@saasicat/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/index.d.ts

@@ -1,5 +1,17 @@
 /** Start of day (00:00 UTC) of the moment — for day-inclusive date comparisons. */
 declare function startOfUtcDay(date: Date): Date;
+/**
+ * The day before `value` — how a validity window closes when its successor
+ * opens (`validUntil = successor.validFrom − 1 day`, the rule this module's
+ * header states and `startOfUtcDay` above is the reading half of).
+ *
+ * It lived as three separate expressions before 2026-08-27: one in each
+ * adapter's publish path and one in the bundle repository, all agreeing by
+ * coincidence rather than by construction. Day arithmetic rather than
+ * `− 24 * 60 * 60 * 1000`: the subtraction is only equivalent while the value
+ * is a UTC midnight, and nothing in the type says it is.
+ */
+declare function previousUtcDay(value: Date): Date;
 /** `<=` upper bound for a date (structurally Prisma-compatible). */
 interface DateAtOrBefore {
     lte: Date;
@@ -73,256 +85,6 @@ type ActiveVersionWhereWithEndsAt = ActivePlanVersionWhereWithEndsAt;
  */
 declare const buildActiveVersionWhere: typeof buildActivePlanVersionWhere;
 
-type FeatureKey = string;
-type PlanId = string;
-type QuotaKey = string;
-interface FeatureDef {
-    key: FeatureKey;
-    label?: string;
-    icon?: string;
-    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
-    tier?: string;
-    plannedOnly?: boolean;
-}
-interface PlanDef {
-    id: PlanId;
-    name?: string;
-    tagline?: string;
-    /** false = not selectable in self-service onboarding. Default: true. */
-    marketed?: boolean;
-    /** Highlighted card in onboarding (max. 1 per catalog). */
-    popular?: boolean;
-    /** Net monthly price. null = on request. */
-    monthlyNet?: number | null;
-    /** Net total amount per year. null = monthly only. */
-    yearlyNet?: number | null;
-    /** Map quotaKey → max value. -1 = unlimited. */
-    quotas: Record<QuotaKey, number>;
-    features: FeatureKey[];
-}
-/** App-wide marketing configuration. */
-interface PlanCatalogMarketing {
-    /**
-     * Allowed language pool that the app may market. First = default
-     * locale. From it, the SuperAdmin activates a subset in the marketing
-     * catalog (LocaleManager).
-     */
-    availableLocales: string[];
-}
-/**
- * App identity block for branding + version. Consumed by the `AdminPublicBootController`
- * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
- * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
- *
- * `name` = brand display name (e.g. "DemoApp", "ClubApp").
- * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
- * `version` = app version string (build info).
- * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
- * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
- *             instead of the initials badge.
- */
-interface PlanCatalogApp {
-    name: string;
-    label?: string;
-    version?: string;
-    icon?: string;
-    logoUrl?: string;
-}
-interface PlanCatalog {
-    schemaVersion: 1;
-    projectKey: string;
-    /** App identity (branding + version), see PlanCatalogApp. Optional. */
-    app?: PlanCatalogApp;
-    /** ISO-4217 currency code. */
-    currency: string;
-    /** VAT rate in percent. */
-    vatRate: number;
-    /** App-wide marketing configuration. Optional. */
-    marketing?: PlanCatalogMarketing;
-    features?: FeatureDef[];
-    /**
-     * Optional. When omitted, plans come exclusively from the
-     * AdminUI / DB table (Plans/PlanVersions lifecycle).
-     */
-    plans?: PlanDef[];
-}
-
-/** Backend capability key, convention: domain.action[.action]. */
-type CapabilityKey = string;
-/** Frontend action-registry key. Same convention as CapabilityKey. */
-type ActionKey = CapabilityKey;
-/** Lookup key in the static extensions: map of the UI build. */
-type ComponentKey = string;
-interface AdminManifest {
-    schemaVersion: 1;
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-        /**
-         * Allowed locale pool from the app config (`saas.yaml`
-         * `marketing.availableLocales`). First = default..
-         */
-        availableLocales?: string[];
-        /** Default locale; equals `availableLocales[0]`. */
-        defaultLocale?: string;
-    };
-    build: {
-        platformPackageVersion: string;
-        appVersion: string;
-        manifestHash: string;
-    };
-    planCatalogSnapshot: {
-        source: string;
-        hash: string;
-        currency: string;
-        vatRate: number;
-        features?: FeatureDef[];
-        plans: PlanDef[];
-    };
-    /** Map CapabilityKey → boolean. Manifest is never a security source. */
-    capabilities: Record<CapabilityKey, boolean>;
-    navigation: {
-        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory';
-interface StandardPageDef {
-    enabled: boolean;
-    requiredCapability?: CapabilityKey;
-}
-interface ProjectPageDef {
-    /** `<projectKey>.<area>`, e.g. `demoapp.datev`. */
-    id: string;
-    label: string;
-    icon?: string;
-    /** Frontend route, e.g. `/admin/datev`. */
-    route: string;
-    navSection?: string;
-    /** Lookup in the static extensions: map of the shell build. */
-    componentKey: ComponentKey;
-    requiredCapability?: CapabilityKey;
-    prefetchOnIdle?: boolean;
-}
-interface KpiCardDef {
-    id: string;
-    label: string;
-    /** Required path: /api/v1/admin/(extras|dashboard)/... */
-    endpoint: string;
-    displayHint: KpiDisplayHint;
-    /** 0–100; UI sorts descending. */
-    slotPriority?: number;
-    requiredCapability?: CapabilityKey;
-}
-interface KpiDisplayHint {
-    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
-    icon?: string;
-}
-interface TenantColumnDef {
-    key: string;
-    label: string;
-    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
-    endpoint: string;
-    requiredCapability?: CapabilityKey;
-}
-interface TenantActionDef {
-    /** `<projectKey>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
-    id: string;
-    label: string;
-    /** Lookup in the static actions: map of the shell build. */
-    actionKey: ActionKey;
-    requiredCapability?: CapabilityKey;
-    requiresMfa?: boolean;
-    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
-}
-interface AuditActionDef {
-    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
-    key: string;
-    label: string;
-    severity?: 'info' | 'low' | 'medium' | 'high';
-}
-interface ManifestContribution {
-    capabilities?: Record<CapabilityKey, boolean>;
-    navigation?: {
-        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-interface PublicBootResponse {
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-    };
-}
-
-/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
-type ActorTag = string;
-interface AuditEntry {
-    id: string;
-    /** null = platform action without tenant context (SUPER_ADMIN). */
-    tenantId: string | null;
-    /** null = system / cron-triggered. */
-    userId: string | null;
-    /** Convenience field; backend resolves it from userId. */
-    userEmail: string | null;
-    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
-    entity: string;
-    entityId: string;
-    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
-    action: string;
-    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
-    changes: Record<string, unknown> | null;
-    actorTag: ActorTag | null;
-    ipAddress: string | null;
-    userAgent: string | null;
-    createdAt: string;
-}
-interface AuditQuery {
-    tenantId?: string;
-    userId?: string;
-    entity?: string;
-    entityId?: string;
-    action?: string;
-    /** Wildcard-capable, e.g. 'cli:*'. */
-    actorTag?: string;
-    from?: string;
-    to?: string;
-    page?: number;
-    pageSize?: number;
-}
-
 /**
  * Approval lifecycle of a feature or a quota. Approval happens per
  * FEATURE/QUOTA — not per capability (#20); only `approved` entries
@@ -385,7 +147,6 @@ type CatalogEntryI18n = Record<string, CatalogEntryI18nFields>;
  */
 interface CapabilityCatalogEntryRow {
     id: string;
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -422,7 +183,6 @@ type FeatureTier = 'CORE' | 'ADVANCED' | 'PRO' | 'ENTERPRISE' | string;
  */
 interface FeatureCatalogEntryRow {
     id: string;
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -477,7 +237,6 @@ interface FeatureCatalogEntryRow {
  */
 interface QuotaCatalogEntryRow {
     id: string;
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -521,7 +280,6 @@ interface QuotaCatalogEntryRow {
  * matching field is relevant.
  */
 interface CatalogEntryFilter {
-    projectKey: string;
     discoveryStatus?: DiscoveryStatus;
     codeStatus?: CapabilityCodeStatus;
 }
@@ -613,6 +371,18 @@ interface MarketingTopFeature {
     label: string;
     strong: string;
 }
+/**
+ * The range a marketing projection's `priority` may take.
+ *
+ * Declared here rather than in the DTO because two sides need the same answer:
+ * the request pipe rejects anything outside it, and the admin UI computes
+ * priorities when an operator drags a plan into a new position. A UI that
+ * picked its own bounds would produce a value the pipe refuses — and it did,
+ * at the top of the range, where a list of tied plans was lifted past the
+ * maximum to pull the ties apart.
+ */
+declare const MARKETING_PRIORITY_MIN = 0;
+declare const MARKETING_PRIORITY_MAX = 10000;
 /**
  * Locale-specific marketing texts per plan/bundle version.
  * Read and projected by the Public-Catalog-Controller
@@ -623,7 +393,6 @@ interface MarketingTopFeature {
  */
 interface MarketingProjectionRow {
     id: string;
-    projectKey: string;
     targetType: MarketingTargetType;
     targetVersionId: string;
     /** ISO-639-1, optionally with region suffix (`de`, `en`, `de-AT`). */
@@ -668,42 +437,178 @@ interface MarketingProjectionRow {
     createdAt: string;
     updatedAt: string;
 }
-/** Filter for `MarketingProjectionRepository.list()`. At least projectKey. */
+/** Filter for `MarketingProjectionRepository.list()`. */
 interface MarketingProjectionFilter {
-    projectKey: string;
     targetType?: MarketingTargetType;
     targetVersionId?: string;
     locale?: string;
 }
-interface CreateMarketingProjectionData {
-    projectKey: string;
-    targetType: MarketingTargetType;
-    targetVersionId: string;
-    locale?: string;
-    displayLabel: string;
-    description: string;
-    visible?: boolean;
-    badge?: string;
-    topFeatures?: MarketingTopFeature[];
-    trialEnabled?: boolean;
-    trialDays?: number;
-    priceTag?: string | null;
-    ctaLabel?: string | null;
-    priority?: number;
-    highlight?: boolean;
+interface CreateMarketingProjectionData {
+    targetType: MarketingTargetType;
+    targetVersionId: string;
+    locale?: string;
+    displayLabel: string;
+    description: string;
+    visible?: boolean;
+    badge?: string;
+    topFeatures?: MarketingTopFeature[];
+    trialEnabled?: boolean;
+    trialDays?: number;
+    priceTag?: string | null;
+    ctaLabel?: string | null;
+    priority?: number;
+    highlight?: boolean;
+}
+interface UpdateMarketingProjectionData {
+    displayLabel?: string;
+    description?: string;
+    visible?: boolean;
+    badge?: string;
+    topFeatures?: MarketingTopFeature[];
+    trialEnabled?: boolean;
+    trialDays?: number;
+    priceTag?: string | null;
+    ctaLabel?: string | null;
+    priority?: number;
+    highlight?: boolean;
+}
+
+type FeatureKey = string;
+type PlanId = string;
+type QuotaKey = string;
+interface FeatureDef {
+    key: FeatureKey;
+    label?: string;
+    icon?: string;
+    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
+    tier?: string;
+    plannedOnly?: boolean;
+}
+interface PlanDef {
+    id: PlanId;
+    name?: string;
+    tagline?: string;
+    /** false = not selectable in self-service onboarding. Default: true. */
+    marketed?: boolean;
+    /** Highlighted card in onboarding (max. 1 per catalog). */
+    popular?: boolean;
+    /** Net monthly price. null = on request. */
+    monthlyNet?: number | null;
+    /** Net total amount per year. null = monthly only. */
+    yearlyNet?: number | null;
+    /** Map quotaKey → max value. -1 = unlimited. */
+    quotas: Record<QuotaKey, number>;
+    features: FeatureKey[];
+}
+/** App-wide marketing configuration. */
+interface PlanCatalogMarketing {
+    /**
+     * Allowed language pool that the app may market. First = default
+     * locale. From it, the SuperAdmin activates a subset in the marketing
+     * catalog (LocaleManager).
+     */
+    availableLocales: string[];
+}
+/**
+ * App identity block for branding + version. Consumed by the `AdminPublicBootController`
+ * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
+ * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
+ *
+ * `name` = brand display name (e.g. "DemoApp", "ClubApp").
+ * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
+ * `version` = app version string (build info).
+ * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
+ * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
+ *             instead of the initials badge.
+ */
+interface PlanCatalogApp {
+    name: string;
+    label?: string;
+    version?: string;
+    icon?: string;
+    logoUrl?: string;
+}
+/**
+ * Notice periods, one per rhythm.
+ *
+ * One number for both was the shape until 2026-08-27, and it could not be right
+ * for both: a yearly contract with a fortnight of notice is unusual, and a
+ * monthly contract with three months of notice is void against a consumer. The
+ * two are configured apart because real contracts set them apart.
+ *
+ * Both members are required. A missing rhythm would read as zero, and a silent
+ * zero is a commercial decision nobody made — the same defect one level below
+ * the one that moved these settings into the file.
+ *
+ * **No ceiling is enforced.** §309 Nr. 9 BGB limits the notice period in German
+ * consumer contracts to one month, and an installation serving businesses is
+ * not bound by it. The platform cannot know which it is, so the number is the
+ * consumer app's to choose and this is the sentence that says what it costs.
+ */
+interface CancellationNoticePeriods {
+    /** Days of notice for a monthly subscription. */
+    monthly: number;
+    /** Days of notice for a yearly subscription. */
+    yearly: number;
+}
+/**
+ * Plans a tenant may not reach or leave without talking to sales.
+ *
+ * `asTarget`: may not be selected via self-service — typically ENTERPRISE,
+ * which only a special contract activates. `asSource`: may not be left via
+ * self-service — typically an active special contract.
+ *
+ * Both lists are required and may be empty. An empty list says out loud that
+ * self-service reaches every plan, which is a decision rather than an omission.
+ */
+interface SelfServiceBlockedPlans {
+    asTarget: string[];
+    asSource: string[];
+}
+/**
+ * Commercial settings for the tenant-facing self-service routes.
+ *
+ * They live in `config/saas.yaml` and nowhere else: an operator reading the
+ * file has to be reading the values that are running, with no "unless somebody
+ * passed it in code" attached. The file is read at boot, so an edit lands on
+ * the next restart.
+ */
+interface PlanCatalogTenantBilling {
+    cancellationNoticeDays: CancellationNoticePeriods;
+    selfServiceBlockedPlans: SelfServiceBlockedPlans;
+}
+/**
+ * Who is told when the settings in the file change between two starts.
+ *
+ * The record inside the application is written whether or not anybody is
+ * named here; mail is the addition, never the substitute. Mailed only where an
+ * email port is bound — without one the boot log says so once, and the change
+ * is recorded in the application only.
+ */
+interface PlanCatalogNotifications {
+    /** Addresses mailed when a start finds the applied settings changed. */
+    settingsChanged?: string[];
 }
-interface UpdateMarketingProjectionData {
-    displayLabel?: string;
-    description?: string;
-    visible?: boolean;
-    badge?: string;
-    topFeatures?: MarketingTopFeature[];
-    trialEnabled?: boolean;
-    trialDays?: number;
-    priceTag?: string | null;
-    ctaLabel?: string | null;
-    priority?: number;
-    highlight?: boolean;
+interface PlanCatalog {
+    schemaVersion: 1;
+    /** App identity (branding + version), see PlanCatalogApp. */
+    app: PlanCatalogApp;
+    /** ISO-4217 currency code. */
+    currency: string;
+    /** VAT rate in percent. */
+    vatRate: number;
+    /** Commercial settings for the tenant self-service routes. */
+    tenantBilling: PlanCatalogTenantBilling;
+    /** App-wide marketing configuration. Optional. */
+    marketing?: PlanCatalogMarketing;
+    /** Who is told when the settings change between two starts. Optional. */
+    notifications?: PlanCatalogNotifications;
+    features?: FeatureDef[];
+    /**
+     * Optional. When omitted, plans come exclusively from the
+     * AdminUI / DB table (Plans/PlanVersions lifecycle).
+     */
+    plans?: PlanDef[];
 }
 
 type PromoCodeValueType = 'PERCENT' | 'ABSOLUTE';
@@ -902,7 +807,7 @@ interface VersionedEntityBase {
  *   own migration).
  * - `startedAt` is the contract start of this booking.
  * - `minimumTermEndsAt` = end of the minimum term; `null` = no minimum term
- *   (platform default = 12 months, set service-side).
+ *   (platform default = no commitment, set service-side).
  * - `canceledAt` / `canceledEffectiveAt`: cancellation anchor vs. effective
  *   date. Before the minimum term ends, `canceledEffectiveAt =
  *   minimumTermEndsAt`, otherwise the subscription's period end.
@@ -919,6 +824,18 @@ interface SubscriptionBundleRecord {
     minimumTermEndsAt: Date | null;
     canceledAt: Date | null;
     canceledEffectiveAt: Date | null;
+    /**
+     * The rhythm this booking is billed in, and the window it is billed for.
+     *
+     * A bundle's periods end on the day its plan's do — the first one short,
+     * from the booking to the next occurrence of that day, and every one after
+     * it anchor to anchor. Null on a booking made before these fields existed,
+     * or on one whose plan has no period; readers fall back to the plan's
+     * cycle, which is what every booking used before.
+     */
+    billingCycle: string | null;
+    currentPeriodStart: Date | null;
+    currentPeriodEnd: Date | null;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -932,14 +849,27 @@ interface SubscriptionBundleRecord {
 interface SubscriptionBundleView extends SubscriptionBundleRecord {
     bundleKey: string | null;
     label: string | null;
-    monthlyNet: string | null;
+    /**
+     * What this booking is billed at, in the rhythm it was booked in and with
+     * the plan's pricing override applied.
+     *
+     * It was `monthlyNet` until 2026-08-27 and carried the bundle's base
+     * monthly price whatever the booking was — so a yearly booking of a bundle
+     * priced 10 monthly and 100 yearly reported 10. The name was half the
+     * defect: a field called `monthlyNet` on a yearly booking cannot be right.
+     */
+    priceNet: number | null;
 }
 interface CreateSubscriptionBundleData {
     subscriptionId: string;
     bundleVersionId: string;
     startedAt: Date;
-    /** Default = startedAt + 12 months, unless set. */
+    /** Null unless a commitment was configured or asked for. */
     minimumTermEndsAt?: Date | null;
+    /** The rhythm and window worked out above this port. */
+    billingCycle?: string | null;
+    currentPeriodStart?: Date | null;
+    currentPeriodEnd?: Date | null;
 }
 interface CancelSubscriptionBundleData {
     canceledAt: Date;
@@ -988,7 +918,6 @@ interface BundlePricingOverride {
  */
 interface BundleRow {
     id: string;
-    projectKey: string;
     bundleKey: string;
     label: string;
     description: string | null;
@@ -1027,7 +956,6 @@ interface BundleVersionRow extends VersionedEntityBase {
  * first BundleVersion via `CreateBundleVersionDraftData`.
  */
 interface CreateBundleData {
-    projectKey: string;
     bundleKey: string;
     label: string;
     description?: string | null;
@@ -1036,9 +964,9 @@ interface CreateBundleData {
     i18n?: CatalogEntryI18n;
 }
 /**
- * Fields that may be changed on the bundle master. `bundleKey` and
- * `projectKey` are intentionally not here — master identity is immutable;
- * whoever wants to change them creates a new bundle and retires the old one.
+ * Fields that may be changed on the bundle master. `bundleKey` is
+ * intentionally not here — master identity is immutable; whoever wants to
+ * change it creates a new bundle and retires the old one.
  */
 interface UpdateBundleData {
     label?: string;
@@ -1161,16 +1089,273 @@ interface StrictModeWarning {
     /** The concrete violating value; optional. */
     value?: string;
 }
-/**
- * Service result for mutating Bundle operations
- * (createDraft, updateDraft, publish): returns the persisted row plus
- * a list of strict-mode warnings. In `warn-only` mode the
- * warnings go into the UI as a banner; in `blocking` mode the service throws
- * HTTP 422 instead, with the same warning list as the body.
- */
-interface BundleVersionMutationResult {
-    bundleVersion: BundleVersionRow;
-    warnings: StrictModeWarning[];
+/**
+ * Service result for mutating Bundle operations
+ * (createDraft, updateDraft, publish): returns the persisted row plus
+ * a list of strict-mode warnings. In `warn-only` mode the
+ * warnings go into the UI as a banner; in `blocking` mode the service throws
+ * HTTP 422 instead, with the same warning list as the body.
+ */
+interface BundleVersionMutationResult {
+    bundleVersion: BundleVersionRow;
+    warnings: StrictModeWarning[];
+}
+
+/**
+ * The column values a new BundleVersion draft starts from.
+ *
+ * Every adapter has to apply the same defaults — an absent quota map is `{}`,
+ * an absent price is null rather than zero, an unstated `marketed` is true —
+ * and two adapters spelling that out separately is the same decision written
+ * twice. It is also the variant jscpd does catch, which is how this came out:
+ * `adapter-drizzle` learning about bundles put a second copy beside
+ * `adapter-prisma`'s.
+ *
+ * Validity windows are deliberately absent. Whether a draft carries
+ * `validFrom`/`validUntil` is an adapter capability rather than a default, and
+ * an adapter that does not maintain those columns must not write them.
+ */
+declare function bundleDraftDefaults(data: CreateBundleVersionDraftData): {
+    baseVersionId: string | null;
+    features: string[];
+    quotas: Record<string, number>;
+    compatibility: Record<string, unknown>;
+    pricingOverrides: unknown[];
+    monthlyNet: string | null;
+    yearlyNet: string | null;
+    marketed: boolean;
+    changeNote: string;
+    createdByUserId: string | null;
+};
+/**
+ * The column values a new Bundle stem starts from.
+ *
+ * The same defaulting rule as above, one level up: an absent description or
+ * icon is null rather than an empty string, an unstated sort order is 0, an
+ * absent translation map is `{}`. Written out in five places before this — two
+ * adapters and two fakes — which is four opportunities for one of them to
+ * decide differently.
+ */
+declare function bundleStemDefaults(data: CreateBundleData): {
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: CatalogEntryI18n;
+};
+/** The stored shape both adapters read a bundle stem back from. */
+interface StoredBundleStem {
+    id: string;
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/**
+ * A stored bundle stem as the port describes it.
+ *
+ * The two stores spell the columns identically, so the mapping was identical
+ * too — and an identical mapping in two files is one place for a field to be
+ * forgotten when the row grows. `i18n` arrives as JSON of unknown shape from
+ * both, and a non-object becomes `{}` rather than reaching a caller that
+ * expects a map.
+ */
+declare function toBundleStemRow(row: StoredBundleStem): BundleRow;
+/**
+ * The fields a caller actually gave, as a patch.
+ *
+ * The update DTOs in this codebase mean three different things by three
+ * different values: a value changes the column, an explicit `null` clears it,
+ * and an **omitted** field leaves it alone. Only the last one needs care, and
+ * it was written out as `...(data.x !== undefined ? { x: data.x } : {})` more
+ * than fifty times across five repositories — one decision, fifty
+ * opportunities to spell it differently, and the duplication ratchet is what
+ * finally pointed at it.
+ *
+ * `null` is deliberately kept: it is a value a caller chose, not an absence.
+ */
+declare function definedFields<T extends object, K extends keyof T>(data: T, keys: readonly K[]): Partial<Pick<T, K>>;
+
+/** Backend capability key, convention: domain.action[.action]. */
+type CapabilityKey = string;
+/** Frontend action-registry key. Same convention as CapabilityKey. */
+type ActionKey = CapabilityKey;
+/** Lookup key in the static extensions: map of the UI build. */
+type ComponentKey = string;
+interface AdminManifest {
+    schemaVersion: 1;
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+        /**
+         * Allowed locale pool from the app config (`saas.yaml`
+         * `marketing.availableLocales`). First = default..
+         */
+        availableLocales?: string[];
+        /** Default locale; equals `availableLocales[0]`. */
+        defaultLocale?: string;
+    };
+    build: {
+        platformPackageVersion: string;
+        appVersion: string;
+        manifestHash: string;
+    };
+    planCatalogSnapshot: {
+        source: string;
+        hash: string;
+        currency: string;
+        vatRate: number;
+        features?: FeatureDef[];
+        plans: PlanDef[];
+    };
+    /** Map CapabilityKey → boolean. Manifest is never a security source. */
+    capabilities: Record<CapabilityKey, boolean>;
+    navigation: {
+        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
+}
+type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory' | 'settings';
+interface StandardPageDef {
+    enabled: boolean;
+    requiredCapability?: CapabilityKey;
+}
+interface ProjectPageDef {
+    /** `<app>.<area>`, e.g. `demoapp.datev`. */
+    id: string;
+    label: string;
+    icon?: string;
+    /** Frontend route, e.g. `/admin/datev`. */
+    route: string;
+    navSection?: string;
+    /** Lookup in the static extensions: map of the shell build. */
+    componentKey: ComponentKey;
+    requiredCapability?: CapabilityKey;
+    prefetchOnIdle?: boolean;
+}
+interface KpiCardDef {
+    id: string;
+    label: string;
+    /** Required path: /api/v1/admin/(extras|dashboard)/... */
+    endpoint: string;
+    displayHint: KpiDisplayHint;
+    /** 0–100; UI sorts descending. */
+    slotPriority?: number;
+    requiredCapability?: CapabilityKey;
+}
+interface KpiDisplayHint {
+    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
+    icon?: string;
+}
+interface TenantColumnDef {
+    key: string;
+    label: string;
+    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
+    endpoint: string;
+    requiredCapability?: CapabilityKey;
+}
+interface TenantActionDef {
+    /** `<app>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
+    id: string;
+    label: string;
+    /** Lookup in the static actions: map of the shell build. */
+    actionKey: ActionKey;
+    requiredCapability?: CapabilityKey;
+    requiresMfa?: boolean;
+    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
+}
+interface AuditActionDef {
+    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
+    key: string;
+    label: string;
+    severity?: 'info' | 'low' | 'medium' | 'high';
+}
+interface ManifestContribution {
+    capabilities?: Record<CapabilityKey, boolean>;
+    navigation?: {
+        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
+}
+interface PublicBootResponse {
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+    };
+}
+
+/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
+type ActorTag = string;
+interface AuditEntry {
+    id: string;
+    /** null = platform action without tenant context (SUPER_ADMIN). */
+    tenantId: string | null;
+    /** null = system / cron-triggered. */
+    userId: string | null;
+    /** Convenience field; backend resolves it from userId. */
+    userEmail: string | null;
+    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
+    entity: string;
+    entityId: string;
+    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
+    action: string;
+    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
+    changes: Record<string, unknown> | null;
+    actorTag: ActorTag | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+}
+interface AuditQuery {
+    tenantId?: string;
+    userId?: string;
+    entity?: string;
+    entityId?: string;
+    action?: string;
+    /** Wildcard-capable, e.g. 'cli:*'. */
+    actorTag?: string;
+    from?: string;
+    to?: string;
+    page?: number;
+    pageSize?: number;
 }
 
 /** Promotion type. */
@@ -1201,7 +1386,6 @@ type PromotionI18n = Record<string, PromotionI18nFields>;
 /** Wire format of a `promotions` row. */
 interface PromotionRow {
     id: string;
-    projectKey: string;
     /** Internal label (not public). */
     internalLabel: string;
     type: PromotionType;
@@ -1227,11 +1411,7 @@ interface PromotionRow {
     createdAt: string;
     updatedAt: string;
 }
-interface PromotionFilter {
-    projectKey: string;
-}
 interface CreatePromotionData {
-    projectKey: string;
     internalLabel: string;
     type: PromotionType;
     value: PromotionValue;
@@ -1354,7 +1534,6 @@ type CheckoutOfferStatus = 'open' | 'consumed' | 'expired';
 /** Wire format of a `checkout_offers` row. */
 interface CheckoutOfferRow {
     id: string;
-    projectKey: string;
     /** Plan selected on the website. */
     planKey: string;
     /** Resolved plan version, if known. */
@@ -1385,12 +1564,10 @@ interface CheckoutOfferRow {
     updatedAt: string;
 }
 interface CheckoutOfferFilter {
-    projectKey: string;
     status?: CheckoutOfferStatus;
 }
 /** Body of `POST /public/checkout-offer` — called from the website. */
 interface CreateCheckoutOfferData {
-    projectKey: string;
     planKey: string;
     planVersionId?: string | null;
     billingCycle: 'monthly' | 'yearly';
@@ -1426,7 +1603,6 @@ interface UpdateCheckoutOfferData {
 
 /** Wire format of the `marketing_settings` row. */
 interface MarketingSettingsRow {
-    projectKey: string;
     /** Runtime-activated subset of the `availableLocales` pool. */
     activeLocales: string[];
     updatedAt: string;
@@ -1462,6 +1638,10 @@ interface PublicMarketingPlan {
     badge: string;
     /** Teaser / description text. */
     description: string;
+    /**
+     * The recommended plan, and at most one card in a catalogue carries it —
+     * see `keepOneRecommended`, which decides it per language served.
+     */
     highlight: boolean;
     /**
      * Formatted pricing tag from the MarketingProjection (#47, e.g.
@@ -1544,7 +1724,6 @@ interface PublicComparisonRow {
 }
 /** Response of `GET /public/marketing-catalog`. */
 interface PublicMarketingCatalogResponse {
-    projectKey: string;
     locale: string;
     currency: string;
     /** VAT rate in percent — for the CheckoutOffer price breakdown. */
@@ -1654,7 +1833,7 @@ interface DiscoverySnapshot {
     /** ISO timestamp of the boot-time scan. */
     scannedAt: string;
     app: {
-        /** projectKey, same concept as in the catalog tables. */
+        /** The application's name, from `saas.yaml#app.name`. */
         key: string;
         /** Backend version, e.g. from package.json. */
         version: string;
@@ -1690,6 +1869,18 @@ interface FeatureUiMeta {
 /** Map FeatureKey → UI metadata. Consumer apps supply a complete table. */
 type FeatureUiRegistry = Record<string, FeatureUiMeta>;
 
+/** A quota as a finite number, or `null` where the value cannot be read as one. */
+declare function readQuotaValue(value: unknown): number | null;
+/**
+ * Every quota in a JSON column, for a caller that computes with them.
+ *
+ * A key that is there stays there. Dropping an unreadable one made it *absent*,
+ * and absent means undeclared: `enforceLimit` answers an undeclared dimension
+ * with a 500, so every operation on that quota was refused — a fail-closed
+ * answer to somebody else's corrupt row.
+ */
+declare function readQuotaRecord(value: unknown): Record<string, number>;
+
 /** Alias for historical compatibility — equivalent to VersionChangeDirection. */
 type ChangeDirection = VersionChangeDirection;
 interface DiffResult {
@@ -1707,9 +1898,16 @@ type DecimalLike = number | string | {
 };
 interface PlanVersionFields {
     features: FeatureKey[];
-    maxUsers: number;
-    maxVehicles: number;
-    maxStorageGb: number;
+    /**
+     * Quotas of the version. -1 = unlimited; missing key = 0.
+     *
+     * Every key either side carries is compared. Which keys exist is the
+     * installation's decision — they come from `@DefinesQuota` — so a fixed
+     * set here would have compared the three the platform happened to know by
+     * name and let every other one be lowered without the confirmation
+     * publishing a regression asks for.
+     */
+    quotas: Record<QuotaKey, number>;
     monthlyNet: DecimalLike;
     yearlyNet: DecimalLike;
 }
@@ -1725,8 +1923,7 @@ declare function classifyPlanDiff(oldV: PlanVersionFields, newV: PlanVersionFiel
 /**
  * Classification of a BundleVersion diff for contract protection.
  *
- * Quota comparison: `-1` (unlimited) is always better than any positive
- * number. Otherwise higher = better. Missing keys are treated as 0.
+ * Quotas are compared exactly as they are for a plan.
  *
  * Pricing can be `null` (the bundle only has override pricing); a switch
  * from value ↔ null is classified as REGRESSION (value dropped) or IMPROVEMENT
@@ -1824,9 +2021,86 @@ interface OnboardingPromoRedemption {
     endsAt: string | null;
 }
 
+/**
+ * The settings subtree of a plan catalogue: every top-level block that is
+ * configuration rather than the catalogue itself. JSON-shaped, because it is
+ * stored as JSON and compared as JSON.
+ */
+type AppliedSettingsValues = Record<string, unknown>;
+/** The one row per installation: what is applied, since when, and from where. */
+interface AppliedSettingsRecord {
+    /**
+     * `sha256-<hex>` over the canonical JSON of `settings`. Two boots with the
+     * same resolved values produce the same fingerprint however the file was
+     * formatted, and a plan added to the catalogue does not move it.
+     */
+    fingerprint: string;
+    settings: AppliedSettingsValues;
+    /**
+     * Where the values came from: the absolute path of the file the platform
+     * read, or a phrase saying they were handed to it in code.
+     */
+    source: string;
+    /** The moment these values became the running configuration. */
+    appliedAt: Date;
+}
+/** What a boot noticed had changed since the previous record. */
+interface SettingsChangeRecord {
+    id: string;
+    /** The boot that noticed the difference and applied the new values. */
+    noticedAt: Date;
+    source: string;
+    previous: AppliedSettingsValues;
+    current: AppliedSettingsValues;
+    /** Set once an operator has seen it; null while it is still owed a look. */
+    acknowledgedAt: Date | null;
+    /** Who acknowledged it — an actor tag, as the audit log writes it. */
+    acknowledgedBy: string | null;
+}
+type NewSettingsChange = Pick<SettingsChangeRecord, 'noticedAt' | 'source' | 'previous' | 'current'>;
+/** One leaf that differs between two settings subtrees. */
+interface SettingsDifference {
+    /** Dotted path, as the loader names a field: `tenantBilling.cancellationNoticeDays.monthly`. */
+    path: string;
+    /** `undefined` where the leaf did not exist on that side. */
+    before: unknown;
+    after: unknown;
+}
+
+/**
+ * The top-level blocks of `config/saas.yaml` that are the catalogue rather than
+ * the configuration, and the format marker.
+ *
+ * An exclusion list rather than a list of settings, on purpose: a block the
+ * schema gains tomorrow is a setting until somebody says otherwise, so it is
+ * fingerprinted by default. The failure mode of the other list — a new setting
+ * silently left out of the fingerprint, so a change to it is never noticed — is
+ * the one this record exists to prevent. `schemaVersion` is excluded because a
+ * format change is a migration of the file, not a decision an operator took.
+ *
+ * `tests/settings-subtree.test.js` holds this list to the schema in both
+ * directions: every name here is a property the schema declares, and every
+ * property the schema declares lands on one side.
+ */
+declare const CATALOGUE_KEYS: ReadonlySet<keyof PlanCatalog>;
+/** Everything in the catalogue that is configuration, as it was resolved. */
+declare function settingsSubtreeOf(catalog: PlanCatalog): AppliedSettingsValues;
+/**
+ * `JSON.stringify` with object keys in sorted order at every depth, so that two
+ * documents saying the same thing in a different order serialise identically.
+ * Array order is kept: a list is what its author wrote, in the order they wrote
+ * it.
+ */
+declare function canonicalJson(value: unknown): string;
+/**
+ * Every leaf that differs between `before` and `after`, in the order the paths
+ * sort. A list counts as one leaf: `asTarget: [] → [ENTERPRISE]` is one thing
+ * that changed, not a change per element.
+ */
+declare function diffSettings(before: AppliedSettingsValues, after: AppliedSettingsValues): SettingsDifference[];
+
 interface PlanRow {
     id: string;
-    projectKey: string;
     planKey: string;
     label: string;
     description: string | null;
@@ -1843,7 +2117,6 @@ interface PlanRow {
  * creation (follows in M6 Pack 2).
  */
 interface CreatePlanData {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1851,9 +2124,9 @@ interface CreatePlanData {
     sortOrder?: number;
 }
 /**
- * Fields that may be changed on the plan stem. `planKey` and `projectKey`
- * are deliberately not here — stem identity is immutable; whoever wants to
- * change it creates a new plan and retires the old one.
+ * Fields that may be changed on the plan stem. `planKey` is deliberately not
+ * here — stem identity is immutable; whoever wants to change it creates a new
+ * plan and retires the old one.
  */
 interface UpdatePlanData {
     label?: string;
@@ -1917,7 +2190,6 @@ interface UpsertResult {
     skipReason?: string;
 }
 interface UpsertPlanInput {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1937,7 +2209,6 @@ interface UpsertPlanVersionInput {
     changeNote: string;
 }
 interface UpsertFeatureCatalogEntryInput {
-    projectKey: string;
     featureKey: FeatureKey;
     label?: string;
     icon?: string;
@@ -1983,7 +2254,7 @@ interface PlanCatalogReadSnapshot {
  * implement it against their Prisma tables.
  */
 interface PlanCatalogReadSink {
-    loadSnapshot(projectKey: string): Promise<PlanCatalogReadSnapshot>;
+    loadSnapshot(): Promise<PlanCatalogReadSnapshot>;
 }
 
 /**
@@ -2220,6 +2491,26 @@ interface PasswordHasher {
     hash(plain: string): Promise<string>;
     verify(hash: string, plain: string): Promise<boolean>;
 }
+/**
+ * Sends a plain-text mail to an operator.
+ *
+ * The platform composes the text; the adapter delivers it — over whatever the
+ * installation already sends mail with. Deliberately narrow: no templates, no
+ * locale, no HTML. The one thing the platform mails today is a diagnostic for
+ * the operator who runs the installation, and a diagnostic is English and
+ * plain, like the boot log it mirrors. Tenant-facing mail — a verification
+ * code, a resume link — goes through the registration module's own delivery
+ * ports, which carry the locale and the person's name because that mail is
+ * for a customer.
+ */
+interface EmailPort {
+    /** Delivers one plain-text mail to one address; rejects when it cannot. */
+    send(message: {
+        to: string;
+        subject: string;
+        text: string;
+    }): Promise<void>;
+}
 /** Adapter for MFA secret persistence. */
 interface MfaPort {
     /** Returns the stored TOTP secret or null. */
@@ -2427,6 +2718,26 @@ interface PromoRevenueDeductionAggregator {
 
 type ContractLineItemKind = 'plan' | 'bundle' | 'discount';
 type SubscriptionContractStatus = 'active' | 'scheduled' | 'terminated' | 'superseded';
+/**
+ * The statuses a contract is looked up under when asking "what is this tenant
+ * on right now" — `scheduled` included, because a contract that starts today
+ * and has not been switched to `active` yet is still the one in force at its
+ * own `effectiveFrom`.
+ *
+ * One list rather than one per adapter: the two adapters have to answer
+ * `findActiveByTenantId` the same way, and a status added here must not reach
+ * only whichever of them somebody remembered.
+ */
+/**
+ * How many bundle versions one price lookup may name.
+ *
+ * One number rather than two: the server validates against it and the client
+ * batches to stay inside it, and a client that learned the cap by receiving a
+ * 400 would fail silently — the lookup answers with an empty map, and every
+ * card falls back to a catalogue price the tenant may not be charged.
+ */
+declare const BUNDLE_PRICE_LOOKUP_LIMIT = 200;
+declare const ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES: readonly SubscriptionContractStatus[];
 interface ContractLineItemRecord {
     id: string;
     contractId: string;
@@ -2440,6 +2751,26 @@ interface ContractLineItemRecord {
     priceNet: number;
     priceGross: number;
     billingCycle: 'monthly' | 'yearly';
+    /**
+     * ISO 4217, as the line was booked in.
+     *
+     * An installation sells in one currency at a time, so this is never a
+     * choice the line makes — it is what keeps the line meaning what it meant
+     * after the configured currency is migrated to another one.
+     */
+    currency: string;
+    /**
+     * The tax rate in percent that was applied, recorded rather than left in
+     * the ratio between net and gross. That ratio is not the rate: it cannot be
+     * reproduced for a rounded gross, cannot express an exempt or reverse-charge
+     * line, and does not survive a rate change.
+     */
+    taxRate: number;
+    /**
+     * The tax contained in the line — exactly `priceGross - priceNet`, so the
+     * line cannot disagree with itself. Rounded once, when the line is written.
+     */
+    taxAmount: number;
     minimumTermUntil: Date | null;
     featuresSnapshot: string[];
     quotaEffectsSnapshot: Record<string, number>;
@@ -2452,12 +2783,23 @@ interface SubscriptionContractPriceSnapshot {
     subtotalNet: number;
     discountNet: number;
     totalNet: number;
+    /**
+     * The rate this contract's total was computed at — in per cent where the
+     * contract was frozen from the catalogue, and as the offer stated it where
+     * it was concluded from one.
+     *
+     * A checkout offer prices its lines as `net * (1 + vatRate)`, so it states
+     * a fraction, and the value is copied here as it stands. The field
+     * therefore carries both units across a history and cannot be compared
+     * across contracts. `ContractLineItemRecord.taxRate` is always per cent and
+     * is the one to read; this is kept as written because it is the record of
+     * what the contract was concluded with.
+     */
     vatRate: number;
     totalGross: number;
 }
 interface SubscriptionContractRecord {
     id: string;
-    projectKey: string;
     tenantId: string;
     status: SubscriptionContractStatus;
     effectiveFrom: Date;
@@ -2476,7 +2818,6 @@ interface SubscriptionContractRecord {
 }
 type NewContractLineItemData = Omit<ContractLineItemRecord, 'id' | 'contractId' | 'createdAt'>;
 interface CreateSubscriptionContractData {
-    projectKey: string;
     tenantId: string;
     status?: SubscriptionContractStatus;
     effectiveFrom: Date;
@@ -2493,10 +2834,22 @@ interface CreateSubscriptionContractData {
 }
 interface TerminateSubscriptionContractData {
     effectiveUntil: Date;
-    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'>;
+    /**
+     * The terminal status, or `null` to end the contract by date alone.
+     *
+     * `findActiveByTenantId` already asks its question as a window —
+     * `effectiveFrom <= asOf` and `effectiveUntil` null or after it — so a
+     * contract given an end in the FUTURE is found until that moment and not
+     * afterwards, with no scheduled job to flip anything.
+     *
+     * Writing a terminal status instead makes the contract disappear from that
+     * lookup at once, which for a cancellation declared months ahead removes an
+     * agreement the customer is still under. Null is how a caller says "it ends
+     * then", and a status is how it says "it is over now".
+     */
+    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'> | null;
 }
 interface SubscriptionContractFilter {
-    projectKey?: string;
     tenantId?: string;
     status?: SubscriptionContractStatus;
     asOf?: Date;
@@ -2513,12 +2866,14 @@ interface InvoiceLineItemSnapshot {
     priceNet: number;
     priceGross: number;
     billingCycle: 'monthly' | 'yearly';
+    currency: string;
+    taxRate: number;
+    taxAmount: number;
     minimumTermUntil: Date | null;
     metadata: Record<string, unknown> | null;
 }
 interface SubscriptionContractInvoiceSnapshot {
     contractId: string;
-    projectKey: string;
     tenantId: string;
     originalOfferId: string | null;
     currency: string;
@@ -2552,6 +2907,24 @@ interface SubscriptionRecord {
     } | null;
     planVersionId: string;
     planVersion: PlanVersionRecord;
+    /**
+     * When a cancellation was declared, and when it takes effect.
+     *
+     * Required, and required together, because entitlement resolution ends a
+     * subscription by reading them: without the second date it cannot tell a
+     * subscription that ends next January from one that ended last January, and
+     * it grants the latter everything. Nothing else in the platform would
+     * notice — no repository filters a cancelled subscription out, and stopping
+     * the billing period is a different decision from ending what a tenant may
+     * do.
+     *
+     * `null` on both means no cancellation. On a row written before the two
+     * fields separated, `canceledAt` carries the effective date and
+     * `canceledEffectiveAt` is genuinely null; every reader in the platform
+     * applies `canceledEffectiveAt ?? canceledAt` for that reason.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
 }
 /** Snapshot of a `PlanVersion` row. */
 interface PlanVersionRecord {
@@ -2608,11 +2981,10 @@ interface SubscriptionRepository {
     countByBundleVersionId?(bundleVersionId: string): Promise<number>;
     /**
      * Counts active subscriptions (status `ACTIVE` or `TRIAL`) per plan key,
-     * platform-wide across all tenants of the project — feeds the tenant
-     * column of the SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
+     * platform-wide across every tenant — feeds the tenant column of the
+     * SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
      * Cross-version: counts the plan, not a single PlanVersion
-     * (subscriptions on superseded versions are included). `projectKey` is
-     * informational for single-project consumers.
+     * (subscriptions on superseded versions are included).
      *
      * Returns a map `planKey → count`; plans without an active subscription
      * are missing (UI defaults to 0). Platform-wide count across all tenants →
@@ -2620,7 +2992,7 @@ interface SubscriptionRepository {
      *
      * Optional — if not implemented, the tenant column stays 0.
      */
-    countActiveByPlanKey?(projectKey: string): Promise<Record<string, number>>;
+    countActiveByPlanKey?(): Promise<Record<string, number>>;
 }
 /**
  * Adapter for the `subscription_bundles` junction.
@@ -2712,6 +3084,40 @@ interface SubscriptionUsageRecord {
     /** Current period window — for proration and change-effective date. */
     currentPeriodStart: Date | null;
     currentPeriodEnd: Date | null;
+    /**
+     * End of what was committed to, which the period end need not equal.
+     *
+     * The cancellation rules measure against this: a subscription cancelled
+     * inside its term keeps running until the term ends, not until the period
+     * does. Null on a trial, and on any subscription written before the field
+     * existed — readers treat that as "the period end is the answer".
+     */
+    minimumTermUntil?: Date | null;
+    /**
+     * The day of the month the subscription is billed on, 1–31.
+     *
+     * Read by the cancellation rules: a declaration after the notice window
+     * lands one period past the term end, and that step has to measure from the
+     * billing day rather than from a term end that may already have been
+     * clamped by a short month.
+     *
+     * Optional, because an adapter that does not store the column keeps today's
+     * behaviour — the step then takes its day from the term end, which is
+     * correct except in the month after a clamp.
+     */
+    billingAnchorDay?: number | null;
+    /**
+     * When a cancellation was declared, and when it lands.
+     *
+     * Required for the reason the same pair is required on
+     * `SubscriptionRecord`: the tenant billing route reads them to refuse a
+     * plan change on a subscription that has ended, and a record that omits
+     * them answers "not cancelled" — so the change is applied and prorated
+     * while entitlement resolution, which reads a record that does carry them,
+     * grants nothing.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
     pendingPlan: string | null;
     pendingBillingCycle: string | null;
     pendingEffectiveAt: Date | null;
@@ -2787,12 +3193,29 @@ interface ImmediatePlanChangeInput {
      * change, or target package without trial). A `Date` is persisted.
      */
     trialEndsAt?: Date | null;
+    /**
+     * `canceledAt` as the caller read it, so the write can claim the row only
+     * while that is still true.
+     *
+     * Three of the plan route's decisions depend on the cancellation — whether
+     * the change is refused at all, whether the billing cycle may move, and
+     * whether a fresh period is opened — and a read and a write are two
+     * moments. A cancellation declared in between made every one of them answer
+     * about a state that no longer existed, and the write went ahead anyway: a
+     * plan term recorded past the date the subscription ends.
+     *
+     * `null` is a value here rather than an absence. It claims a row that has
+     * no cancellation, and loses against one that has acquired one.
+     */
+    expectedCanceledAt: Date | null;
 }
 /** Input for `schedulePlanChange` (change at period end). */
 interface ScheduledPlanChangeInput {
     pendingPlan: string;
     pendingBillingCycle: string;
     pendingEffectiveAt: Date;
+    /** See `ImmediatePlanChangeInput.expectedCanceledAt`. */
+    expectedCanceledAt: Date | null;
 }
 /**
  * Input for `applyOnboardingSelection`. Plan-change fields that the
@@ -2801,6 +3224,12 @@ interface ScheduledPlanChangeInput {
 interface ApplyOnboardingSelectionInput {
     planId: string;
     cycle: string;
+    /**
+     * See `ImmediatePlanChangeInput.expectedCanceledAt`. The atomic path needs
+     * it for the same reason the sequential one does: without it, the preferred
+     * implementation is the one where the race stays open.
+     */
+    expectedCanceledAt: Date | null;
     /** For TRIAL → null, otherwise period start from `initialPeriodWindow`. */
     periodStart: Date | null;
     periodEnd: Date | null;
@@ -2817,6 +3246,12 @@ interface ApplyOnboardingSelectionResult {
     subscriptionId: string;
     /** null if no redeemPromo callback was provided or the callback returned null. */
     promoRedemption: PromoCodeRedemptionRecord | null;
+    /**
+     * False when the row's cancellation moved since the caller read it, in
+     * which case nothing was written — including the promo redemption, which
+     * shares the transaction.
+     */
+    claimed: boolean;
 }
 /**
  * Callback signature for promo-code redemption WITHIN the onboarding
@@ -2834,14 +3269,46 @@ type RedeemPromoInTransactionCallback = (tx: TransactionContext, subscriptionId:
  * app-specific. The platform service calls `invalidateTenant` in the
  * EntitlementService after a successful adapter call.
  */
+/** What `cancelSubscription` is told to write. Named so both adapters spell
+ * the same shape once rather than each restating it. */
+interface CancelSubscriptionInput {
+    canceledAt: Date;
+    effectiveAt: Date;
+    terminateNow: boolean;
+    minimumTermUntil?: Date;
+}
+/** What `cancelSubscription` answers with. */
+interface CancelSubscriptionResult {
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
+    status: string;
+    /**
+     * True when a cancellation was already recorded and this call changed
+     * nothing — the stored dates are returned instead.
+     *
+     * The caller checks first, but a check and a write are two moments, and two
+     * requests can pass the check before either writes. Straddling a notice
+     * deadline that costs a billing cycle: the first declaration lands on time,
+     * the second recomputes against a later `now`, and an unconditional write
+     * replaces the first answer with one a period further out. An
+     * implementation therefore claims the row only while both cancellation
+     * fields are still empty, and answers `true` here when the claim finds
+     * nothing to claim.
+     */
+    alreadyCanceled: boolean;
+}
 interface TenantSubscriptionWritePort {
     /** Immediate change: set plan + cycle, clear pending fields, optionally reset the period. */
     changePlanImmediate(tenantId: string, input: ImmediatePlanChangeInput): Promise<{
         plan: string;
         billingCycle: string;
+        /** False when the row's cancellation moved since the caller read it. */
+        claimed: boolean;
     }>;
     /** Change at period end: set pending fields. */
-    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<void>;
+    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<{
+        claimed: boolean;
+    }>;
     /**
      * Marks the pending PlanVersion as accepted. Idempotent — a duplicate
      * accept is a no-op. Returns `alreadyAccepted: true` if the status was
@@ -2854,13 +3321,30 @@ interface TenantSubscriptionWritePort {
         alreadyAccepted: boolean;
     }>;
     /**
-     * Cancel the subscription. `immediate=true` → status CANCELED from now;
-     * `false` → canceledAt = currentPeriodEnd, status is preserved.
+     * Record a cancellation. The dates are decided above this port.
+     *
+     * `canceledAt` is when the customer said it; `effectiveAt` is when it
+     * lands. They differ for every ordinary cancellation, because a
+     * subscription cancelled inside its term keeps running, keeps being billed
+     * and keeps its entitlements until the term ends. An adapter that computed
+     * the second from the first — which this one did, as
+     * `immediate ? now : currentPeriodEnd` — was deciding a commercial
+     * question in a persistence layer, and could not see the minimum term or
+     * the notice period at all.
+     *
+     * `terminateNow` flips the status immediately, and is set when the
+     * cancellation is already effective: an operator ending a contract, or the
+     * rules finding nothing left to run — no period, no term, as on a trial.
+     * It is never a client's request. A tenant may always declare a
+     * cancellation and may never shorten the term they are in; what decides
+     * this flag is the date the rules returned, not the date they asked for.
+     *
+     * `minimumTermUntil` extends the stored commitment, and is set only when
+     * the cancellation itself extends it: a declaration made after the notice
+     * deadline buys the following period. Left unset the stored term end is
+     * unchanged, which is the ordinary case.
      */
-    cancelSubscription(tenantId: string, immediate: boolean, now: Date): Promise<{
-        canceledAt: Date | null;
-        status: string;
-    }>;
+    cancelSubscription(tenantId: string, input: CancelSubscriptionInput): Promise<CancelSubscriptionResult>;
     /**
      * Atomic onboarding creation: sets plan + cycle + period window
      * AND optionally calls a promo-redeem callback — all in a
@@ -3112,7 +3596,6 @@ interface RlsBypassPort {
 
 /** Filter for `PlanRepository.list()`. */
 interface PlanListFilter {
-    projectKey: string;
     /** Exclude soft-deleted plans — default `true`. */
     excludeDeleted?: boolean;
     /**
@@ -3146,7 +3629,7 @@ interface PlanListFilter {
 interface PlanRepository {
     list(filter: PlanListFilter): Promise<PlanRow[]>;
     findById(planId: string): Promise<PlanRow | null>;
-    findByKey(projectKey: string, planKey: string): Promise<PlanRow | null>;
+    findByKey(planKey: string): Promise<PlanRow | null>;
     create(data: CreatePlanData): Promise<PlanRow>;
     update(planId: string, data: UpdatePlanData): Promise<PlanRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted plans are filtered from `list` by default. */
@@ -3247,10 +3730,24 @@ interface PlanRepository {
 }
 /** Filter for `BundleRepository.list()`. */
 interface BundleListFilter {
-    projectKey: string;
     /** Exclude soft-deleted bundles — default `true`. */
     excludeDeleted?: boolean;
 }
+/**
+ * What publishing a bundle draft records.
+ *
+ * Named because it was written out three times — the port, and each adapter's
+ * implementation of it — and a signature restated is a contract restated: the
+ * copies can drift, and nothing but a reader would notice.
+ */
+interface PublishBundleVersionMeta {
+    publishedByUserId: string | null;
+    publishedChanges: VersionChange[];
+    nonRegressive: boolean;
+    /** Required — validated by the service before the repository call. */
+    validFrom: Date;
+    validUntil: Date | null;
+}
 /**
  * Adapter for `Bundle` + `BundleVersion` persistence. Consumers implement
  * this against their Prisma tables (`bundles` + `bundle_versions`).
@@ -3269,7 +3766,7 @@ interface BundleListFilter {
 interface BundleRepository {
     list(filter: BundleListFilter): Promise<BundleRow[]>;
     findById(bundleId: string): Promise<BundleRow | null>;
-    findByKey(projectKey: string, bundleKey: string): Promise<BundleRow | null>;
+    findByKey(bundleKey: string): Promise<BundleRow | null>;
     create(data: CreateBundleData): Promise<BundleRow>;
     update(bundleId: string, data: UpdateBundleData): Promise<BundleRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted bundles are filtered from `list` by default. */
@@ -3328,14 +3825,7 @@ interface BundleRepository {
      * if the predecessor carries a `validUntil` — the adapter only
      * persists, it does not validate again.
      */
-    publishDraft(versionId: string, publishMeta: {
-        publishedByUserId: string | null;
-        publishedChanges: VersionChange[];
-        nonRegressive: boolean;
-        /** Required — validated by the service before the repository call. */
-        validFrom: Date;
-        validUntil: Date | null;
-    }, tx?: TransactionContext): Promise<BundleVersionRow>;
+    publishDraft(versionId: string, publishMeta: PublishBundleVersionMeta, tx?: TransactionContext): Promise<BundleVersionRow>;
     /**
      * Hard-discards a draft version (`publishedAt === null`) from the DB.
      * Throws if the version was already published — published versions
@@ -3373,7 +3863,6 @@ interface MarketingProjectionRepository {
 }
 /** Upsert input for a capability from the discovery sync. */
 interface UpsertCapabilityEntryData {
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -3390,7 +3879,6 @@ interface UpsertCapabilityEntryData {
 }
 /** Upsert input for a feature from the discovery sync. */
 interface UpsertFeatureEntryData {
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -3404,7 +3892,6 @@ interface UpsertFeatureEntryData {
 }
 /** Upsert input for a quota from the discovery sync. */
 interface UpsertQuotaEntryData {
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -3434,7 +3921,7 @@ interface SetCatalogEntryReviewData {
  * Prisma tables.
  *
  * Binding:
- * - `upsert*` matches on (`projectKey`, `<key>`) and leaves `i18n`,
+ * - `upsert*` matches on `<key>` and leaves `i18n`,
  *   `sortOrder`, `createdAt` as well as the approval fields (`approvedAt`/
  *   `approvedBy`/`approvedSignature`) **untouched** on an update —
  *   only the code-derived fields + the status (resolved by the service)
@@ -3450,7 +3937,7 @@ interface CatalogEntryRepository {
     upsertCapability(data: UpsertCapabilityEntryData): Promise<CapabilityCatalogEntryRow>;
     upsertFeature(data: UpsertFeatureEntryData): Promise<FeatureCatalogEntryRow>;
     upsertQuota(data: UpsertQuotaEntryData): Promise<QuotaCatalogEntryRow>;
-    retireMissing(projectKey: string, type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
+    retireMissing(type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
     /**
      * Sets or clears the successor pointer of a feature/quota
      * (#39). The sync calls this when a key disappears from the snapshot
@@ -3459,17 +3946,17 @@ interface CatalogEntryRepository {
      * adapters without a `successor_key` column omit the methods, and the sync
      * then skips the pointers with a warn log.
      */
-    setFeatureSuccessor?(projectKey: string, featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
-    setQuotaSuccessor?(projectKey: string, quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
-    findFeature(projectKey: string, featureKey: string): Promise<FeatureCatalogEntryRow | null>;
-    findQuota(projectKey: string, quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
-    setFeatureReview(projectKey: string, featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
-    setQuotaReview(projectKey: string, quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
-    setFeatureI18n(projectKey: string, featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
-    setQuotaI18n(projectKey: string, quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
+    setFeatureSuccessor?(featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
+    setQuotaSuccessor?(quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
+    findFeature(featureKey: string): Promise<FeatureCatalogEntryRow | null>;
+    findQuota(quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
+    setFeatureReview(featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
+    setQuotaReview(quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
+    setFeatureI18n(featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
+    setQuotaI18n(quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
     /** Sets the editable base fields (default locale `label`/`description`). */
-    setFeatureBase(projectKey: string, featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
-    setQuotaBase(projectKey: string, quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
+    setFeatureBase(featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
+    setQuotaBase(quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
 }
 /**
  * Adapter for `promotions`. **No versioning** — promotions are edited
@@ -3477,7 +3964,7 @@ interface CatalogEntryRepository {
  * this against their `promotions` Prisma table.
  */
 interface PromotionRepository {
-    list(filter: PromotionFilter): Promise<PromotionRow[]>;
+    list(): Promise<PromotionRow[]>;
     findById(id: string): Promise<PromotionRow | null>;
     create(data: CreatePromotionData): Promise<PromotionRow>;
     update(id: string, data: UpdatePromotionData): Promise<PromotionRow>;
@@ -3485,13 +3972,14 @@ interface PromotionRepository {
     delete(id: string): Promise<void>;
 }
 /**
- * Adapter for `marketing_settings` — one row per project. `get` returns
- * `null` as long as the SuperAdmin has saved nothing (then the full
- * `availableLocales` pool counts as active). `upsert` creates the row or replaces it.
+ * Adapter for `marketing_settings` — at most one row, which a `CHECK` on the
+ * canonical schema holds rather than convention. `get` returns `null` as long
+ * as the SuperAdmin has saved nothing (then the full `availableLocales` pool
+ * counts as active). `upsert` creates the row or replaces it.
  */
 interface MarketingSettingsRepository {
-    get(projectKey: string): Promise<MarketingSettingsRow | null>;
-    upsert(projectKey: string, data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
+    get(): Promise<MarketingSettingsRow | null>;
+    upsert(data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
 }
 
 /**
@@ -3508,6 +3996,62 @@ interface CheckoutOfferRepository {
     consume(id: string): Promise<CheckoutOfferRow>;
 }
 
+/** Which changes to list. */
+interface SettingsChangeFilter {
+    /** Only changes an operator has, or has not, acknowledged. Omitted: both. */
+    acknowledged?: boolean;
+    /** The most recently recorded ones. Omitted: every matching change. */
+    limit?: number;
+}
+/**
+ * Stores what the installation applied and what changed between two boots.
+ *
+ * `applied_settings` holds one row for the installation; `settings_changes`
+ * holds one row per boot that found the fingerprint moved. An adapter
+ * translates: it does not decide what a change is, and it does not read the
+ * row back into anything that runs.
+ *
+ * Both writes are guarded on the fingerprint the caller read. Several replicas
+ * of one installation start together after one edit of the file, each reads
+ * the same record and each finds the same difference; the guard is what makes
+ * one of them the boot that recorded it and the others boots that found it
+ * recorded. Without it every replica would write the change and mail the
+ * addresses, once per replica.
+ */
+interface AppliedSettingsPort {
+    /** The record, or null before the first boot that could write one. */
+    readApplied(): Promise<AppliedSettingsRecord | null>;
+    /**
+     * Replaces the installation's record — there is only ever the one row —
+     * provided the stored record still carries `expectedFingerprint`: the
+     * fingerprint the caller read, or `null` where it read no record. Returns
+     * whether it did. `false` means the record moved between the caller's read
+     * and this write, and nothing was written: another boot got there first.
+     */
+    writeApplied(record: AppliedSettingsRecord, expectedFingerprint: string | null): Promise<boolean>;
+    /**
+     * Appends a change a boot noticed and replaces the record it supersedes, in
+     * one step: both land, or neither does. Guarded like `writeApplied`, on the
+     * fingerprint of the record the change was noticed against. Returns the
+     * change as stored — the id is the adapter's to assign — or `null` where
+     * the record had already moved on: another boot noticed first, and the
+     * change is that boot's to report.
+     */
+    recordChange(change: NewSettingsChange, record: AppliedSettingsRecord, expectedFingerprint: string): Promise<SettingsChangeRecord | null>;
+    /**
+     * Changes, the most recently recorded first: the order the record went
+     * through them, which the database numbers at each write — not the order
+     * of the moments they carry, which are the recording starts' clocks.
+     */
+    listChanges(filter?: SettingsChangeFilter): Promise<SettingsChangeRecord[]>;
+    /**
+     * Marks a change as seen. Returns the updated record, or null where no
+     * change has that id. A change already acknowledged keeps its first
+     * acknowledgement — repeating the action changes nothing.
+     */
+    acknowledgeChange(id: string, acknowledgedBy: string, acknowledgedAt: Date): Promise<SettingsChangeRecord | null>;
+}
+
 /** Class reference usable as a DI token (e.g. the consumer's `PrismaService`). */
 type PersistenceClassRef = abstract new (...args: never[]) => unknown;
 /** DI token forms a persistence bundle may reference in `inject`. */
@@ -3565,6 +4109,12 @@ interface SaaSiCatPersistenceCore {
     auditQuery?: PersistenceProvider<AuditQueryPort>;
     /** Aggregation for the admin stats dashboard. */
     auditStats?: PersistenceProvider<AuditStatsPort>;
+    /**
+     * The record of the applied configuration (`SettingsModule`). Optional so
+     * an adapter written before it existed keeps working; without it the
+     * platform says once at boot that it is not recording.
+     */
+    appliedSettings?: PersistenceProvider<AppliedSettingsPort>;
 }
 /** Repositories for the entitlement/contract loop (`EntitlementModule`). */
 interface SaaSiCatPersistenceEntitlement {
@@ -3703,6 +4253,8 @@ declare const CATALOG_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -3730,6 +4282,10 @@ declare const CATALOG_ERROR_CODES: {
     readonly QUOTA_NOT_IN_DISCOVERY_SNAPSHOT: "QUOTA_NOT_IN_DISCOVERY_SNAPSHOT";
     readonly DISCOVERY_STATUS_TRANSITION_INVALID: "DISCOVERY_STATUS_TRANSITION_INVALID";
     readonly DISCOVERY_NOT_INITIALIZED: "DISCOVERY_NOT_INITIALIZED";
+    /** The uploaded document is not a plan catalog — unparseable, or not an object. */
+    readonly PLAN_CATALOG_UNREADABLE: "PLAN_CATALOG_UNREADABLE";
+    /** It parsed, and then failed the schema or a cross-field rule. */
+    readonly PLAN_CATALOG_INVALID: "PLAN_CATALOG_INVALID";
 };
 type CatalogErrorCode = (typeof CATALOG_ERROR_CODES)[keyof typeof CATALOG_ERROR_CODES];
 /** Bundle bookings on a tenant subscription. */
@@ -3743,6 +4299,8 @@ declare const BILLING_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3758,6 +4316,72 @@ declare const BILLING_ERROR_CODES: {
     readonly PLAN_NOT_SELF_SERVICE: "PLAN_NOT_SELF_SERVICE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
+    /**
+     * The subscription moved between the read a request was decided on and the
+     * write it attempted, so nothing was written. The caller reloads and asks
+     * again.
+     */
+    readonly SUBSCRIPTION_CHANGED: "SUBSCRIPTION_CHANGED";
+    /**
+     * The tenant has no subscription to act on.
+     *
+     * `SUBSCRIPTION_NOT_FOUND` states the same fact on the read routes. Both
+     * are already on the wire and a code is renamed only deliberately, so both
+     * are named here rather than one being dropped behind a consumer's back.
+     */
+    readonly NO_SUBSCRIPTION: "NO_SUBSCRIPTION";
+    /**
+     * The cancellation date the reader was shown is no longer the one the rules
+     * return, so the confirmation is refused rather than silently applied.
+     * Carries the recomputed dates, so the page can re-ask instead of guessing.
+     */
+    readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /** The subscription has ended; its plan can no longer be changed. */
+    readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
+    /** An active special contract blocks self-service plan changes. */
+    readonly PLAN_LOCKED: "PLAN_LOCKED";
+    /** Current usage of one quota exceeds what the target plan allows. */
+    readonly QUOTA_OVER_TARGET: "QUOTA_OVER_TARGET";
+    /** The change drops features the tenant has today. */
+    readonly FEATURE_LOST: "FEATURE_LOST";
+    readonly FEATURES_LOST: "FEATURES_LOST";
+    /** Target plan and cycle already match what is in place. */
+    readonly NO_CHANGE: "NO_CHANGE";
+    /** A shorter cycle cannot start inside the term already running. */
+    readonly CYCLE_SHORTENS_AT_TERM_END: "CYCLE_SHORTENS_AT_TERM_END";
+    /** A cancelled subscription cannot change its billing cycle. */
+    readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
+    /**
+     * A bundle the tenant already holds runs past the cycle they are moving to.
+     *
+     * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
+     * same rule about a booking that has not been made yet. The two need
+     * different sentences: this one can name the day the obstacle lifts and
+     * tell the reader to cancel the booking, and that advice is wrong for
+     * someone who is only about to book. One template cannot serve both.
+     */
+    readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * Features of the previewed bundle are already covered by the plan or by
+     * another booked bundle. A warning rather than a blocker: paying twice is
+     * the customer's decision, and the preview only has to say so first.
+     */
+    readonly REDUNDANT_FEATURES: "REDUNDANT_FEATURES";
+    /**
+     * A booking's minimum term outlasts the period being cancelled, so the
+     * cancellation takes effect at the end of the term, not of the period.
+     */
+    readonly MINIMUM_TERM_BINDS: "MINIMUM_TERM_BINDS";
+    /**
+     * The previewed bundle requires features that neither the plan nor an
+     * active booking provides.
+     *
+     * The same string is a `StrictModeWarningCode` in `bundle.types.ts`, where
+     * it names the catalogue-authoring reading of the rule and travels with its
+     * own message. This declaration is the booking preview's blocker, which a
+     * tenant reads and therefore needs a shipped text for.
+     */
+    readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
     readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
@@ -3782,6 +4406,8 @@ declare const CONTRACT_ERROR_CODES: {
     readonly SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED: "SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_INVALID_DATE: "SUBSCRIPTION_CONTRACT_INVALID_DATE";
     readonly SUBSCRIPTION_CONTRACT_INVALID_WINDOW: "SUBSCRIPTION_CONTRACT_INVALID_WINDOW";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH";
     readonly SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START: "SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START";
     readonly CHECKOUT_OFFER_NOT_FOUND: "CHECKOUT_OFFER_NOT_FOUND";
     readonly CHECKOUT_OFFER_EXPIRED: "CHECKOUT_OFFER_EXPIRED";
@@ -3850,6 +4476,12 @@ declare const PROMO_ERROR_CODES: {
     readonly PROMO_MAX_REDEMPTIONS_LOWERED: "PROMO_MAX_REDEMPTIONS_LOWERED";
 };
 type PromoErrorCode = (typeof PROMO_ERROR_CODES)[keyof typeof PROMO_ERROR_CODES];
+/** Codes of the settings record (`GET /admin/settings`, the acknowledgement). */
+declare const SETTINGS_ERROR_CODES: {
+    /** No recorded change has this id, or the installation keeps no record at all. */
+    readonly SETTINGS_CHANGE_NOT_FOUND: "SETTINGS_CHANGE_NOT_FOUND";
+};
+type SettingsErrorCode = (typeof SETTINGS_ERROR_CODES)[keyof typeof SETTINGS_ERROR_CODES];
 /**
  * Every exception code the platform emits, in one object.
  *
@@ -3858,6 +4490,8 @@ type PromoErrorCode = (typeof PROMO_ERROR_CODES)[keyof typeof PROMO_ERROR_CODES]
  * removing one may not.
  */
 declare const PLATFORM_ERROR_CODES: {
+    /** No recorded change has this id, or the installation keeps no record at all. */
+    readonly SETTINGS_CHANGE_NOT_FOUND: "SETTINGS_CHANGE_NOT_FOUND";
     readonly PENDING_REGISTRATION_NOT_FOUND: "PENDING_REGISTRATION_NOT_FOUND";
     readonly PENDING_REGISTRATION_EXPIRED: "PENDING_REGISTRATION_EXPIRED";
     readonly INVALID_REGISTRATION_STATE: "INVALID_REGISTRATION_STATE";
@@ -3882,6 +4516,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED: "SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_INVALID_DATE: "SUBSCRIPTION_CONTRACT_INVALID_DATE";
     readonly SUBSCRIPTION_CONTRACT_INVALID_WINDOW: "SUBSCRIPTION_CONTRACT_INVALID_WINDOW";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH";
     readonly SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START: "SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START";
     readonly CHECKOUT_OFFER_NOT_FOUND: "CHECKOUT_OFFER_NOT_FOUND";
     readonly CHECKOUT_OFFER_EXPIRED: "CHECKOUT_OFFER_EXPIRED";
@@ -3899,6 +4535,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3914,6 +4552,72 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_NOT_SELF_SERVICE: "PLAN_NOT_SELF_SERVICE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
+    /**
+     * The subscription moved between the read a request was decided on and the
+     * write it attempted, so nothing was written. The caller reloads and asks
+     * again.
+     */
+    readonly SUBSCRIPTION_CHANGED: "SUBSCRIPTION_CHANGED";
+    /**
+     * The tenant has no subscription to act on.
+     *
+     * `SUBSCRIPTION_NOT_FOUND` states the same fact on the read routes. Both
+     * are already on the wire and a code is renamed only deliberately, so both
+     * are named here rather than one being dropped behind a consumer's back.
+     */
+    readonly NO_SUBSCRIPTION: "NO_SUBSCRIPTION";
+    /**
+     * The cancellation date the reader was shown is no longer the one the rules
+     * return, so the confirmation is refused rather than silently applied.
+     * Carries the recomputed dates, so the page can re-ask instead of guessing.
+     */
+    readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /** The subscription has ended; its plan can no longer be changed. */
+    readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
+    /** An active special contract blocks self-service plan changes. */
+    readonly PLAN_LOCKED: "PLAN_LOCKED";
+    /** Current usage of one quota exceeds what the target plan allows. */
+    readonly QUOTA_OVER_TARGET: "QUOTA_OVER_TARGET";
+    /** The change drops features the tenant has today. */
+    readonly FEATURE_LOST: "FEATURE_LOST";
+    readonly FEATURES_LOST: "FEATURES_LOST";
+    /** Target plan and cycle already match what is in place. */
+    readonly NO_CHANGE: "NO_CHANGE";
+    /** A shorter cycle cannot start inside the term already running. */
+    readonly CYCLE_SHORTENS_AT_TERM_END: "CYCLE_SHORTENS_AT_TERM_END";
+    /** A cancelled subscription cannot change its billing cycle. */
+    readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
+    /**
+     * A bundle the tenant already holds runs past the cycle they are moving to.
+     *
+     * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
+     * same rule about a booking that has not been made yet. The two need
+     * different sentences: this one can name the day the obstacle lifts and
+     * tell the reader to cancel the booking, and that advice is wrong for
+     * someone who is only about to book. One template cannot serve both.
+     */
+    readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * Features of the previewed bundle are already covered by the plan or by
+     * another booked bundle. A warning rather than a blocker: paying twice is
+     * the customer's decision, and the preview only has to say so first.
+     */
+    readonly REDUNDANT_FEATURES: "REDUNDANT_FEATURES";
+    /**
+     * A booking's minimum term outlasts the period being cancelled, so the
+     * cancellation takes effect at the end of the term, not of the period.
+     */
+    readonly MINIMUM_TERM_BINDS: "MINIMUM_TERM_BINDS";
+    /**
+     * The previewed bundle requires features that neither the plan nor an
+     * active booking provides.
+     *
+     * The same string is a `StrictModeWarningCode` in `bundle.types.ts`, where
+     * it names the catalogue-authoring reading of the rule and travels with its
+     * own message. This declaration is the booking preview's blocker, which a
+     * tenant reads and therefore needs a shipped text for.
+     */
+    readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
     readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
@@ -3952,6 +4656,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -3979,6 +4685,10 @@ declare const PLATFORM_ERROR_CODES: {
     readonly QUOTA_NOT_IN_DISCOVERY_SNAPSHOT: "QUOTA_NOT_IN_DISCOVERY_SNAPSHOT";
     readonly DISCOVERY_STATUS_TRANSITION_INVALID: "DISCOVERY_STATUS_TRANSITION_INVALID";
     readonly DISCOVERY_NOT_INITIALIZED: "DISCOVERY_NOT_INITIALIZED";
+    /** The uploaded document is not a plan catalog — unparseable, or not an object. */
+    readonly PLAN_CATALOG_UNREADABLE: "PLAN_CATALOG_UNREADABLE";
+    /** It parsed, and then failed the schema or a cross-field rule. */
+    readonly PLAN_CATALOG_INVALID: "PLAN_CATALOG_INVALID";
     readonly PROMO_CODE_NOT_FOUND: "PROMO_CODE_NOT_FOUND";
     readonly PROMO_CODE_ALREADY_EXISTS: "PROMO_CODE_ALREADY_EXISTS";
     readonly PROMO_CODE_HAS_REDEMPTIONS: "PROMO_CODE_HAS_REDEMPTIONS";
@@ -4021,7 +4731,7 @@ declare const PLATFORM_ERROR_CODES: {
     /** Email already taken (mapped from `PlatformUserExistsError`). */
     readonly EMAIL_EXISTS: "EMAIL_EXISTS";
 };
-type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | RegistrationErrorCode;
+type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | RegistrationErrorCode | SettingsErrorCode;
 /**
  * Shape of a coded error response.
  *
@@ -4766,6 +5476,101 @@ interface SetupConfirmMfaResponse {
     ok: boolean;
 }
 
+/** What the adapter's schema can actually answer about a version's dates. */
+interface PlanVersionMappingFields {
+    /** `validFrom`/`validUntil` are maintained; otherwise both read as null. */
+    validityWindows: boolean;
+    /** `endsAt` exists; otherwise the field is left off the record entirely. */
+    endsAt: boolean;
+}
+/** A `plans` row as either adapter reads it back. */
+interface CanonicalPlanRow {
+    id: string;
+    planKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/** A `plan_versions` row as either adapter reads it back. */
+interface CanonicalPlanVersionRow {
+    id: string;
+    version: number;
+    baseVersionId: string | null;
+    features: unknown;
+    quotas: unknown;
+    monthlyNet: unknown;
+    yearlyNet: unknown;
+    marketed: boolean;
+    publishedAt: Date | null;
+    supersededAt: Date | null;
+    publishedChanges: unknown;
+    changeNote: string;
+    nonRegressive: boolean;
+    validFrom?: Date | null;
+    validUntil?: Date | null;
+    endsAt?: Date | null;
+    createdByUserId: string | null;
+    publishedByUserId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+declare function toPlanRow(row: CanonicalPlanRow): PlanRow;
+/**
+ * `planKey` is passed rather than read off the row: the canonical schema stores
+ * the plan key in `planId`, but an adapter translating a consumer schema with a
+ * real foreign key has to resolve it first, and only the adapter knows which
+ * shape it is looking at.
+ */
+declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string, fields: PlanVersionMappingFields): PlanVersionRow;
+
+/** A `subscription_contracts` row as either adapter reads it back. */
+interface CanonicalContractRow {
+    id: string;
+    tenantId: string;
+    status: string;
+    effectiveFrom: Date;
+    effectiveUntil: Date | null;
+    originalOfferId: string | null;
+    originalPlanVersionId: string | null;
+    originalBundleVersionIds: unknown;
+    entitlementSnapshot: unknown;
+    priceSnapshot: unknown;
+    promotionSnapshots: unknown;
+    promoCodeSnapshots: unknown;
+    termsSnapshot: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** A `contract_line_items` row as either adapter reads it back. */
+interface CanonicalContractLineItemRow {
+    id: string;
+    contractId: string;
+    kind: string;
+    sourceKey: string;
+    sourceVersionId: string | null;
+    titleSnapshot: string;
+    descriptionSnapshot: string | null;
+    quantity: number;
+    unit: string | null;
+    priceNet: unknown;
+    priceGross: unknown;
+    billingCycle: string;
+    currency: string;
+    taxRate: unknown;
+    taxAmount: unknown;
+    minimumTermUntil: Date | null;
+    featuresSnapshot: unknown;
+    quotaEffectsSnapshot: unknown;
+    metadata: unknown;
+    createdAt: Date;
+}
+declare function toSubscriptionContractRecord(row: CanonicalContractRow, lineItems: CanonicalContractLineItemRow[]): SubscriptionContractRecord;
+declare function toContractLineItemRecord(row: CanonicalContractLineItemRow): ContractLineItemRecord;
+
 /** Why a version is editable (for UI badges + audit logs). */
 type VersionEditableReason = 'draft' | 'pre-active';
 interface VersionEditability {
@@ -4780,6 +5585,30 @@ interface VersionEditability {
  */
 declare function isVersionEditable(v: VersionedEntityBase, now?: Date): VersionEditability;
 
+/** The part of a plan card this rule reads and writes. */
+interface RecommendablePlan {
+    planKey: string;
+    highlight: boolean;
+}
+/**
+ * Leaves the mark on at most one plan, in place, and returns the winner.
+ *
+ * `inRequestedLocale` holds the keys of the plans whose card was described in
+ * the language that was asked for. Where a caller has no fallback to model —
+ * the SuperAdmin edits one language at a time — passing every key, or none,
+ * gives the same answer: the first plan in the list order wins.
+ *
+ * The list order is the caller's, and it is what the reader sees, so the
+ * answer is the first recommended card on the page. Said exactly, because it
+ * is easy to overstate: the tie-break inherits whatever order the caller
+ * arranged, and where two plans are equal by every criterion it sorted on,
+ * that order is the repository's. `PlanRepository.list` promises none, so an
+ * adapter that returns rows in a different order each time would move the mark
+ * between two otherwise indistinguishable plans. The shipped adapters order
+ * totally.
+ */
+declare function keepOneRecommended<T extends RecommendablePlan>(plans: T[], inRequestedLocale: ReadonlySet<string>): T | null;
+
 declare const ERROR_MESSAGES_EN: Record<PlatformErrorCode, string>;
 /** Values available for interpolation into a message template. */
 type ErrorMessageParams = Record<string, unknown>;
@@ -4789,6 +5618,23 @@ type ErrorMessageParams = Record<string, unknown>;
  * vanishing.
  */
 declare function formatErrorMessage(template: string, params?: ErrorMessageParams): string;
+/**
+ * An error body this function can read.
+ *
+ * `code` is widened past `PlatformErrorCode` on purpose. The function checks
+ * `typeof body.code === 'string'` and resolves whatever it finds, and the
+ * `overrides` parameter exists so a consumer can bring its own codes — one
+ * consumer carries 98 of them against the platform's 135, overlapping in five.
+ * A closed union here would reject exactly the case the parameter is for, and
+ * the cast that works around it is one a reader has to be told is deliberate.
+ *
+ * `PlatformErrorBody` stays closed: a body the *platform* produces really does
+ * carry a platform code. It is the reader that has to accept more. The same
+ * shape appears in `SaLocale` next door, for the same reason.
+ */
+type ResolvableErrorBody = Omit<Partial<PlatformErrorBody>, 'code'> & Record<string, unknown> & {
+    code?: PlatformErrorCode | (string & {});
+};
 /**
  * Turns an error body into display text.
  *
@@ -4802,8 +5648,8 @@ declare function formatErrorMessage(template: string, params?: ErrorMessageParam
  * second, so a template may name either without the value being duplicated on
  * the wire.
  */
-declare function resolveErrorMessage(body: Partial<PlatformErrorBody> & Record<string, unknown>, overrides?: Partial<Record<string, string>>, defaults?: Partial<Record<string, string>>): string;
+declare function resolveErrorMessage(body: ResolvableErrorBody, overrides?: Partial<Record<string, string>>, defaults?: Partial<Record<string, string>>): string;
 
 declare const ERROR_MESSAGES_DE: Record<PlatformErrorCode, string>;
 
-export { AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionFilter, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SetCatalogEntryReviewData, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, missingRequiresFor, pickActivePromo, promoStatus, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, startOfUtcDay };
+export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, type NewSettingsChange, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RecommendablePlan, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, canonicalJson, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, definedFields, diffSettings, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, keepOneRecommended, missingRequiresFor, pickActivePromo, previousUtcDay, promoStatus, readQuotaRecord, readQuotaValue, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, toBundleStemRow, toContractLineItemRecord, toPlanRow, toPlanVersionRow, toSubscriptionContractRecord };