscriberAccounts(options));
       lightweightProviders.push({
         provide: STANDARD_MANIFEST_REGISTRATION_TOKEN,
         useFactory: /* @__PURE__ */ __name((manifest) => {
@@ -2912,8 +3502,8 @@ var SaaSiCatModule = class _SaaSiCatModule {
     };
   }
 };
-SaaSiCatModule = _ts_decorate15([
-  Module3({})
+SaaSiCatModule = _ts_decorate20([
+  Module4({})
 ], SaaSiCatModule);
 
 export {
@@ -2931,6 +3521,10 @@ export {
   AppliedSettingsRecorder,
   buildSettingsController,
   SettingsModule,
+  buildMaintenanceAdminController,
+  MaintenanceStatusController,
+  MaintenanceGuard,
+  MaintenanceModule,
   ENFORCEMENT_CHAIN_STATE_TOKEN,
   EnforcementChainCheck,
   IssuerIdentityInspector,