@saasicat/core 1.0.0-rc.15 → 1.0.0-rc.17

package/dist/index.d.cts

@@ -473,6 +473,275 @@ interface UpdateMarketingProjectionData {
     highlight?: boolean;
 }
 
+/** The address lines a party is named with. Every one of them may be unknown. */
+interface PartyAddress {
+    /** Street and number. */
+    addressLine1: string | null;
+    /** A second line, such as a building or a c/o. */
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string | null;
+}
+/**
+ * What names a legal entity: the name it is registered under and the
+ * identifiers its tax office gave it.
+ *
+ * For a subscriber these are the party a contract was concluded with. Under a
+ * running contract they change only as a correction of that same entity,
+ * recorded with the values it replaced and the reason; contact details change
+ * freely.
+ */
+interface LegalIdentity {
+    /** The registered name, legal form included. */
+    legalName: string;
+    /** VAT identification number. */
+    vatId: string | null;
+    /** The national tax number, where one is stated beside or instead of the VAT id. */
+    taxNumber: string | null;
+}
+/** The fields of the legal identity, the ones a correction may change. */
+type SubscriberIdentityField = keyof LegalIdentity;
+/** How a subscriber is reached, which may change at any time. */
+interface SubscriberContact extends PartyAddress {
+    /** Where invoices will be sent. */
+    invoiceEmail: string | null;
+}
+/** A subscriber's master data, as it stands. */
+type SubscriberDetails = LegalIdentity & SubscriberContact;
+/**
+ * What a subscriber is created with.
+ *
+ * Only the legal name is required. The address, the tax identifiers and the
+ * invoice email stay optional until sign-up asks for them and invoicing
+ * requires them; an absent or blank value is recorded as unknown.
+ */
+type NewSubscriberDetails = Pick<SubscriberDetails, 'legalName'> & Partial<Omit<SubscriberDetails, 'legalName'>>;
+interface SubscriberRecord extends SubscriberDetails {
+    id: string;
+    /**
+     * Assigned when the subscriber is created and never changed: the number,
+     * counted per installation, behind the prefix configured at that moment.
+     */
+    customerNumber: string;
+    /** The tenant this subscriber is live for, or `null` once it has none. */
+    tenantId: string | null;
+    /**
+     * Created by the migration that gave every existing tenant its subscriber,
+     * from the application's own tenant record rather than from what a customer
+     * entered.
+     */
+    migrated: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** What a repository writes for a new subscriber, every detail already settled. */
+interface CreateSubscriberData extends SubscriberDetails {
+    /** The tenant the subscriber is created for and live with. */
+    tenantId: string;
+    /** Put in front of the assigned number; empty for the number alone. */
+    customerNumberPrefix: string;
+}
+/** Contact details to change; a member left out keeps its value. */
+type SubscriberContactChange = Partial<SubscriberContact>;
+/**
+ * A change to a subscriber's legal identity, and what the operator declares it
+ * to be.
+ *
+ * SaaSiCat cannot tell a misspelt name from another company taking over, so the
+ * operator says which: `correction` for the same legal entity — a typo, a wrong
+ * tax identifier, a change of name that entity went through — and `takeover`
+ * for another one, which is a transfer rather than an edit and is refused.
+ */
+interface SubscriberIdentityCorrection {
+    kind: 'correction' | 'takeover';
+    legalName?: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+    /** Why the identity is corrected. Part of the record. */
+    reason: string;
+    /** Who corrects it, as an actor tag the audit log would write. */
+    correctedBy: string;
+}
+/** Identity values by field, holding only the fields a correction changed. */
+type SubscriberIdentityValues = Partial<LegalIdentity>;
+/** What a correction replaces and what it writes, holding only the fields that move. */
+interface SubscriberIdentityDelta {
+    previous: SubscriberIdentityValues;
+    corrected: SubscriberIdentityValues;
+}
+/** What a repository writes for a correction the service has accepted. */
+interface SubscriberCorrectionData {
+    /** The new values; a field equal to what is stored is not recorded. */
+    corrected: SubscriberIdentityValues;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/** One correction of a subscriber's legal identity, as it was recorded. */
+interface SubscriberCorrectionRecord {
+    id: string;
+    subscriberId: string;
+    /** The values the correction replaced. */
+    previous: SubscriberIdentityValues;
+    /** The values it wrote. */
+    corrected: SubscriberIdentityValues;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/** The outcome of writing a correction: nothing is recorded when no value moved. */
+interface SubscriberCorrectionResult {
+    subscriber: SubscriberRecord;
+    correction: SubscriberCorrectionRecord | null;
+}
+
+/** The payment methods SaaSiCat takes, by the names `config/saas.yaml` uses. */
+type PaymentMethodType = 'card' | 'sepa_debit';
+/**
+ * Whom a payment method is set up for. The gateway hands it back unchanged
+ * with its confirmation, which is how the confirmation finds its way to the
+ * sign-up or the subscriber that asked for it.
+ */
+type PaymentMethodSetupSubject = {
+    kind: 'registration';
+    pendingRegistrationId: string;
+} | {
+    kind: 'subscriber';
+    subscriberId: string;
+};
+/** The party the gateway keeps the payment method for: its customer there. */
+interface PaymentMethodHolder {
+    /** The legal name, which a direct debit mandate names. */
+    name: string;
+    /** Where the gateway sends what it sends; `null` lets its form ask. */
+    email: string | null;
+    address: PartyAddress;
+    /**
+     * The customer this party already has at the account, from an earlier
+     * payment method. `null` asks the gateway for a new one.
+     */
+    customerRef: string | null;
+}
+interface StartPaymentMethodSetupInput {
+    subject: PaymentMethodSetupSubject;
+    holder: PaymentMethodHolder;
+    /** What the form offers, from the account's `methods`. */
+    methods: readonly PaymentMethodType[];
+    /** Where the gateway sends the person once the form is done. */
+    successUrl: string;
+    /** Where the gateway sends the person who leaves the form. */
+    cancelUrl: string;
+}
+/** A body and headers exactly as they arrived, before anything parsed them. */
+interface PaymentGatewayCallback {
+    body: string | Uint8Array;
+    headers: Readonly<Record<string, string | readonly string[] | undefined>>;
+}
+interface PaymentMethodSetupSession {
+    /**
+     * The gateway's identifier of the session, unique within its account — and
+     * an adapter that has no session of its own makes one per start rather than
+     * a constant. A session is confirmed once, which the event log holds, so a
+     * value two starts share lets the second confirmation through as the
+     * duplicate it is not.
+     */
+    sessionRef: string;
+    /** The gateway's form, where the person is sent next. */
+    redirectUrl: string;
+    /** The customer the payment method is set up for, created if none was given. */
+    customerRef: string;
+    /**
+     * A confirmation the gateway already holds when the session starts, to be
+     * handled like any callback. Only a gateway without a form of its own has
+     * one — the development gateway; a real gateway confirms through its
+     * webhook.
+     */
+    immediateCallback?: PaymentGatewayCallback;
+}
+/**
+ * What SaaSiCat keeps about a payment method: enough to show which one it is,
+ * never enough to pay with it (`SC-PRIV-005`).
+ */
+interface MaskedPaymentMethod {
+    type: PaymentMethodType;
+    /** The card network, such as `visa`; `null` for a direct debit. */
+    brand: string | null;
+    /** The last four digits of the card number or the IBAN. */
+    last4: string;
+    /** 1–12; `null` for a direct debit. */
+    expiryMonth: number | null;
+    /** Four digits; `null` for a direct debit. */
+    expiryYear: number | null;
+    /** ISO 3166-1 alpha-2 of the card's issuer or the bank account, where the gateway says. */
+    country: string | null;
+    /** The bank code of a direct debit account, where the gateway says. */
+    bankCode: string | null;
+    /** The reference of a direct debit mandate, which a debit announcement quotes. */
+    mandateReference: string | null;
+}
+/** A payment method the gateway confirmed, with the references that reach it there. */
+interface ConfirmedPaymentMethod extends MaskedPaymentMethod {
+    customerRef: string;
+    paymentMethodRef: string;
+}
+/** A gateway callback, verified and translated. */
+type PaymentGatewayEvent = {
+    kind: 'payment-method-confirmed';
+    /** The gateway's identifier of the event, unique within its account. */
+    eventId: string;
+    /** When the gateway says it happened. */
+    occurredAt: Date;
+    sessionRef: string;
+    subject: PaymentMethodSetupSubject;
+    paymentMethod: ConfirmedPaymentMethod;
+} | {
+    kind: 'payment-method-setup-failed';
+    eventId: string;
+    occurredAt: Date;
+    sessionRef: string;
+    subject: PaymentMethodSetupSubject;
+} | {
+    /** Genuine, and nothing SaaSiCat acts on. */
+    kind: 'unhandled';
+    eventId: string;
+    occurredAt: Date;
+    /** The gateway's own name for the event, for the log. */
+    type: string;
+};
+/**
+ * One account at a payment gateway: its keys, its form and its callbacks.
+ *
+ * An adapter is bound to one account, and `config/saas.yaml#payments.accounts`
+ * names it. Mollie or any other provider is another adapter behind this port.
+ */
+interface PaymentGateway {
+    /** The provider, as `config/saas.yaml` names it, e.g. `stripe`. */
+    readonly provider: string;
+    /**
+     * Opens the gateway's form for a payment method. Nothing is confirmed until
+     * the gateway says so through `readCallback`.
+     */
+    startPaymentMethodSetup(input: StartPaymentMethodSetupInput): Promise<PaymentMethodSetupSession>;
+    /**
+     * Verifies a callback with the account's secret and translates it.
+     * Throws `PaymentCallbackRejectedError` for anything the gateway did not
+     * send, before a single field of it is trusted.
+     */
+    readCallback(callback: PaymentGatewayCallback): Promise<PaymentGatewayEvent>;
+}
+/**
+ * A callback that is not the gateway's: a missing or wrong signature, a stale
+ * timestamp, a body that was altered. Nothing is read from it.
+ */
+declare class PaymentCallbackRejectedError extends Error {
+    readonly code = "PAYMENT_CALLBACK_REJECTED";
+    constructor(reason: string);
+}
+/** Realm-safe type guard, like `isPlatformUserExistsError`. */
+declare function isPaymentCallbackRejectedError(err: unknown): err is PaymentCallbackRejectedError;
+
 type FeatureKey = string;
 type PlanId = string;
 type QuotaKey = string;
@@ -589,8 +858,57 @@ interface PlanCatalogNotifications {
     /** Addresses mailed when a start finds the applied settings changed. */
     settingsChanged?: string[];
 }
-interface PlanCatalog {
-    schemaVersion: 1;
+/**
+ * The legal entity on the operator's side of every contract the installation
+ * concludes. A contract copies it on the day it is concluded; only the legal
+ * name is required while nothing is invoiced.
+ */
+interface PlanCatalogIssuer {
+    legalName: string;
+    addressLine1?: string;
+    addressLine2?: string;
+    postalCode?: string;
+    city?: string;
+    /** ISO 3166-1 alpha-2. */
+    country?: string;
+    vatId?: string;
+    taxNumber?: string;
+}
+/** How the parties contracts are concluded with are numbered. */
+interface PlanCatalogSubscribers {
+    /**
+     * Put in front of every customer number assigned from the next start on.
+     * A number keeps the prefix it was assigned with.
+     */
+    customerNumberPrefix?: string;
+}
+/** One account at a payment gateway, by the name `PlanCatalogPayments.accounts` gives it. */
+interface PlanCatalogPaymentAccount {
+    /** The provider its bound adapter names itself as, e.g. `stripe`. */
+    provider: string;
+    /** What a new payment method may be at this account. Read for `newPaymentMethods` only. */
+    methods?: PaymentMethodType[];
+}
+/**
+ * The gateway accounts payment methods are taken through. Their keys are bound
+ * in code from the environment, never written into the file.
+ */
+interface PlanCatalogPayments {
+    /** The account a new payment method is taken at. Omitted, none is taken. */
+    newPaymentMethods?: string;
+    /** The origins a gateway's form may send a person back to, such as `https://app.example.com`. */
+    returnUrlOrigins: string[];
+    /** Every account taking new payment methods or holding a reference in use. */
+    accounts: Record<string, PlanCatalogPaymentAccount>;
+}
+/**
+ * The part of `config/saas.yaml` that is configuration rather than catalogue.
+ *
+ * Declared apart so it can be handed on whole — a database catalogue takes its
+ * settings from the file and its plans from the database — without anybody
+ * listing the blocks again. `CATALOGUE_KEYS` names what is left over.
+ */
+interface PlanCatalogSettings {
     /** App identity (branding + version), see PlanCatalogApp. */
     app: PlanCatalogApp;
     /** ISO-4217 currency code. */
@@ -603,6 +921,15 @@ interface PlanCatalog {
     marketing?: PlanCatalogMarketing;
     /** Who is told when the settings change between two starts. Optional. */
     notifications?: PlanCatalogNotifications;
+    /** The operator's side of every contract. Optional until invoicing requires it. */
+    issuer?: PlanCatalogIssuer;
+    /** How subscribers are numbered. Optional. */
+    subscribers?: PlanCatalogSubscribers;
+    /** The payment gateway accounts. Optional until payment methods are taken. */
+    payments?: PlanCatalogPayments;
+}
+interface PlanCatalog extends PlanCatalogSettings {
+    schemaVersion: 1;
     features?: FeatureDef[];
     /**
      * Optional. When omitted, plans come exclusively from the
@@ -2125,6 +2452,14 @@ interface SettingsDifference {
  * property the schema declares lands on one side.
  */
 declare const CATALOGUE_KEYS: ReadonlySet<keyof PlanCatalog>;
+/**
+ * The settings of a catalogue, typed, for handing them on as a whole.
+ *
+ * The same selection as `settingsSubtreeOf`, which is why it is that function:
+ * a caller that listed the blocks it passes on would drop the next one the
+ * schema gains, and nothing would say so.
+ */
+declare function planCatalogSettingsOf(catalog: PlanCatalog): PlanCatalogSettings;
 /** Everything in the catalogue that is configuration, as it was resolved. */
 declare function settingsSubtreeOf(catalog: PlanCatalog): AppliedSettingsValues;
 /**
@@ -2832,9 +3167,40 @@ interface SubscriptionContractPriceSnapshot {
     vatRate: number;
     totalGross: number;
 }
-interface SubscriptionContractRecord {
+/**
+ * The subscriber as a contract copied it on the day it was concluded.
+ *
+ * The invoice email is not part of it: it says how the party is reached, not
+ * who the party is, and a contract is kept for years after an address like that
+ * stopped mattering.
+ */
+interface ContractSubscriberParty extends LegalIdentity, PartyAddress {
+    customerNumber: string;
+}
+/** The issuer as `config/saas.yaml` named it on the day a contract was concluded. */
+interface ContractIssuerParty extends LegalIdentity, PartyAddress {
+}
+/** Who a contract is between, copied when it is concluded. */
+interface SubscriptionContractParties {
+    subscriberId: string;
+    subscriber: ContractSubscriberParty;
+    /** `null` where `config/saas.yaml` named no issuer that day. */
+    issuer: ContractIssuerParty | null;
+}
+interface SubscriptionContractRecord extends SubscriptionContractParties {
     id: string;
+    /**
+     * The tenant the contract was concluded for, kept as a trace. The contract
+     * belongs to its subscriber and outlives the tenant.
+     */
     tenantId: string;
+    /**
+     * The parties were copied by the migration that attached contracts
+     * concluded before subscribers existed, not on the day the contract was
+     * concluded. Either party may have changed in between, so such a copy is
+     * never presented as what was agreed.
+     */
+    partiesMigrated: boolean;
     status: SubscriptionContractStatus;
     effectiveFrom: Date;
     effectiveUntil: Date | null;
@@ -2851,6 +3217,11 @@ interface SubscriptionContractRecord {
     updatedAt: Date;
 }
 type NewContractLineItemData = Omit<ContractLineItemRecord, 'id' | 'contractId' | 'createdAt'>;
+/**
+ * A contract as a caller asks for it. The parties are not among it: the
+ * platform copies them from the tenant's subscriber and the configuration when
+ * the contract is written, so no caller can name a party of its own.
+ */
 interface CreateSubscriptionContractData {
     tenantId: string;
     status?: SubscriptionContractStatus;
@@ -2866,6 +3237,10 @@ interface CreateSubscriptionContractData {
     termsSnapshot?: Record<string, unknown> | null;
     lineItems: NewContractLineItemData[];
 }
+/** What a repository writes: the contract as asked for, with the parties the platform copied. */
+interface NewSubscriptionContractData extends CreateSubscriptionContractData {
+    parties: SubscriptionContractParties;
+}
 interface TerminateSubscriptionContractData {
     effectiveUntil: Date;
     /**
@@ -3085,8 +3460,11 @@ interface SubscriptionContractRepository {
      * instead of drawing an extra pool connection (starvation guard, #70).
      */
     findActiveByTenantId(tenantId: string, asOf?: Date, tx?: TransactionContext): Promise<SubscriptionContractRecord | null>;
-    /** With `tx`, the contract is written on that transaction and undone with it. */
-    create(data: CreateSubscriptionContractData, tx?: TransactionContext): Promise<SubscriptionContractRecord>;
+    /**
+     * Writes the contract with the parties it names. With `tx`, the contract is
+     * written on that transaction and undone with it.
+     */
+    create(data: NewSubscriptionContractData, tx?: TransactionContext): Promise<SubscriptionContractRecord>;
     /**
      * The contract concluded from a checkout offer (`originalOfferId`), or
      * `null` when none was. An offer is consumed once and so yields one
@@ -3096,6 +3474,39 @@ interface SubscriptionContractRepository {
     findByOriginalOfferId(offerId: string, tx?: TransactionContext): Promise<SubscriptionContractRecord | null>;
     terminate(contractId: string, data: TerminateSubscriptionContractData): Promise<SubscriptionContractRecord>;
 }
+/**
+ * The parties contracts are concluded with, their link to the tenant they are
+ * live for, and the corrections of their legal identity.
+ *
+ * A subscriber has at most one live tenant and a tenant at most one live
+ * subscriber; the database holds both, so two callers creating one for the
+ * same tenant at once end with one.
+ */
+interface SubscriberRepository {
+    /**
+     * Creates a subscriber, assigns its customer number, and makes it the
+     * tenant's live subscriber — all or nothing. `null` when the tenant already
+     * has a live subscriber, in which case nothing is written and the caller's
+     * transaction stays usable.
+     */
+    createForTenant(data: CreateSubscriberData, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    findById(subscriberId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /** The subscriber live for this tenant, or `null` when it has none. */
+    findByTenantId(tenantId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /** Writes the members given and keeps the rest; `null` when no such subscriber exists. */
+    updateContact(subscriberId: string, change: SubscriberContactChange, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /**
+     * Writes a correction of the legal identity and records it, in one step:
+     * the subscriber is read and changed under a lock, so the values recorded
+     * as replaced are the ones this write replaced even when two corrections
+     * arrive at once. A field whose stored value already equals the corrected
+     * one is left out of the record, and when none differs nothing is written
+     * and `correction` is `null`. `null` when no such subscriber exists.
+     */
+    correctIdentity(subscriberId: string, data: SubscriberCorrectionData, tx?: TransactionContext): Promise<SubscriberCorrectionResult | null>;
+    /** Every correction of this subscriber, the latest first. */
+    listCorrections(subscriberId: string): Promise<SubscriberCorrectionRecord[]>;
+}
 /**
  * Display form of a subscription for the tenant self-service UI.
  * Richer than `SubscriptionRecord` (which is only the aggregation form); contains
@@ -4053,6 +4464,160 @@ interface CheckoutOfferRepository {
     consume(id: string, tx?: TransactionContext): Promise<CheckoutOfferRow>;
 }
 
+/** `ACTIVE` is the one in use; `REPLACED` is one a later payment method took over from. */
+type SubscriberPaymentMethodStatus = 'ACTIVE' | 'REPLACED';
+interface SubscriberPaymentMethodRecord extends ConfirmedPaymentMethod {
+    id: string;
+    subscriberId: string;
+    /** The account in `config/saas.yaml#payments.accounts` the references belong to. */
+    gatewayAccount: string;
+    /** The provider of that account when the payment method was confirmed. */
+    provider: string;
+    status: SubscriberPaymentMethodStatus;
+    /** When the gateway confirmed the payment method. */
+    confirmedAt: Date;
+    /** When a later payment method took over; `null` while this one is in use. */
+    replacedAt: Date | null;
+    createdAt: Date;
+}
+/** What a repository records for a payment method the gateway confirmed. */
+interface RecordSubscriberPaymentMethodData extends ConfirmedPaymentMethod {
+    subscriberId: string;
+    gatewayAccount: string;
+    provider: string;
+    confirmedAt: Date;
+}
+/**
+ * - `activated`: it is the subscriber's payment method now, and the one it
+ *   replaced, if any, is `REPLACED`.
+ * - `already-recorded`: the account's reference was recorded before; nothing
+ *   was written, and `method` is the row that holds it.
+ * - `superseded`: the subscriber's payment method in use was confirmed after
+ *   this one, so this one is recorded as already replaced — confirmations can
+ *   arrive in another order than the forms were filled in.
+ */
+type RecordSubscriberPaymentMethodOutcome = 'activated' | 'already-recorded' | 'superseded';
+/**
+ * A change of payment method a tenant started: the gateway session it opened
+ * for the subscriber. A confirmation is recorded only against the setup it
+ * belongs to, so a callback that names another subscriber than the session was
+ * opened for changes nobody's payment method.
+ */
+interface SubscriberPaymentMethodSetupData {
+    subscriberId: string;
+    gatewayAccount: string;
+    /** The gateway's session, unique within the account. */
+    sessionRef: string;
+    /** The customer the gateway keeps the payment method under. */
+    customerRef: string;
+    startedAt: Date;
+}
+/** Which setup a confirmation claims to complete. */
+interface SubscriberPaymentMethodSetupMatch {
+    gatewayAccount: string;
+    sessionRef: string;
+    subscriberId: string;
+}
+interface RecordSubscriberPaymentMethodResult {
+    method: SubscriberPaymentMethodRecord;
+    outcome: RecordSubscriberPaymentMethodOutcome;
+}
+
+/** A gateway event, as the log records it. */
+interface PaymentEventClaim {
+    /** The account the event came from; an event identifier is unique only within it. */
+    gatewayAccount: string;
+    eventId: string;
+    provider: string;
+    /** The gateway session the event is about, where it is about one. */
+    sessionId: string | null;
+    kind: PaymentGatewayEvent['kind'];
+    /** What the event said, without anything that names or reaches a person. */
+    summary: Record<string, unknown>;
+}
+/**
+ * The events a gateway sent, each handled once.
+ *
+ * Gateways deliver at least once, so the same event arrives again after a
+ * timeout or a retry. An event is claimed on the transaction that writes what
+ * it changes: when that transaction rolls back, the claim goes with it and the
+ * gateway's retry is handled rather than discarded as a duplicate.
+ */
+interface PaymentEventLog {
+    /**
+     * Records the event and returns `true`, or returns `false` when this account
+     * already recorded it, writing nothing.
+     *
+     * The duplicate must not raise: on PostgreSQL an error aborts the
+     * transaction it happened on, and the caller's transaction has to stay
+     * usable. An `INSERT … ON CONFLICT DO NOTHING` does both — and when another
+     * transaction holds the same claim uncommitted, it waits for that one and
+     * answers by its outcome.
+     *
+     * A confirmation of a session this account already confirmed is a duplicate
+     * as well, whatever its `eventId`: one session is set up once, and a gateway
+     * may report it through more than one event. `sql/constraints.postgres.sql`
+     * holds that as a second unique index, and the untargeted `DO NOTHING`
+     * answers for it too.
+     */
+    claim(claim: PaymentEventClaim, tx: TransactionContext): Promise<boolean>;
+    /**
+     * Takes the session off a claim whose event changed nothing, so the next
+     * event about that session is handled instead of taken for the duplicate it
+     * is not. The claim itself stays: that one event is never handled twice.
+     *
+     * The session is held from the claim onwards, which is what keeps two
+     * confirmations delivered at once from both taking effect; an event that
+     * turned out to have nothing to do gives it back on the same transaction.
+     */
+    releaseSession(gatewayAccount: string, eventId: string, tx: TransactionContext): Promise<void>;
+}
+/**
+ * The payment methods of subscribers, as references at the gateway accounts
+ * that confirmed them.
+ *
+ * A subscriber has at most one `ACTIVE` payment method; the database holds
+ * that, so two confirmations recorded at once for one subscriber end with one.
+ */
+interface SubscriberPaymentMethodRepository {
+    /**
+     * Records a confirmed payment method for its subscriber, under a lock on the
+     * subscriber so two confirmations take turns. See
+     * `RecordSubscriberPaymentMethodOutcome` for the three outcomes.
+     */
+    recordConfirmed(data: RecordSubscriberPaymentMethodData, tx?: TransactionContext): Promise<RecordSubscriberPaymentMethodResult>;
+    /** The subscriber's payment method in use, or `null` when it has none. */
+    findActive(subscriberId: string, tx?: TransactionContext): Promise<SubscriberPaymentMethodRecord | null>;
+    /**
+     * The payment method an account's reference names, whatever its status.
+     *
+     * The one read that reaches a payment method a newer one replaced, which is
+     * how `@saasicat/persistence-testing` verifies that an implementation keeps
+     * the history rather than overwriting the row (`SC-PRIC-030`).
+     */
+    findByReference(gatewayAccount: string, paymentMethodRef: string, tx?: TransactionContext): Promise<SubscriberPaymentMethodRecord | null>;
+    /** Every account that holds a payment method in use, each once. */
+    accountsInUse(): Promise<string[]>;
+    /**
+     * Records a change of payment method a tenant started, open until its
+     * confirmation completes it.
+     *
+     * One session is one setup: the account and the session are unique together,
+     * and a second setup for a session already recorded raises. A gateway hands
+     * out a session per start, so an adapter that returns one twice is the
+     * defect this refuses to write over.
+     */
+    recordSetup(data: SubscriberPaymentMethodSetupData, tx?: TransactionContext): Promise<void>;
+    /**
+     * Completes the open setup the account, the session and the subscriber all
+     * name, and returns `true` — or returns `false`, writing nothing, when no
+     * open setup matches all three: none was started, it was started for another
+     * subscriber, or it is complete already. A single conditional write, so two
+     * confirmations for one setup complete it once.
+     */
+    completeSetup(match: SubscriberPaymentMethodSetupMatch, completedAt: Date, tx?: TransactionContext): Promise<boolean>;
+}
+
 /** Which changes to list. */
 interface SettingsChangeFilter {
     /** Only changes an operator has, or has not, acknowledged. Omitted: both. */
@@ -4178,6 +4743,8 @@ interface SaaSiCatPersistenceEntitlement {
     subscriptionRepository: PersistenceProvider<SubscriptionRepository>;
     planVersionRepository: PersistenceProvider<PlanVersionRepository>;
     subscriptionContractRepository?: PersistenceProvider<SubscriptionContractRepository>;
+    /** The parties contracts are concluded with; required wherever contracts are written. */
+    subscriberRepository?: PersistenceProvider<SubscriberRepository>;
     subscriptionBundleRepository?: PersistenceProvider<SubscriptionBundleRepository>;
     bundleRepository?: PersistenceProvider<BundleRepository>;
 }
@@ -4204,6 +4771,15 @@ interface SaaSiCatPersistenceTenantBilling {
     subscriptionWritePort: PersistenceProvider<TenantSubscriptionWritePort>;
     usageSnapshotPort?: PersistenceProvider<UsageSnapshotPort>;
 }
+/**
+ * The record of payment gateway callbacks and the payment methods they confirm
+ * (`payments` in `SaaSiCatModule.forRoot`). Both are written on the transaction
+ * a callback is handled on, so they come from the adapter that runs it.
+ */
+interface SaaSiCatPersistencePayments {
+    paymentEventLog: PersistenceProvider<PaymentEventLog>;
+    subscriberPaymentMethodRepository: PersistenceProvider<SubscriberPaymentMethodRepository>;
+}
 /** Read/write backing for the standard SuperAdmin resource pages. */
 interface SaaSiCatPersistenceAdminResources {
     resources: PersistenceProvider<AdminResourcesPort>;
@@ -4238,6 +4814,8 @@ interface SaaSiCatPersistenceAdapter {
     /** Tenant, user, audit and subscription resources for the SuperAdmin UI. */
     adminResources?: SaaSiCatPersistenceAdminResources;
     promo?: SaaSiCatPersistencePromo;
+    /** Payment gateway callbacks and subscriber payment methods. */
+    payments?: SaaSiCatPersistencePayments;
     /** DB hydration of the plan catalog at boot (`PlanCatalogModule`). */
     planCatalogReadSink?: PersistenceProvider<PlanCatalogReadSink>;
     /** One-shot `saas.yaml → DB` import. */
@@ -4491,6 +5069,32 @@ declare const CONTRACT_ERROR_CODES: {
     readonly SUBSCRIPTION_CONTRACT_ALREADY_CLOSED: "SUBSCRIPTION_CONTRACT_ALREADY_CLOSED";
 };
 type ContractErrorCode = (typeof CONTRACT_ERROR_CODES)[keyof typeof CONTRACT_ERROR_CODES];
+/** The parties contracts are concluded with (`SubscriberService`), and their absence. */
+declare const SUBSCRIBER_ERROR_CODES: {
+    /**
+     * A contract, a plan change or a booking for a tenant that has no
+     * subscriber. Nothing is agreed or charged without the party to it.
+     * Carries `tenantId`.
+     */
+    readonly SUBSCRIBER_REQUIRED: "SUBSCRIBER_REQUIRED";
+    /** The tenant already has a live subscriber. Carries `tenantId`. */
+    readonly SUBSCRIBER_ALREADY_EXISTS: "SUBSCRIBER_ALREADY_EXISTS";
+    readonly SUBSCRIBER_NOT_FOUND: "SUBSCRIBER_NOT_FOUND";
+    readonly SUBSCRIBER_LEGAL_NAME_REQUIRED: "SUBSCRIBER_LEGAL_NAME_REQUIRED";
+    /**
+     * A detail that has a form — the country, the invoice email — is not in it,
+     * or one sign-up requires — the billing address — is missing. Carries `field`.
+     */
+    readonly SUBSCRIBER_DETAIL_INVALID: "SUBSCRIBER_DETAIL_INVALID";
+    /** A contact change named a field of the legal identity. Carries `field`. */
+    readonly SUBSCRIBER_IDENTITY_NOT_A_CONTACT: "SUBSCRIBER_IDENTITY_NOT_A_CONTACT";
+    readonly SUBSCRIBER_CORRECTION_REASON_REQUIRED: "SUBSCRIBER_CORRECTION_REASON_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_ACTOR_REQUIRED: "SUBSCRIBER_CORRECTION_ACTOR_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
+    /** The operator declared another legal entity: that is a transfer, not an edit. */
+    readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
+};
+type SubscriberErrorCode = (typeof SUBSCRIBER_ERROR_CODES)[keyof typeof SUBSCRIBER_ERROR_CODES];
 /** Self-service registration funnel (`PendingRegistration`). */
 declare const REGISTRATION_ERROR_CODES: {
     readonly PENDING_REGISTRATION_NOT_FOUND: "PENDING_REGISTRATION_NOT_FOUND";
@@ -4519,6 +5123,12 @@ declare const AUTH_ERROR_CODES: {
     /** Neither `tenantId` nor `userId` could be resolved from the request. */
     readonly TENANT_CONTEXT_MISSING: "TENANT_CONTEXT_MISSING";
     readonly TENANT_ADMIN_REQUIRED: "TENANT_ADMIN_REQUIRED";
+    /**
+     * The tenant's billing area — its payment method, and later its invoices
+     * and account — needs the billing permission, which the application maps
+     * to its roles and the tenant's administrator holds by default.
+     */
+    readonly BILLING_PERMISSION_REQUIRED: "BILLING_PERMISSION_REQUIRED";
     readonly SUPER_ADMIN_REQUIRED: "SUPER_ADMIN_REQUIRED";
     /** TOTP MFA has never been set up for this user. */
     readonly MFA_NOT_SET_UP: "MFA_NOT_SET_UP";
@@ -4549,6 +5159,24 @@ declare const PROMO_ERROR_CODES: {
     readonly PROMO_MAX_REDEMPTIONS_LOWERED: "PROMO_MAX_REDEMPTIONS_LOWERED";
 };
 type PromoErrorCode = (typeof PROMO_ERROR_CODES)[keyof typeof PROMO_ERROR_CODES];
+/** Payment methods and the gateways that confirm them. */
+declare const PAYMENT_ERROR_CODES: {
+    /**
+     * No gateway account takes new payment methods:
+     * `config/saas.yaml#payments.newPaymentMethods` names none.
+     */
+    readonly PAYMENTS_NOT_CONFIGURED: "PAYMENTS_NOT_CONFIGURED";
+    /** A callback arrived for an account `config/saas.yaml#payments.accounts` does not name. Carries `account`. */
+    readonly PAYMENT_GATEWAY_ACCOUNT_UNKNOWN: "PAYMENT_GATEWAY_ACCOUNT_UNKNOWN";
+    /** A callback the gateway did not send: its signature does not verify. */
+    readonly PAYMENT_CALLBACK_REJECTED: "PAYMENT_CALLBACK_REJECTED";
+    /**
+     * A success or cancel URL at an origin `config/saas.yaml#payments.returnUrlOrigins`
+     * does not name. Carries `field`.
+     */
+    readonly PAYMENT_RETURN_URL_NOT_ALLOWED: "PAYMENT_RETURN_URL_NOT_ALLOWED";
+};
+type PaymentErrorCode = (typeof PAYMENT_ERROR_CODES)[keyof typeof PAYMENT_ERROR_CODES];
 /** Codes of the settings record (`GET /admin/settings`, the acknowledgement). */
 declare const SETTINGS_ERROR_CODES: {
     /** No recorded change has this id, or the installation keeps no record at all. */
@@ -4565,6 +5193,20 @@ type SettingsErrorCode = (typeof SETTINGS_ERROR_CODES)[keyof typeof SETTINGS_ERR
 declare const PLATFORM_ERROR_CODES: {
     /** No recorded change has this id, or the installation keeps no record at all. */
     readonly SETTINGS_CHANGE_NOT_FOUND: "SETTINGS_CHANGE_NOT_FOUND";
+    /**
+     * No gateway account takes new payment methods:
+     * `config/saas.yaml#payments.newPaymentMethods` names none.
+     */
+    readonly PAYMENTS_NOT_CONFIGURED: "PAYMENTS_NOT_CONFIGURED";
+    /** A callback arrived for an account `config/saas.yaml#payments.accounts` does not name. Carries `account`. */
+    readonly PAYMENT_GATEWAY_ACCOUNT_UNKNOWN: "PAYMENT_GATEWAY_ACCOUNT_UNKNOWN";
+    /** A callback the gateway did not send: its signature does not verify. */
+    readonly PAYMENT_CALLBACK_REJECTED: "PAYMENT_CALLBACK_REJECTED";
+    /**
+     * A success or cancel URL at an origin `config/saas.yaml#payments.returnUrlOrigins`
+     * does not name. Carries `field`.
+     */
+    readonly PAYMENT_RETURN_URL_NOT_ALLOWED: "PAYMENT_RETURN_URL_NOT_ALLOWED";
     readonly PENDING_REGISTRATION_NOT_FOUND: "PENDING_REGISTRATION_NOT_FOUND";
     readonly PENDING_REGISTRATION_EXPIRED: "PENDING_REGISTRATION_EXPIRED";
     readonly INVALID_REGISTRATION_STATE: "INVALID_REGISTRATION_STATE";
@@ -4580,6 +5222,28 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_NOT_AVAILABLE: "PLAN_NOT_AVAILABLE";
     readonly PLAN_NOT_SELECTED: "PLAN_NOT_SELECTED";
     readonly MODEL_NOT_AVAILABLE: "MODEL_NOT_AVAILABLE";
+    /**
+     * A contract, a plan change or a booking for a tenant that has no
+     * subscriber. Nothing is agreed or charged without the party to it.
+     * Carries `tenantId`.
+     */
+    readonly SUBSCRIBER_REQUIRED: "SUBSCRIBER_REQUIRED";
+    /** The tenant already has a live subscriber. Carries `tenantId`. */
+    readonly SUBSCRIBER_ALREADY_EXISTS: "SUBSCRIBER_ALREADY_EXISTS";
+    readonly SUBSCRIBER_NOT_FOUND: "SUBSCRIBER_NOT_FOUND";
+    readonly SUBSCRIBER_LEGAL_NAME_REQUIRED: "SUBSCRIBER_LEGAL_NAME_REQUIRED";
+    /**
+     * A detail that has a form — the country, the invoice email — is not in it,
+     * or one sign-up requires — the billing address — is missing. Carries `field`.
+     */
+    readonly SUBSCRIBER_DETAIL_INVALID: "SUBSCRIBER_DETAIL_INVALID";
+    /** A contact change named a field of the legal identity. Carries `field`. */
+    readonly SUBSCRIBER_IDENTITY_NOT_A_CONTACT: "SUBSCRIBER_IDENTITY_NOT_A_CONTACT";
+    readonly SUBSCRIBER_CORRECTION_REASON_REQUIRED: "SUBSCRIBER_CORRECTION_REASON_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_ACTOR_REQUIRED: "SUBSCRIBER_CORRECTION_ACTOR_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
+    /** The operator declared another legal entity: that is a transfer, not an edit. */
+    readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
     readonly CHECKOUT_OFFER_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_LINE_ITEMS_REQUIRED";
     readonly CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED: "CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED";
     readonly CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED";
@@ -4800,6 +5464,12 @@ declare const PLATFORM_ERROR_CODES: {
     /** Neither `tenantId` nor `userId` could be resolved from the request. */
     readonly TENANT_CONTEXT_MISSING: "TENANT_CONTEXT_MISSING";
     readonly TENANT_ADMIN_REQUIRED: "TENANT_ADMIN_REQUIRED";
+    /**
+     * The tenant's billing area — its payment method, and later its invoices
+     * and account — needs the billing permission, which the application maps
+     * to its roles and the tenant's administrator holds by default.
+     */
+    readonly BILLING_PERMISSION_REQUIRED: "BILLING_PERMISSION_REQUIRED";
     readonly SUPER_ADMIN_REQUIRED: "SUPER_ADMIN_REQUIRED";
     /** TOTP MFA has never been set up for this user. */
     readonly MFA_NOT_SET_UP: "MFA_NOT_SET_UP";
@@ -4820,7 +5490,7 @@ declare const PLATFORM_ERROR_CODES: {
     /** Email already taken (mapped from `PlatformUserExistsError`). */
     readonly EMAIL_EXISTS: "EMAIL_EXISTS";
 };
-type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | RegistrationErrorCode | SettingsErrorCode;
+type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | SubscriberErrorCode | RegistrationErrorCode | PaymentErrorCode | SettingsErrorCode;
 /**
  * Shape of a coded error response.
  *
@@ -5041,7 +5711,25 @@ interface PendingRegistration {
     billingCycle: 'MONTHLY' | 'YEARLY' | null;
     /** Plaintext code (UI display). Validation runs fresh every time. */
     appliedPromoCode: string | null;
+    /**
+     * The billing address and tax identifiers step 4 asks for, which the
+     * subscriber is created with. The address is required before a payment
+     * method is set up; the tax identifiers stay optional.
+     */
+    addressLine1: string | null;
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string | null;
+    vatId: string | null;
+    taxNumber: string | null;
+    /** The gateway's session for the payment method, unique within `checkoutGatewayAccount`. */
     checkoutSessionId: string | null;
+    /** The account in `config/saas.yaml#payments.accounts` the session was opened at. */
+    checkoutGatewayAccount: string | null;
+    /** The customer the gateway created for the sign-up, reused when step 4 is repeated. */
+    gatewayCustomerRef: string | null;
     checkoutStartedAt: Date | null;
     expiresAt: Date;
     createdAt: Date;
@@ -5073,7 +5761,16 @@ interface PendingRegistrationUpdateInput {
     configJson?: RegistrationConfigSelection | null;
     billingCycle?: 'MONTHLY' | 'YEARLY' | null;
     appliedPromoCode?: string | null;
+    addressLine1?: string | null;
+    addressLine2?: string | null;
+    postalCode?: string | null;
+    city?: string | null;
+    country?: string | null;
+    vatId?: string | null;
+    taxNumber?: string | null;
     checkoutSessionId?: string | null;
+    checkoutGatewayAccount?: string | null;
+    gatewayCustomerRef?: string | null;
     checkoutStartedAt?: Date | null;
     expiresAt?: Date;
 }
@@ -5081,14 +5778,24 @@ interface PendingRegistrationUpdateInput {
 interface PendingRegistrationRepository {
     findById(id: string): Promise<PendingRegistration | null>;
     findByEmail(email: string): Promise<PendingRegistration | null>;
-    /** Webhook lookup: finds the pending record for the provider session. */
-    findByCheckoutSession(sessionId: string): Promise<PendingRegistration | null>;
+    /**
+     * Finds the pending record a gateway session belongs to. A session
+     * identifier is unique only within its account, so both are matched.
+     */
+    findByCheckoutSession(gatewayAccount: string, sessionId: string): Promise<PendingRegistration | null>;
     /**
      * Cleanup lookup: all pending records with `expiresAt < now`, max
      * `limit` entries per call (batch protection). Ordering irrelevant, the
      * cron service iterates sequentially.
      */
     findExpired(now: Date, limit: number): Promise<PendingRegistration[]>;
+    /**
+     * Every gateway account a checkout session is still open at: the distinct
+     * `checkoutGatewayAccount` of records in `CHECKOUT_STARTED` whose
+     * `expiresAt` is after `now`. The start refuses when one of them is no
+     * longer configured, because that sign-up's confirmation could not arrive.
+     */
+    findOpenCheckoutAccounts(now: Date): Promise<string[]>;
     create(input: PendingRegistrationCreateInput): Promise<PendingRegistration>;
     update(id: string, input: PendingRegistrationUpdateInput): Promise<PendingRegistration>;
     /**
@@ -5098,7 +5805,13 @@ interface PendingRegistrationRepository {
      * value is the authoritative threshold for the lockout check.
      */
     incrementOtpAttemptCount(id: string): Promise<number>;
-    delete(id: string): Promise<void>;
+    /**
+     * Removes the record. With `tx` it is removed on that transaction and comes
+     * back with its rollback — an activation deletes the sign-up on the
+     * transaction that creates the tenant, so a sign-up is either still waiting
+     * or activated, never both.
+     */
+    delete(id: string, tx?: TransactionContext): Promise<void>;
 }
 /** Adapter port: detects whether a full user account (verified) exists for this email. */
 interface UserAccountLookup {
@@ -5108,67 +5821,42 @@ interface UserAccountLookup {
 interface SlugAvailabilityCheck {
     isSlugAvailable(slug: string): Promise<boolean>;
 }
-/** Wire format of a created checkout session (provider-agnostic). */
-interface CheckoutSession {
-    /** Provider-specific session ID (e.g. Stripe `cs_…`). */
-    sessionId: string;
-    /** Payment URL to be opened by the frontend. */
-    checkoutUrl: string;
-    /** Optional: provider name (`stripe`, `dev-stub`) for logging/audit. */
-    provider?: string;
-}
-type PaymentEventStatus = 'SUCCEEDED' | 'FAILED';
-/**
- * Adapter port: idempotency log for payment webhooks. Stripe (and most
- * other providers) deliver events at-least-once — the service calls
- * `tryClaim` as an atomic race guard BEFORE it triggers the final
- * activation.
- */
-interface PaymentEventLog {
-    /**
-     * Tries to insert an event record via `@unique` INSERT. Returns
-     * `true` if it was newly created (webhook seen for the first time),
-     * `false` if it already exists (duplicate → silently drop).
-     *
-     * Implementations must return a DB unique-constraint-violation error
-     * (Prisma P2002) as `false`.
-     */
-    tryClaim(eventId: string, payload: {
-        provider: string;
-        sessionId: string | null;
-        status: PaymentEventStatus;
-        rawPayload?: unknown;
-    }): Promise<boolean>;
-}
 interface FinalActivationResult {
     userId: string;
     tenantId: string;
     subscriptionId: string;
+    /**
+     * The subscriber created for the tenant in the same transaction — the party
+     * its contracts are concluded with. `subscriberFromRegistration(pending)`
+     * says what it is created with.
+     */
+    subscriberId: string;
+}
+/** The transaction a sign-up is activated on. */
+interface RegistrationActivation {
+    /**
+     * Opened by the platform, which has already claimed the gateway's
+     * confirmation on it and records the confirmed payment method on it once
+     * `activate` returns. Every row the activation writes goes through it, so
+     * a failure anywhere rolls back all of it — the claim included, and the
+     * gateway's retry is handled rather than discarded as a duplicate.
+     */
+    tx: TransactionContext;
 }
 /**
- * Adapter port: orchestrates the final creation of User + Tenant +
- * Subscription after successful payment. App-specific — each app has its
- * own schema (e.g. Tenant + TenantUser + Role + UserRole +
- * Subscription).
+ * Adapter port: creates User + Tenant + Subscriber + Subscription once the
+ * gateway confirmed the sign-up's payment method. App-specific — each app has
+ * its own schema (e.g. Tenant + TenantUser + Role + UserRole + Subscription).
  *
- * Implementations MUST perform the creation in a DB transaction so that
- * partial creations are fully rolled back on errors.
+ * Implementations write on `activation.tx` and open no transaction of their
+ * own: a write beside it would survive the rollback that undoes the rest. The
+ * subscriber is created there too, before any contract:
+ * `SubscriberService.createForTenant(tenantId, subscriberFromRegistration(pending),
+ * activation.tx)`, or `CheckoutOfferService.conclude` with `subscriber` and
+ * that transaction.
  */
 interface ActivationOrchestrator {
-    activate(pending: PendingRegistration): Promise<FinalActivationResult>;
-}
-interface HandlePaymentEventInput {
-    eventId: string;
-    sessionId: string | null;
-    provider: string;
-    status: PaymentEventStatus;
-    rawPayload?: unknown;
-}
-type HandlePaymentEventReason = 'ALREADY_PROCESSED' | 'PAYMENT_NOT_SUCCEEDED' | 'MISSING_SESSION_ID' | 'PENDING_REGISTRATION_NOT_FOUND' | 'INVALID_STATE';
-interface HandlePaymentEventResult {
-    activated: boolean;
-    reason?: HandlePaymentEventReason;
-    result?: FinalActivationResult;
+    activate(pending: PendingRegistration, activation: RegistrationActivation): Promise<FinalActivationResult>;
 }
 interface CleanupResult {
     /** Number of deleted PendingRegistration records. */
@@ -5179,7 +5867,7 @@ interface CleanupResult {
      */
     moreAvailable: boolean;
 }
-type RegistrationAuditEventType = 'REGISTRATION_STARTED' | 'REGISTRATION_NEUTRAL_ACTIVE_USER' | 'REGISTRATION_NEUTRAL_REPLAY' | 'REGISTRATION_NEUTRAL_EXPIRED' | 'OTP_VERIFIED' | 'OTP_VERIFY_FAILED' | 'OTP_RESEND_REQUESTED' | 'OTP_RATE_LIMIT_HIT' | 'PLAN_SELECTED' | 'CHECKOUT_STARTED' | 'PAYMENT_RECEIVED' | 'PAYMENT_DUPLICATE_IGNORED' | 'PAYMENT_FAILED' | 'ACTIVATION_COMPLETED' | 'LOGIN_SUCCEEDED' | 'LOGIN_INVALID_CREDENTIALS' | 'LOGIN_ONBOARDING_REQUIRED';
+type RegistrationAuditEventType = 'REGISTRATION_STARTED' | 'REGISTRATION_NEUTRAL_ACTIVE_USER' | 'REGISTRATION_NEUTRAL_REPLAY' | 'REGISTRATION_NEUTRAL_EXPIRED' | 'OTP_VERIFIED' | 'OTP_VERIFY_FAILED' | 'OTP_RESEND_REQUESTED' | 'OTP_RATE_LIMIT_HIT' | 'PLAN_SELECTED' | 'CHECKOUT_STARTED' | 'PAYMENT_RECEIVED' | 'PAYMENT_FAILED' | 'ACTIVATION_COMPLETED' | 'LOGIN_SUCCEEDED' | 'LOGIN_INVALID_CREDENTIALS' | 'LOGIN_ONBOARDING_REQUIRED';
 /**
  * Context information that the audit layer records per event.
  * IP is expected as a hashed fingerprint — no plaintext IPs in the
@@ -5426,6 +6114,8 @@ interface PendingRegistrationSnapshot {
     config: RegistrationConfigSelection | null;
     billingCycle: 'MONTHLY' | 'YEARLY' | null;
     appliedPromoCode: string | null;
+    /** The billing details step 4 already took, to fill its form again. */
+    billingDetails: RegistrationBillingDetails | null;
     checkoutSessionId: string | null;
 }
 interface ResumeRegistrationResult {
@@ -5434,27 +6124,6 @@ interface ResumeRegistrationResult {
     nextStep: RegistrationStep;
     snapshot: PendingRegistrationSnapshot;
 }
-/** Adapter port: payment provider (Stripe, Dev-Stub, Mollie, ...). */
-interface PaymentProvider {
-    /**
-     * Creates a checkout session at the payment provider and returns the URL
-     * that the frontend should redirect to.
-     *
-     * @param params.pendingRegistrationId Stored as `client_reference_id` (or similar)
-     *   in the provider — the webhook needs it to link back.
-     * @param params.planId The chosen plan (Stripe price/product mapping lives
-     *   in the adapter).
-     * @param params.successUrl Where to go after successful payment.
-     * @param params.cancelUrl Where to go on cancellation.
-     */
-    createCheckoutSession(params: {
-        pendingRegistrationId: string;
-        planId: string;
-        email: string;
-        successUrl: string;
-        cancelUrl: string;
-    }): Promise<CheckoutSession>;
-}
 /** Adapter port: OTP delivery via email (or another channel). */
 interface RegistrationOtpDelivery {
     sendVerificationOtp(params: {
@@ -5520,9 +6189,27 @@ interface SelectPlanResult {
     nextStep: RegistrationStep;
     selectedPlanId: string;
 }
+/**
+ * The billing address and tax identifiers a sign-up gives in step 4, which its
+ * subscriber is created with. The address is required; the tax identifiers
+ * stay optional until the tax adapter says when one is needed.
+ */
+interface RegistrationBillingDetails {
+    addressLine1: string;
+    addressLine2?: string | null;
+    postalCode: string;
+    city: string;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+}
 interface StartCheckoutInput {
     pendingRegistrationId: string;
+    billingDetails: RegistrationBillingDetails;
+    /** Where the gateway's form sends the person once the payment method is set up. */
     successUrl: string;
+    /** Where the gateway's form sends the person who leaves it. */
     cancelUrl: string;
 }
 interface StartCheckoutResult {
@@ -5617,10 +6304,106 @@ declare function toPlanRow(row: CanonicalPlanRow): PlanRow;
  */
 declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string, fields: PlanVersionMappingFields): PlanVersionRow;
 
+/** The fields a correction of the legal identity may change, in the order they are shown. */
+declare const SUBSCRIBER_IDENTITY_FIELDS: readonly SubscriberIdentityField[];
+/** A `subscribers` row as either adapter reads it back. */
+interface CanonicalSubscriberRow {
+    id: string;
+    customerSequence: number;
+    customerNumberPrefix: string;
+    legalName: string;
+    addressLine1: string | null;
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    country: string | null;
+    vatId: string | null;
+    taxNumber: string | null;
+    invoiceEmail: string | null;
+    migrated: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** A `subscriber_corrections` row as either adapter reads it back. */
+interface CanonicalSubscriberCorrectionRow {
+    id: string;
+    subscriberId: string;
+    previous: unknown;
+    corrected: unknown;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/**
+ * The customer number a subscriber is known by: the prefix it was assigned
+ * with, then the number. Kept apart in storage so the number orders and the
+ * prefix stays what it was on the day it was assigned.
+ */
+declare function formatCustomerNumber(prefix: string, sequence: number): string;
+/** `tenantId` is the tenant the subscriber's live link names, read beside the row. */
+declare function toSubscriberRecord(row: CanonicalSubscriberRow, tenantId: string | null): SubscriberRecord;
+declare function toSubscriberCorrectionRecord(row: CanonicalSubscriberCorrectionRow): SubscriberCorrectionRecord;
+/**
+ * The part of a correction that changes something: every corrected field whose
+ * stored value differs, with the value it replaces. Both adapters decide this
+ * the same way, under the lock they read `current` with.
+ */
+declare function identityCorrectionDelta(current: Pick<SubscriberRecord, SubscriberIdentityField>, corrected: SubscriberIdentityValues): SubscriberIdentityDelta;
+/**
+ * Who a new contract is between: the subscriber as it stands, and the issuer as
+ * the running configuration names it — or no issuer, where it names none.
+ */
+declare function contractPartiesOf(subscriber: SubscriberRecord, issuer: PlanCatalog['issuer']): SubscriptionContractParties;
+/**
+ * The subscriber a completed sign-up is created with: the name the tenant was
+ * registered under as its legal name, the address the registration was
+ * verified with as its invoice email, and the billing address and tax
+ * identifiers step 4 took.
+ */
+declare function subscriberFromRegistration(pending: Pick<PendingRegistration, 'tenantName' | 'email' | 'addressLine1' | 'addressLine2' | 'postalCode' | 'city' | 'country' | 'vatId' | 'taxNumber'>): NewSubscriberDetails;
+
+/** The payment method types, in the order a form offers them. */
+declare const PAYMENT_METHOD_TYPES: readonly PaymentMethodType[];
+/** A `subscriber_payment_methods` row as either adapter reads it back. */
+interface CanonicalSubscriberPaymentMethodRow {
+    id: string;
+    subscriberId: string;
+    gatewayAccount: string;
+    provider: string;
+    customerRef: string;
+    paymentMethodRef: string;
+    type: string;
+    brand: string | null;
+    last4: string;
+    expiryMonth: number | null;
+    expiryYear: number | null;
+    country: string | null;
+    bankCode: string | null;
+    mandateReference: string | null;
+    status: string;
+    confirmedAt: Date;
+    replacedAt: Date | null;
+    createdAt: Date;
+}
+/**
+ * Reads a row back as a record.
+ *
+ * The two text columns with a closed set of values are checked rather than
+ * cast: a value written by hand or by an older release would otherwise reach a
+ * screen as a type nobody handles.
+ */
+declare function toSubscriberPaymentMethodRecord(row: CanonicalSubscriberPaymentMethodRow): SubscriberPaymentMethodRecord;
+/** The columns a confirmed payment method is written with, and nothing a caller added beside them. */
+declare function subscriberPaymentMethodColumns(data: RecordSubscriberPaymentMethodData): Omit<CanonicalSubscriberPaymentMethodRow, 'id' | 'status' | 'replacedAt' | 'createdAt'>;
+
 /** A `subscription_contracts` row as either adapter reads it back. */
 interface CanonicalContractRow {
     id: string;
     tenantId: string;
+    subscriberId: string;
+    subscriberSnapshot: unknown;
+    issuerSnapshot: unknown;
+    partiesMigrated: boolean;
     status: string;
     effectiveFrom: Date;
     effectiveUntil: Date | null;
@@ -5742,4 +6525,4 @@ declare function resolveErrorMessage(body: ResolvableErrorBody, overrides?: Part
 
 declare const ERROR_MESSAGES_DE: Record<PlatformErrorCode, string>;
 
-export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferSelection, type CheckoutOfferSelectionUpdate, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, type NewSettingsChange, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RecommendablePlan, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, canonicalJson, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, definedFields, diffSettings, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, keepOneRecommended, missingRequiresFor, pickActivePromo, previousUtcDay, promoStatus, readQuotaRecord, readQuotaValue, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, toBundleStemRow, toContractLineItemRecord, toPlanRow, toPlanVersionRow, toSubscriptionContractRecord };
+export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CanonicalSubscriberCorrectionRow, type CanonicalSubscriberPaymentMethodRow, type CanonicalSubscriberRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferSelection, type CheckoutOfferSelectionUpdate, type CheckoutOfferStatus, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ConfirmedPaymentMethod, type ContractErrorCode, type ContractIssuerParty, type ContractLineItemKind, type ContractLineItemRecord, type ContractSubscriberParty, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriberData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, type LegalIdentity, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MaskedPaymentMethod, type MfaPort, type NewContractLineItemData, type NewSettingsChange, type NewSubscriberDetails, type NewSubscriptionContractData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PAYMENT_ERROR_CODES, PAYMENT_METHOD_TYPES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PartyAddress, type PasswordHasher, type PasswordResetCliResult, PaymentCallbackRejectedError, type PaymentErrorCode, type PaymentEventClaim, type PaymentEventLog, type PaymentGateway, type PaymentGatewayCallback, type PaymentGatewayEvent, type PaymentMethodHolder, type PaymentMethodSetupSession, type PaymentMethodSetupSubject, type PaymentMethodType, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogIssuer, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogPaymentAccount, type PlanCatalogPayments, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogSettings, type PlanCatalogSubscribers, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RecommendablePlan, type RecordSubscriberPaymentMethodData, type RecordSubscriberPaymentMethodOutcome, type RecordSubscriberPaymentMethodResult, type RedeemPromoInTransactionCallback, type RegistrationActivation, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationBillingDetails, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, SUBSCRIBER_ERROR_CODES, SUBSCRIBER_IDENTITY_FIELDS, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePayments, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartPaymentMethodSetupInput, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type SubscriberContact, type SubscriberContactChange, type SubscriberCorrectionData, type SubscriberCorrectionRecord, type SubscriberCorrectionResult, type SubscriberDetails, type SubscriberErrorCode, type SubscriberIdentityCorrection, type SubscriberIdentityDelta, type SubscriberIdentityField, type SubscriberIdentityValues, type SubscriberPaymentMethodRecord, type SubscriberPaymentMethodRepository, type SubscriberPaymentMethodSetupData, type SubscriberPaymentMethodSetupMatch, type SubscriberPaymentMethodStatus, type SubscriberRecord, type SubscriberRepository, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractParties, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, canonicalJson, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, contractPartiesOf, coverageExcludingSelf, definedFields, diffSettings, formatCustomerNumber, formatErrorMessage, identityCorrectionDelta, isBundleRedundant, isPaymentCallbackRejectedError, isPlatformUserExistsError, isVersionEditable, keepOneRecommended, missingRequiresFor, pickActivePromo, planCatalogSettingsOf, previousUtcDay, promoStatus, readQuotaRecord, readQuotaValue, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, subscriberFromRegistration, subscriberPaymentMethodColumns, toBundleStemRow, toContractLineItemRecord, toPlanRow, toPlanVersionRow, toSubscriberCorrectionRecord, toSubscriberPaymentMethodRecord, toSubscriberRecord, toSubscriptionContractRecord };