@lukoweb/apitogo 0.1.96 → 0.1.98

package/dist/declarations/cli/platform/helpers/dev-portal-manifest.d.ts

@@ -1,4 +1,5 @@
 import { type LandingManifestInput } from "./dev-portal-landing.js";
+import { type GatewayLimits } from "../../../config/gateway-limits.js";
 export declare const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 export declare const DEV_PORTAL_MANIFEST_FILENAME = "apitogo.local.json";
 export declare const PLACEHOLDER_DEV_PORTAL_API_URL = "https://dp-example.azurecontainerapps.io";
@@ -8,6 +9,7 @@ export interface ManifestPlanInput {
     priceAmount?: number;
     priceCurrency?: string;
     billingPeriod?: "month" | "year" | "monthly" | "annual";
+    limits?: GatewayLimits;
     limitsJson?: string;
     includedActionKeys?: string[];
 }
@@ -55,6 +57,7 @@ export interface DevPortalLocalManifest {
         oidcMetadataUrl?: string;
         oidcAllowedIssuers?: string[];
         oidcAudiences?: string[];
+        limits?: GatewayLimits;
         limitsJson?: string;
         publicHealthActionKey?: string;
         publicRoutes?: string[];

package/dist/declarations/cli/platform/helpers/publish-preflight.d.ts

@@ -1,3 +1,4 @@
+import { type GatewayLimits } from "../../../config/gateway-limits.js";
 export declare const ALLOWED_RUNTIME_VERSIONS: readonly ["DOTNET_10", "DOTNET_9", "DOTNET_8", "NODE_24_LTS", "NODE_22_LTS", "PYTHON_314", "PYTHON_313", "PYTHON_312", "PYTHON_311", "PYTHON_310"];
 export type AllowedRuntimeVersion = (typeof ALLOWED_RUNTIME_VERSIONS)[number];
 export interface PublishPlanInput {
@@ -6,6 +7,7 @@ export interface PublishPlanInput {
     priceAmount?: number;
     priceCurrency?: string;
     billingPeriod?: string;
+    limits?: GatewayLimits;
     limitsJson?: string;
     includedActionKeys?: string[];
 }
@@ -21,6 +23,7 @@ export interface PublishManifestLike {
     plans?: PublishPlanInput[];
     backend?: PublishBackendInput;
     gateway?: {
+        limits?: GatewayLimits;
         limitsJson?: string;
     };
 }

package/dist/declarations/config/gateway-limits.d.ts

@@ -0,0 +1,29 @@
+export type GatewayLimits = {
+    rateLimit?: {
+        calls: number;
+        renewalPeriodSeconds?: number;
+        [key: string]: unknown;
+    };
+    quota?: {
+        calls: number;
+        renewalPeriodDays?: number;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+export type GatewayLimitsSource = {
+    limits?: unknown;
+    limitsJson?: unknown;
+};
+export declare function isGatewayLimitsObject(value: unknown): value is GatewayLimits;
+export declare function parseLimitsJson(limitsJson?: string | null): GatewayLimits | undefined;
+export declare function coerceGatewayLimits(source: GatewayLimitsSource): GatewayLimits | undefined;
+export declare function stringifyGatewayLimits(limits?: GatewayLimits | null): string | undefined;
+export declare function planForConfig<T extends object>(plan: T): T;
+export declare function gatewayForConfig<T extends object>(gateway: T): T;
+export declare function mergeLimitsSource<T extends object>(prior: T | undefined, patch: T): T;
+export declare function planLimitsForPlatform(plan: object): string | undefined;
+export declare function validateLimitsField(value: unknown, field: string): Array<{
+    field: string;
+    message: string;
+}>;

package/dist/declarations/config/local-manifest.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type GatewayLimits } from "./gateway-limits.js";
 import { APITOGO_CONFIG_FILENAME } from "./apitogo-config-loader.js";
 import { type LandingManifestInput } from "./landing-manifest.js";
 export declare const APITOGO_MANIFEST_BASE_FILENAME = "apitogo.json";
@@ -20,6 +21,16 @@ export declare const ManifestPlanInputSchema: z.ZodObject<{
         year: "year";
         annual: "annual";
     }>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+        quota: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
     limitsJson: z.ZodOptional<z.ZodString>;
     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
@@ -64,6 +75,16 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
             year: "year";
             annual: "annual";
         }>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
@@ -87,6 +108,16 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         oidcMetadataUrl: z.ZodOptional<z.ZodString>;
         oidcAllowedIssuers: z.ZodOptional<z.ZodArray<z.ZodString>>;
         oidcAudiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         publicHealthActionKey: z.ZodOptional<z.ZodString>;
         publicRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -201,6 +232,7 @@ export type DevPortalPreviewPlan = {
     priceAmount: number;
     priceCurrency: string;
     billingPeriod: string;
+    limits: GatewayLimits | null;
     limitsJson: string | null;
     includedActionKeys: string[];
 };

package/dist/declarations/config/validators/ModulesSchema.d.ts

@@ -390,6 +390,16 @@ declare const PlanCatalogItemSchema: z.ZodObject<{
     priceAmount: z.ZodDefault<z.ZodNumber>;
     priceCurrency: z.ZodOptional<z.ZodString>;
     billingPeriod: z.ZodOptional<z.ZodString>;
+    limits: z.ZodOptional<z.ZodObject<{
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+        quota: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
     limitsJson: z.ZodOptional<z.ZodString>;
     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
@@ -413,6 +423,16 @@ export declare const PlansModuleSchema: z.ZodObject<{
         priceAmount: z.ZodDefault<z.ZodNumber>;
         priceCurrency: z.ZodOptional<z.ZodString>;
         billingPeriod: z.ZodOptional<z.ZodString>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
@@ -489,6 +509,16 @@ export declare const UserPanelModuleSchema: z.ZodObject<{
             priceAmount: z.ZodDefault<z.ZodNumber>;
             priceCurrency: z.ZodOptional<z.ZodString>;
             billingPeriod: z.ZodOptional<z.ZodString>;
+            limits: z.ZodOptional<z.ZodObject<{
+                rateLimit: z.ZodOptional<z.ZodObject<{
+                    calls: z.ZodNumber;
+                    renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$loose>>;
+                quota: z.ZodOptional<z.ZodObject<{
+                    calls: z.ZodNumber;
+                    renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$loose>>;
+            }, z.core.$loose>>;
             limitsJson: z.ZodOptional<z.ZodString>;
             includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>;
@@ -677,6 +707,16 @@ export declare const ModulesSchema: z.ZodOptional<z.ZodObject<{
                 priceAmount: z.ZodDefault<z.ZodNumber>;
                 priceCurrency: z.ZodOptional<z.ZodString>;
                 billingPeriod: z.ZodOptional<z.ZodString>;
+                limits: z.ZodOptional<z.ZodObject<{
+                    rateLimit: z.ZodOptional<z.ZodObject<{
+                        calls: z.ZodNumber;
+                        renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$loose>>;
+                    quota: z.ZodOptional<z.ZodObject<{
+                        calls: z.ZodNumber;
+                        renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$loose>>;
+                }, z.core.$loose>>;
                 limitsJson: z.ZodOptional<z.ZodString>;
                 includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>>>;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -7041,6 +7041,16 @@ export declare const ZudokuConfig: z.ZodObject<{
                     priceAmount: z.ZodDefault<z.ZodNumber>;
                     priceCurrency: z.ZodOptional<z.ZodString>;
                     billingPeriod: z.ZodOptional<z.ZodString>;
+                    limits: z.ZodOptional<z.ZodObject<{
+                        rateLimit: z.ZodOptional<z.ZodObject<{
+                            calls: z.ZodNumber;
+                            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                        }, z.core.$loose>>;
+                        quota: z.ZodOptional<z.ZodObject<{
+                            calls: z.ZodNumber;
+                            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                        }, z.core.$loose>>;
+                    }, z.core.$loose>>;
                     limitsJson: z.ZodOptional<z.ZodString>;
                     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 }, z.core.$strip>>>;

package/dist/flat-config.d.ts

@@ -70,6 +70,19 @@ export type _Schema37 = {
   priceAmount?: number
   priceCurrency?: string
   billingPeriod?: string
+  limits?: {
+    rateLimit?: {
+      calls: number
+      renewalPeriodSeconds?: number
+      [k: string]: unknown
+    }
+    quota?: {
+      calls: number
+      renewalPeriodDays?: number
+      [k: string]: unknown
+    }
+    [k: string]: unknown
+  }
   limitsJson?: string
   includedActionKeys?: string[]
 }[]

package/docs/configuration/plans.md

@@ -39,7 +39,10 @@ npx apitogo config
             "sku": "free",
             "displayName": "Free",
             "priceAmount": 0,
-            "limitsJson": "{\"rateLimit\":{\"calls\":100,\"renewalPeriodSeconds\":60},\"quota\":{\"calls\":50000,\"renewalPeriodDays\":30}}"
+            "limits": {
+              "rateLimit": { "calls": 100, "renewalPeriodSeconds": 60 },
+              "quota": { "calls": 50000, "renewalPeriodDays": 30 }
+            }
           },
           {
             "sku": "pro",
@@ -47,7 +50,10 @@ npx apitogo config
             "priceAmount": 29,
             "priceCurrency": "usd",
             "billingPeriod": "month",
-            "limitsJson": "{\"rateLimit\":{\"calls\":1000,\"renewalPeriodSeconds\":60},\"quota\":{\"calls\":500000,\"renewalPeriodDays\":30}}"
+            "limits": {
+              "rateLimit": { "calls": 1000, "renewalPeriodSeconds": 60 },
+              "quota": { "calls": 500000, "renewalPeriodDays": 30 }
+            }
           }
         ]
       }
@@ -59,12 +65,12 @@ npx apitogo config
 - **`sku`** — stable identifier (used in checkout URLs and gateway sync).
 - **`displayName`** — label on `/pricing`.
 - **`priceAmount`** — `0` for free tiers; greater than zero for paid plans (USD by default).
-- **`limitsJson`** — JSON string with rate limit and quota policies (see below).
+- **`limits`** — rate limit and quota policies (see below). Encoded `limitsJson` strings are still accepted on load.
 
 Enable the catalog with `modules.userPanel.plans.enabled: true`. Legacy root `plans` is migrated on
 load.
 
-## limitsJson schema
+## limits schema
 
 ```json
 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -1,3 +1,5 @@
+import { gatewayForConfig, mergeLimitsSource, planForConfig } from "./gateway-limits.js";
+
 export const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 
 const ENV_PREFIX = "APITOGO_CONFIG_";
@@ -103,6 +105,7 @@ const COLLAPSED_UPPERCASE_ALIASES: Record<string, string> = {
   PRICECURRENCY: "priceCurrency",
   BILLINGPERIOD: "billingPeriod",
   LIMITSJSON: "limitsJson",
+  LIMITS: "limits",
   INCLUDEDACTIONKEYS: "includedActionKeys",
   SOURCEDIRECTORY: "sourceDirectory",
   PUBLISHDIRECTORY: "publishDirectory",
@@ -333,7 +336,7 @@ function mergePlansBySku(
       continue;
     }
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -372,6 +375,21 @@ function migratePlanCatalog(normalized: ApitogoJsonConfig): void {
   delete normalized.plans;
 }
 
+function migratePlanLimits(normalized: ApitogoJsonConfig): void {
+  const modules = asRecord(normalized.modules);
+  const plansModule = asRecord(asRecord(modules?.userPanel)?.plans);
+  if (Array.isArray(plansModule?.items)) {
+    plansModule.items = (plansModule.items as PlanCatalogItem[]).map((plan) =>
+      planForConfig(plan),
+    );
+  }
+
+  const gateway = asRecord(normalized.gateway);
+  if (gateway) {
+    normalized.gateway = gatewayForConfig(gateway);
+  }
+}
+
 /** Collapse legacy duplicate fields into canonical shape (mutates copy). */
 export function normalizeApitogoConfig(
   config: ApitogoJsonConfig,
@@ -428,6 +446,7 @@ export function normalizeApitogoConfig(
   delete normalized.projectName;
 
   migratePlanCatalog(normalized);
+  migratePlanLimits(normalized);
   syncBillingEnabled(normalized);
   syncAuthentication(normalized);
 

package/src/config/gateway-limits.ts

@@ -0,0 +1,123 @@
+export type GatewayLimits = {
+  rateLimit?: {
+    calls: number;
+    renewalPeriodSeconds?: number;
+    [key: string]: unknown;
+  };
+  quota?: {
+    calls: number;
+    renewalPeriodDays?: number;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+};
+
+export type GatewayLimitsSource = {
+  limits?: unknown;
+  limitsJson?: unknown;
+};
+
+export function isGatewayLimitsObject(value: unknown): value is GatewayLimits {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function parseLimitsJson(
+  limitsJson?: string | null,
+): GatewayLimits | undefined {
+  if (!limitsJson?.trim()) {
+    return undefined;
+  }
+
+  try {
+    const parsed = JSON.parse(limitsJson) as unknown;
+    return isGatewayLimitsObject(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function coerceGatewayLimits(
+  source: GatewayLimitsSource,
+): GatewayLimits | undefined {
+  if (isGatewayLimitsObject(source.limits)) {
+    return source.limits;
+  }
+
+  return parseLimitsJson(
+    typeof source.limitsJson === "string" ? source.limitsJson : undefined,
+  );
+}
+
+export function stringifyGatewayLimits(
+  limits?: GatewayLimits | null,
+): string | undefined {
+  if (!isGatewayLimitsObject(limits)) {
+    return undefined;
+  }
+  return JSON.stringify(limits);
+}
+
+/** Canonical config shape: nested `limits`, no encoded `limitsJson`. */
+export function planForConfig<T extends object>(plan: T): T {
+  const limits = coerceGatewayLimits(plan as GatewayLimitsSource);
+  const next = { ...plan } as T & GatewayLimitsSource;
+  delete next.limitsJson;
+  if (limits) {
+    next.limits = limits;
+  } else {
+    delete next.limits;
+  }
+  return next;
+}
+
+export function gatewayForConfig<T extends object>(gateway: T): T {
+  return planForConfig(gateway);
+}
+
+/** Merge patch over prior; a patch `limitsJson` string replaces existing `limits`. */
+export function mergeLimitsSource<T extends object>(
+  prior: T | undefined,
+  patch: T,
+): T {
+  const merged = prior ? { ...prior, ...patch } : { ...patch };
+  const patchSource = patch as GatewayLimitsSource;
+  if (patchSource.limits === undefined && patchSource.limitsJson !== undefined) {
+    delete (merged as GatewayLimitsSource).limits;
+  }
+  return planForConfig(merged);
+}
+
+/** Stringify for the platform HTTP/DB `limitsJson` field. */
+export function planLimitsForPlatform(plan: object): string | undefined {
+  return stringifyGatewayLimits(coerceGatewayLimits(plan as GatewayLimitsSource));
+}
+
+export function validateLimitsField(
+  value: unknown,
+  field: string,
+): Array<{ field: string; message: string }> {
+  if (value == null || value === "") {
+    return [];
+  }
+
+  if (typeof value === "string") {
+    if (!value.trim()) {
+      return [];
+    }
+    try {
+      const parsed = JSON.parse(value) as unknown;
+      if (!isGatewayLimitsObject(parsed)) {
+        return [{ field, message: `${field} must be a JSON object.` }];
+      }
+      return [];
+    } catch {
+      return [{ field, message: `${field} is not valid JSON.` }];
+    }
+  }
+
+  if (isGatewayLimitsObject(value)) {
+    return [];
+  }
+
+  return [{ field, message: `${field} must be a JSON object.` }];
+}

package/src/config/local-manifest.ts

@@ -1,6 +1,14 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
+import {
+  type GatewayLimits,
+  coerceGatewayLimits,
+  planForConfig,
+  gatewayForConfig,
+  mergeLimitsSource,
+  planLimitsForPlatform,
+} from "./gateway-limits.js";
 import {
   APITOGO_CONFIG_FILENAME,
   extractManifest,
@@ -28,6 +36,25 @@ export type ApitogoManifestEnv = keyof typeof APITOGO_MANIFEST_ENV_FILES;
 
 const BillingPeriodSchema = z.enum(["month", "year", "monthly", "annual"]);
 
+const GatewayLimitsSchema = z
+  .object({
+    rateLimit: z
+      .object({
+        calls: z.number(),
+        renewalPeriodSeconds: z.number().optional(),
+      })
+      .passthrough()
+      .optional(),
+    quota: z
+      .object({
+        calls: z.number(),
+        renewalPeriodDays: z.number().optional(),
+      })
+      .passthrough()
+      .optional(),
+  })
+  .passthrough();
+
 const PriceCurrencySchema = z
   .string()
   .trim()
@@ -56,6 +83,8 @@ export const ManifestPlanInputSchema = z.object({
   priceAmount: z.number().default(0),
   priceCurrency: PriceCurrencySchema.optional(),
   billingPeriod: BillingPeriodSchema.optional(),
+  limits: GatewayLimitsSchema.optional(),
+  /** @deprecated Use `limits`. Encoded string still accepted on load. */
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),
 });
@@ -138,6 +167,8 @@ export const DevPortalLocalManifestSchema = z.object({
       oidcMetadataUrl: z.string().optional(),
       oidcAllowedIssuers: z.array(z.string()).optional(),
       oidcAudiences: z.array(z.string()).optional(),
+      limits: GatewayLimitsSchema.optional(),
+      /** @deprecated Use `limits`. Encoded string still accepted on load. */
       limitsJson: z.string().optional(),
       publicHealthActionKey: z.string().optional(),
       publicRoutes: z.array(z.string()).optional(),
@@ -169,6 +200,7 @@ export type DevPortalPreviewPlan = {
   priceAmount: number;
   priceCurrency: string;
   billingPeriod: string;
+  limits: GatewayLimits | null;
   limitsJson: string | null;
   includedActionKeys: string[];
 };
@@ -242,7 +274,8 @@ export function plansToPreviewCatalog(
       priceAmount: plan.priceAmount ?? 0,
       priceCurrency: plan.priceCurrency ?? "usd",
       billingPeriod: normalizeBillingPeriod(plan.billingPeriod),
-      limitsJson: plan.limitsJson ?? null,
+      limits: coerceGatewayLimits(plan) ?? null,
+      limitsJson: planLimitsForPlatform(plan) ?? null,
       includedActionKeys: plan.includedActionKeys ?? [],
     })),
   };
@@ -262,7 +295,7 @@ export function mergePlansBySku(
   }
   for (const plan of patch) {
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -384,7 +417,7 @@ export function mergeManifest(
     merged.backend = { ...base.backend, ...override.backend };
   }
   if (override.gateway) {
-    merged.gateway = { ...base.gateway, ...override.gateway };
+    merged.gateway = mergeLimitsSource(base.gateway, override.gateway);
   }
   if (override.plans) {
     merged.plans = mergePlansBySku(base.plans, override.plans);
@@ -423,7 +456,14 @@ export function parseLocalManifestJson(
     if (!result.success) {
       return null;
     }
-    return result.data;
+    const data = result.data;
+    if (data.plans) {
+      data.plans = data.plans.map((plan) => planForConfig(plan));
+    }
+    if (data.gateway) {
+      data.gateway = gatewayForConfig(data.gateway);
+    }
+    return data;
   } catch {
     return null;
   }

package/src/config/validators/ModulesSchema.ts

@@ -274,6 +274,25 @@ const PlanCatalogItemSchema = z.object({
     )
     .optional(),
   billingPeriod: z.string().optional(),
+  limits: z
+    .object({
+      rateLimit: z
+        .object({
+          calls: z.number(),
+          renewalPeriodSeconds: z.number().optional(),
+        })
+        .passthrough()
+        .optional(),
+      quota: z
+        .object({
+          calls: z.number(),
+          renewalPeriodDays: z.number().optional(),
+        })
+        .passthrough()
+        .optional(),
+    })
+    .passthrough()
+    .optional(),
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),
 });

package/src/vite/config.ts

@@ -160,6 +160,9 @@ export async function getViteConfig(
     server: {
       middlewareMode: true,
       open: true,
+      fs: {
+        allow: [dir, path.dirname(dir)],
+      },
       watch: {
         ignored: [
           `${dir}/dist`,

package/src/vite/plugin-offroot-resolve.ts

@@ -0,0 +1,71 @@
+import path from "node:path";
+import type { Plugin, ResolveIdOptions } from "vite";
+import { getCurrentConfig } from "../config/loader.js";
+
+function stripQuery(id: string): string {
+  const query = id.indexOf("?");
+  return query === -1 ? id : id.slice(0, query);
+}
+
+function isInside(parent: string, child: string): boolean {
+  const relative = path.relative(path.resolve(parent), path.resolve(child));
+  return (
+    relative === "" ||
+    (!relative.startsWith("..") && !path.isAbsolute(relative))
+  );
+}
+
+function isBareSpecifier(source: string): boolean {
+  return (
+    !source.startsWith("\0") &&
+    !source.startsWith(".") &&
+    !source.startsWith("/") &&
+    !path.isAbsolute(source)
+  );
+}
+
+function isInsideNodeModules(filePath: string): boolean {
+  return filePath.split(path.sep).includes("node_modules");
+}
+
+/** True when Vite followed a symlink (or glob) to markdown outside the site. */
+export function shouldResolveFromSiteRoot(
+  source: string,
+  importer: string | undefined,
+  rootDir: string,
+): boolean {
+  if (!importer || !isBareSpecifier(source)) {
+    return false;
+  }
+  const importerPath = stripQuery(importer);
+  if (isInside(rootDir, importerPath) || isInsideNodeModules(importerPath)) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Linked docs live outside the site (e.g. ../doc/*.md). Vite import-analysis
+ * then cannot resolve `@lukoweb/apitogo/components` from that folder.
+ * Re-resolve bare imports as if they came from the site package.json.
+ */
+export default function viteOffrootResolvePlugin(): Plugin {
+  return {
+    name: "zudoku-offroot-resolve",
+    enforce: "pre",
+    async resolveId(
+      source: string,
+      importer: string | undefined,
+      options: ResolveIdOptions,
+    ) {
+      const rootDir = getCurrentConfig().__meta.rootDir;
+      if (!shouldResolveFromSiteRoot(source, importer, rootDir)) {
+        return;
+      }
+      return this.resolve(source, path.join(rootDir, "package.json"), {
+        ...options,
+        skipSelf: true,
+      });
+    },
+  };
+}