@fleetless/contracts 6.0.0 → 6.1.0-next.2

package/artifacts/schema/plan-overrides.schema.json

@@ -0,0 +1,111 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "seats": {
+      "description": "Replaces the plan's `seats`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "robots": {
+      "description": "Replaces the plan's `robots`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "apps": {
+      "description": "Replaces the plan's `apps`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "app_users": {
+      "description": "Replaces the plan's `app_users`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "live_video_ms_per_month": {
+      "description": "Replaces the plan's `live_video_ms_per_month`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "asset_bytes_per_robot": {
+      "description": "Replaces the plan's `asset_bytes_per_robot`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "history_days": {
+      "description": "Replaces the plan's `history_days`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "audit_days": {
+      "description": "Replaces the plan's `audit_days`. `null` clears the override.",
+      "anyOf": [
+        {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "maximum": 9007199254740991
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "additionalProperties": false
+}

package/artifacts/schema/plan-prices.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "eur_month": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Per month in euro cents, excluding VAT."
+    },
+    "usd_month": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Per month in US dollar cents, excluding VAT: the euro price × 1.15, rounded up to a whole dollar."
+    },
+    "eur_year": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Per year in euro cents, excluding VAT: twelve months less 15 %."
+    },
+    "usd_year": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 9007199254740991,
+      "description": "Per year in US dollar cents, excluding VAT: the yearly euro price × 1.15, rounded up to a whole dollar."
+    }
+  },
+  "required": [
+    "eur_month",
+    "usd_month",
+    "eur_year",
+    "usd_year"
+  ],
+  "additionalProperties": false
+}

package/artifacts/schema/plan-required-details.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "type": "object",
+  "properties": {
+    "feature": {
+      "type": "string",
+      "enum": [
+        "app_mcp",
+        "two_factor",
+        "require_two_factor",
+        "app_oidc",
+        "hosted_logo",
+        "audit_export",
+        "addons"
+      ],
+      "description": "The feature the action needs."
+    },
+    "plan": {
+      "type": "string",
+      "enum": [
+        "basic",
+        "plus",
+        "pro",
+        "enterprise"
+      ],
+      "description": "The org's current plan."
+    },
+    "required_plan": {
+      "type": "string",
+      "enum": [
+        "basic",
+        "plus",
+        "pro",
+        "enterprise"
+      ],
+      "description": "The cheapest plan that has the feature."
+    }
+  },
+  "required": [
+    "feature",
+    "plan",
+    "required_plan"
+  ],
+  "additionalProperties": false
+}

package/dist/audit.d.ts

@@ -27,6 +27,13 @@ import { z } from 'zod';
  *
  * `developer` is a Fleetless user. It kept its name through both redesigns
  * because it was always right: the person who configures robots.
+ *
+ * `fleetless` (2026-10-02, fleetless/fleetless#103) records what the
+ * platform itself did, with no member behind it: the admin plan route, a
+ * plan change landing at its `effective_at`, a lock taking effect, and the
+ * beta-to-plan switch. Its `id` is the nil uuid and its `label` is always
+ * `Fleetless`, because there is no row to look up — the actor and the label
+ * are the same constant for every one of these events.
  */
 export declare const auditActor: z.ZodObject<{
     kind: z.ZodEnum<{
@@ -35,6 +42,7 @@ export declare const auditActor: z.ZodObject<{
         bridge: "bridge";
         end_user: "end_user";
         app_user: "app_user";
+        fleetless: "fleetless";
     }>;
     id: z.ZodUUID;
     label: z.ZodString;
@@ -52,6 +60,7 @@ export declare const auditEvent: z.ZodObject<{
             bridge: "bridge";
             end_user: "end_user";
             app_user: "app_user";
+            fleetless: "fleetless";
         }>;
         id: z.ZodUUID;
         label: z.ZodString;
@@ -90,6 +99,7 @@ export declare const auditListResponse: z.ZodObject<{
                 bridge: "bridge";
                 end_user: "end_user";
                 app_user: "app_user";
+                fleetless: "fleetless";
             }>;
             id: z.ZodUUID;
             label: z.ZodString;

package/dist/audit.js

@@ -28,9 +28,16 @@ import { wireSeqCursor, wireTimestampMs } from './common.js';
  *
  * `developer` is a Fleetless user. It kept its name through both redesigns
  * because it was always right: the person who configures robots.
+ *
+ * `fleetless` (2026-10-02, fleetless/fleetless#103) records what the
+ * platform itself did, with no member behind it: the admin plan route, a
+ * plan change landing at its `effective_at`, a lock taking effect, and the
+ * beta-to-plan switch. Its `id` is the nil uuid and its `label` is always
+ * `Fleetless`, because there is no row to look up — the actor and the label
+ * are the same constant for every one of these events.
  */
 export const auditActor = z.object({
-    kind: z.enum(['developer', 'end_user', 'app_user', 'server_key', 'bridge']),
+    kind: z.enum(['developer', 'end_user', 'app_user', 'server_key', 'bridge', 'fleetless']),
     id: z.uuid(),
     label: z.string().min(1).max(200),
 });

package/dist/errors.d.ts

@@ -72,10 +72,147 @@ export declare const invalidCodeDetails: z.ZodObject<{
     attempts_left: z.ZodNumber;
 }, z.core.$strip>;
 export type InvalidCodeDetails = z.infer<typeof invalidCodeDetails>;
+/**
+ * The `details` of a `409 plan_limit` refusal (2026-10-02, fleetless/fleetless#103).
+ * `history_days` and `audit_days` are excluded from `limit` — they size a
+ * retention window, not a quota an action can exceed, so nothing ever
+ * refuses against them. `max` is the effective ceiling the refusal was
+ * checked against: the plan's own number, or — for `asset_bytes_per_robot`
+ * — the org's whole pool, `robots × asset_bytes_per_robot`. `plan` is the
+ * plan that refused, which during a pending downgrade is the **target**
+ * plan, not the one still in effect. `lifted_by` is `nextPlanRaising` for
+ * `plan` and `limit`, paired with the add-on that raises the same limit when
+ * the org's plan has `planFeature.addons` — never both at once, since a plan
+ * that cannot buy add-ons has nothing in that field.
+ */
+export declare const planLimitDetails: z.ZodObject<{
+    limit: z.ZodEnum<{
+        apps: "apps";
+        robots: "robots";
+        seats: "seats";
+        app_users: "app_users";
+        live_video_ms_per_month: "live_video_ms_per_month";
+        asset_bytes_per_robot: "asset_bytes_per_robot";
+    }>;
+    used: z.ZodNumber;
+    max: z.ZodNumber;
+    plan: z.ZodEnum<{
+        basic: "basic";
+        plus: "plus";
+        pro: "pro";
+        enterprise: "enterprise";
+    }>;
+    lifted_by: z.ZodObject<{
+        plan: z.ZodNullable<z.ZodEnum<{
+            basic: "basic";
+            plus: "plus";
+            pro: "pro";
+            enterprise: "enterprise";
+        }>>;
+        addon: z.ZodNullable<z.ZodEnum<{
+            apps: "apps";
+            robots: "robots";
+            seats: "seats";
+            app_user_packs: "app_user_packs";
+            live_video_packs: "live_video_packs";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PlanLimitDetails = z.infer<typeof planLimitDetails>;
+/**
+ * `planLimitDetails` plus the three numbers `assetStoreRefusedDetails`
+ * already carries, for the one refusal that answers both at once: a robot
+ * asset sync refused because the **org's** pool (not a per-robot ceiling,
+ * which no longer exists) has no room left. `store_bytes` and `used_bytes`
+ * are the org's totals, the same pool `max` and `used` above describe; they
+ * ride twice because the bridge reads these three specific keys off any
+ * `409` and a consumer parsing only `assetStoreRefusedDetails` must keep
+ * working unchanged.
+ *
+ * **The two carried-over fields are re-described, not re-typed.** Plain
+ * `.extend(assetStoreRefusedDetails.shape)` would publish that schema's own
+ * per-robot wording (`'The robot\'s store, in bytes.'`) on a refusal that is
+ * never about one robot — so `store_bytes` and `used_bytes` get their own
+ * `.meta()` here, org-wide, while keeping the exact same underlying type
+ * (`.meta()` clones a schema and only replaces its registered metadata, so
+ * the bridge's own parser sees the same shape it always did). `size_bytes`
+ * is unchanged: the refused upload's size means the same thing in both
+ * contexts.
+ */
+export declare const assetPlanLimitDetails: z.ZodObject<{
+    limit: z.ZodEnum<{
+        apps: "apps";
+        robots: "robots";
+        seats: "seats";
+        app_users: "app_users";
+        live_video_ms_per_month: "live_video_ms_per_month";
+        asset_bytes_per_robot: "asset_bytes_per_robot";
+    }>;
+    used: z.ZodNumber;
+    max: z.ZodNumber;
+    plan: z.ZodEnum<{
+        basic: "basic";
+        plus: "plus";
+        pro: "pro";
+        enterprise: "enterprise";
+    }>;
+    lifted_by: z.ZodObject<{
+        plan: z.ZodNullable<z.ZodEnum<{
+            basic: "basic";
+            plus: "plus";
+            pro: "pro";
+            enterprise: "enterprise";
+        }>>;
+        addon: z.ZodNullable<z.ZodEnum<{
+            apps: "apps";
+            robots: "robots";
+            seats: "seats";
+            app_user_packs: "app_user_packs";
+            live_video_packs: "live_video_packs";
+        }>>;
+    }, z.core.$strip>;
+    store_bytes: z.ZodNumber;
+    used_bytes: z.ZodNumber;
+    size_bytes: z.ZodNumber;
+}, z.core.$strip>;
+export type AssetPlanLimitDetails = z.infer<typeof assetPlanLimitDetails>;
+/** The `details` of a `403 plan_required` refusal: the feature, the org's own plan, and the cheapest plan that has it (`requiredPlanFor`). */
+export declare const planRequiredDetails: z.ZodObject<{
+    feature: z.ZodEnum<{
+        require_two_factor: "require_two_factor";
+        two_factor: "two_factor";
+        app_mcp: "app_mcp";
+        app_oidc: "app_oidc";
+        hosted_logo: "hosted_logo";
+        audit_export: "audit_export";
+        addons: "addons";
+    }>;
+    plan: z.ZodEnum<{
+        basic: "basic";
+        plus: "plus";
+        pro: "pro";
+        enterprise: "enterprise";
+    }>;
+    required_plan: z.ZodEnum<{
+        basic: "basic";
+        plus: "plus";
+        pro: "pro";
+        enterprise: "enterprise";
+    }>;
+}, z.core.$strip>;
+export type PlanRequiredDetails = z.infer<typeof planRequiredDetails>;
+/** The `details` of a `403 org_locked` refusal: why the org is locked, matching `orgLock.reason`. */
+export declare const orgLockedDetails: z.ZodObject<{
+    reason: z.ZodEnum<{
+        migration: "migration";
+        payment: "payment";
+    }>;
+}, z.core.$strip>;
+export type OrgLockedDetails = z.infer<typeof orgLockedDetails>;
 /**
  * The codes in use today. The wire deliberately allows any string — this
  * list is the shared vocabulary, not a closed set, so a new refusal never
  * needs a contracts release before it can be reported honestly.
  */
-export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed"];
+export declare const ERROR_CODES: readonly ["not_found", "validation_error", "bad_request", "unknown_datapoint", "invalid_token", "protocol_mismatch", "bridge_too_old", "invalid_frame", "duplicate_slug", "reserved_slug", "unknown_slug", "unknown_field_path", "unknown_type", "unknown_topic", "invalid_rate", "invalid_range", "config_conflict", "no_data", "robot_offline", "bridge_timeout", "unauthorized", "forbidden", "invalid_credentials", "token_expired", "token_revoked", "email_taken", "identifier_taken", "weak_password", "account_blocked", "busy", "parameter_invalid", "cancel_rejected", "job_lost", "job_unknown_to_bridge", "action_server_lost", "action_failed", "goal_rejected", "goal_send_failed", "result_failed", "goal_uncontrollable", "bridge_disconnected", "config_changed", "publisher_busy", "unknown_command", "not_subscribable", "camera_offline", "no_snapshot_yet", "live_unavailable", "wrong_kind", "not_recorded", "not_aggregatable", "quota_exceeded", "credential_in_use", "goal_timeout", "robot_in_use", "robot_deletion_partial", "job_queue_full", "invalid_uuid", "rate_limited", "tier_required", "token_spent", "service_timeout", "asset_missing", "dynamic_registration_disabled", "client_limit_reached", "idp_unavailable", "mcp_disabled", "tool_not_available", "capability_required", "last_owner", "role_name_taken", "role_in_use", "last_role", "target_state_conflict", "signup_closed", "draft_not_a_document", "internal_error", "not_cancellable", "unsupported_media_type", "wrong_browser", "invalid_yaml", "unstorable_yaml", "registration_closed", "domain_not_allowed", "email_unverified", "origin_not_allowed", "template_invalid", "provider_disabled", "provider_misconfigured", "invalid_redirect_uri", "interaction_expired", "invalid_code", "method_not_allowed", "plan_limit", "plan_required", "org_locked"];
 export type ErrorCode = (typeof ERROR_CODES)[number];

package/dist/errors.js

@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
+import { assetStoreRefusedDetails } from './assets.js';
+import { addonKey, planFeature, planId, planLimitKey } from './plans.js';
 import { bridgeCancelResultEntry } from './protocol.js';
 /**
  * The one error shape of the REST and realtime APIs: a stable
@@ -63,6 +65,76 @@ export const invalidCodeDetails = z.object({
         description: 'How many more wrong codes this code or challenge takes before it is spent. `0` means the next attempt answers `410 token_spent`.',
     }),
 });
+/**
+ * The `details` of a `409 plan_limit` refusal (2026-10-02, fleetless/fleetless#103).
+ * `history_days` and `audit_days` are excluded from `limit` — they size a
+ * retention window, not a quota an action can exceed, so nothing ever
+ * refuses against them. `max` is the effective ceiling the refusal was
+ * checked against: the plan's own number, or — for `asset_bytes_per_robot`
+ * — the org's whole pool, `robots × asset_bytes_per_robot`. `plan` is the
+ * plan that refused, which during a pending downgrade is the **target**
+ * plan, not the one still in effect. `lifted_by` is `nextPlanRaising` for
+ * `plan` and `limit`, paired with the add-on that raises the same limit when
+ * the org's plan has `planFeature.addons` — never both at once, since a plan
+ * that cannot buy add-ons has nothing in that field.
+ */
+export const planLimitDetails = z.object({
+    limit: planLimitKey.exclude(['history_days', 'audit_days']).meta({ description: 'The limit the action would exceed.' }),
+    used: z.number().int().nonnegative().meta({ description: 'How much of the limit the org uses now.' }),
+    max: z.number().int().nonnegative().meta({
+        description: 'The limit. For `asset_bytes_per_robot`, the org\'s whole pool: robots × the plan\'s bytes per robot.',
+    }),
+    plan: planId.meta({ description: 'The plan whose limit refused: the target plan while a move to a lower plan is pending.' }),
+    lifted_by: z
+        .object({
+        plan: planId.nullable().meta({ description: 'The cheapest higher plan that raises this limit, or `null` when none does.' }),
+        addon: addonKey.nullable().meta({
+            description: 'The add-on that raises this limit, when the org\'s plan can buy add-ons; otherwise `null`.',
+        }),
+    })
+        .meta({ description: 'What would lift the limit.' }),
+});
+/**
+ * `planLimitDetails` plus the three numbers `assetStoreRefusedDetails`
+ * already carries, for the one refusal that answers both at once: a robot
+ * asset sync refused because the **org's** pool (not a per-robot ceiling,
+ * which no longer exists) has no room left. `store_bytes` and `used_bytes`
+ * are the org's totals, the same pool `max` and `used` above describe; they
+ * ride twice because the bridge reads these three specific keys off any
+ * `409` and a consumer parsing only `assetStoreRefusedDetails` must keep
+ * working unchanged.
+ *
+ * **The two carried-over fields are re-described, not re-typed.** Plain
+ * `.extend(assetStoreRefusedDetails.shape)` would publish that schema's own
+ * per-robot wording (`'The robot\'s store, in bytes.'`) on a refusal that is
+ * never about one robot — so `store_bytes` and `used_bytes` get their own
+ * `.meta()` here, org-wide, while keeping the exact same underlying type
+ * (`.meta()` clones a schema and only replaces its registered metadata, so
+ * the bridge's own parser sees the same shape it always did). `size_bytes`
+ * is unchanged: the refused upload's size means the same thing in both
+ * contexts.
+ */
+export const assetPlanLimitDetails = planLimitDetails.extend({
+    ...assetStoreRefusedDetails.shape,
+    store_bytes: assetStoreRefusedDetails.shape.store_bytes.meta({
+        description: 'The org\'s asset pool, in bytes: `robots × asset_bytes_per_robot`.',
+    }),
+    used_bytes: assetStoreRefusedDetails.shape.used_bytes.meta({
+        description: 'Bytes the org\'s assets occupy, across every robot, before this upload.',
+    }),
+});
+/** The `details` of a `403 plan_required` refusal: the feature, the org's own plan, and the cheapest plan that has it (`requiredPlanFor`). */
+export const planRequiredDetails = z.object({
+    feature: planFeature.meta({ description: 'The feature the action needs.' }),
+    plan: planId.meta({ description: 'The org\'s current plan.' }),
+    required_plan: planId.meta({ description: 'The cheapest plan that has the feature.' }),
+});
+/** The `details` of a `403 org_locked` refusal: why the org is locked, matching `orgLock.reason`. */
+export const orgLockedDetails = z.object({
+    reason: z.enum(['payment', 'migration']).meta({
+        description: '`payment`: a payment is missing. `migration`: the org did not choose what stays when the beta ended.',
+    }),
+});
 /**
  * The codes in use today. The wire deliberately allows any string — this
  * list is the shared vocabulary, not a closed set, so a new refusal never
@@ -891,4 +963,36 @@ export const ERROR_CODES = [
      * is no enumeration oracle.
      */
     'method_not_allowed',
+    // 2026-10-02 — plans (#103).
+    /**
+     * `409`: the action would push the org past one of its plan's limits —
+     * a seat, a robot, an app, an app user, this month's live video, or the
+     * org's asset storage pool (its robots × the plan's bytes per robot). Answered **before anything is written**, so a
+     * refused create or invite never leaves a half-made row behind. `details`
+     * is `planLimitDetails` (or `assetPlanLimitDetails` for an asset-storage
+     * refusal): which limit, how much is used, the ceiling, the plan that
+     * refused, and what would lift it — a higher plan, an add-on, or neither.
+     * The existing `quota_exceeded` protection ceiling is still checked, and
+     * only after this one: it exists to stop runaway consumption, not to tell
+     * a developer what their plan allows.
+     */
+    'plan_limit',
+    /**
+     * `403`: the feature the caller reached for is not on the org's plan — an
+     * app's MCP endpoint, two-factor for a developer, a two-factor requirement
+     * for the org, an app's OIDC federation, a hosted logo, the audit export,
+     * or add-ons themselves. `details` is `planRequiredDetails`:
+     * the feature, the org's own plan, and the cheapest plan that has it, so
+     * the console can offer the upgrade in the same breath as the refusal.
+     */
+    'plan_required',
+    /**
+     * `403`: the org is locked. Every sign-in and every token refresh is
+     * refused, except an owner's, so an owner can still sign in and settle
+     * it; the sign-in pages render this refusal. A bridge's `hello` is
+     * refused with this code as well. Nothing is deleted while an org is
+     * locked. `details` is `orgLockedDetails`, naming why — a missing
+     * payment, or the platform's own move off the beta.
+     */
+    'org_locked',
 ];

package/dist/index.d.ts

@@ -47,9 +47,13 @@ export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMN
 export type { AuditActor, AuditEvent, AuditQuery, AuditListResponse } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
 export type { AlertRowCondition, AlertSeverity, AlertState, DatapointAlertRow, AlertListResponse, OrgFiringAlertsResponse, OrgAlertsQuery, DatapointDisplay, PutDatapointDisplayRequest, } from './alerts.js';
-export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES } from './errors.js';
-export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, InvalidCodeDetails, ErrorCode } from './errors.js';
+export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES, planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, } from './errors.js';
+export type { ApiError, ParameterViolation, ParameterInvalidDetails, CancelRejectedDetails, InvalidCodeDetails, ErrorCode, PlanLimitDetails, AssetPlanLimitDetails, PlanRequiredDetails, OrgLockedDetails, } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
 export type { OauthErrorCode, OauthError, OauthRedirectResponse, OauthCodeTokenRequest, OauthRefreshTokenRequest, OauthTokenRequest, OauthTokenResponse, RedirectUri, OauthAuthorizeQuery, DynamicClientRegistrationRequest, DynamicClientRegistrationResponse, AuthorizationServerMetadata, ProtectedResourceMetadata, } from './oauth.js';
 export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';
 export type { RouteEntry, RouteParam, RouteAudience, RouteAuth, RouteSection, RouteMethod, RouteTransport, } from './routes.js';
+export { planId, PLAN_ORDER, planLimitKey, planLimits, planFeature, planFeatures, planPrices, planSupport, planCatalogueEntry, addonKey, addonCatalogueEntry, usdCentsFromEurCents, yearlyEurCents, pricesFromEurMonth, PLANS, ADDONS, requiredPlanFor, nextPlanRaising, } from './plans.js';
+export type { PlanId, PlanLimitKey, PlanLimits, PlanFeature, PlanFeatures, PlanPrices, PlanSupport, PlanCatalogueEntry, AddonKey, AddonCatalogueEntry, } from './plans.js';
+export { planCurrency, orgAddons, orgPlanUsage, planChangeKeep, planChangeReason, pendingPlanChange, orgLock, orgPlan, planChangeRequest, planOverrides, adminPlanChangeRequest, } from './plans.js';
+export type { PlanCurrency, OrgAddons, OrgPlanUsage, PlanChangeKeep, PlanChangeReason, PendingPlanChange, OrgLock, OrgPlan, PlanChangeRequest, PlanOverrides, AdminPlanChangeRequest, } from './plans.js';

package/dist/index.js

@@ -52,6 +52,16 @@ export { APP_USER_DISPLAY_NAME_MAX, APP_URL_PLACEHOLDERS, MAIL_TEMPLATE_VARIABLE
 export { assetKind, URDF_ASSET_NAME, asset, urdfCompleteness, assetListResponse, assetsClearResponse, missingAssetQuery, assetSyncRequest, assetSyncResponse, assetSyncState, assetSyncStatus, assetFailure, assetFailureKind, assetStoreRefusedDetails, assetSyncBusyDetails, ROBOT_ASSET_STORE_BYTES, } from './assets.js';
 export { auditActor, auditEvent, auditQuery, auditListResponse, AUDIT_CSV_COLUMNS, AUDIT_RETENTION_DAYS } from './audit.js';
 export { alertRowCondition, alertSeverity, alertState, datapointAlertRow, alertListResponse, orgFiringAlertsResponse, orgAlertsQuery, datapointDisplay, putDatapointDisplayRequest, } from './alerts.js';
-export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES } from './errors.js';
+export { apiError, parameterViolation, parameterInvalidDetails, cancelRejectedDetails, invalidCodeDetails, ERROR_CODES, 
+// 2026-10-02 — plans (#103). The plan errors (I-3).
+planLimitDetails, assetPlanLimitDetails, planRequiredDetails, orgLockedDetails, } from './errors.js';
 export { oauthErrorCode, oauthError, oauthRedirectResponse, oauthCodeTokenRequest, oauthRefreshTokenRequest, oauthTokenRequest, oauthTokenResponse, redirectUri, codeChallengeMethod, oauthAuthorizeQuery, dynamicClientRegistrationRequest, MCP_DCR_MAX_REDIRECT_URIS, dynamicClientRegistrationResponse, authorizationServerMetadata, protectedResourceMetadata, } from './oauth.js';
 export { ROUTES, ROUTE_SECTIONS, IN_HANDLER_ROUTES, developerSignInRoutes } from './routes.js';
+// 2026-10-02 — plans (#103). The catalogue (I-1) only: `PLANS` and `ADDONS`
+// are deliberately not constants exports (`constants.json` is vendored by
+// the bridge and must stay unchanged) but are exported values of this
+// barrel like any other schema module.
+export { planId, PLAN_ORDER, planLimitKey, planLimits, planFeature, planFeatures, planPrices, planSupport, planCatalogueEntry, addonKey, addonCatalogueEntry, usdCentsFromEurCents, yearlyEurCents, pricesFromEurMonth, PLANS, ADDONS, requiredPlanFor, nextPlanRaising, } from './plans.js';
+// 2026-10-02 — plans (#103). The organization's plan, plan changes and the
+// admin request (I-2).
+export { planCurrency, orgAddons, orgPlanUsage, planChangeKeep, planChangeReason, pendingPlanChange, orgLock, orgPlan, planChangeRequest, planOverrides, adminPlanChangeRequest, } from './plans.js';