@lukoweb/apitogo 0.1.97 → 0.1.99

package/dist/cli/cli.js

@@ -8,6 +8,88 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/config/gateway-limits.ts
+function isGatewayLimitsObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseLimitsJson(limitsJson) {
+  if (!limitsJson?.trim()) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(limitsJson);
+    return isGatewayLimitsObject(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function coerceGatewayLimits(source) {
+  if (isGatewayLimitsObject(source.limits)) {
+    return source.limits;
+  }
+  return parseLimitsJson(
+    typeof source.limitsJson === "string" ? source.limitsJson : void 0
+  );
+}
+function stringifyGatewayLimits(limits) {
+  if (!isGatewayLimitsObject(limits)) {
+    return void 0;
+  }
+  return JSON.stringify(limits);
+}
+function planForConfig(plan) {
+  const limits = coerceGatewayLimits(plan);
+  const next = { ...plan };
+  delete next.limitsJson;
+  if (limits) {
+    next.limits = limits;
+  } else {
+    delete next.limits;
+  }
+  return next;
+}
+function gatewayForConfig(gateway) {
+  return planForConfig(gateway);
+}
+function mergeLimitsSource(prior, patch) {
+  const merged = prior ? { ...prior, ...patch } : { ...patch };
+  const patchSource = patch;
+  if (patchSource.limits === void 0 && patchSource.limitsJson !== void 0) {
+    delete merged.limits;
+  }
+  return planForConfig(merged);
+}
+function planLimitsForPlatform(plan) {
+  return stringifyGatewayLimits(coerceGatewayLimits(plan));
+}
+function validateLimitsField(value, field) {
+  if (value == null || value === "") {
+    return [];
+  }
+  if (typeof value === "string") {
+    if (!value.trim()) {
+      return [];
+    }
+    try {
+      const parsed = JSON.parse(value);
+      if (!isGatewayLimitsObject(parsed)) {
+        return [{ field, message: `${field} must be a JSON object.` }];
+      }
+      return [];
+    } catch {
+      return [{ field, message: `${field} is not valid JSON.` }];
+    }
+  }
+  if (isGatewayLimitsObject(value)) {
+    return [];
+  }
+  return [{ field, message: `${field} must be a JSON object.` }];
+}
+var init_gateway_limits = __esm({
+  "src/config/gateway-limits.ts"() {
+  }
+});
+
 // src/cli/common/package-json.ts
 import { readFileSync } from "node:fs";
 import path19 from "node:path";
@@ -328,7 +410,7 @@ function mergePlansBySku2(existing, patch) {
       continue;
     }
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -355,6 +437,19 @@ function migratePlanCatalog(normalized) {
   }
   delete normalized.plans;
 }
+function migratePlanLimits(normalized) {
+  const modules = asRecord2(normalized.modules);
+  const plansModule = asRecord2(asRecord2(modules?.userPanel)?.plans);
+  if (Array.isArray(plansModule?.items)) {
+    plansModule.items = plansModule.items.map(
+      (plan) => planForConfig(plan)
+    );
+  }
+  const gateway = asRecord2(normalized.gateway);
+  if (gateway) {
+    normalized.gateway = gatewayForConfig(gateway);
+  }
+}
 function normalizeApitogoConfig(config2) {
   const normalized = structuredClone(stripRuntimeConfigFields(config2));
   const title = readSiteTitle2(normalized);
@@ -401,6 +496,7 @@ function normalizeApitogoConfig(config2) {
   delete normalized.branding;
   delete normalized.projectName;
   migratePlanCatalog(normalized);
+  migratePlanLimits(normalized);
   syncBillingEnabled(normalized);
   syncAuthentication(normalized);
   return normalized;
@@ -597,6 +693,7 @@ function extractSiteConfig(config2) {
 var APITOGO_CONFIG_FILENAME2, ENV_PREFIX, DERIVED_MANIFEST_KEYS, SITE_CONFIG_KEYS, COLLAPSED_UPPERCASE_ALIASES2;
 var init_apitogo_config_core = __esm({
   "src/config/apitogo-config-core.ts"() {
+    init_gateway_limits();
     APITOGO_CONFIG_FILENAME2 = "apitogo.config.json";
     ENV_PREFIX = "APITOGO_CONFIG_";
     DERIVED_MANIFEST_KEYS = [
@@ -640,6 +737,7 @@ var init_apitogo_config_core = __esm({
       PRICECURRENCY: "priceCurrency",
       BILLINGPERIOD: "billingPeriod",
       LIMITSJSON: "limitsJson",
+      LIMITS: "limits",
       INCLUDEDACTIONKEYS: "includedActionKeys",
       SOURCEDIRECTORY: "sourceDirectory",
       PUBLISHDIRECTORY: "publishDirectory",
@@ -925,6 +1023,16 @@ var init_ModulesSchema = __esm({
         "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
       ).optional(),
       billingPeriod: z3.string().optional(),
+      limits: z3.object({
+        rateLimit: z3.object({
+          calls: z3.number(),
+          renewalPeriodSeconds: z3.number().optional()
+        }).passthrough().optional(),
+        quota: z3.object({
+          calls: z3.number(),
+          renewalPeriodDays: z3.number().optional()
+        }).passthrough().optional()
+      }).passthrough().optional(),
       limitsJson: z3.string().optional(),
       includedActionKeys: z3.array(z3.string()).optional()
     });
@@ -1019,7 +1127,8 @@ function plansToPreviewCatalog(plans) {
       priceAmount: plan.priceAmount ?? 0,
       priceCurrency: plan.priceCurrency ?? "usd",
       billingPeriod: normalizeBillingPeriod2(plan.billingPeriod),
-      limitsJson: plan.limitsJson ?? null,
+      limits: coerceGatewayLimits(plan) ?? null,
+      limitsJson: planLimitsForPlatform(plan) ?? null,
       includedActionKeys: plan.includedActionKeys ?? []
     }))
   };
@@ -1064,12 +1173,23 @@ async function readEffectiveManifest(rootDir, _env) {
     return null;
   }
 }
-var BillingPeriodSchema, PriceCurrencySchema, ALLOWED_RUNTIME_VERSIONS2, ManifestPlanInputSchema, DevPortalLocalManifestSchema;
+var BillingPeriodSchema, GatewayLimitsSchema, PriceCurrencySchema, ALLOWED_RUNTIME_VERSIONS2, ManifestPlanInputSchema, DevPortalLocalManifestSchema;
 var init_local_manifest = __esm({
   "src/config/local-manifest.ts"() {
+    init_gateway_limits();
     init_apitogo_config_loader();
     init_landing_manifest();
     BillingPeriodSchema = z4.enum(["month", "year", "monthly", "annual"]);
+    GatewayLimitsSchema = z4.object({
+      rateLimit: z4.object({
+        calls: z4.number(),
+        renewalPeriodSeconds: z4.number().optional()
+      }).passthrough().optional(),
+      quota: z4.object({
+        calls: z4.number(),
+        renewalPeriodDays: z4.number().optional()
+      }).passthrough().optional()
+    }).passthrough();
     PriceCurrencySchema = z4.string().trim().toLowerCase().regex(
       /^[a-z]{3}$/,
       "priceCurrency must be a 3-letter ISO 4217 code (lowercase)"
@@ -1092,6 +1212,8 @@ var init_local_manifest = __esm({
       priceAmount: z4.number().default(0),
       priceCurrency: PriceCurrencySchema.optional(),
       billingPeriod: BillingPeriodSchema.optional(),
+      limits: GatewayLimitsSchema.optional(),
+      /** @deprecated Use `limits`. Encoded string still accepted on load. */
       limitsJson: z4.string().optional(),
       includedActionKeys: z4.array(z4.string()).optional()
     });
@@ -1147,6 +1269,8 @@ var init_local_manifest = __esm({
         oidcMetadataUrl: z4.string().optional(),
         oidcAllowedIssuers: z4.array(z4.string()).optional(),
         oidcAudiences: z4.array(z4.string()).optional(),
+        limits: GatewayLimitsSchema.optional(),
+        /** @deprecated Use `limits`. Encoded string still accepted on load. */
         limitsJson: z4.string().optional(),
         publicHealthActionKey: z4.string().optional(),
         publicRoutes: z4.array(z4.string()).optional(),
@@ -5961,6 +6085,9 @@ function resolveDevPortalDeployConfig(config2) {
   return { endpointUrl, apiKey, defaultEnv };
 }
 
+// src/cli/platform/tools/dev-portal-publish.ts
+init_gateway_limits();
+
 // src/cli/platform/helpers/dev-portal-manifest.ts
 import { existsSync } from "node:fs";
 import { access, mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
@@ -6017,6 +6144,7 @@ function readLandingFromConfig(config2) {
 }
 
 // src/cli/platform/helpers/dev-portal-manifest.ts
+init_gateway_limits();
 var APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 var PLACEHOLDER_DEV_PORTAL_API_URL = "https://dp-example.azurecontainerapps.io";
 function isPlanFree(plan) {
@@ -6037,11 +6165,11 @@ function readPlanItemsFromConfig(config2) {
   const plansModule = userPanel?.plans;
   const items = plansModule?.items;
   if (Array.isArray(items) && items.length) {
-    return items;
+    return items.map((item) => planForConfig(item));
   }
   const rootPlans = config2.plans;
   if (Array.isArray(rootPlans) && rootPlans.length) {
-    return rootPlans;
+    return rootPlans.map((item) => planForConfig(item));
   }
   return void 0;
 }
@@ -6063,7 +6191,7 @@ function applyPlansToUserPanel(config2, plans, pricingEnabled) {
   const userPanel = modules.userPanel ?? {};
   const plansModule = userPanel.plans ?? {};
   if (plans.length > 0) {
-    plansModule.items = plans;
+    plansModule.items = plans.map((plan) => planForConfig(plan));
     if (pricingEnabled !== false) {
       plansModule.enabled = plansModule.enabled ?? true;
     }
@@ -6177,6 +6305,9 @@ function extractManifestFromConfig(config2) {
       manifest[key] = config2[key];
     }
   }
+  if (manifest.gateway) {
+    manifest.gateway = gatewayForConfig(manifest.gateway);
+  }
   const plans = readPlanItemsFromConfig(config2);
   if (plans) {
     manifest.plans = plans;
@@ -6210,7 +6341,7 @@ function applyManifestToConfig(config2, manifest) {
   for (const key of STORED_MANIFEST_KEYS) {
     const value = manifest[key];
     if (value !== void 0) {
-      next[key] = value;
+      next[key] = key === "gateway" ? gatewayForConfig(value) : value;
     } else {
       delete next[key];
     }
@@ -6262,9 +6393,9 @@ var DEFAULT_PLANS = [
     sku: "free",
     displayName: "Free",
     priceAmount: 0,
-    limitsJson: JSON.stringify({
+    limits: {
       rateLimit: { calls: 10, renewalPeriodSeconds: 60 }
-    }),
+    },
     includedActionKeys: []
   },
   {
@@ -6272,10 +6403,10 @@ var DEFAULT_PLANS = [
     displayName: "Pro",
     priceAmount: 9.99,
     billingPeriod: "month",
-    limitsJson: JSON.stringify({
+    limits: {
       rateLimit: { calls: 100, renewalPeriodSeconds: 60 },
       quota: { calls: 5e4, renewalPeriodDays: 1 }
-    }),
+    },
     includedActionKeys: []
   }
 ];
@@ -6472,7 +6603,7 @@ function mergePlansBySku(existing, patch) {
   }
   for (const plan of patch) {
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -6564,6 +6695,7 @@ async function writeManifest(siteDirectory, manifest) {
 }
 
 // src/cli/platform/helpers/publish-preflight.ts
+init_gateway_limits();
 var ALLOWED_RUNTIME_VERSIONS = [
   "DOTNET_10",
   "DOTNET_9",
@@ -6683,20 +6815,6 @@ function normalizeRuntime(runtime) {
   if (raw === "python") return "python";
   throw new Error(`runtime must be one of: dotnet, nodejs, python; got '${runtime}'.`);
 }
-function validateLimitsJson(limitsJson, field) {
-  if (!limitsJson?.trim()) {
-    return [];
-  }
-  try {
-    const parsed = JSON.parse(limitsJson);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return [{ field, message: `${field} must be a JSON object.` }];
-    }
-    return [];
-  } catch {
-    return [{ field, message: `${field} is not valid JSON.` }];
-  }
-}
 function normalizePlanForGatewayApi(plan) {
   return {
     ...plan,
@@ -6811,7 +6929,12 @@ function validateManifestForPlatformPublish(manifest) {
           });
         }
       }
-      issues.push(...validateLimitsJson(plan.limitsJson, `plans[${index}].limitsJson`));
+      issues.push(
+        ...validateLimitsField(
+          plan.limits ?? plan.limitsJson,
+          `plans[${index}].limits`
+        )
+      );
     }
   }
   if (manifest.backend?.sourceDirectory?.trim() || manifest.backend?.runtimeVersion) {
@@ -6846,8 +6969,13 @@ function validateManifestForPlatformPublish(manifest) {
       });
     }
   }
-  if (manifest.gateway?.limitsJson) {
-    issues.push(...validateLimitsJson(manifest.gateway.limitsJson, "gateway.limitsJson"));
+  if (manifest.gateway?.limits ?? manifest.gateway?.limitsJson) {
+    issues.push(
+      ...validateLimitsField(
+        manifest.gateway.limits ?? manifest.gateway.limitsJson,
+        "gateway.limits"
+      )
+    );
   }
   return {
     issues,
@@ -6874,6 +7002,7 @@ var COLLAPSED_UPPERCASE_ALIASES = {
   PRICECURRENCY: "priceCurrency",
   BILLINGPERIOD: "billingPeriod",
   LIMITSJSON: "limitsJson",
+  LIMITS: "limits",
   INCLUDEDACTIONKEYS: "includedActionKeys",
   SOURCEDIRECTORY: "sourceDirectory",
   PUBLISHDIRECTORY: "publishDirectory",
@@ -7246,6 +7375,9 @@ function formatDevPortalBackendResponse(projectId, backend) {
   };
 }
 
+// src/cli/platform/helpers/gateway-plan-sync.ts
+init_gateway_limits();
+
 // src/cli/platform/tools/gateway.ts
 var DEFAULT_BASELINE_LIMITS_JSON = JSON.stringify({
   rateLimit: { calls: 100, renewalPeriodSeconds: 60 },
@@ -7393,13 +7525,33 @@ async function listAllGatewayActions(client, projectId, pageSize = 100) {
   }
   return items;
 }
+async function resolveIncludedActionKeysForCreate(client, projectId, includedActionKeys, options) {
+  if (options?.skipDefaultActions) {
+    return includedActionKeys ?? [];
+  }
+  if (includedActionKeys && includedActionKeys.length > 0) {
+    return includedActionKeys;
+  }
+  try {
+    const actions = await listAllGatewayActions(client, projectId);
+    return actions.map((action) => action.actionKey);
+  } catch {
+    return includedActionKeys ?? [];
+  }
+}
 async function handleCreateGatewayPlan(client, config2, args) {
   const projectId = resolveProjectId(args.projectId, config2);
+  const includedActionKeys = await resolveIncludedActionKeysForCreate(
+    client,
+    projectId,
+    args.includedActionKeys,
+    { skipDefaultActions: args.skipDefaultActions }
+  );
   const body = {
     sku: args.sku,
     displayName: args.displayName,
     limitsJson: args.limitsJson ?? null,
-    includedActionKeys: args.includedActionKeys ?? [],
+    includedActionKeys,
     priceAmount: args.priceAmount,
     priceCurrency: args.priceCurrency,
     billingPeriod: args.billingPeriod,
@@ -7593,6 +7745,14 @@ function resolveIncludedActionKeysForUpsert(manifestPlan, existingPlan) {
   }
   return [];
 }
+async function resolveActionKeysOrAllProjectActions(manifestPlan, existingPlan, getAllKeys) {
+  const resolved = resolveIncludedActionKeysForUpsert(manifestPlan, existingPlan);
+  if (resolved.length > 0) {
+    return resolved;
+  }
+  const allKeys = await getAllKeys();
+  return allKeys.length > 0 ? allKeys : resolved;
+}
 var GATEWAY_PLAN_SORT_TEMP_OFFSET = 1e3;
 function buildGatewayPlanSortTargetsFromIds(manifestPlans, planIdsBySku, skuById) {
   const targets = [];
@@ -7627,17 +7787,36 @@ async function applyGatewayPlanSortOrders(client, config2, projectId, targets) {
   }
   return results;
 }
+async function listProjectActionKeys(client, projectId) {
+  try {
+    const actions = await listAllGatewayActions(client, projectId);
+    return actions.map((action) => action.actionKey);
+  } catch {
+    return [];
+  }
+}
 async function upsertGatewayPlansFromManifest(client, config2, projectId, plans, options) {
   const existing = await client.listGatewayPlans(projectId);
   const bySku = new Map(existing.map((plan) => [plan.sku.toLowerCase(), plan]));
   const results = [];
   const planIdsBySku = /* @__PURE__ */ new Map();
+  let cachedProjectActionKeys;
+  const projectActionKeys = async () => {
+    if (cachedProjectActionKeys === void 0) {
+      cachedProjectActionKeys = await listProjectActionKeys(client, projectId);
+    }
+    return cachedProjectActionKeys;
+  };
   for (const [index, inputRaw] of plans.entries()) {
     const input3 = normalizePlanForGatewayApi(inputRaw);
     const found = bySku.get(input3.sku.toLowerCase());
     if (found) {
       if (options?.syncActionsOnly) {
-        const actionKeys = resolveIncludedActionKeysForUpsert(input3, found);
+        const actionKeys = await resolveActionKeysOrAllProjectActions(
+          input3,
+          found,
+          projectActionKeys
+        );
         if (actionKeys.length === 0) {
           continue;
         }
@@ -7655,13 +7834,17 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
         planId: found.id,
         displayName: input3.displayName,
         isActive: true,
-        limitsJson: input3.limitsJson,
+        limitsJson: planLimitsForPlatform(input3),
         priceAmount: input3.priceAmount,
         priceCurrency: input3.priceCurrency,
         billingPeriod: input3.billingPeriod ? normalizeBillingPeriod(input3.billingPeriod) : void 0
       };
       if (!options?.deferActionKeys) {
-        patchArgs.includedActionKeys = resolveIncludedActionKeysForUpsert(input3, found);
+        patchArgs.includedActionKeys = await resolveActionKeysOrAllProjectActions(
+          input3,
+          found,
+          projectActionKeys
+        );
       }
       const patchedJson = await handlePatchGatewayPlan(client, config2, patchArgs);
       results.push(JSON.parse(patchedJson));
@@ -7678,8 +7861,9 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
       priceAmount: input3.priceAmount,
       priceCurrency: input3.priceCurrency ?? "usd",
       billingPeriod: normalizeBillingPeriod(input3.billingPeriod),
-      limitsJson: input3.limitsJson,
-      includedActionKeys: options?.deferActionKeys ? [] : resolveIncludedActionKeysForUpsert(input3),
+      limitsJson: planLimitsForPlatform(input3),
+      includedActionKeys: options?.deferActionKeys ? [] : await resolveActionKeysOrAllProjectActions(input3, void 0, projectActionKeys),
+      skipDefaultActions: true,
       sortOrder: index
     });
     const created = JSON.parse(createdJson);
@@ -11251,6 +11435,7 @@ async function handleBuildDevPortalSite(client, config2, args, progress) {
 import { readFile as readFile8 } from "node:fs/promises";
 import { createRequire } from "node:module";
 import path17 from "node:path";
+init_gateway_limits();
 var cachedFallbackTs;
 async function loadTypeScriptForSite(sourceDirectory) {
   const require2 = createRequire(path17.join(path17.resolve(sourceDirectory), "package.json"));
@@ -11371,6 +11556,11 @@ async function validateSiteConfigStructure(config2, sourceDirectory) {
             `"modules.userPanel.plans.items[${index}].sku" must be a non-empty string.`
           );
         }
+        if (plan.limits !== void 0 && !isGatewayLimitsObject(plan.limits)) {
+          errors.push(
+            `"modules.userPanel.plans.items[${index}].limits" must be a JSON object.`
+          );
+        }
         if (typeof plan.limitsJson === "string" && plan.limitsJson.trim()) {
           try {
             JSON.parse(plan.limitsJson);
@@ -11910,7 +12100,7 @@ async function runApplyFromSiteDirectory(client, config2, args, progress) {
       const enableGatewayJwt = Boolean(explicitAuthMode || explicitOidcUrl);
       const baselineArgs = {
         projectId,
-        limitsJson: gateway.limitsJson,
+        limitsJson: planLimitsForPlatform(gateway),
         publicHealthActionKey: gateway.publicHealthActionKey,
         publicRoutes: gateway.publicRoutes,
         waitForEntra: wait,
@@ -12610,7 +12800,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.97",
+  version: "0.1.99",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -19307,28 +19497,37 @@ function createDefaultApitogoJsonConfig(options) {
               displayName: "Free",
               priceAmount: 0,
               billingPeriod: "month",
-              limitsJson: '{"rateLimit":{"calls":10,"renewalPeriodSeconds":1},"quota":{"calls":1000,"renewalPeriodDays":30}}'
+              limits: {
+                rateLimit: { calls: 10, renewalPeriodSeconds: 1 },
+                quota: { calls: 1e3, renewalPeriodDays: 30 }
+              }
             },
             {
               sku: "developer",
               displayName: "Developer",
               priceAmount: 19,
               billingPeriod: "month",
-              limitsJson: '{"rateLimit":{"calls":50,"renewalPeriodSeconds":1},"quota":{"calls":50000,"renewalPeriodDays":30}}'
+              limits: {
+                rateLimit: { calls: 50, renewalPeriodSeconds: 1 },
+                quota: { calls: 5e4, renewalPeriodDays: 30 }
+              }
             },
             {
               sku: "team",
               displayName: "Team",
               priceAmount: 79,
               billingPeriod: "month",
-              limitsJson: '{"rateLimit":{"calls":200,"renewalPeriodSeconds":1},"quota":{"calls":500000,"renewalPeriodDays":30}}'
+              limits: {
+                rateLimit: { calls: 200, renewalPeriodSeconds: 1 },
+                quota: { calls: 5e5, renewalPeriodDays: 30 }
+              }
             },
             {
               sku: "enterprise",
               displayName: "Enterprise",
               priceAmount: -1,
               billingPeriod: "custom",
-              limitsJson: '{"quota":{"calls":-1}}'
+              limits: { quota: { calls: -1 } }
             }
           ]
         }
@@ -19512,11 +19711,11 @@ function slugifyPlanSku(displayName) {
   const sku = displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return sku || "plan";
 }
-function buildLimitsJson(rateLimitCalls, monthlyQuota) {
-  return JSON.stringify({
+function buildLimits(rateLimitCalls, monthlyQuota) {
+  return {
     rateLimit: { calls: rateLimitCalls, renewalPeriodSeconds: 60 },
     quota: { calls: monthlyQuota, renewalPeriodDays: 30 }
-  });
+  };
 }
 function buildPlanItemFromWizard(input3) {
   const sku = input3.sku ?? slugifyPlanSku(input3.displayName);
@@ -19524,7 +19723,7 @@ function buildPlanItemFromWizard(input3) {
     sku,
     displayName: input3.displayName,
     priceAmount: input3.priceAmount,
-    limitsJson: buildLimitsJson(input3.rateLimitCalls, input3.monthlyQuota)
+    limits: buildLimits(input3.rateLimitCalls, input3.monthlyQuota)
   };
   if (input3.priceAmount > 0) {
     item.priceCurrency = "usd";
@@ -19713,7 +19912,7 @@ function printPlanAddedHint(displayName) {
     `Plan "${displayName}" added to modules.userPanel.plans.items in apitogo.config.json.`
   );
   printDiagnosticsToConsole(
-    "Configure includedActionKeys, billing, and Stripe in the manifest before publish."
+    "New plans include all API operations by default. Set includedActionKeys to restrict, and configure Stripe before publishing paid plans."
   );
   printDiagnosticsToConsole(`Docs: ${DOCS}/docs/configuration/plans`);
 }

package/dist/declarations/cli/platform/helpers/dev-portal-manifest.d.ts

@@ -1,4 +1,5 @@
 import { type LandingManifestInput } from "./dev-portal-landing.js";
+import { type GatewayLimits } from "../../../config/gateway-limits.js";
 export declare const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 export declare const DEV_PORTAL_MANIFEST_FILENAME = "apitogo.local.json";
 export declare const PLACEHOLDER_DEV_PORTAL_API_URL = "https://dp-example.azurecontainerapps.io";
@@ -8,6 +9,7 @@ export interface ManifestPlanInput {
     priceAmount?: number;
     priceCurrency?: string;
     billingPeriod?: "month" | "year" | "monthly" | "annual";
+    limits?: GatewayLimits;
     limitsJson?: string;
     includedActionKeys?: string[];
 }
@@ -55,6 +57,7 @@ export interface DevPortalLocalManifest {
         oidcMetadataUrl?: string;
         oidcAllowedIssuers?: string[];
         oidcAudiences?: string[];
+        limits?: GatewayLimits;
         limitsJson?: string;
         publicHealthActionKey?: string;
         publicRoutes?: string[];

package/dist/declarations/cli/platform/helpers/publish-preflight.d.ts

@@ -1,3 +1,4 @@
+import { type GatewayLimits } from "../../../config/gateway-limits.js";
 export declare const ALLOWED_RUNTIME_VERSIONS: readonly ["DOTNET_10", "DOTNET_9", "DOTNET_8", "NODE_24_LTS", "NODE_22_LTS", "PYTHON_314", "PYTHON_313", "PYTHON_312", "PYTHON_311", "PYTHON_310"];
 export type AllowedRuntimeVersion = (typeof ALLOWED_RUNTIME_VERSIONS)[number];
 export interface PublishPlanInput {
@@ -6,6 +7,7 @@ export interface PublishPlanInput {
     priceAmount?: number;
     priceCurrency?: string;
     billingPeriod?: string;
+    limits?: GatewayLimits;
     limitsJson?: string;
     includedActionKeys?: string[];
 }
@@ -21,6 +23,7 @@ export interface PublishManifestLike {
     plans?: PublishPlanInput[];
     backend?: PublishBackendInput;
     gateway?: {
+        limits?: GatewayLimits;
         limitsJson?: string;
     };
 }

package/dist/declarations/cli/platform/tools/gateway.d.ts

@@ -28,9 +28,13 @@ export interface ApplyPublicRoutesResult {
 export declare function applyGatewayPublicRoutes(client: PlatformApiClient, projectId: string, routes: string[], options?: {
     knownActions?: GatewayActionDto[];
 }): Promise<ApplyPublicRoutesResult>;
+export declare function listAllGatewayActions(client: PlatformApiClient, projectId: string, pageSize?: number): Promise<GatewayActionDto[]>;
 export declare function handleListGatewayPlans(client: PlatformApiClient, config: ApitogoConfig, args: {
     projectId?: string;
 }): Promise<string>;
+export declare function resolveIncludedActionKeysForCreate(client: PlatformApiClient, projectId: string, includedActionKeys: string[] | undefined, options?: {
+    skipDefaultActions?: boolean;
+}): Promise<string[]>;
 export declare function handleCreateGatewayPlan(client: PlatformApiClient, config: ApitogoConfig, args: {
     projectId?: string;
     sku: string;
@@ -41,6 +45,7 @@ export declare function handleCreateGatewayPlan(client: PlatformApiClient, confi
     priceCurrency?: string;
     billingPeriod?: string;
     sortOrder?: number;
+    skipDefaultActions?: boolean;
 }): Promise<string>;
 export declare function handleGetGatewayPlan(client: PlatformApiClient, config: ApitogoConfig, args: {
     projectId?: string;

package/dist/declarations/config/gateway-limits.d.ts

@@ -0,0 +1,29 @@
+export type GatewayLimits = {
+    rateLimit?: {
+        calls: number;
+        renewalPeriodSeconds?: number;
+        [key: string]: unknown;
+    };
+    quota?: {
+        calls: number;
+        renewalPeriodDays?: number;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+export type GatewayLimitsSource = {
+    limits?: unknown;
+    limitsJson?: unknown;
+};
+export declare function isGatewayLimitsObject(value: unknown): value is GatewayLimits;
+export declare function parseLimitsJson(limitsJson?: string | null): GatewayLimits | undefined;
+export declare function coerceGatewayLimits(source: GatewayLimitsSource): GatewayLimits | undefined;
+export declare function stringifyGatewayLimits(limits?: GatewayLimits | null): string | undefined;
+export declare function planForConfig<T extends object>(plan: T): T;
+export declare function gatewayForConfig<T extends object>(gateway: T): T;
+export declare function mergeLimitsSource<T extends object>(prior: T | undefined, patch: T): T;
+export declare function planLimitsForPlatform(plan: object): string | undefined;
+export declare function validateLimitsField(value: unknown, field: string): Array<{
+    field: string;
+    message: string;
+}>;

package/dist/declarations/config/local-manifest.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type GatewayLimits } from "./gateway-limits.js";
 import { APITOGO_CONFIG_FILENAME } from "./apitogo-config-loader.js";
 import { type LandingManifestInput } from "./landing-manifest.js";
 export declare const APITOGO_MANIFEST_BASE_FILENAME = "apitogo.json";
@@ -20,6 +21,16 @@ export declare const ManifestPlanInputSchema: z.ZodObject<{
         year: "year";
         annual: "annual";
     }>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+        quota: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
     limitsJson: z.ZodOptional<z.ZodString>;
     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
@@ -64,6 +75,16 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
             year: "year";
             annual: "annual";
         }>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
@@ -87,6 +108,16 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         oidcMetadataUrl: z.ZodOptional<z.ZodString>;
         oidcAllowedIssuers: z.ZodOptional<z.ZodArray<z.ZodString>>;
         oidcAudiences: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         publicHealthActionKey: z.ZodOptional<z.ZodString>;
         publicRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -201,6 +232,7 @@ export type DevPortalPreviewPlan = {
     priceAmount: number;
     priceCurrency: string;
     billingPeriod: string;
+    limits: GatewayLimits | null;
     limitsJson: string | null;
     includedActionKeys: string[];
 };

package/dist/declarations/config/validators/ModulesSchema.d.ts

@@ -390,6 +390,16 @@ declare const PlanCatalogItemSchema: z.ZodObject<{
     priceAmount: z.ZodDefault<z.ZodNumber>;
     priceCurrency: z.ZodOptional<z.ZodString>;
     billingPeriod: z.ZodOptional<z.ZodString>;
+    limits: z.ZodOptional<z.ZodObject<{
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+        quota: z.ZodOptional<z.ZodObject<{
+            calls: z.ZodNumber;
+            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$loose>>;
+    }, z.core.$loose>>;
     limitsJson: z.ZodOptional<z.ZodString>;
     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
@@ -413,6 +423,16 @@ export declare const PlansModuleSchema: z.ZodObject<{
         priceAmount: z.ZodDefault<z.ZodNumber>;
         priceCurrency: z.ZodOptional<z.ZodString>;
         billingPeriod: z.ZodOptional<z.ZodString>;
+        limits: z.ZodOptional<z.ZodObject<{
+            rateLimit: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+            quota: z.ZodOptional<z.ZodObject<{
+                calls: z.ZodNumber;
+                renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$loose>>;
+        }, z.core.$loose>>;
         limitsJson: z.ZodOptional<z.ZodString>;
         includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
@@ -489,6 +509,16 @@ export declare const UserPanelModuleSchema: z.ZodObject<{
             priceAmount: z.ZodDefault<z.ZodNumber>;
             priceCurrency: z.ZodOptional<z.ZodString>;
             billingPeriod: z.ZodOptional<z.ZodString>;
+            limits: z.ZodOptional<z.ZodObject<{
+                rateLimit: z.ZodOptional<z.ZodObject<{
+                    calls: z.ZodNumber;
+                    renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$loose>>;
+                quota: z.ZodOptional<z.ZodObject<{
+                    calls: z.ZodNumber;
+                    renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$loose>>;
+            }, z.core.$loose>>;
             limitsJson: z.ZodOptional<z.ZodString>;
             includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>>;
@@ -677,6 +707,16 @@ export declare const ModulesSchema: z.ZodOptional<z.ZodObject<{
                 priceAmount: z.ZodDefault<z.ZodNumber>;
                 priceCurrency: z.ZodOptional<z.ZodString>;
                 billingPeriod: z.ZodOptional<z.ZodString>;
+                limits: z.ZodOptional<z.ZodObject<{
+                    rateLimit: z.ZodOptional<z.ZodObject<{
+                        calls: z.ZodNumber;
+                        renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$loose>>;
+                    quota: z.ZodOptional<z.ZodObject<{
+                        calls: z.ZodNumber;
+                        renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$loose>>;
+                }, z.core.$loose>>;
                 limitsJson: z.ZodOptional<z.ZodString>;
                 includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>>>;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -7041,6 +7041,16 @@ export declare const ZudokuConfig: z.ZodObject<{
                     priceAmount: z.ZodDefault<z.ZodNumber>;
                     priceCurrency: z.ZodOptional<z.ZodString>;
                     billingPeriod: z.ZodOptional<z.ZodString>;
+                    limits: z.ZodOptional<z.ZodObject<{
+                        rateLimit: z.ZodOptional<z.ZodObject<{
+                            calls: z.ZodNumber;
+                            renewalPeriodSeconds: z.ZodOptional<z.ZodNumber>;
+                        }, z.core.$loose>>;
+                        quota: z.ZodOptional<z.ZodObject<{
+                            calls: z.ZodNumber;
+                            renewalPeriodDays: z.ZodOptional<z.ZodNumber>;
+                        }, z.core.$loose>>;
+                    }, z.core.$loose>>;
                     limitsJson: z.ZodOptional<z.ZodString>;
                     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 }, z.core.$strip>>>;

package/dist/flat-config.d.ts

@@ -70,6 +70,19 @@ export type _Schema37 = {
   priceAmount?: number
   priceCurrency?: string
   billingPeriod?: string
+  limits?: {
+    rateLimit?: {
+      calls: number
+      renewalPeriodSeconds?: number
+      [k: string]: unknown
+    }
+    quota?: {
+      calls: number
+      renewalPeriodDays?: number
+      [k: string]: unknown
+    }
+    [k: string]: unknown
+  }
   limitsJson?: string
   includedActionKeys?: string[]
 }[]

package/docs/configuration/plans.md

@@ -39,7 +39,10 @@ npx apitogo config
             "sku": "free",
             "displayName": "Free",
             "priceAmount": 0,
-            "limitsJson": "{\"rateLimit\":{\"calls\":100,\"renewalPeriodSeconds\":60},\"quota\":{\"calls\":50000,\"renewalPeriodDays\":30}}"
+            "limits": {
+              "rateLimit": { "calls": 100, "renewalPeriodSeconds": 60 },
+              "quota": { "calls": 50000, "renewalPeriodDays": 30 }
+            }
           },
           {
             "sku": "pro",
@@ -47,7 +50,10 @@ npx apitogo config
             "priceAmount": 29,
             "priceCurrency": "usd",
             "billingPeriod": "month",
-            "limitsJson": "{\"rateLimit\":{\"calls\":1000,\"renewalPeriodSeconds\":60},\"quota\":{\"calls\":500000,\"renewalPeriodDays\":30}}"
+            "limits": {
+              "rateLimit": { "calls": 1000, "renewalPeriodSeconds": 60 },
+              "quota": { "calls": 500000, "renewalPeriodDays": 30 }
+            }
           }
         ]
       }
@@ -59,12 +65,12 @@ npx apitogo config
 - **`sku`** — stable identifier (used in checkout URLs and gateway sync).
 - **`displayName`** — label on `/pricing`.
 - **`priceAmount`** — `0` for free tiers; greater than zero for paid plans (USD by default).
-- **`limitsJson`** — JSON string with rate limit and quota policies (see below).
+- **`limits`** — rate limit and quota policies (see below). Encoded `limitsJson` strings are still accepted on load.
 
 Enable the catalog with `modules.userPanel.plans.enabled: true`. Legacy root `plans` is migrated on
 load.
 
-## limitsJson schema
+## limits schema
 
 ```json
 {
@@ -76,7 +82,8 @@ load.
 - **rateLimit** — maximum calls per renewal window (per minute when `renewalPeriodSeconds` is 60).
 - **quota** — longer-window cap (per 30 days when `renewalPeriodDays` is 30).
 
-After OpenAPI is deployed, you can scope plans to specific API operations with
+New plans include **all** discovered OpenAPI operations unless you set `includedActionKeys`.
+After OpenAPI is deployed, you can scope a plan to specific operations with
 `includedActionKeys` (for example `get:/orders/{id}`). Edit those fields in
 `apitogo.config.json` — see [Manifest](./manifest.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.97",
+  "version": "0.1.99",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -1,3 +1,5 @@
+import { gatewayForConfig, mergeLimitsSource, planForConfig } from "./gateway-limits.js";
+
 export const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 
 const ENV_PREFIX = "APITOGO_CONFIG_";
@@ -103,6 +105,7 @@ const COLLAPSED_UPPERCASE_ALIASES: Record<string, string> = {
   PRICECURRENCY: "priceCurrency",
   BILLINGPERIOD: "billingPeriod",
   LIMITSJSON: "limitsJson",
+  LIMITS: "limits",
   INCLUDEDACTIONKEYS: "includedActionKeys",
   SOURCEDIRECTORY: "sourceDirectory",
   PUBLISHDIRECTORY: "publishDirectory",
@@ -333,7 +336,7 @@ function mergePlansBySku(
       continue;
     }
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -372,6 +375,21 @@ function migratePlanCatalog(normalized: ApitogoJsonConfig): void {
   delete normalized.plans;
 }
 
+function migratePlanLimits(normalized: ApitogoJsonConfig): void {
+  const modules = asRecord(normalized.modules);
+  const plansModule = asRecord(asRecord(modules?.userPanel)?.plans);
+  if (Array.isArray(plansModule?.items)) {
+    plansModule.items = (plansModule.items as PlanCatalogItem[]).map((plan) =>
+      planForConfig(plan),
+    );
+  }
+
+  const gateway = asRecord(normalized.gateway);
+  if (gateway) {
+    normalized.gateway = gatewayForConfig(gateway);
+  }
+}
+
 /** Collapse legacy duplicate fields into canonical shape (mutates copy). */
 export function normalizeApitogoConfig(
   config: ApitogoJsonConfig,
@@ -428,6 +446,7 @@ export function normalizeApitogoConfig(
   delete normalized.projectName;
 
   migratePlanCatalog(normalized);
+  migratePlanLimits(normalized);
   syncBillingEnabled(normalized);
   syncAuthentication(normalized);
 

package/src/config/gateway-limits.ts

@@ -0,0 +1,123 @@
+export type GatewayLimits = {
+  rateLimit?: {
+    calls: number;
+    renewalPeriodSeconds?: number;
+    [key: string]: unknown;
+  };
+  quota?: {
+    calls: number;
+    renewalPeriodDays?: number;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+};
+
+export type GatewayLimitsSource = {
+  limits?: unknown;
+  limitsJson?: unknown;
+};
+
+export function isGatewayLimitsObject(value: unknown): value is GatewayLimits {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+export function parseLimitsJson(
+  limitsJson?: string | null,
+): GatewayLimits | undefined {
+  if (!limitsJson?.trim()) {
+    return undefined;
+  }
+
+  try {
+    const parsed = JSON.parse(limitsJson) as unknown;
+    return isGatewayLimitsObject(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export function coerceGatewayLimits(
+  source: GatewayLimitsSource,
+): GatewayLimits | undefined {
+  if (isGatewayLimitsObject(source.limits)) {
+    return source.limits;
+  }
+
+  return parseLimitsJson(
+    typeof source.limitsJson === "string" ? source.limitsJson : undefined,
+  );
+}
+
+export function stringifyGatewayLimits(
+  limits?: GatewayLimits | null,
+): string | undefined {
+  if (!isGatewayLimitsObject(limits)) {
+    return undefined;
+  }
+  return JSON.stringify(limits);
+}
+
+/** Canonical config shape: nested `limits`, no encoded `limitsJson`. */
+export function planForConfig<T extends object>(plan: T): T {
+  const limits = coerceGatewayLimits(plan as GatewayLimitsSource);
+  const next = { ...plan } as T & GatewayLimitsSource;
+  delete next.limitsJson;
+  if (limits) {
+    next.limits = limits;
+  } else {
+    delete next.limits;
+  }
+  return next;
+}
+
+export function gatewayForConfig<T extends object>(gateway: T): T {
+  return planForConfig(gateway);
+}
+
+/** Merge patch over prior; a patch `limitsJson` string replaces existing `limits`. */
+export function mergeLimitsSource<T extends object>(
+  prior: T | undefined,
+  patch: T,
+): T {
+  const merged = prior ? { ...prior, ...patch } : { ...patch };
+  const patchSource = patch as GatewayLimitsSource;
+  if (patchSource.limits === undefined && patchSource.limitsJson !== undefined) {
+    delete (merged as GatewayLimitsSource).limits;
+  }
+  return planForConfig(merged);
+}
+
+/** Stringify for the platform HTTP/DB `limitsJson` field. */
+export function planLimitsForPlatform(plan: object): string | undefined {
+  return stringifyGatewayLimits(coerceGatewayLimits(plan as GatewayLimitsSource));
+}
+
+export function validateLimitsField(
+  value: unknown,
+  field: string,
+): Array<{ field: string; message: string }> {
+  if (value == null || value === "") {
+    return [];
+  }
+
+  if (typeof value === "string") {
+    if (!value.trim()) {
+      return [];
+    }
+    try {
+      const parsed = JSON.parse(value) as unknown;
+      if (!isGatewayLimitsObject(parsed)) {
+        return [{ field, message: `${field} must be a JSON object.` }];
+      }
+      return [];
+    } catch {
+      return [{ field, message: `${field} is not valid JSON.` }];
+    }
+  }
+
+  if (isGatewayLimitsObject(value)) {
+    return [];
+  }
+
+  return [{ field, message: `${field} must be a JSON object.` }];
+}

package/src/config/local-manifest.ts

@@ -1,6 +1,14 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
+import {
+  type GatewayLimits,
+  coerceGatewayLimits,
+  planForConfig,
+  gatewayForConfig,
+  mergeLimitsSource,
+  planLimitsForPlatform,
+} from "./gateway-limits.js";
 import {
   APITOGO_CONFIG_FILENAME,
   extractManifest,
@@ -28,6 +36,25 @@ export type ApitogoManifestEnv = keyof typeof APITOGO_MANIFEST_ENV_FILES;
 
 const BillingPeriodSchema = z.enum(["month", "year", "monthly", "annual"]);
 
+const GatewayLimitsSchema = z
+  .object({
+    rateLimit: z
+      .object({
+        calls: z.number(),
+        renewalPeriodSeconds: z.number().optional(),
+      })
+      .passthrough()
+      .optional(),
+    quota: z
+      .object({
+        calls: z.number(),
+        renewalPeriodDays: z.number().optional(),
+      })
+      .passthrough()
+      .optional(),
+  })
+  .passthrough();
+
 const PriceCurrencySchema = z
   .string()
   .trim()
@@ -56,6 +83,8 @@ export const ManifestPlanInputSchema = z.object({
   priceAmount: z.number().default(0),
   priceCurrency: PriceCurrencySchema.optional(),
   billingPeriod: BillingPeriodSchema.optional(),
+  limits: GatewayLimitsSchema.optional(),
+  /** @deprecated Use `limits`. Encoded string still accepted on load. */
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),
 });
@@ -138,6 +167,8 @@ export const DevPortalLocalManifestSchema = z.object({
       oidcMetadataUrl: z.string().optional(),
       oidcAllowedIssuers: z.array(z.string()).optional(),
       oidcAudiences: z.array(z.string()).optional(),
+      limits: GatewayLimitsSchema.optional(),
+      /** @deprecated Use `limits`. Encoded string still accepted on load. */
       limitsJson: z.string().optional(),
       publicHealthActionKey: z.string().optional(),
       publicRoutes: z.array(z.string()).optional(),
@@ -169,6 +200,7 @@ export type DevPortalPreviewPlan = {
   priceAmount: number;
   priceCurrency: string;
   billingPeriod: string;
+  limits: GatewayLimits | null;
   limitsJson: string | null;
   includedActionKeys: string[];
 };
@@ -242,7 +274,8 @@ export function plansToPreviewCatalog(
       priceAmount: plan.priceAmount ?? 0,
       priceCurrency: plan.priceCurrency ?? "usd",
       billingPeriod: normalizeBillingPeriod(plan.billingPeriod),
-      limitsJson: plan.limitsJson ?? null,
+      limits: coerceGatewayLimits(plan) ?? null,
+      limitsJson: planLimitsForPlatform(plan) ?? null,
       includedActionKeys: plan.includedActionKeys ?? [],
     })),
   };
@@ -262,7 +295,7 @@ export function mergePlansBySku(
   }
   for (const plan of patch) {
     const prior = bySku.get(plan.sku);
-    bySku.set(plan.sku, prior ? { ...prior, ...plan } : plan);
+    bySku.set(plan.sku, mergeLimitsSource(prior, plan));
   }
   return Array.from(bySku.values());
 }
@@ -384,7 +417,7 @@ export function mergeManifest(
     merged.backend = { ...base.backend, ...override.backend };
   }
   if (override.gateway) {
-    merged.gateway = { ...base.gateway, ...override.gateway };
+    merged.gateway = mergeLimitsSource(base.gateway, override.gateway);
   }
   if (override.plans) {
     merged.plans = mergePlansBySku(base.plans, override.plans);
@@ -423,7 +456,14 @@ export function parseLocalManifestJson(
     if (!result.success) {
       return null;
     }
-    return result.data;
+    const data = result.data;
+    if (data.plans) {
+      data.plans = data.plans.map((plan) => planForConfig(plan));
+    }
+    if (data.gateway) {
+      data.gateway = gatewayForConfig(data.gateway);
+    }
+    return data;
   } catch {
     return null;
   }

package/src/config/validators/ModulesSchema.ts

@@ -274,6 +274,25 @@ const PlanCatalogItemSchema = z.object({
     )
     .optional(),
   billingPeriod: z.string().optional(),
+  limits: z
+    .object({
+      rateLimit: z
+        .object({
+          calls: z.number(),
+          renewalPeriodSeconds: z.number().optional(),
+        })
+        .passthrough()
+        .optional(),
+      quota: z
+        .object({
+          calls: z.number(),
+          renewalPeriodDays: z.number().optional(),
+        })
+        .passthrough()
+        .optional(),
+    })
+    .passthrough()
+    .optional(),
   limitsJson: z.string().optional(),
   includedActionKeys: z.array(z.string()).optional(),
 });