@saasicat/core 1.0.0-rc.2 → 1.0.0-rc.21

package/dist/index.d.cts

@@ -1,5 +1,17 @@
 /** Start of day (00:00 UTC) of the moment — for day-inclusive date comparisons. */
 declare function startOfUtcDay(date: Date): Date;
+/**
+ * The day before `value` — how a validity window closes when its successor
+ * opens (`validUntil = successor.validFrom − 1 day`, the rule this module's
+ * header states and `startOfUtcDay` above is the reading half of).
+ *
+ * It lived as three separate expressions before 2026-08-27: one in each
+ * adapter's publish path and one in the bundle repository, all agreeing by
+ * coincidence rather than by construction. Day arithmetic rather than
+ * `− 24 * 60 * 60 * 1000`: the subtraction is only equivalent while the value
+ * is a UTC midnight, and nothing in the type says it is.
+ */
+declare function previousUtcDay(value: Date): Date;
 /** `<=` upper bound for a date (structurally Prisma-compatible). */
 interface DateAtOrBefore {
     lte: Date;
@@ -73,256 +85,6 @@ type ActiveVersionWhereWithEndsAt = ActivePlanVersionWhereWithEndsAt;
  */
 declare const buildActiveVersionWhere: typeof buildActivePlanVersionWhere;
 
-type FeatureKey = string;
-type PlanId = string;
-type QuotaKey = string;
-interface FeatureDef {
-    key: FeatureKey;
-    label?: string;
-    icon?: string;
-    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
-    tier?: string;
-    plannedOnly?: boolean;
-}
-interface PlanDef {
-    id: PlanId;
-    name?: string;
-    tagline?: string;
-    /** false = not selectable in self-service onboarding. Default: true. */
-    marketed?: boolean;
-    /** Highlighted card in onboarding (max. 1 per catalog). */
-    popular?: boolean;
-    /** Net monthly price. null = on request. */
-    monthlyNet?: number | null;
-    /** Net total amount per year. null = monthly only. */
-    yearlyNet?: number | null;
-    /** Map quotaKey → max value. -1 = unlimited. */
-    quotas: Record<QuotaKey, number>;
-    features: FeatureKey[];
-}
-/** App-wide marketing configuration. */
-interface PlanCatalogMarketing {
-    /**
-     * Allowed language pool that the app may market. First = default
-     * locale. From it, the SuperAdmin activates a subset in the marketing
-     * catalog (LocaleManager).
-     */
-    availableLocales: string[];
-}
-/**
- * App identity block for branding + version. Consumed by the `AdminPublicBootController`
- * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
- * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
- *
- * `name` = brand display name (e.g. "DemoApp", "ClubApp").
- * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
- * `version` = app version string (build info).
- * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
- * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
- *             instead of the initials badge.
- */
-interface PlanCatalogApp {
-    name: string;
-    label?: string;
-    version?: string;
-    icon?: string;
-    logoUrl?: string;
-}
-interface PlanCatalog {
-    schemaVersion: 1;
-    projectKey: string;
-    /** App identity (branding + version), see PlanCatalogApp. Optional. */
-    app?: PlanCatalogApp;
-    /** ISO-4217 currency code. */
-    currency: string;
-    /** VAT rate in percent. */
-    vatRate: number;
-    /** App-wide marketing configuration. Optional. */
-    marketing?: PlanCatalogMarketing;
-    features?: FeatureDef[];
-    /**
-     * Optional. When omitted, plans come exclusively from the
-     * AdminUI / DB table (Plans/PlanVersions lifecycle).
-     */
-    plans?: PlanDef[];
-}
-
-/** Backend capability key, convention: domain.action[.action]. */
-type CapabilityKey = string;
-/** Frontend action-registry key. Same convention as CapabilityKey. */
-type ActionKey = CapabilityKey;
-/** Lookup key in the static extensions: map of the UI build. */
-type ComponentKey = string;
-interface AdminManifest {
-    schemaVersion: 1;
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-        /**
-         * Allowed locale pool from the app config (`saas.yaml`
-         * `marketing.availableLocales`). First = default..
-         */
-        availableLocales?: string[];
-        /** Default locale; equals `availableLocales[0]`. */
-        defaultLocale?: string;
-    };
-    build: {
-        platformPackageVersion: string;
-        appVersion: string;
-        manifestHash: string;
-    };
-    planCatalogSnapshot: {
-        source: string;
-        hash: string;
-        currency: string;
-        vatRate: number;
-        features?: FeatureDef[];
-        plans: PlanDef[];
-    };
-    /** Map CapabilityKey → boolean. Manifest is never a security source. */
-    capabilities: Record<CapabilityKey, boolean>;
-    navigation: {
-        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory';
-interface StandardPageDef {
-    enabled: boolean;
-    requiredCapability?: CapabilityKey;
-}
-interface ProjectPageDef {
-    /** `<projectKey>.<area>`, e.g. `demoapp.datev`. */
-    id: string;
-    label: string;
-    icon?: string;
-    /** Frontend route, e.g. `/admin/datev`. */
-    route: string;
-    navSection?: string;
-    /** Lookup in the static extensions: map of the shell build. */
-    componentKey: ComponentKey;
-    requiredCapability?: CapabilityKey;
-    prefetchOnIdle?: boolean;
-}
-interface KpiCardDef {
-    id: string;
-    label: string;
-    /** Required path: /api/v1/admin/(extras|dashboard)/... */
-    endpoint: string;
-    displayHint: KpiDisplayHint;
-    /** 0–100; UI sorts descending. */
-    slotPriority?: number;
-    requiredCapability?: CapabilityKey;
-}
-interface KpiDisplayHint {
-    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
-    icon?: string;
-}
-interface TenantColumnDef {
-    key: string;
-    label: string;
-    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
-    endpoint: string;
-    requiredCapability?: CapabilityKey;
-}
-interface TenantActionDef {
-    /** `<projectKey>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
-    id: string;
-    label: string;
-    /** Lookup in the static actions: map of the shell build. */
-    actionKey: ActionKey;
-    requiredCapability?: CapabilityKey;
-    requiresMfa?: boolean;
-    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
-}
-interface AuditActionDef {
-    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
-    key: string;
-    label: string;
-    severity?: 'info' | 'low' | 'medium' | 'high';
-}
-interface ManifestContribution {
-    capabilities?: Record<CapabilityKey, boolean>;
-    navigation?: {
-        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-interface PublicBootResponse {
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-    };
-}
-
-/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
-type ActorTag = string;
-interface AuditEntry {
-    id: string;
-    /** null = platform action without tenant context (SUPER_ADMIN). */
-    tenantId: string | null;
-    /** null = system / cron-triggered. */
-    userId: string | null;
-    /** Convenience field; backend resolves it from userId. */
-    userEmail: string | null;
-    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
-    entity: string;
-    entityId: string;
-    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
-    action: string;
-    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
-    changes: Record<string, unknown> | null;
-    actorTag: ActorTag | null;
-    ipAddress: string | null;
-    userAgent: string | null;
-    createdAt: string;
-}
-interface AuditQuery {
-    tenantId?: string;
-    userId?: string;
-    entity?: string;
-    entityId?: string;
-    action?: string;
-    /** Wildcard-capable, e.g. 'cli:*'. */
-    actorTag?: string;
-    from?: string;
-    to?: string;
-    page?: number;
-    pageSize?: number;
-}
-
 /**
  * Approval lifecycle of a feature or a quota. Approval happens per
  * FEATURE/QUOTA — not per capability (#20); only `approved` entries
@@ -385,7 +147,6 @@ type CatalogEntryI18n = Record<string, CatalogEntryI18nFields>;
  */
 interface CapabilityCatalogEntryRow {
     id: string;
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -422,7 +183,6 @@ type FeatureTier = 'CORE' | 'ADVANCED' | 'PRO' | 'ENTERPRISE' | string;
  */
 interface FeatureCatalogEntryRow {
     id: string;
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -477,7 +237,6 @@ interface FeatureCatalogEntryRow {
  */
 interface QuotaCatalogEntryRow {
     id: string;
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -521,7 +280,6 @@ interface QuotaCatalogEntryRow {
  * matching field is relevant.
  */
 interface CatalogEntryFilter {
-    projectKey: string;
     discoveryStatus?: DiscoveryStatus;
     codeStatus?: CapabilityCodeStatus;
 }
@@ -613,6 +371,18 @@ interface MarketingTopFeature {
     label: string;
     strong: string;
 }
+/**
+ * The range a marketing projection's `priority` may take.
+ *
+ * Declared here rather than in the DTO because two sides need the same answer:
+ * the request pipe rejects anything outside it, and the admin UI computes
+ * priorities when an operator drags a plan into a new position. A UI that
+ * picked its own bounds would produce a value the pipe refuses — and it did,
+ * at the top of the range, where a list of tied plans was lifted past the
+ * maximum to pull the ties apart.
+ */
+declare const MARKETING_PRIORITY_MIN = 0;
+declare const MARKETING_PRIORITY_MAX = 10000;
 /**
  * Locale-specific marketing texts per plan/bundle version.
  * Read and projected by the Public-Catalog-Controller
@@ -623,7 +393,6 @@ interface MarketingTopFeature {
  */
 interface MarketingProjectionRow {
     id: string;
-    projectKey: string;
     targetType: MarketingTargetType;
     targetVersionId: string;
     /** ISO-639-1, optionally with region suffix (`de`, `en`, `de-AT`). */
@@ -668,15 +437,13 @@ interface MarketingProjectionRow {
     createdAt: string;
     updatedAt: string;
 }
-/** Filter for `MarketingProjectionRepository.list()`. At least projectKey. */
+/** Filter for `MarketingProjectionRepository.list()`. */
 interface MarketingProjectionFilter {
-    projectKey: string;
     targetType?: MarketingTargetType;
     targetVersionId?: string;
     locale?: string;
 }
 interface CreateMarketingProjectionData {
-    projectKey: string;
     targetType: MarketingTargetType;
     targetVersionId: string;
     locale?: string;
@@ -706,6 +473,409 @@ interface UpdateMarketingProjectionData {
     highlight?: boolean;
 }
 
+/** The address lines a party is named with. Every one of them may be unknown. */
+interface PartyAddress {
+    /** Street and number. */
+    addressLine1: string | null;
+    /** A second line, such as a building or a c/o. */
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string | null;
+}
+/**
+ * What names a legal entity: the name it is registered under and the
+ * identifiers its tax office gave it.
+ *
+ * These are the party a contract was concluded with. Under a running contract
+ * they change only as a correction of that same entity, recorded with the
+ * values they replaced and the reason; contact details change freely.
+ */
+interface LegalIdentity {
+    /** The registered name, legal form included. */
+    legalName: string;
+    /** VAT identification number. */
+    vatId: string | null;
+    /** The national tax number, where one is stated beside or instead of the VAT id. */
+    taxNumber: string | null;
+}
+/** The fields of the legal identity, the ones a correction may change. */
+type LegalIdentityField = keyof LegalIdentity;
+/** Those fields, in the order they are named and shown. */
+declare const LEGAL_IDENTITY_FIELDS: readonly LegalIdentityField[];
+/** Whether two identities name the same entity: every field, value for value. */
+declare function sameLegalIdentity(before: LegalIdentity, after: LegalIdentity): boolean;
+/** The fields whose value differs between two identities, in field order. */
+declare function movedIdentityFields(before: LegalIdentity, after: LegalIdentity): LegalIdentityField[];
+
+/** The payment methods SaaSiCat takes, by the names `config/saas.yaml` uses. */
+type PaymentMethodType = 'card' | 'sepa_debit';
+/**
+ * Whom a payment method is set up for. The gateway hands it back unchanged
+ * with its confirmation, which is how the confirmation finds its way to the
+ * sign-up or the subscriber that asked for it.
+ */
+type PaymentMethodSetupSubject = {
+    kind: 'registration';
+    pendingRegistrationId: string;
+} | {
+    kind: 'subscriber';
+    subscriberId: string;
+};
+/** The party the gateway keeps the payment method for: its customer there. */
+interface PaymentMethodHolder {
+    /** The legal name, which a direct debit mandate names. */
+    name: string;
+    /** Where the gateway sends what it sends; `null` lets its form ask. */
+    email: string | null;
+    address: PartyAddress;
+    /**
+     * The customer this party already has at the account, from an earlier
+     * payment method. `null` asks the gateway for a new one.
+     */
+    customerRef: string | null;
+}
+interface StartPaymentMethodSetupInput {
+    subject: PaymentMethodSetupSubject;
+    holder: PaymentMethodHolder;
+    /** What the form offers, from the account's `methods`. */
+    methods: readonly PaymentMethodType[];
+    /** Where the gateway sends the person once the form is done. */
+    successUrl: string;
+    /** Where the gateway sends the person who leaves the form. */
+    cancelUrl: string;
+}
+/** A body and headers exactly as they arrived, before anything parsed them. */
+interface PaymentGatewayCallback {
+    body: string | Uint8Array;
+    headers: Readonly<Record<string, string | readonly string[] | undefined>>;
+}
+interface PaymentMethodSetupSession {
+    /**
+     * The gateway's identifier of the session, unique within its account — and
+     * an adapter that has no session of its own makes one per start rather than
+     * a constant. A session is confirmed once, which the event log holds, so a
+     * value two starts share lets the second confirmation through as the
+     * duplicate it is not.
+     */
+    sessionRef: string;
+    /** The gateway's form, where the person is sent next. */
+    redirectUrl: string;
+    /** The customer the payment method is set up for, created if none was given. */
+    customerRef: string;
+    /**
+     * The last moment a confirmation of this session can still arrive: the end
+     * of its form, after which nobody can complete it, plus the time the
+     * gateway goes on retrying a confirmation it could not deliver. `null` for
+     * a gateway that states neither. A sign-up's promo code slot is held until
+     * then, so a form paid shortly before its end still finds its slot when the
+     * confirmation arrives late, and an abandoned form gives it back.
+     */
+    confirmableUntil: Date | null;
+    /**
+     * A confirmation the gateway already holds when the session starts, to be
+     * handled like any callback. Only a gateway without a form of its own has
+     * one — the development gateway; a real gateway confirms through its
+     * webhook.
+     */
+    immediateCallback?: PaymentGatewayCallback;
+}
+/**
+ * What SaaSiCat keeps about a payment method: enough to show which one it is,
+ * never enough to pay with it (`SC-PRIV-005`).
+ */
+interface MaskedPaymentMethod {
+    type: PaymentMethodType;
+    /** The card network, such as `visa`; `null` for a direct debit. */
+    brand: string | null;
+    /** The last four digits of the card number or the IBAN. */
+    last4: string;
+    /** 1–12; `null` for a direct debit. */
+    expiryMonth: number | null;
+    /** Four digits; `null` for a direct debit. */
+    expiryYear: number | null;
+    /** ISO 3166-1 alpha-2 of the card's issuer or the bank account, where the gateway says. */
+    country: string | null;
+    /** The bank code of a direct debit account, where the gateway says. */
+    bankCode: string | null;
+    /** The reference of a direct debit mandate, which a debit announcement quotes. */
+    mandateReference: string | null;
+}
+/** A payment method the gateway confirmed, with the references that reach it there. */
+interface ConfirmedPaymentMethod extends MaskedPaymentMethod {
+    customerRef: string;
+    paymentMethodRef: string;
+}
+/** A gateway callback, verified and translated. */
+type PaymentGatewayEvent = {
+    kind: 'payment-method-confirmed';
+    /** The gateway's identifier of the event, unique within its account. */
+    eventId: string;
+    /** When the gateway says it happened. */
+    occurredAt: Date;
+    sessionRef: string;
+    subject: PaymentMethodSetupSubject;
+    paymentMethod: ConfirmedPaymentMethod;
+} | {
+    kind: 'payment-method-setup-failed';
+    eventId: string;
+    occurredAt: Date;
+    sessionRef: string;
+    subject: PaymentMethodSetupSubject;
+} | {
+    /** Genuine, and nothing SaaSiCat acts on. */
+    kind: 'unhandled';
+    eventId: string;
+    occurredAt: Date;
+    /** The gateway's own name for the event, for the log. */
+    type: string;
+};
+/**
+ * One account at a payment gateway: its keys, its form and its callbacks.
+ *
+ * An adapter is bound to one account, and `config/saas.yaml#payments.accounts`
+ * names it. Mollie or any other provider is another adapter behind this port.
+ */
+interface PaymentGateway {
+    /** The provider, as `config/saas.yaml` names it, e.g. `stripe`. */
+    readonly provider: string;
+    /**
+     * Opens the gateway's form for a payment method. Nothing is confirmed until
+     * the gateway says so through `readCallback`.
+     */
+    startPaymentMethodSetup(input: StartPaymentMethodSetupInput): Promise<PaymentMethodSetupSession>;
+    /**
+     * Verifies a callback with the account's secret and translates it.
+     * Throws `PaymentCallbackRejectedError` for anything the gateway did not
+     * send, before a single field of it is trusted.
+     */
+    readCallback(callback: PaymentGatewayCallback): Promise<PaymentGatewayEvent>;
+}
+/**
+ * A callback that is not the gateway's: a missing or wrong signature, a stale
+ * timestamp, a body that was altered. Nothing is read from it.
+ */
+declare class PaymentCallbackRejectedError extends Error {
+    readonly code = "PAYMENT_CALLBACK_REJECTED";
+    constructor(reason: string);
+}
+/** Realm-safe type guard, like `isPlatformUserExistsError`. */
+declare function isPaymentCallbackRejectedError(err: unknown): err is PaymentCallbackRejectedError;
+
+type FeatureKey = string;
+type PlanId = string;
+type QuotaKey = string;
+interface FeatureDef {
+    key: FeatureKey;
+    label?: string;
+    icon?: string;
+    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
+    tier?: string;
+    plannedOnly?: boolean;
+}
+interface PlanDef {
+    id: PlanId;
+    name?: string;
+    tagline?: string;
+    /** false = not selectable in self-service onboarding. Default: true. */
+    marketed?: boolean;
+    /** Highlighted card in onboarding (max. 1 per catalog). */
+    popular?: boolean;
+    /** Net monthly price. null = on request. */
+    monthlyNet?: number | null;
+    /** Net total amount per year. null = monthly only. */
+    yearlyNet?: number | null;
+    /** Map quotaKey → max value. -1 = unlimited. */
+    quotas: Record<QuotaKey, number>;
+    features: FeatureKey[];
+}
+/** App-wide marketing configuration. */
+interface PlanCatalogMarketing {
+    /**
+     * Allowed language pool that the app may market. First = default
+     * locale. From it, the SuperAdmin activates a subset in the marketing
+     * catalog (LocaleManager).
+     */
+    availableLocales: string[];
+}
+/**
+ * App identity block for branding + version. Consumed by the `AdminPublicBootController`
+ * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
+ * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
+ *
+ * `name` = brand display name (e.g. "DemoApp", "ClubApp").
+ * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
+ * `version` = app version string (build info).
+ * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
+ * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
+ *             instead of the initials badge.
+ */
+interface PlanCatalogApp {
+    name: string;
+    label?: string;
+    version?: string;
+    icon?: string;
+    logoUrl?: string;
+}
+/**
+ * Notice periods, one per rhythm.
+ *
+ * One number for both was the shape until 2026-08-27, and it could not be right
+ * for both: a yearly contract with a fortnight of notice is unusual, and a
+ * monthly contract with three months of notice is void against a consumer. The
+ * two are configured apart because real contracts set them apart.
+ *
+ * Both members are required. A missing rhythm would read as zero, and a silent
+ * zero is a commercial decision nobody made — the same defect one level below
+ * the one that moved these settings into the file.
+ *
+ * **No ceiling is enforced.** §309 Nr. 9 BGB limits the notice period in German
+ * consumer contracts to one month, and an installation serving businesses is
+ * not bound by it. The platform cannot know which it is, so the number is the
+ * consumer app's to choose and this is the sentence that says what it costs.
+ */
+interface CancellationNoticePeriods {
+    /** Days of notice for a monthly subscription. */
+    monthly: number;
+    /** Days of notice for a yearly subscription. */
+    yearly: number;
+}
+/**
+ * Plans a tenant may not reach or leave without talking to sales.
+ *
+ * `asTarget`: may not be selected via self-service — typically ENTERPRISE,
+ * which only a special contract activates. `asSource`: may not be left via
+ * self-service — typically an active special contract.
+ *
+ * Both lists are required and may be empty. An empty list says out loud that
+ * self-service reaches every plan, which is a decision rather than an omission.
+ */
+interface SelfServiceBlockedPlans {
+    asTarget: string[];
+    asSource: string[];
+}
+/**
+ * Commercial settings for the tenant-facing self-service routes.
+ *
+ * They live in `config/saas.yaml` and nowhere else: an operator reading the
+ * file has to be reading the values that are running, with no "unless somebody
+ * passed it in code" attached. The file is read at boot, so an edit lands on
+ * the next restart.
+ */
+interface PlanCatalogTenantBilling {
+    cancellationNoticeDays: CancellationNoticePeriods;
+    selfServiceBlockedPlans: SelfServiceBlockedPlans;
+}
+/**
+ * Who is told when the settings in the file change between two starts.
+ *
+ * The record inside the application is written whether or not anybody is
+ * named here; mail is the addition, never the substitute. Mailed only where an
+ * email port is bound — without one the boot log says so once, and the change
+ * is recorded in the application only.
+ */
+interface PlanCatalogNotifications {
+    /** Addresses mailed when a start finds the applied settings changed. */
+    settingsChanged?: string[];
+}
+/**
+ * The legal entity on the operator's side of every contract the installation
+ * concludes. A contract copies it on the day it is concluded; only the legal
+ * name is required while nothing is invoiced.
+ */
+interface PlanCatalogIssuer {
+    legalName: string;
+    addressLine1?: string;
+    addressLine2?: string;
+    postalCode?: string;
+    city?: string;
+    /** ISO 3166-1 alpha-2. */
+    country?: string;
+    vatId?: string;
+    taxNumber?: string;
+    /** Declares a changed identity as a correction of the same legal entity. */
+    correctionOf?: PlanCatalogIssuerCorrection;
+}
+/**
+ * What a changed issuer identity replaces, and why.
+ *
+ * The identity is the counterparty a contract names, so it moves under a
+ * running contract only as a correction of that same entity. Each field names
+ * the value the installation recorded before the change, `null` where it
+ * recorded none; a field the change leaves alone need not be named.
+ */
+interface PlanCatalogIssuerCorrection {
+    legalName?: string | null;
+    vatId?: string | null;
+    taxNumber?: string | null;
+    /** Why the same entity now reads differently. Kept in the settings record. */
+    reason: string;
+}
+/** How the parties contracts are concluded with are numbered. */
+interface PlanCatalogSubscribers {
+    /**
+     * Put in front of every customer number assigned from the next start on.
+     * A number keeps the prefix it was assigned with.
+     */
+    customerNumberPrefix?: string;
+}
+/** One account at a payment gateway, by the name `PlanCatalogPayments.accounts` gives it. */
+interface PlanCatalogPaymentAccount {
+    /** The provider its bound adapter names itself as, e.g. `stripe`. */
+    provider: string;
+    /** What a new payment method may be at this account. Read for `newPaymentMethods` only. */
+    methods?: PaymentMethodType[];
+}
+/**
+ * The gateway accounts payment methods are taken through. Their keys are bound
+ * in code from the environment, never written into the file.
+ */
+interface PlanCatalogPayments {
+    /** The account a new payment method is taken at. Omitted, none is taken. */
+    newPaymentMethods?: string;
+    /** The origins a gateway's form may send a person back to, such as `https://app.example.com`. */
+    returnUrlOrigins: string[];
+    /** Every account taking new payment methods or holding a reference in use. */
+    accounts: Record<string, PlanCatalogPaymentAccount>;
+}
+/**
+ * The part of `config/saas.yaml` that is configuration rather than catalogue.
+ *
+ * Declared apart so it can be handed on whole — a database catalogue takes its
+ * settings from the file and its plans from the database — without anybody
+ * listing the blocks again. `CATALOGUE_KEYS` names what is left over.
+ */
+interface PlanCatalogSettings {
+    /** App identity (branding + version), see PlanCatalogApp. */
+    app: PlanCatalogApp;
+    /** ISO-4217 currency code. */
+    currency: string;
+    /** VAT rate in percent. */
+    vatRate: number;
+    /** Commercial settings for the tenant self-service routes. */
+    tenantBilling: PlanCatalogTenantBilling;
+    /** App-wide marketing configuration. Optional. */
+    marketing?: PlanCatalogMarketing;
+    /** Who is told when the settings change between two starts. Optional. */
+    notifications?: PlanCatalogNotifications;
+    /** The operator's side of every contract. Optional until invoicing requires it. */
+    issuer?: PlanCatalogIssuer;
+    /** How subscribers are numbered. Optional. */
+    subscribers?: PlanCatalogSubscribers;
+    /** The payment gateway accounts. Optional until payment methods are taken. */
+    payments?: PlanCatalogPayments;
+}
+interface PlanCatalog extends PlanCatalogSettings {
+    schemaVersion: 1;
+    features?: FeatureDef[];
+    /**
+     * Optional. When omitted, plans come exclusively from the
+     * AdminUI / DB table (Plans/PlanVersions lifecycle).
+     */
+    plans?: PlanDef[];
+}
+
 type PromoCodeValueType = 'PERCENT' | 'ABSOLUTE';
 type PromoCodeDurationType = 'ONCE' | 'MONTHS' | 'BILLING_CYCLES';
 type PromoCodeStatus = 'ACTIVE' | 'PAUSED' | 'EXHAUSTED' | 'EXPIRED';
@@ -754,6 +924,11 @@ interface PromoCode {
     validUntil: string | null;
     maxRedemptions: number | null;
     redemptionsCount: number;
+    /**
+     * Slots held for checkouts that started and have not concluded. A code has
+     * a free slot while `redemptionsCount + heldCount` is below `maxRedemptions`.
+     */
+    heldCount: number;
     appliesToPlans: PlanId[];
     appliesToBilling: BillingCycle | null;
     firstTimeCustomersOnly: boolean;
@@ -902,7 +1077,7 @@ interface VersionedEntityBase {
  *   own migration).
  * - `startedAt` is the contract start of this booking.
  * - `minimumTermEndsAt` = end of the minimum term; `null` = no minimum term
- *   (platform default = 12 months, set service-side).
+ *   (platform default = no commitment, set service-side).
  * - `canceledAt` / `canceledEffectiveAt`: cancellation anchor vs. effective
  *   date. Before the minimum term ends, `canceledEffectiveAt =
  *   minimumTermEndsAt`, otherwise the subscription's period end.
@@ -919,6 +1094,18 @@ interface SubscriptionBundleRecord {
     minimumTermEndsAt: Date | null;
     canceledAt: Date | null;
     canceledEffectiveAt: Date | null;
+    /**
+     * The rhythm this booking is billed in, and the window it is billed for.
+     *
+     * A bundle's periods end on the day its plan's do — the first one short,
+     * from the booking to the next occurrence of that day, and every one after
+     * it anchor to anchor. Null on a booking made before these fields existed,
+     * or on one whose plan has no period; readers fall back to the plan's
+     * cycle, which is what every booking used before.
+     */
+    billingCycle: string | null;
+    currentPeriodStart: Date | null;
+    currentPeriodEnd: Date | null;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -932,14 +1119,27 @@ interface SubscriptionBundleRecord {
 interface SubscriptionBundleView extends SubscriptionBundleRecord {
     bundleKey: string | null;
     label: string | null;
-    monthlyNet: string | null;
+    /**
+     * What this booking is billed at, in the rhythm it was booked in and with
+     * the plan's pricing override applied.
+     *
+     * It was `monthlyNet` until 2026-08-27 and carried the bundle's base
+     * monthly price whatever the booking was — so a yearly booking of a bundle
+     * priced 10 monthly and 100 yearly reported 10. The name was half the
+     * defect: a field called `monthlyNet` on a yearly booking cannot be right.
+     */
+    priceNet: number | null;
 }
 interface CreateSubscriptionBundleData {
     subscriptionId: string;
     bundleVersionId: string;
     startedAt: Date;
-    /** Default = startedAt + 12 months, unless set. */
+    /** Null unless a commitment was configured or asked for. */
     minimumTermEndsAt?: Date | null;
+    /** The rhythm and window worked out above this port. */
+    billingCycle?: string | null;
+    currentPeriodStart?: Date | null;
+    currentPeriodEnd?: Date | null;
 }
 interface CancelSubscriptionBundleData {
     canceledAt: Date;
@@ -988,7 +1188,6 @@ interface BundlePricingOverride {
  */
 interface BundleRow {
     id: string;
-    projectKey: string;
     bundleKey: string;
     label: string;
     description: string | null;
@@ -1027,7 +1226,6 @@ interface BundleVersionRow extends VersionedEntityBase {
  * first BundleVersion via `CreateBundleVersionDraftData`.
  */
 interface CreateBundleData {
-    projectKey: string;
     bundleKey: string;
     label: string;
     description?: string | null;
@@ -1036,9 +1234,9 @@ interface CreateBundleData {
     i18n?: CatalogEntryI18n;
 }
 /**
- * Fields that may be changed on the bundle master. `bundleKey` and
- * `projectKey` are intentionally not here — master identity is immutable;
- * whoever wants to change them creates a new bundle and retires the old one.
+ * Fields that may be changed on the bundle master. `bundleKey` is
+ * intentionally not here — master identity is immutable; whoever wants to
+ * change it creates a new bundle and retires the old one.
  */
 interface UpdateBundleData {
     label?: string;
@@ -1143,34 +1341,291 @@ interface PublishBundleVersionData {
     validUntil?: string | null;
 }
 /**
- * Code of a strict-mode violation. lists the eight rules
- * that are checked; each rule has its own code so the UI can show
- * focused help texts.
+ * Code of a strict-mode violation. lists the eight rules
+ * that are checked; each rule has its own code so the UI can show
+ * focused help texts.
+ */
+type StrictModeWarningCode = 'CAPABILITY_MISSING' | 'CAPABILITY_RETIRED' | 'FEATURE_MISSING' | 'FEATURE_PLANNED_ONLY' | 'BUNDLE_FEATURE_UNKNOWN' | 'BUNDLE_PLAN_KEY_UNKNOWN' | 'PLAN_FEATURE_UNKNOWN' | 'PLAN_FEATURE_NOT_APPROVED' | 'BUNDLE_FEATURE_NOT_APPROVED' | 'PLAN_FEATURE_DEPENDENCY_UNSATISFIED' | 'BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED' | 'QUOTA_MISSING' | 'QUOTA_NOT_APPROVED' | 'VERSION_PUBLISH_OVERLAP';
+/**
+ * A strict-mode violation. `field` points to the violating field
+ * (e.g. `'features[3]'`), `value` is the concrete value (e.g. `'INVENTORY'`).
+ */
+interface StrictModeWarning {
+    code: StrictModeWarningCode;
+    /** Human-readable reason (German). */
+    message: string;
+    /** Path to the violating field; optional. */
+    field?: string;
+    /** The concrete violating value; optional. */
+    value?: string;
+}
+/**
+ * Service result for mutating Bundle operations
+ * (createDraft, updateDraft, publish): returns the persisted row plus
+ * a list of strict-mode warnings. In `warn-only` mode the
+ * warnings go into the UI as a banner; in `blocking` mode the service throws
+ * HTTP 422 instead, with the same warning list as the body.
+ */
+interface BundleVersionMutationResult {
+    bundleVersion: BundleVersionRow;
+    warnings: StrictModeWarning[];
+}
+
+/**
+ * The column values a new BundleVersion draft starts from.
+ *
+ * Every adapter has to apply the same defaults — an absent quota map is `{}`,
+ * an absent price is null rather than zero, an unstated `marketed` is true —
+ * and two adapters spelling that out separately is the same decision written
+ * twice. It is also the variant jscpd does catch, which is how this came out:
+ * `adapter-drizzle` learning about bundles put a second copy beside
+ * `adapter-prisma`'s.
+ *
+ * Validity windows are deliberately absent. Whether a draft carries
+ * `validFrom`/`validUntil` is an adapter capability rather than a default, and
+ * an adapter that does not maintain those columns must not write them.
+ */
+declare function bundleDraftDefaults(data: CreateBundleVersionDraftData): {
+    baseVersionId: string | null;
+    features: string[];
+    quotas: Record<string, number>;
+    compatibility: Record<string, unknown>;
+    pricingOverrides: unknown[];
+    monthlyNet: string | null;
+    yearlyNet: string | null;
+    marketed: boolean;
+    changeNote: string;
+    createdByUserId: string | null;
+};
+/**
+ * The column values a new Bundle stem starts from.
+ *
+ * The same defaulting rule as above, one level up: an absent description or
+ * icon is null rather than an empty string, an unstated sort order is 0, an
+ * absent translation map is `{}`. Written out in five places before this — two
+ * adapters and two fakes — which is four opportunities for one of them to
+ * decide differently.
+ */
+declare function bundleStemDefaults(data: CreateBundleData): {
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: CatalogEntryI18n;
+};
+/** The stored shape both adapters read a bundle stem back from. */
+interface StoredBundleStem {
+    id: string;
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/**
+ * A stored bundle stem as the port describes it.
+ *
+ * The two stores spell the columns identically, so the mapping was identical
+ * too — and an identical mapping in two files is one place for a field to be
+ * forgotten when the row grows. `i18n` arrives as JSON of unknown shape from
+ * both, and a non-object becomes `{}` rather than reaching a caller that
+ * expects a map.
  */
-type StrictModeWarningCode = 'CAPABILITY_MISSING' | 'CAPABILITY_RETIRED' | 'FEATURE_MISSING' | 'FEATURE_PLANNED_ONLY' | 'BUNDLE_FEATURE_UNKNOWN' | 'BUNDLE_PLAN_KEY_UNKNOWN' | 'PLAN_FEATURE_UNKNOWN' | 'PLAN_FEATURE_NOT_APPROVED' | 'BUNDLE_FEATURE_NOT_APPROVED' | 'PLAN_FEATURE_DEPENDENCY_UNSATISFIED' | 'BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED' | 'QUOTA_MISSING' | 'QUOTA_NOT_APPROVED' | 'VERSION_PUBLISH_OVERLAP';
+declare function toBundleStemRow(row: StoredBundleStem): BundleRow;
 /**
- * A strict-mode violation. `field` points to the violating field
- * (e.g. `'features[3]'`), `value` is the concrete value (e.g. `'INVENTORY'`).
+ * The fields a caller actually gave, as a patch.
+ *
+ * The update DTOs in this codebase mean three different things by three
+ * different values: a value changes the column, an explicit `null` clears it,
+ * and an **omitted** field leaves it alone. Only the last one needs care, and
+ * it was written out as `...(data.x !== undefined ? { x: data.x } : {})` more
+ * than fifty times across five repositories — one decision, fifty
+ * opportunities to spell it differently, and the duplication ratchet is what
+ * finally pointed at it.
+ *
+ * `null` is deliberately kept: it is a value a caller chose, not an absence.
  */
-interface StrictModeWarning {
-    code: StrictModeWarningCode;
-    /** Human-readable reason (German). */
-    message: string;
-    /** Path to the violating field; optional. */
-    field?: string;
-    /** The concrete violating value; optional. */
-    value?: string;
+declare function definedFields<T extends object, K extends keyof T>(data: T, keys: readonly K[]): Partial<Pick<T, K>>;
+
+/** Backend capability key, convention: domain.action[.action]. */
+type CapabilityKey = string;
+/** Frontend action-registry key. Same convention as CapabilityKey. */
+type ActionKey = CapabilityKey;
+/** Lookup key in the static extensions: map of the UI build. */
+type ComponentKey = string;
+interface AdminManifest {
+    schemaVersion: 1;
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+        /**
+         * Allowed locale pool from the app config (`saas.yaml`
+         * `marketing.availableLocales`). First = default..
+         */
+        availableLocales?: string[];
+        /** Default locale; equals `availableLocales[0]`. */
+        defaultLocale?: string;
+    };
+    build: {
+        platformPackageVersion: string;
+        appVersion: string;
+        manifestHash: string;
+    };
+    planCatalogSnapshot: {
+        source: string;
+        hash: string;
+        currency: string;
+        vatRate: number;
+        features?: FeatureDef[];
+        plans: PlanDef[];
+    };
+    /** Map CapabilityKey → boolean. Manifest is never a security source. */
+    capabilities: Record<CapabilityKey, boolean>;
+    navigation: {
+        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
 }
-/**
- * Service result for mutating Bundle operations
- * (createDraft, updateDraft, publish): returns the persisted row plus
- * a list of strict-mode warnings. In `warn-only` mode the
- * warnings go into the UI as a banner; in `blocking` mode the service throws
- * HTTP 422 instead, with the same warning list as the body.
- */
-interface BundleVersionMutationResult {
-    bundleVersion: BundleVersionRow;
-    warnings: StrictModeWarning[];
+type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory' | 'settings';
+interface StandardPageDef {
+    enabled: boolean;
+    requiredCapability?: CapabilityKey;
+}
+interface ProjectPageDef {
+    /** `<app>.<area>`, e.g. `demoapp.datev`. */
+    id: string;
+    label: string;
+    icon?: string;
+    /** Frontend route, e.g. `/admin/datev`. */
+    route: string;
+    navSection?: string;
+    /** Lookup in the static extensions: map of the shell build. */
+    componentKey: ComponentKey;
+    requiredCapability?: CapabilityKey;
+    prefetchOnIdle?: boolean;
+}
+interface KpiCardDef {
+    id: string;
+    label: string;
+    /** Required path: /api/v1/admin/(extras|dashboard)/... */
+    endpoint: string;
+    displayHint: KpiDisplayHint;
+    /** 0–100; UI sorts descending. */
+    slotPriority?: number;
+    requiredCapability?: CapabilityKey;
+}
+interface KpiDisplayHint {
+    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
+    icon?: string;
+}
+interface TenantColumnDef {
+    key: string;
+    label: string;
+    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
+    endpoint: string;
+    requiredCapability?: CapabilityKey;
+}
+interface TenantActionDef {
+    /** `<app>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
+    id: string;
+    label: string;
+    /** Lookup in the static actions: map of the shell build. */
+    actionKey: ActionKey;
+    requiredCapability?: CapabilityKey;
+    requiresMfa?: boolean;
+    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
+}
+interface AuditActionDef {
+    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
+    key: string;
+    label: string;
+    severity?: 'info' | 'low' | 'medium' | 'high';
+}
+interface ManifestContribution {
+    capabilities?: Record<CapabilityKey, boolean>;
+    navigation?: {
+        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
+}
+interface PublicBootResponse {
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+    };
+}
+
+/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
+type ActorTag = string;
+interface AuditEntry {
+    id: string;
+    /** null = platform action without tenant context (SUPER_ADMIN). */
+    tenantId: string | null;
+    /** null = system / cron-triggered. */
+    userId: string | null;
+    /** Convenience field; backend resolves it from userId. */
+    userEmail: string | null;
+    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
+    entity: string;
+    entityId: string;
+    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
+    action: string;
+    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
+    changes: Record<string, unknown> | null;
+    actorTag: ActorTag | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+}
+interface AuditQuery {
+    tenantId?: string;
+    userId?: string;
+    entity?: string;
+    entityId?: string;
+    action?: string;
+    /** Wildcard-capable, e.g. 'cli:*'. */
+    actorTag?: string;
+    from?: string;
+    to?: string;
+    page?: number;
+    pageSize?: number;
 }
 
 /** Promotion type. */
@@ -1201,7 +1656,6 @@ type PromotionI18n = Record<string, PromotionI18nFields>;
 /** Wire format of a `promotions` row. */
 interface PromotionRow {
     id: string;
-    projectKey: string;
     /** Internal label (not public). */
     internalLabel: string;
     type: PromotionType;
@@ -1227,11 +1681,7 @@ interface PromotionRow {
     createdAt: string;
     updatedAt: string;
 }
-interface PromotionFilter {
-    projectKey: string;
-}
 interface CreatePromotionData {
-    projectKey: string;
     internalLabel: string;
     type: PromotionType;
     value: PromotionValue;
@@ -1293,8 +1743,35 @@ type PromotionResult = {
     original: number;
     months: number;
 };
-/** Applies the promotion math to a base price. */
+/**
+ * Applies the promotion math to a base price, or `null` where the promotion
+ * takes nothing off it.
+ *
+ * The discounted price stays between 0 and the base price, whatever the
+ * promotion states: a promotion lowers the price of what it is on and nothing
+ * else. Creating one refuses a value no price could make sense of, but whether
+ * an intro price or an amount fits depends on the price it meets — which
+ * differs per plan and rhythm and moves when a new version is published — so
+ * the bound is held here, where every place that resolves a promotion reads it:
+ * the public catalogue, a checkout offer, the operator's preview.
+ */
 declare function applyPromo(promo: PromotionRow | null, basePrice: number | null): PromotionResult | null;
+/** A promotion on a price, and what it makes of that price. */
+interface PromotionOnPrice {
+    promotion: PromotionRow;
+    result: PromotionResult;
+}
+/**
+ * The promotion a price carries: the one `pickActivePromo` selects for the key,
+ * language and rhythm, where `applyPromo` finds that it lowers the price at
+ * all — or `null`.
+ *
+ * One question, asked the same way by every place that shows or charges a
+ * promotion: the public catalogue, a checkout offer, and the operator's
+ * preview. A promotion that lowers nothing is no promotion there, so it carries
+ * no badge and takes nothing off.
+ */
+declare function promotionOnPrice(promotions: PromotionRow[], targetKey: string, locale: string, cycle: 'monthly' | 'yearly', basePrice: number | null, today?: Date, targetType?: PromotionTargetType): PromotionOnPrice | null;
 
 type CheckoutOfferLineItemKind = 'plan' | 'bundle' | 'discount';
 /** Frozen billable line item in the offer. */
@@ -1346,6 +1823,7 @@ interface CheckoutOfferPriceBreakdown {
     regularNet: number;
     /** Net total after promo. */
     effectiveNet: number;
+    /** VAT rate in percent, as the plan catalogue names it (19 = 19 %). */
     vatRate: number;
     /** Gross total after promo. */
     effectiveGross: number;
@@ -1354,7 +1832,6 @@ type CheckoutOfferStatus = 'open' | 'consumed' | 'expired';
 /** Wire format of a `checkout_offers` row. */
 interface CheckoutOfferRow {
     id: string;
-    projectKey: string;
     /** Plan selected on the website. */
     planKey: string;
     /** Resolved plan version, if known. */
@@ -1362,7 +1839,7 @@ interface CheckoutOfferRow {
     billingCycle: 'monthly' | 'yearly';
     /** Applied promotion (active at offer time). */
     promotionId: string | null;
-    /** Redeemed promo code, if the promotion was `requiresCoupon`. */
+    /** Promo code applied to the offer, as the promo module normalised it. */
     promoCode: string | null;
     /** Added bundle keys. Legacy display; V3 uses `bundleVersionIds` + `lineItems`. */
     bundles: string[];
@@ -1385,12 +1862,44 @@ interface CheckoutOfferRow {
     updatedAt: string;
 }
 interface CheckoutOfferFilter {
-    projectKey: string;
     status?: CheckoutOfferStatus;
 }
-/** Body of `POST /public/checkout-offer` — called from the website. */
+/**
+ * What a caller chooses: the body of `POST /public/checkout-offer`, and the
+ * input of `CheckoutOfferService.create`.
+ *
+ * No amount is part of it. The plan version, the bundle prices, the promotion
+ * and the promo code discount are resolved on the server, so the offer costs
+ * what the catalogue says rather than what a request says.
+ */
+interface CheckoutOfferSelection {
+    planKey: string;
+    billingCycle: 'monthly' | 'yearly';
+    /** Concrete BundleVersion IDs to book with the plan. */
+    bundleVersionIds?: string[];
+    /** A promo code to apply; refused when the promo module cannot accept it. */
+    promoCode?: string | null;
+    locale?: string;
+    validUntil?: string | null;
+}
+/**
+ * What a caller may change while an offer is open: the body of
+ * `PATCH /public/checkout-offer/:id`. The plan is fixed; everything given here
+ * is priced again.
+ */
+interface CheckoutOfferSelectionUpdate {
+    billingCycle?: 'monthly' | 'yearly';
+    bundleVersionIds?: string[];
+    /** `null` removes a code applied before. */
+    promoCode?: string | null;
+    locale?: string;
+    validUntil?: string | null;
+}
+/**
+ * A new offer as the repository stores it — the selection with the amounts
+ * the server computed for it (`CheckoutOfferRepository.create`).
+ */
 interface CreateCheckoutOfferData {
-    projectKey: string;
     planKey: string;
     planVersionId?: string | null;
     billingCycle: 'monthly' | 'yearly';
@@ -1406,11 +1915,13 @@ interface CreateCheckoutOfferData {
     validUntil?: string | null;
 }
 /**
- * Body of `PATCH /public/checkout-offer/:id` — customization during
- * onboarding. `status`/`consumedAt` are not editable — `consume()`
- * sets them server-side.
+ * A change to an open offer as the repository stores it, with the amounts
+ * priced again (`CheckoutOfferRepository.update`). `status`/`consumedAt` are
+ * not editable — `consume()` sets them server-side.
  */
 interface UpdateCheckoutOfferData {
+    /** The plan version active when the change was priced. */
+    planVersionId?: string | null;
     billingCycle?: 'monthly' | 'yearly';
     promotionId?: string | null;
     promoCode?: string | null;
@@ -1426,7 +1937,6 @@ interface UpdateCheckoutOfferData {
 
 /** Wire format of the `marketing_settings` row. */
 interface MarketingSettingsRow {
-    projectKey: string;
     /** Runtime-activated subset of the `availableLocales` pool. */
     activeLocales: string[];
     updatedAt: string;
@@ -1462,6 +1972,10 @@ interface PublicMarketingPlan {
     badge: string;
     /** Teaser / description text. */
     description: string;
+    /**
+     * The recommended plan, and at most one card in a catalogue carries it —
+     * see `keepOneRecommended`, which decides it per language served.
+     */
     highlight: boolean;
     /**
      * Formatted pricing tag from the MarketingProjection (#47, e.g.
@@ -1542,13 +2056,32 @@ interface PublicComparisonRow {
     /** Quotas only: display unit. */
     unit?: string;
 }
+/**
+ * What this installation takes a new payment method with, so a page offering the
+ * plans can say it before anybody reaches the form.
+ *
+ * It is the account `config/saas.yaml#payments.newPaymentMethods` names, with the
+ * gateway bound for it — the same account a sign-up's payment step and a tenant's
+ * own change both go to. Whether an installation runs sign-ups at all is not part
+ * of it: that is the application's own wiring, and the application knows it.
+ *
+ * Which account it is and who keeps the payment method stay inside: a prospect is
+ * told that a card or a direct debit will be asked for, not where it is kept.
+ */
+interface PublicNewPaymentMethods {
+    /** Whether a new payment method is taken here at all. */
+    taken: boolean;
+    /** The methods the form offers, in the order the installation names them; empty where none is taken. */
+    methods: PaymentMethodType[];
+}
 /** Response of `GET /public/marketing-catalog`. */
 interface PublicMarketingCatalogResponse {
-    projectKey: string;
     locale: string;
     currency: string;
     /** VAT rate in percent — for the CheckoutOffer price breakdown. */
     vatRate: number;
+    /** What a new payment method is taken with here, if one is taken. */
+    newPaymentMethods: PublicNewPaymentMethods;
     /** Visible, marketed plans — sorted by `priority` DESC. */
     plans: PublicMarketingPlan[];
     /**
@@ -1654,7 +2187,7 @@ interface DiscoverySnapshot {
     /** ISO timestamp of the boot-time scan. */
     scannedAt: string;
     app: {
-        /** projectKey, same concept as in the catalog tables. */
+        /** The application's name, from `saas.yaml#app.name`. */
         key: string;
         /** Backend version, e.g. from package.json. */
         version: string;
@@ -1690,6 +2223,18 @@ interface FeatureUiMeta {
 /** Map FeatureKey → UI metadata. Consumer apps supply a complete table. */
 type FeatureUiRegistry = Record<string, FeatureUiMeta>;
 
+/** A quota as a finite number, or `null` where the value cannot be read as one. */
+declare function readQuotaValue(value: unknown): number | null;
+/**
+ * Every quota in a JSON column, for a caller that computes with them.
+ *
+ * A key that is there stays there. Dropping an unreadable one made it *absent*,
+ * and absent means undeclared: `enforceLimit` answers an undeclared dimension
+ * with a 500, so every operation on that quota was refused — a fail-closed
+ * answer to somebody else's corrupt row.
+ */
+declare function readQuotaRecord(value: unknown): Record<string, number>;
+
 /** Alias for historical compatibility — equivalent to VersionChangeDirection. */
 type ChangeDirection = VersionChangeDirection;
 interface DiffResult {
@@ -1707,9 +2252,16 @@ type DecimalLike = number | string | {
 };
 interface PlanVersionFields {
     features: FeatureKey[];
-    maxUsers: number;
-    maxVehicles: number;
-    maxStorageGb: number;
+    /**
+     * Quotas of the version. -1 = unlimited; missing key = 0.
+     *
+     * Every key either side carries is compared. Which keys exist is the
+     * installation's decision — they come from `@DefinesQuota` — so a fixed
+     * set here would have compared the three the platform happened to know by
+     * name and let every other one be lowered without the confirmation
+     * publishing a regression asks for.
+     */
+    quotas: Record<QuotaKey, number>;
     monthlyNet: DecimalLike;
     yearlyNet: DecimalLike;
 }
@@ -1725,8 +2277,7 @@ declare function classifyPlanDiff(oldV: PlanVersionFields, newV: PlanVersionFiel
 /**
  * Classification of a BundleVersion diff for contract protection.
  *
- * Quota comparison: `-1` (unlimited) is always better than any positive
- * number. Otherwise higher = better. Missing keys are treated as 0.
+ * Quotas are compared exactly as they are for a plan.
  *
  * Pricing can be `null` (the bundle only has override pricing); a switch
  * from value ↔ null is classified as REGRESSION (value dropped) or IMPROVEMENT
@@ -1769,6 +2320,11 @@ interface PromoPreviewValidResponse {
         /** Decimal-as-string, e.g. "199.00". */
         originalGross: string;
         discountGross: string;
+        /**
+         * `discountGross` in net, converted at the installation's VAT rate —
+         * the figure a page showing net prices takes off the plan price.
+         */
+        discountNet: string;
         discountedGross: string;
         includedVat: string;
         nextRegularAmountGross: string;
@@ -1824,9 +2380,94 @@ interface OnboardingPromoRedemption {
     endsAt: string | null;
 }
 
+/**
+ * The settings subtree of a plan catalogue: every top-level block that is
+ * configuration rather than the catalogue itself. JSON-shaped, because it is
+ * stored as JSON and compared as JSON.
+ */
+type AppliedSettingsValues = Record<string, unknown>;
+/** The one row per installation: what is applied, since when, and from where. */
+interface AppliedSettingsRecord {
+    /**
+     * `sha256-<hex>` over the canonical JSON of `settings`. Two boots with the
+     * same resolved values produce the same fingerprint however the file was
+     * formatted, and a plan added to the catalogue does not move it.
+     */
+    fingerprint: string;
+    settings: AppliedSettingsValues;
+    /**
+     * Where the values came from: the absolute path of the file the platform
+     * read, or a phrase saying they were handed to it in code.
+     */
+    source: string;
+    /** The moment these values became the running configuration. */
+    appliedAt: Date;
+}
+/** What a boot noticed had changed since the previous record. */
+interface SettingsChangeRecord {
+    id: string;
+    /** The boot that noticed the difference and applied the new values. */
+    noticedAt: Date;
+    source: string;
+    previous: AppliedSettingsValues;
+    current: AppliedSettingsValues;
+    /** Set once an operator has seen it; null while it is still owed a look. */
+    acknowledgedAt: Date | null;
+    /** Who acknowledged it — an actor tag, as the audit log writes it. */
+    acknowledgedBy: string | null;
+}
+type NewSettingsChange = Pick<SettingsChangeRecord, 'noticedAt' | 'source' | 'previous' | 'current'>;
+/** One leaf that differs between two settings subtrees. */
+interface SettingsDifference {
+    /** Dotted path, as the loader names a field: `tenantBilling.cancellationNoticeDays.monthly`. */
+    path: string;
+    /** `undefined` where the leaf did not exist on that side. */
+    before: unknown;
+    after: unknown;
+}
+
+/**
+ * The top-level blocks of `config/saas.yaml` that are the catalogue rather than
+ * the configuration, and the format marker.
+ *
+ * An exclusion list rather than a list of settings, on purpose: a block the
+ * schema gains tomorrow is a setting until somebody says otherwise, so it is
+ * fingerprinted by default. The failure mode of the other list — a new setting
+ * silently left out of the fingerprint, so a change to it is never noticed — is
+ * the one this record exists to prevent. `schemaVersion` is excluded because a
+ * format change is a migration of the file, not a decision an operator took.
+ *
+ * `tests/settings-subtree.test.js` holds this list to the schema in both
+ * directions: every name here is a property the schema declares, and every
+ * property the schema declares lands on one side.
+ */
+declare const CATALOGUE_KEYS: ReadonlySet<keyof PlanCatalog>;
+/**
+ * The settings of a catalogue, typed, for handing them on as a whole.
+ *
+ * The same selection as `settingsSubtreeOf`, which is why it is that function:
+ * a caller that listed the blocks it passes on would drop the next one the
+ * schema gains, and nothing would say so.
+ */
+declare function planCatalogSettingsOf(catalog: PlanCatalog): PlanCatalogSettings;
+/** Everything in the catalogue that is configuration, as it was resolved. */
+declare function settingsSubtreeOf(catalog: PlanCatalog | PlanCatalogSettings): AppliedSettingsValues;
+/**
+ * `JSON.stringify` with object keys in sorted order at every depth, so that two
+ * documents saying the same thing in a different order serialise identically.
+ * Array order is kept: a list is what its author wrote, in the order they wrote
+ * it.
+ */
+declare function canonicalJson(value: unknown): string;
+/**
+ * Every leaf that differs between `before` and `after`, in the order the paths
+ * sort. A list counts as one leaf: `asTarget: [] → [ENTERPRISE]` is one thing
+ * that changed, not a change per element.
+ */
+declare function diffSettings(before: AppliedSettingsValues, after: AppliedSettingsValues): SettingsDifference[];
+
 interface PlanRow {
     id: string;
-    projectKey: string;
     planKey: string;
     label: string;
     description: string | null;
@@ -1843,7 +2484,6 @@ interface PlanRow {
  * creation (follows in M6 Pack 2).
  */
 interface CreatePlanData {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1851,9 +2491,9 @@ interface CreatePlanData {
     sortOrder?: number;
 }
 /**
- * Fields that may be changed on the plan stem. `planKey` and `projectKey`
- * are deliberately not here — stem identity is immutable; whoever wants to
- * change it creates a new plan and retires the old one.
+ * Fields that may be changed on the plan stem. `planKey` is deliberately not
+ * here — stem identity is immutable; whoever wants to change it creates a new
+ * plan and retires the old one.
  */
 interface UpdatePlanData {
     label?: string;
@@ -1917,7 +2557,6 @@ interface UpsertResult {
     skipReason?: string;
 }
 interface UpsertPlanInput {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1937,7 +2576,6 @@ interface UpsertPlanVersionInput {
     changeNote: string;
 }
 interface UpsertFeatureCatalogEntryInput {
-    projectKey: string;
     featureKey: FeatureKey;
     label?: string;
     icon?: string;
@@ -1983,7 +2621,7 @@ interface PlanCatalogReadSnapshot {
  * implement it against their Prisma tables.
  */
 interface PlanCatalogReadSink {
-    loadSnapshot(projectKey: string): Promise<PlanCatalogReadSnapshot>;
+    loadSnapshot(): Promise<PlanCatalogReadSnapshot>;
 }
 
 /**
@@ -2220,6 +2858,26 @@ interface PasswordHasher {
     hash(plain: string): Promise<string>;
     verify(hash: string, plain: string): Promise<boolean>;
 }
+/**
+ * Sends a plain-text mail to an operator.
+ *
+ * The platform composes the text; the adapter delivers it — over whatever the
+ * installation already sends mail with. Deliberately narrow: no templates, no
+ * locale, no HTML. The one thing the platform mails today is a diagnostic for
+ * the operator who runs the installation, and a diagnostic is English and
+ * plain, like the boot log it mirrors. Tenant-facing mail — a verification
+ * code, a resume link — goes through the registration module's own delivery
+ * ports, which carry the locale and the person's name because that mail is
+ * for a customer.
+ */
+interface EmailPort {
+    /** Delivers one plain-text mail to one address; rejects when it cannot. */
+    send(message: {
+        to: string;
+        subject: string;
+        text: string;
+    }): Promise<void>;
+}
 /** Adapter for MFA secret persistence. */
 interface MfaPort {
     /** Returns the stored TOTP secret or null. */
@@ -2261,6 +2919,11 @@ interface PromoCodeRecord {
     validUntil: Date | null;
     maxRedemptions: number | null;
     redemptionsCount: number;
+    /**
+     * Slots held for checkouts that started and have not concluded
+     * (`PromoCodeHoldRepository`). An adapter without holds reports 0.
+     */
+    heldCount: number;
     appliesToPlans: string[];
     appliesToBilling: BillingCycle | null;
     firstTimeCustomersOnly: boolean;
@@ -2350,7 +3013,7 @@ interface PromoCodeRedemptionListItem extends PromoCodeRedemptionRecord {
 /**
  * Adapter for PromoCode persistence. Atomic slot reservation lives in the
  * adapter because it is DB-specific (Postgres `UPDATE ... WHERE ... AND
- * (maxRedemptions IS NULL OR redemptionsCount < maxRedemptions)`).
+ * (maxRedemptions IS NULL OR redemptionsCount + heldCount < maxRedemptions)`).
  */
 interface PromoCodeRepository {
     findById(id: string): Promise<PromoCodeRecord | null>;
@@ -2361,12 +3024,17 @@ interface PromoCodeRepository {
     softDelete(id: string): Promise<void>;
     /**
      * Atomic slot reservation: increments `redemptionsCount` and checks
-     * `status === 'ACTIVE' && (maxRedemptions IS NULL || redemptionsCount < maxRedemptions)`.
+     * `status === 'ACTIVE' && (maxRedemptions IS NULL || redemptionsCount + heldCount < maxRedemptions)`.
      * Returns true if the slot was reserved, false if EXHAUSTED
-     * or the status is not ACTIVE.
+     * or the status is not ACTIVE. A slot held for a checkout is not free, so
+     * an adapter that keeps holds counts `heldCount` here.
      */
     claimSlot(id: string, tx?: TransactionContext): Promise<boolean>;
-    /** Sets the status to `EXHAUSTED` when `redemptionsCount >= maxRedemptions`. */
+    /**
+     * Sets the status to `EXHAUSTED` when `redemptionsCount >= maxRedemptions`.
+     * Holds do not count: a code full only because of held slots stays ACTIVE,
+     * and gets its slots back when the holds end.
+     */
     markExhaustedIfFull(id: string, tx?: TransactionContext): Promise<void>;
     /** Decrements `redemptionsCount` by 1 (min 0); EXHAUSTED → ACTIVE. */
     releaseSlot(id: string, tx?: TransactionContext): Promise<void>;
@@ -2376,6 +3044,98 @@ interface PromoCodeRepository {
      */
     expireDueCodes(now: Date): Promise<number>;
 }
+/**
+ * A slot of a code kept for a checkout offer, from the start of its checkout
+ * until the checkout concludes, the offer's code changes, or `expiresAt`
+ * passes, whichever comes first. For a sign-up, `expiresAt` is the last moment
+ * a confirmation of its payment form can arrive
+ * (`PaymentMethodSetupSession.confirmableUntil`), not the checkout's lifetime.
+ */
+interface PromoCodeHoldRecord {
+    id: string;
+    promoCodeId: string;
+    checkoutOfferId: string;
+    expiresAt: Date;
+    createdAt: Date;
+}
+/** What `PromoCodeHoldRepository.take` did. */
+type PromoCodeHoldTaken = {
+    outcome: 'taken';
+    hold: PromoCodeHoldRecord;
+}
+/** The code is not ACTIVE, is deleted, or has no free slot. */
+ | {
+    outcome: 'no-slot';
+}
+/** The offer holds a slot already, perhaps taken by a concurrent call. */
+ | {
+    outcome: 'offer-holds-one';
+};
+/**
+ * Adapter for the slots a code keeps for checkouts. Every method that ends a
+ * hold deletes its row and gives its slot back in one statement, so a hold is
+ * counted in `PromoCodeRecord.heldCount` exactly as long as its row exists.
+ *
+ * Optional in the promo module: an adapter that has no holds leaves
+ * `heldCount` at 0, and taking a hold then refuses to start rather than
+ * quietly holding nothing.
+ */
+interface PromoCodeHoldRepository {
+    /** The offer's hold, live or past its expiry and not yet given back. */
+    findByCheckoutOffer(checkoutOfferId: string, tx?: TransactionContext): Promise<PromoCodeHoldRecord | null>;
+    /**
+     * Takes a slot of an ACTIVE, undeleted code for the offer, atomically with
+     * `claimSlot`'s rule: `maxRedemptions IS NULL OR redemptionsCount +
+     * heldCount < maxRedemptions`. An offer holds one slot at most. Runs on a
+     * transaction of its own: a checkout starts outside any other, and the
+     * slot is committed before the gateway's form opens.
+     */
+    take(hold: {
+        promoCodeId: string;
+        checkoutOfferId: string;
+        expiresAt: Date;
+    }): Promise<PromoCodeHoldTaken>;
+    /**
+     * Moves the expiry of the offer's hold on that code to `expiresAt`, and
+     * never earlier than it stands: the later of the two is written in the one
+     * statement, so a start of the same checkout that asks for less cannot
+     * shorten the slot a form opened by another start relies on, however the
+     * two interleave. False when the offer holds no slot of it any more — it
+     * ended in the meantime.
+     */
+    extend(checkoutOfferId: string, promoCodeId: string, expiresAt: Date): Promise<boolean>;
+    /** Ends the offer's hold and gives its slot back. False when it had none. */
+    release(checkoutOfferId: string, tx?: TransactionContext): Promise<boolean>;
+    /**
+     * Ends the offer's hold and gives its slot back only while it still expires
+     * at `expiresAt` — the hold as the caller wrote it. A hold another start
+     * moved since stays, and so does its slot, in the same statement. False when
+     * nothing was given back.
+     */
+    releaseIfUnmoved(checkoutOfferId: string, expiresAt: Date): Promise<boolean>;
+    /**
+     * Marks the offer's hold, if it is live at `now`, as the slot of the
+     * redemption that runs on `tx`. The mark never outlives the transaction: the
+     * redemption turns the hold into its slot (`convertHandedOver`), or the
+     * caller releases it before committing. False when the offer has no live
+     * hold.
+     */
+    handOver(checkoutOfferId: string, now: Date, tx: TransactionContext): Promise<boolean>;
+    /**
+     * Turns the hold of that code handed over on `tx` into a redemption's slot:
+     * the row goes, `heldCount` drops by one and `redemptionsCount` rises by one,
+     * whatever the code's status. False when nothing was handed over on `tx`.
+     */
+    convertHandedOver(promoCodeId: string, tx: TransactionContext): Promise<boolean>;
+    /**
+     * Ends every hold past its expiry at `now` — of one code when `promoCodeId`
+     * is given — and gives the slots back. A hold handed over on `tx` is left
+     * to the conclusion running there; one handed over on another running
+     * transaction is waited for, and is gone once that transaction ends.
+     * Returns how many ended.
+     */
+    expireDue(now: Date, promoCodeId?: string, tx?: TransactionContext): Promise<number>;
+}
 /** Adapter for PromoCodeRedemption persistence. */
 interface PromoCodeRedemptionRepository {
     findBySubscription(subscriptionId: string, tx?: TransactionContext): Promise<PromoCodeRedemptionRecord | null>;
@@ -2427,6 +3187,26 @@ interface PromoRevenueDeductionAggregator {
 
 type ContractLineItemKind = 'plan' | 'bundle' | 'discount';
 type SubscriptionContractStatus = 'active' | 'scheduled' | 'terminated' | 'superseded';
+/**
+ * The statuses a contract is looked up under when asking "what is this tenant
+ * on right now" — `scheduled` included, because a contract that starts today
+ * and has not been switched to `active` yet is still the one in force at its
+ * own `effectiveFrom`.
+ *
+ * One list rather than one per adapter: the two adapters have to answer
+ * `findActiveByTenantId` the same way, and a status added here must not reach
+ * only whichever of them somebody remembered.
+ */
+/**
+ * How many bundle versions one price lookup may name.
+ *
+ * One number rather than two: the server validates against it and the client
+ * batches to stay inside it, and a client that learned the cap by receiving a
+ * 400 would fail silently — the lookup answers with an empty map, and every
+ * card falls back to a catalogue price the tenant may not be charged.
+ */
+declare const BUNDLE_PRICE_LOOKUP_LIMIT = 200;
+declare const ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES: readonly SubscriptionContractStatus[];
 interface ContractLineItemRecord {
     id: string;
     contractId: string;
@@ -2437,9 +3217,36 @@ interface ContractLineItemRecord {
     descriptionSnapshot: string | null;
     quantity: number;
     unit: string | null;
+    /**
+     * What the line costs over one of its billing periods, `quantity` already
+     * in it — not a unit price. A contract's totals take its lines as they
+     * stand, each counted as often as it falls due in one period of the
+     * contract, and are refused where they do not add up.
+     */
     priceNet: number;
+    /** `priceNet` with the line's share of the tax its rhythm owes. */
     priceGross: number;
     billingCycle: 'monthly' | 'yearly';
+    /**
+     * ISO 4217, as the line was booked in.
+     *
+     * An installation sells in one currency at a time, so this is never a
+     * choice the line makes — it is what keeps the line meaning what it meant
+     * after the configured currency is migrated to another one.
+     */
+    currency: string;
+    /**
+     * The tax rate in percent that was applied, recorded rather than left in
+     * the ratio between net and gross. That ratio is not the rate: it cannot be
+     * reproduced for a rounded gross, cannot express an exempt or reverse-charge
+     * line, and does not survive a rate change.
+     */
+    taxRate: number;
+    /**
+     * The tax contained in the line — exactly `priceGross - priceNet`, so the
+     * line cannot disagree with itself. Rounded once, when the line is written.
+     */
+    taxAmount: number;
     minimumTermUntil: Date | null;
     featuresSnapshot: string[];
     quotaEffectsSnapshot: Record<string, number>;
@@ -2452,13 +3259,47 @@ interface SubscriptionContractPriceSnapshot {
     subtotalNet: number;
     discountNet: number;
     totalNet: number;
+    /**
+     * The tax rate this contract's total was computed at, as a percentage:
+     * 19 means 19 %, as every tax rate in SaaSiCat is.
+     */
     vatRate: number;
     totalGross: number;
 }
-interface SubscriptionContractRecord {
+/**
+ * The subscriber as a contract copied it on the day it was concluded.
+ *
+ * The invoice email is not part of it: it says how the party is reached, not
+ * who the party is, and a contract is kept for years after an address like that
+ * stopped mattering.
+ */
+interface ContractSubscriberParty extends LegalIdentity, PartyAddress {
+    customerNumber: string;
+}
+/** The issuer as `config/saas.yaml` named it on the day a contract was concluded. */
+interface ContractIssuerParty extends LegalIdentity, PartyAddress {
+}
+/** Who a contract is between, copied when it is concluded. */
+interface SubscriptionContractParties {
+    subscriberId: string;
+    subscriber: ContractSubscriberParty;
+    /** `null` where `config/saas.yaml` named no issuer that day. */
+    issuer: ContractIssuerParty | null;
+}
+interface SubscriptionContractRecord extends SubscriptionContractParties {
     id: string;
-    projectKey: string;
+    /**
+     * The tenant the contract was concluded for, kept as a trace. The contract
+     * belongs to its subscriber and outlives the tenant.
+     */
     tenantId: string;
+    /**
+     * The parties were copied by the migration that attached contracts
+     * concluded before subscribers existed, not on the day the contract was
+     * concluded. Either party may have changed in between, so such a copy is
+     * never presented as what was agreed.
+     */
+    partiesMigrated: boolean;
     status: SubscriptionContractStatus;
     effectiveFrom: Date;
     effectiveUntil: Date | null;
@@ -2475,8 +3316,12 @@ interface SubscriptionContractRecord {
     updatedAt: Date;
 }
 type NewContractLineItemData = Omit<ContractLineItemRecord, 'id' | 'contractId' | 'createdAt'>;
+/**
+ * A contract as a caller asks for it. The parties are not among it: the
+ * platform copies them from the tenant's subscriber and the configuration when
+ * the contract is written, so no caller can name a party of its own.
+ */
 interface CreateSubscriptionContractData {
-    projectKey: string;
     tenantId: string;
     status?: SubscriptionContractStatus;
     effectiveFrom: Date;
@@ -2491,16 +3336,53 @@ interface CreateSubscriptionContractData {
     termsSnapshot?: Record<string, unknown> | null;
     lineItems: NewContractLineItemData[];
 }
+/** What a repository writes: the contract as asked for, with the parties the platform copied. */
+interface NewSubscriptionContractData extends CreateSubscriptionContractData {
+    parties: SubscriptionContractParties;
+}
 interface TerminateSubscriptionContractData {
     effectiveUntil: Date;
-    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'>;
+    /**
+     * The terminal status, or `null` to end the contract by date alone.
+     *
+     * `findActiveByTenantId` already asks its question as a window —
+     * `effectiveFrom <= asOf` and `effectiveUntil` null or after it — so a
+     * contract given an end in the FUTURE is found until that moment and not
+     * afterwards, with no scheduled job to flip anything.
+     *
+     * Writing a terminal status instead makes the contract disappear from that
+     * lookup at once, which for a cancellation declared months ahead removes an
+     * agreement the customer is still under. Null is how a caller says "it ends
+     * then", and a status is how it says "it is over now".
+     */
+    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'> | null;
 }
 interface SubscriptionContractFilter {
-    projectKey?: string;
     tenantId?: string;
     status?: SubscriptionContractStatus;
     asOf?: Date;
 }
+/** One contract still running, and the issuer it was concluded under. */
+interface RunningContractIssuer {
+    id: string;
+    /** The tenant it was concluded for, kept as a trace. */
+    tenantId: string;
+    /**
+     * The legal name on the issuer copy, or `null` where the contract names no
+     * issuer — it was concluded while `config/saas.yaml` named none, or its
+     * party copy was made by the migration that attached contracts concluded
+     * before subscribers existed.
+     */
+    issuerLegalName: string | null;
+    effectiveFrom: Date;
+}
+/** How many contracts are concluded and not yet over, and the first few of them. */
+interface RunningContractIssuers {
+    /** All of them, whether or not the list below holds them all. */
+    total: number;
+    /** At most the limit the caller asked for, oldest first. */
+    contracts: RunningContractIssuer[];
+}
 interface InvoiceLineItemSnapshot {
     sourceContractLineItemId: string;
     sourceKey: string;
@@ -2513,12 +3395,14 @@ interface InvoiceLineItemSnapshot {
     priceNet: number;
     priceGross: number;
     billingCycle: 'monthly' | 'yearly';
+    currency: string;
+    taxRate: number;
+    taxAmount: number;
     minimumTermUntil: Date | null;
     metadata: Record<string, unknown> | null;
 }
 interface SubscriptionContractInvoiceSnapshot {
     contractId: string;
-    projectKey: string;
     tenantId: string;
     originalOfferId: string | null;
     currency: string;
@@ -2533,6 +3417,100 @@ interface SubscriptionContractInvoiceSnapshot {
     lineItems: InvoiceLineItemSnapshot[];
 }
 
+/** How a subscriber is reached, which may change at any time. */
+interface SubscriberContact extends PartyAddress {
+    /** Where invoices will be sent. */
+    invoiceEmail: string | null;
+}
+/** A subscriber's master data, as it stands. */
+type SubscriberDetails = LegalIdentity & SubscriberContact;
+/**
+ * What a subscriber is created with.
+ *
+ * Only the legal name is required. The address, the tax identifiers and the
+ * invoice email stay optional until sign-up asks for them and invoicing
+ * requires them; an absent or blank value is recorded as unknown.
+ */
+type NewSubscriberDetails = Pick<SubscriberDetails, 'legalName'> & Partial<Omit<SubscriberDetails, 'legalName'>>;
+interface SubscriberRecord extends SubscriberDetails {
+    id: string;
+    /**
+     * Assigned when the subscriber is created and never changed: the number,
+     * counted per installation, behind the prefix configured at that moment.
+     */
+    customerNumber: string;
+    /** The tenant this subscriber is live for, or `null` once it has none. */
+    tenantId: string | null;
+    /**
+     * Created by the migration that gave every existing tenant its subscriber,
+     * from the application's own tenant record rather than from what a customer
+     * entered.
+     */
+    migrated: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** What a repository writes for a new subscriber, every detail already settled. */
+interface CreateSubscriberData extends SubscriberDetails {
+    /** The tenant the subscriber is created for and live with. */
+    tenantId: string;
+    /** Put in front of the assigned number; empty for the number alone. */
+    customerNumberPrefix: string;
+}
+/** Contact details to change; a member left out keeps its value. */
+type SubscriberContactChange = Partial<SubscriberContact>;
+/**
+ * A change to a subscriber's legal identity, and what the operator declares it
+ * to be.
+ *
+ * SaaSiCat cannot tell a misspelt name from another company taking over, so the
+ * operator says which: `correction` for the same legal entity — a typo, a wrong
+ * tax identifier, a change of name that entity went through — and `takeover`
+ * for another one, which is a transfer rather than an edit and is refused.
+ */
+interface SubscriberIdentityCorrection {
+    kind: 'correction' | 'takeover';
+    legalName?: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+    /** Why the identity is corrected. Part of the record. */
+    reason: string;
+    /** Who corrects it, as an actor tag the audit log would write. */
+    correctedBy: string;
+}
+/** Identity values by field, holding only the fields a correction changed. */
+type SubscriberIdentityValues = Partial<LegalIdentity>;
+/** What a correction replaces and what it writes, holding only the fields that move. */
+interface SubscriberIdentityDelta {
+    previous: SubscriberIdentityValues;
+    corrected: SubscriberIdentityValues;
+}
+/** What a repository writes for a correction the service has accepted. */
+interface SubscriberCorrectionData {
+    /** The new values; a field equal to what is stored is not recorded. */
+    corrected: SubscriberIdentityValues;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/** One correction of a subscriber's legal identity, as it was recorded. */
+interface SubscriberCorrectionRecord {
+    id: string;
+    subscriberId: string;
+    /** The values the correction replaced. */
+    previous: SubscriberIdentityValues;
+    /** The values it wrote. */
+    corrected: SubscriberIdentityValues;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/** The outcome of writing a correction: nothing is recorded when no value moved. */
+interface SubscriberCorrectionResult {
+    subscriber: SubscriberRecord;
+    correction: SubscriberCorrectionRecord | null;
+}
+
 /**
  * Snapshot form of a `Subscription` row for the EntitlementService
  * computation. The consumer maps its Prisma structure onto this form.
@@ -2552,6 +3530,24 @@ interface SubscriptionRecord {
     } | null;
     planVersionId: string;
     planVersion: PlanVersionRecord;
+    /**
+     * When a cancellation was declared, and when it takes effect.
+     *
+     * Required, and required together, because entitlement resolution ends a
+     * subscription by reading them: without the second date it cannot tell a
+     * subscription that ends next January from one that ended last January, and
+     * it grants the latter everything. Nothing else in the platform would
+     * notice — no repository filters a cancelled subscription out, and stopping
+     * the billing period is a different decision from ending what a tenant may
+     * do.
+     *
+     * `null` on both means no cancellation. On a row written before the two
+     * fields separated, `canceledAt` carries the effective date and
+     * `canceledEffectiveAt` is genuinely null; every reader in the platform
+     * applies `canceledEffectiveAt ?? canceledAt` for that reason.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
 }
 /** Snapshot of a `PlanVersion` row. */
 interface PlanVersionRecord {
@@ -2608,11 +3604,10 @@ interface SubscriptionRepository {
     countByBundleVersionId?(bundleVersionId: string): Promise<number>;
     /**
      * Counts active subscriptions (status `ACTIVE` or `TRIAL`) per plan key,
-     * platform-wide across all tenants of the project — feeds the tenant
-     * column of the SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
+     * platform-wide across every tenant — feeds the tenant column of the
+     * SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
      * Cross-version: counts the plan, not a single PlanVersion
-     * (subscriptions on superseded versions are included). `projectKey` is
-     * informational for single-project consumers.
+     * (subscriptions on superseded versions are included).
      *
      * Returns a map `planKey → count`; plans without an active subscription
      * are missing (UI defaults to 0). Platform-wide count across all tenants →
@@ -2620,7 +3615,7 @@ interface SubscriptionRepository {
      *
      * Optional — if not implemented, the tenant column stays 0.
      */
-    countActiveByPlanKey?(projectKey: string): Promise<Record<string, number>>;
+    countActiveByPlanKey?(): Promise<Record<string, number>>;
 }
 /**
  * Adapter for the `subscription_bundles` junction.
@@ -2679,8 +3674,89 @@ interface SubscriptionContractRepository {
      * instead of drawing an extra pool connection (starvation guard, #70).
      */
     findActiveByTenantId(tenantId: string, asOf?: Date, tx?: TransactionContext): Promise<SubscriptionContractRecord | null>;
-    create(data: CreateSubscriptionContractData): Promise<SubscriptionContractRecord>;
+    /**
+     * Writes the contract with the parties it names. With `tx`, the contract is
+     * written on that transaction and undone with it.
+     */
+    create(data: NewSubscriptionContractData, tx?: TransactionContext): Promise<SubscriptionContractRecord>;
+    /**
+     * The contract concluded from a checkout offer (`originalOfferId`), or
+     * `null` when none was. An offer is consumed once and so yields one
+     * contract (`SC-MKT-017`); where an application's own path wrote two, the
+     * earliest is returned, so the answer does not depend on read order.
+     */
+    findByOriginalOfferId(offerId: string, tx?: TransactionContext): Promise<SubscriptionContractRecord | null>;
     terminate(contractId: string, data: TerminateSubscriptionContractData): Promise<SubscriptionContractRecord>;
+    /**
+     * The contracts concluded and not yet over, with the issuer each was
+     * concluded under: how many there are, and the first `limit` of them,
+     * oldest first. `limit` caps the list and not the count, so a start refused
+     * over a changed issuer identity says how many contracts it means before it
+     * names any of them.
+     *
+     * Running means `active` or `scheduled` AND not ended at `asOf` — the same
+     * window `findActiveByTenantId` uses on its upper end, and for the same
+     * reason. Status alone is not enough: an ordinary cancellation lands at the
+     * term end and writes only `effectiveUntil`, leaving the status where it
+     * was, and nothing flips it when that day arrives. Counting by status would
+     * therefore report every customer who ever left as still running — and
+     * because the list is oldest first, the ones it names would be exactly the
+     * expired ones.
+     *
+     * The window is open at the bottom on purpose: a contract that starts next
+     * month is concluded, its party copy is fixed, and it will be invoiced under
+     * the issuer it names.
+     *
+     * Platform-wide: unlike every other read here it is anchored by no tenant,
+     * no contract and no offer, and a start makes it before anything is served.
+     * An implementation on a tenant-scoped client must count RLS-exempt, as
+     * `countActiveByPlanKey` must — the platform wraps the call in
+     * `RlsBypassPort`, and one that answers with the caller's tenant scope
+     * instead returns nothing at a boot, where there is no tenant. The
+     * persistence contract runs with no policy forced, so it cannot catch that
+     * for you.
+     *
+     * `limit` may be `0`, and a caller that wants only the count passes it:
+     * `total` is exact whatever the limit, so nothing has to come back for it.
+     * Zero means zero — an implementation that reads a falsy limit as "no limit"
+     * returns every running contract to a caller asking for none, which is the
+     * one shape of this method that gets slower the more an installation sells.
+     * The executable contract asks for `0`.
+     */
+    listRunningIssuers(limit: number, asOf?: Date): Promise<RunningContractIssuers>;
+}
+/**
+ * The parties contracts are concluded with, their link to the tenant they are
+ * live for, and the corrections of their legal identity.
+ *
+ * A subscriber has at most one live tenant and a tenant at most one live
+ * subscriber; the database holds both, so two callers creating one for the
+ * same tenant at once end with one.
+ */
+interface SubscriberRepository {
+    /**
+     * Creates a subscriber, assigns its customer number, and makes it the
+     * tenant's live subscriber — all or nothing. `null` when the tenant already
+     * has a live subscriber, in which case nothing is written and the caller's
+     * transaction stays usable.
+     */
+    createForTenant(data: CreateSubscriberData, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    findById(subscriberId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /** The subscriber live for this tenant, or `null` when it has none. */
+    findByTenantId(tenantId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /** Writes the members given and keeps the rest; `null` when no such subscriber exists. */
+    updateContact(subscriberId: string, change: SubscriberContactChange, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /**
+     * Writes a correction of the legal identity and records it, in one step:
+     * the subscriber is read and changed under a lock, so the values recorded
+     * as replaced are the ones this write replaced even when two corrections
+     * arrive at once. A field whose stored value already equals the corrected
+     * one is left out of the record, and when none differs nothing is written
+     * and `correction` is `null`. `null` when no such subscriber exists.
+     */
+    correctIdentity(subscriberId: string, data: SubscriberCorrectionData, tx?: TransactionContext): Promise<SubscriberCorrectionResult | null>;
+    /** Every correction of this subscriber, the latest first. */
+    listCorrections(subscriberId: string): Promise<SubscriberCorrectionRecord[]>;
 }
 /**
  * Display form of a subscription for the tenant self-service UI.
@@ -2712,6 +3788,40 @@ interface SubscriptionUsageRecord {
     /** Current period window — for proration and change-effective date. */
     currentPeriodStart: Date | null;
     currentPeriodEnd: Date | null;
+    /**
+     * End of what was committed to, which the period end need not equal.
+     *
+     * The cancellation rules measure against this: a subscription cancelled
+     * inside its term keeps running until the term ends, not until the period
+     * does. Null on a trial, and on any subscription written before the field
+     * existed — readers treat that as "the period end is the answer".
+     */
+    minimumTermUntil?: Date | null;
+    /**
+     * The day of the month the subscription is billed on, 1–31.
+     *
+     * Read by the cancellation rules: a declaration after the notice window
+     * lands one period past the term end, and that step has to measure from the
+     * billing day rather than from a term end that may already have been
+     * clamped by a short month.
+     *
+     * Optional, because an adapter that does not store the column keeps today's
+     * behaviour — the step then takes its day from the term end, which is
+     * correct except in the month after a clamp.
+     */
+    billingAnchorDay?: number | null;
+    /**
+     * When a cancellation was declared, and when it lands.
+     *
+     * Required for the reason the same pair is required on
+     * `SubscriptionRecord`: the tenant billing route reads them to refuse a
+     * plan change on a subscription that has ended, and a record that omits
+     * them answers "not cancelled" — so the change is applied and prorated
+     * while entitlement resolution, which reads a record that does carry them,
+     * grants nothing.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
     pendingPlan: string | null;
     pendingBillingCycle: string | null;
     pendingEffectiveAt: Date | null;
@@ -2787,12 +3897,29 @@ interface ImmediatePlanChangeInput {
      * change, or target package without trial). A `Date` is persisted.
      */
     trialEndsAt?: Date | null;
+    /**
+     * `canceledAt` as the caller read it, so the write can claim the row only
+     * while that is still true.
+     *
+     * Three of the plan route's decisions depend on the cancellation — whether
+     * the change is refused at all, whether the billing cycle may move, and
+     * whether a fresh period is opened — and a read and a write are two
+     * moments. A cancellation declared in between made every one of them answer
+     * about a state that no longer existed, and the write went ahead anyway: a
+     * plan term recorded past the date the subscription ends.
+     *
+     * `null` is a value here rather than an absence. It claims a row that has
+     * no cancellation, and loses against one that has acquired one.
+     */
+    expectedCanceledAt: Date | null;
 }
 /** Input for `schedulePlanChange` (change at period end). */
 interface ScheduledPlanChangeInput {
     pendingPlan: string;
     pendingBillingCycle: string;
     pendingEffectiveAt: Date;
+    /** See `ImmediatePlanChangeInput.expectedCanceledAt`. */
+    expectedCanceledAt: Date | null;
 }
 /**
  * Input for `applyOnboardingSelection`. Plan-change fields that the
@@ -2801,6 +3928,12 @@ interface ScheduledPlanChangeInput {
 interface ApplyOnboardingSelectionInput {
     planId: string;
     cycle: string;
+    /**
+     * See `ImmediatePlanChangeInput.expectedCanceledAt`. The atomic path needs
+     * it for the same reason the sequential one does: without it, the preferred
+     * implementation is the one where the race stays open.
+     */
+    expectedCanceledAt: Date | null;
     /** For TRIAL → null, otherwise period start from `initialPeriodWindow`. */
     periodStart: Date | null;
     periodEnd: Date | null;
@@ -2817,6 +3950,12 @@ interface ApplyOnboardingSelectionResult {
     subscriptionId: string;
     /** null if no redeemPromo callback was provided or the callback returned null. */
     promoRedemption: PromoCodeRedemptionRecord | null;
+    /**
+     * False when the row's cancellation moved since the caller read it, in
+     * which case nothing was written — including the promo redemption, which
+     * shares the transaction.
+     */
+    claimed: boolean;
 }
 /**
  * Callback signature for promo-code redemption WITHIN the onboarding
@@ -2834,14 +3973,54 @@ type RedeemPromoInTransactionCallback = (tx: TransactionContext, subscriptionId:
  * app-specific. The platform service calls `invalidateTenant` in the
  * EntitlementService after a successful adapter call.
  */
+/** What `cancelSubscription` is told to write. Named so both adapters spell
+ * the same shape once rather than each restating it. */
+interface CancelSubscriptionInput {
+    canceledAt: Date;
+    effectiveAt: Date;
+    terminateNow: boolean;
+    minimumTermUntil?: Date;
+}
+/** What `cancelSubscription` answers with. */
+interface CancelSubscriptionResult {
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
+    status: string;
+    /**
+     * True when a cancellation was already recorded and this call changed
+     * nothing — the stored dates are returned instead.
+     *
+     * The caller checks first, but a check and a write are two moments, and two
+     * requests can pass the check before either writes. Straddling a notice
+     * deadline that costs a billing cycle: the first declaration lands on time,
+     * the second recomputes against a later `now`, and an unconditional write
+     * replaces the first answer with one a period further out. An
+     * implementation therefore claims the row only while both cancellation
+     * fields are still empty, and answers `true` here when the claim finds
+     * nothing to claim.
+     */
+    alreadyCanceled: boolean;
+}
 interface TenantSubscriptionWritePort {
+    /**
+     * Whether the writes that change a plan — the immediate change and the
+     * onboarding selection — bind the subscription's `planVersionId` to the
+     * version they sell. A contract freeze records the bound version, so it
+     * refuses to start beside a write that says `false`. Left out, it is taken
+     * on trust: the platform cannot see into a write it did not ship.
+     */
+    readonly bindsPlanVersion?: boolean;
     /** Immediate change: set plan + cycle, clear pending fields, optionally reset the period. */
     changePlanImmediate(tenantId: string, input: ImmediatePlanChangeInput): Promise<{
         plan: string;
         billingCycle: string;
+        /** False when the row's cancellation moved since the caller read it. */
+        claimed: boolean;
     }>;
     /** Change at period end: set pending fields. */
-    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<void>;
+    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<{
+        claimed: boolean;
+    }>;
     /**
      * Marks the pending PlanVersion as accepted. Idempotent — a duplicate
      * accept is a no-op. Returns `alreadyAccepted: true` if the status was
@@ -2854,13 +4033,30 @@ interface TenantSubscriptionWritePort {
         alreadyAccepted: boolean;
     }>;
     /**
-     * Cancel the subscription. `immediate=true` → status CANCELED from now;
-     * `false` → canceledAt = currentPeriodEnd, status is preserved.
+     * Record a cancellation. The dates are decided above this port.
+     *
+     * `canceledAt` is when the customer said it; `effectiveAt` is when it
+     * lands. They differ for every ordinary cancellation, because a
+     * subscription cancelled inside its term keeps running, keeps being billed
+     * and keeps its entitlements until the term ends. An adapter that computed
+     * the second from the first — which this one did, as
+     * `immediate ? now : currentPeriodEnd` — was deciding a commercial
+     * question in a persistence layer, and could not see the minimum term or
+     * the notice period at all.
+     *
+     * `terminateNow` flips the status immediately, and is set when the
+     * cancellation is already effective: an operator ending a contract, or the
+     * rules finding nothing left to run — no period, no term, as on a trial.
+     * It is never a client's request. A tenant may always declare a
+     * cancellation and may never shorten the term they are in; what decides
+     * this flag is the date the rules returned, not the date they asked for.
+     *
+     * `minimumTermUntil` extends the stored commitment, and is set only when
+     * the cancellation itself extends it: a declaration made after the notice
+     * deadline buys the following period. Left unset the stored term end is
+     * unchanged, which is the ordinary case.
      */
-    cancelSubscription(tenantId: string, immediate: boolean, now: Date): Promise<{
-        canceledAt: Date | null;
-        status: string;
-    }>;
+    cancelSubscription(tenantId: string, input: CancelSubscriptionInput): Promise<CancelSubscriptionResult>;
     /**
      * Atomic onboarding creation: sets plan + cycle + period window
      * AND optionally calls a promo-redeem callback — all in a
@@ -2883,6 +4079,8 @@ interface PlanVersionRepository {
      *
      * Note: ignores `validFrom`/`validUntil`. For time-aware
      * resolution (onboarding, plan fallback for TRIAL) use `findActive`.
+     *
+     * A plan key no plan has finds `null`, not an error.
      */
     findLatestLive(planId: string, tx?: TransactionContext): Promise<PlanVersionRecord | null>;
     /**
@@ -2895,6 +4093,8 @@ interface PlanVersionRepository {
      * return the highest `validFrom`, explicitly ordering null start dates
      * last as a legacy fallback. Adapters without validity columns may omit
      * the method (consumers fall back to `findLatestLive`).
+     *
+     * A plan key no plan has finds `null`, not an error.
      */
     findActive?(planId: string, asOf?: Date, tx?: TransactionContext): Promise<PlanVersionRecord | null>;
 }
@@ -3088,23 +4288,31 @@ interface AdminResourcesPort {
 }
 /**
  * Read adapter for the current AdminManifest. The consumer implementation
- * delegates to its `AdminManifestService.getManifest()`. The platform CLI
- * uses this for `<app> manifest dump|hash|check` etc.
+ * delegates to its `AdminManifestService.getManifest()`, which reads the plan
+ * catalogue on every call and therefore answers asynchronously. The platform
+ * CLI uses this for `<app> manifest dump|hash|check` etc.
  */
 interface ManifestAccessPort {
-    getManifest(): AdminManifest;
+    getManifest(): Promise<AdminManifest>;
     /** Optional: forces a rebuild from the contributions (e.g. after code reload). */
-    rebuild?(): AdminManifest;
+    rebuild?(): Promise<AdminManifest>;
 }
 /**
  * Adapter for the RLS bypass context. Platform code calls `runWithBypass`,
  * the consumer implementation triggers the Postgres session variable
  * (`set_config('app.bypass_rls', 'true', true)`) or the equivalent in
- * Django/other stacks. The execution context lives for exactly one
- * request pipeline (AsyncLocalStorage / `contextvars` etc.).
+ * Django/other stacks. The execution context lives for the call it wraps
+ * (AsyncLocalStorage / `contextvars` etc.).
  *
  * SuperAdmin operations are platform-wide without tenant scope — without
  * bypass, all RLS-protected reads would come back empty.
+ *
+ * **Not only inside a request.** The platform's boot checks read platform-wide
+ * before anything is served: an implementation that reaches for a
+ * request-scoped connection, or that asserts a request context is open, fails
+ * at start rather than where it is called. Wrap the call the way it is given —
+ * `AsyncLocalStorage.run` is the shape both shipped adapters use, and it is as
+ * good at boot as it is in a request.
  */
 interface RlsBypassPort {
     runWithBypass<T>(fn: () => Promise<T>): Promise<T>;
@@ -3112,7 +4320,6 @@ interface RlsBypassPort {
 
 /** Filter for `PlanRepository.list()`. */
 interface PlanListFilter {
-    projectKey: string;
     /** Exclude soft-deleted plans — default `true`. */
     excludeDeleted?: boolean;
     /**
@@ -3146,7 +4353,7 @@ interface PlanListFilter {
 interface PlanRepository {
     list(filter: PlanListFilter): Promise<PlanRow[]>;
     findById(planId: string): Promise<PlanRow | null>;
-    findByKey(projectKey: string, planKey: string): Promise<PlanRow | null>;
+    findByKey(planKey: string): Promise<PlanRow | null>;
     create(data: CreatePlanData): Promise<PlanRow>;
     update(planId: string, data: UpdatePlanData): Promise<PlanRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted plans are filtered from `list` by default. */
@@ -3247,10 +4454,24 @@ interface PlanRepository {
 }
 /** Filter for `BundleRepository.list()`. */
 interface BundleListFilter {
-    projectKey: string;
     /** Exclude soft-deleted bundles — default `true`. */
     excludeDeleted?: boolean;
 }
+/**
+ * What publishing a bundle draft records.
+ *
+ * Named because it was written out three times — the port, and each adapter's
+ * implementation of it — and a signature restated is a contract restated: the
+ * copies can drift, and nothing but a reader would notice.
+ */
+interface PublishBundleVersionMeta {
+    publishedByUserId: string | null;
+    publishedChanges: VersionChange[];
+    nonRegressive: boolean;
+    /** Required — validated by the service before the repository call. */
+    validFrom: Date;
+    validUntil: Date | null;
+}
 /**
  * Adapter for `Bundle` + `BundleVersion` persistence. Consumers implement
  * this against their Prisma tables (`bundles` + `bundle_versions`).
@@ -3269,7 +4490,7 @@ interface BundleListFilter {
 interface BundleRepository {
     list(filter: BundleListFilter): Promise<BundleRow[]>;
     findById(bundleId: string): Promise<BundleRow | null>;
-    findByKey(projectKey: string, bundleKey: string): Promise<BundleRow | null>;
+    findByKey(bundleKey: string): Promise<BundleRow | null>;
     create(data: CreateBundleData): Promise<BundleRow>;
     update(bundleId: string, data: UpdateBundleData): Promise<BundleRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted bundles are filtered from `list` by default. */
@@ -3328,14 +4549,7 @@ interface BundleRepository {
      * if the predecessor carries a `validUntil` — the adapter only
      * persists, it does not validate again.
      */
-    publishDraft(versionId: string, publishMeta: {
-        publishedByUserId: string | null;
-        publishedChanges: VersionChange[];
-        nonRegressive: boolean;
-        /** Required — validated by the service before the repository call. */
-        validFrom: Date;
-        validUntil: Date | null;
-    }, tx?: TransactionContext): Promise<BundleVersionRow>;
+    publishDraft(versionId: string, publishMeta: PublishBundleVersionMeta, tx?: TransactionContext): Promise<BundleVersionRow>;
     /**
      * Hard-discards a draft version (`publishedAt === null`) from the DB.
      * Throws if the version was already published — published versions
@@ -3373,7 +4587,6 @@ interface MarketingProjectionRepository {
 }
 /** Upsert input for a capability from the discovery sync. */
 interface UpsertCapabilityEntryData {
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -3390,7 +4603,6 @@ interface UpsertCapabilityEntryData {
 }
 /** Upsert input for a feature from the discovery sync. */
 interface UpsertFeatureEntryData {
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -3404,7 +4616,6 @@ interface UpsertFeatureEntryData {
 }
 /** Upsert input for a quota from the discovery sync. */
 interface UpsertQuotaEntryData {
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -3434,7 +4645,7 @@ interface SetCatalogEntryReviewData {
  * Prisma tables.
  *
  * Binding:
- * - `upsert*` matches on (`projectKey`, `<key>`) and leaves `i18n`,
+ * - `upsert*` matches on `<key>` and leaves `i18n`,
  *   `sortOrder`, `createdAt` as well as the approval fields (`approvedAt`/
  *   `approvedBy`/`approvedSignature`) **untouched** on an update —
  *   only the code-derived fields + the status (resolved by the service)
@@ -3450,7 +4661,7 @@ interface CatalogEntryRepository {
     upsertCapability(data: UpsertCapabilityEntryData): Promise<CapabilityCatalogEntryRow>;
     upsertFeature(data: UpsertFeatureEntryData): Promise<FeatureCatalogEntryRow>;
     upsertQuota(data: UpsertQuotaEntryData): Promise<QuotaCatalogEntryRow>;
-    retireMissing(projectKey: string, type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
+    retireMissing(type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
     /**
      * Sets or clears the successor pointer of a feature/quota
      * (#39). The sync calls this when a key disappears from the snapshot
@@ -3459,17 +4670,17 @@ interface CatalogEntryRepository {
      * adapters without a `successor_key` column omit the methods, and the sync
      * then skips the pointers with a warn log.
      */
-    setFeatureSuccessor?(projectKey: string, featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
-    setQuotaSuccessor?(projectKey: string, quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
-    findFeature(projectKey: string, featureKey: string): Promise<FeatureCatalogEntryRow | null>;
-    findQuota(projectKey: string, quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
-    setFeatureReview(projectKey: string, featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
-    setQuotaReview(projectKey: string, quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
-    setFeatureI18n(projectKey: string, featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
-    setQuotaI18n(projectKey: string, quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
+    setFeatureSuccessor?(featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
+    setQuotaSuccessor?(quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
+    findFeature(featureKey: string): Promise<FeatureCatalogEntryRow | null>;
+    findQuota(quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
+    setFeatureReview(featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
+    setQuotaReview(quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
+    setFeatureI18n(featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
+    setQuotaI18n(quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
     /** Sets the editable base fields (default locale `label`/`description`). */
-    setFeatureBase(projectKey: string, featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
-    setQuotaBase(projectKey: string, quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
+    setFeatureBase(featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
+    setQuotaBase(quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
 }
 /**
  * Adapter for `promotions`. **No versioning** — promotions are edited
@@ -3477,7 +4688,7 @@ interface CatalogEntryRepository {
  * this against their `promotions` Prisma table.
  */
 interface PromotionRepository {
-    list(filter: PromotionFilter): Promise<PromotionRow[]>;
+    list(): Promise<PromotionRow[]>;
     findById(id: string): Promise<PromotionRow | null>;
     create(data: CreatePromotionData): Promise<PromotionRow>;
     update(id: string, data: UpdatePromotionData): Promise<PromotionRow>;
@@ -3485,27 +4696,322 @@ interface PromotionRepository {
     delete(id: string): Promise<void>;
 }
 /**
- * Adapter for `marketing_settings` — one row per project. `get` returns
- * `null` as long as the SuperAdmin has saved nothing (then the full
- * `availableLocales` pool counts as active). `upsert` creates the row or replaces it.
+ * Adapter for `marketing_settings` — at most one row, which a `CHECK` on the
+ * canonical schema holds rather than convention. `get` returns `null` as long
+ * as the SuperAdmin has saved nothing (then the full `availableLocales` pool
+ * counts as active). `upsert` creates the row or replaces it.
  */
 interface MarketingSettingsRepository {
-    get(projectKey: string): Promise<MarketingSettingsRow | null>;
-    upsert(projectKey: string, data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
+    get(): Promise<MarketingSettingsRow | null>;
+    upsert(data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
+}
+
+/**
+ * Adapter for `checkout_offers`. The offer is an immutable bundle snapshot:
+ * `create` creates it, `update` only allows customization while
+ * `status = 'open'`, `consume` freezes it.
+ */
+interface CheckoutOfferRepository {
+    list(filter: CheckoutOfferFilter): Promise<CheckoutOfferRow[]>;
+    findById(id: string): Promise<CheckoutOfferRow | null>;
+    create(data: CreateCheckoutOfferData): Promise<CheckoutOfferRow>;
+    update(id: string, data: UpdateCheckoutOfferData): Promise<CheckoutOfferRow>;
+    /**
+     * Sets `status = 'consumed'` + `consumedAt = NOW()`, and only while the
+     * offer is still `open`: the write carries that condition, so of two
+     * callers consuming at once one succeeds and the other is refused with
+     * `CHECKOUT_OFFER_ALREADY_CONSUMED` (or `CHECKOUT_OFFER_EXPIRED`). A check
+     * before the write cannot decide it, because the status can change in
+     * between.
+     *
+     * With `tx`, the write runs on that transaction, so it is undone with
+     * everything else the transaction wrote. `CheckoutOfferService.conclude`
+     * depends on that; the persistence contract holds both.
+     */
+    consume(id: string, tx?: TransactionContext): Promise<CheckoutOfferRow>;
+}
+
+/** `ACTIVE` is the one in use; `REPLACED` is one a later payment method took over from. */
+type SubscriberPaymentMethodStatus = 'ACTIVE' | 'REPLACED';
+interface SubscriberPaymentMethodRecord extends ConfirmedPaymentMethod {
+    id: string;
+    subscriberId: string;
+    /** The account in `config/saas.yaml#payments.accounts` the references belong to. */
+    gatewayAccount: string;
+    /** The provider of that account when the payment method was confirmed. */
+    provider: string;
+    status: SubscriberPaymentMethodStatus;
+    /** When the gateway confirmed the payment method. */
+    confirmedAt: Date;
+    /** When a later payment method took over; `null` while this one is in use. */
+    replacedAt: Date | null;
+    createdAt: Date;
+}
+/** What a repository records for a payment method the gateway confirmed. */
+interface RecordSubscriberPaymentMethodData extends ConfirmedPaymentMethod {
+    subscriberId: string;
+    gatewayAccount: string;
+    provider: string;
+    confirmedAt: Date;
+}
+/**
+ * - `activated`: it is the subscriber's payment method now, and the one it
+ *   replaced, if any, is `REPLACED`.
+ * - `already-recorded`: the account's reference was recorded before; nothing
+ *   was written, and `method` is the row that holds it.
+ * - `superseded`: the subscriber's payment method in use was confirmed after
+ *   this one, so this one is recorded as already replaced — confirmations can
+ *   arrive in another order than the forms were filled in.
+ */
+type RecordSubscriberPaymentMethodOutcome = 'activated' | 'already-recorded' | 'superseded';
+/**
+ * A change of payment method a tenant started: the gateway session it opened
+ * for the subscriber. A confirmation is recorded only against the setup it
+ * belongs to, so a callback that names another subscriber than the session was
+ * opened for changes nobody's payment method.
+ */
+interface SubscriberPaymentMethodSetupData {
+    subscriberId: string;
+    gatewayAccount: string;
+    /** The gateway's session, unique within the account. */
+    sessionRef: string;
+    /** The customer the gateway keeps the payment method under. */
+    customerRef: string;
+    startedAt: Date;
+}
+/** Which setup a confirmation claims to complete. */
+interface SubscriberPaymentMethodSetupMatch {
+    gatewayAccount: string;
+    sessionRef: string;
+    subscriberId: string;
+}
+/**
+ * Which payment method a read by reference asks about.
+ *
+ * All three together, because `(gatewayAccount, paymentMethodRef)` is unique
+ * account-wide rather than per subscriber: without the subscriber the question
+ * has no answer that is this caller's.
+ *
+ * One argument rather than three strings in a row, for the reason
+ * `SubscriberPaymentMethodSetupMatch` is one — at a call site three strings of
+ * the same type can be swapped with nothing saying so — and for a second that
+ * is specific to a port. `TransactionContext` is `unknown`, so it accepts a
+ * string: against a positional signature, an implementation whose parameters
+ * are offset by one typechecks and then reads the account out of the
+ * subscriber's place. Against an object it does not.
+ */
+interface SubscriberPaymentMethodReference {
+    subscriberId: string;
+    gatewayAccount: string;
+    paymentMethodRef: string;
+}
+interface RecordSubscriberPaymentMethodResult {
+    method: SubscriberPaymentMethodRecord;
+    outcome: RecordSubscriberPaymentMethodOutcome;
+}
+
+/** A gateway event, as the log records it. */
+interface PaymentEventClaim {
+    /** The account the event came from; an event identifier is unique only within it. */
+    gatewayAccount: string;
+    eventId: string;
+    provider: string;
+    /** The gateway session the event is about, where it is about one. */
+    sessionId: string | null;
+    kind: PaymentGatewayEvent['kind'];
+    /** What the event said, without anything that names or reaches a person. */
+    summary: Record<string, unknown>;
+}
+/**
+ * The events a gateway sent, each handled once.
+ *
+ * Gateways deliver at least once, so the same event arrives again after a
+ * timeout or a retry. An event is claimed on the transaction that writes what
+ * it changes: when that transaction rolls back, the claim goes with it and the
+ * gateway's retry is handled rather than discarded as a duplicate.
+ */
+interface PaymentEventLog {
+    /**
+     * Records the event and returns `true`, or returns `false` when this account
+     * already recorded it, writing nothing.
+     *
+     * The duplicate must not raise: on PostgreSQL an error aborts the
+     * transaction it happened on, and the caller's transaction has to stay
+     * usable. An `INSERT … ON CONFLICT DO NOTHING` does both — and when another
+     * transaction holds the same claim uncommitted, it waits for that one and
+     * answers by its outcome.
+     *
+     * A confirmation of a session this account already confirmed is a duplicate
+     * as well, whatever its `eventId`: one session is set up once, and a gateway
+     * may report it through more than one event. `sql/constraints.postgres.sql`
+     * holds that as a second unique index, and the untargeted `DO NOTHING`
+     * answers for it too.
+     */
+    claim(claim: PaymentEventClaim, tx: TransactionContext): Promise<boolean>;
+    /**
+     * Takes the session off a claim whose event changed nothing, so the next
+     * event about that session is handled instead of taken for the duplicate it
+     * is not. The claim itself stays: that one event is never handled twice.
+     *
+     * The session is held from the claim onwards, which is what keeps two
+     * confirmations delivered at once from both taking effect; an event that
+     * turned out to have nothing to do gives it back on the same transaction.
+     */
+    releaseSession(gatewayAccount: string, eventId: string, tx: TransactionContext): Promise<void>;
+}
+/**
+ * The payment methods of subscribers, as references at the gateway accounts
+ * that confirmed them.
+ *
+ * A subscriber has at most one `ACTIVE` payment method; the database holds
+ * that, so two confirmations recorded at once for one subscriber end with one.
+ *
+ * **Within an account, a reference belongs to exactly one subscriber**, and
+ * keeps belonging to it once a newer payment method has replaced it. Every
+ * method that reaches a payment method therefore names the subscriber it is
+ * about, and an implementation answers about that one only. `accountsInUse` is
+ * the exception and says so at itself: it counts accounts rather than handing
+ * out a row.
+ *
+ * That matters on a gateway callback, which is where these are reached: it
+ * arrives without a session, so an installation that keeps its tenants apart
+ * with a policy lifts that policy for it, and what the question names is then
+ * all that bounds it.
+ */
+interface SubscriberPaymentMethodRepository {
+    /**
+     * Records a confirmed payment method for its subscriber, under a lock on the
+     * subscriber so two confirmations take turns. See
+     * `RecordSubscriberPaymentMethodOutcome` for the three outcomes.
+     *
+     * A confirmation carrying a reference **another** subscriber holds is a
+     * fourth case and has no outcome: it is refused with
+     * `ForeignPaymentMethodReferenceError`, because the account's reference is
+     * that subscriber's and answering `already-recorded` would hand its payment
+     * method to a caller acting for somebody else.
+     *
+     * Two subscribers can reach that reference at the same time: the lock is on
+     * the subscriber, so confirmations for two of them do not take turns, and a
+     * read sees nothing of a row the other has not committed. Reading is
+     * therefore not enough to decide it. **Claim the reference with the first
+     * write, conflict-free** — `ON CONFLICT DO NOTHING` on its unique key, or
+     * whatever the store spells that as — and refuse when the claim takes no
+     * row. Both shipped adapters do exactly that, and it is what lets the
+     * refusal say the same thing everywhere: the key decides, not an error
+     * whose shape belongs to one driver.
+     *
+     * The order is part of the contract, not an implementation detail. Because
+     * the claim is the first write, a refusal leaves the caller's transaction
+     * as it found it — nothing to undo, and nothing that makes it unusable.
+     * An implementation that writes before it claims cannot promise that.
+     */
+    recordConfirmed(data: RecordSubscriberPaymentMethodData, tx?: TransactionContext): Promise<RecordSubscriberPaymentMethodResult>;
+    /** The subscriber's payment method in use, or `null` when it has none. */
+    findActive(subscriberId: string, tx?: TransactionContext): Promise<SubscriberPaymentMethodRecord | null>;
+    /**
+     * The payment method the reference names, whatever its status — and `null`
+     * when that subscriber holds none under it, which includes the case of
+     * another subscriber holding the reference.
+     *
+     * The one read that reaches a payment method a newer one replaced, which is
+     * how `@saasicat/persistence-testing` verifies that an implementation keeps
+     * the history rather than overwriting the row (`SC-PRIC-030`).
+     *
+     * The subscriber is what bounds the read. Without it an implementation
+     * would have only the account's reference to go on, which is unique
+     * account-wide: inside a tenant's context a policy would answer `null` and
+     * on a gateway callback, where that policy is lifted, the same call would
+     * answer with somebody else's row. One question, two answers by where it
+     * was asked, is what naming the subscriber removes.
+     */
+    findByReference(reference: SubscriberPaymentMethodReference, tx?: TransactionContext): Promise<SubscriberPaymentMethodRecord | null>;
+    /**
+     * Every account that holds a payment method in use, each once.
+     *
+     * Platform-wide: anchored by no subscriber and no tenant, and a start makes
+     * it before anything is served, to refuse a configuration that no longer
+     * names an account somebody's payment method is held at. An implementation
+     * on a tenant-scoped client must read RLS-exempt — the platform wraps the
+     * call in `RlsBypassPort`, and one that answers with the caller's tenant
+     * scope instead returns an empty list at a boot, where there is no tenant,
+     * so the check that exists to refuse passes. The persistence contract runs
+     * with no policy forced, so it cannot catch that for you.
+     */
+    accountsInUse(): Promise<string[]>;
+    /**
+     * Records a change of payment method a tenant started, open until its
+     * confirmation completes it.
+     *
+     * One session is one setup: the account and the session are unique together,
+     * and a second setup for a session already recorded raises. A gateway hands
+     * out a session per start, so an adapter that returns one twice is the
+     * defect this refuses to write over.
+     */
+    recordSetup(data: SubscriberPaymentMethodSetupData, tx?: TransactionContext): Promise<void>;
+    /**
+     * Completes the open setup the account, the session and the subscriber all
+     * name, and returns `true` — or returns `false`, writing nothing, when no
+     * open setup matches all three: none was started, it was started for another
+     * subscriber, or it is complete already. A single conditional write, so two
+     * confirmations for one setup complete it once.
+     */
+    completeSetup(match: SubscriberPaymentMethodSetupMatch, completedAt: Date, tx?: TransactionContext): Promise<boolean>;
 }
 
+/** Which changes to list. */
+interface SettingsChangeFilter {
+    /** Only changes an operator has, or has not, acknowledged. Omitted: both. */
+    acknowledged?: boolean;
+    /** The most recently recorded ones. Omitted: every matching change. */
+    limit?: number;
+}
 /**
- * Adapter for `checkout_offers`. The offer is an immutable bundle snapshot:
- * `create` creates it, `update` only allows customization while
- * `status = 'open'`, `consume` freezes it.
- */
-interface CheckoutOfferRepository {
-    list(filter: CheckoutOfferFilter): Promise<CheckoutOfferRow[]>;
-    findById(id: string): Promise<CheckoutOfferRow | null>;
-    create(data: CreateCheckoutOfferData): Promise<CheckoutOfferRow>;
-    update(id: string, data: UpdateCheckoutOfferData): Promise<CheckoutOfferRow>;
-    /** Sets `status = 'consumed'` + `consumedAt = NOW()`. */
-    consume(id: string): Promise<CheckoutOfferRow>;
+ * Stores what the installation applied and what changed between two boots.
+ *
+ * `applied_settings` holds one row for the installation; `settings_changes`
+ * holds one row per boot that found the fingerprint moved. An adapter
+ * translates: it does not decide what a change is, and it does not read the
+ * row back into anything that runs.
+ *
+ * Both writes are guarded on the fingerprint the caller read. Several replicas
+ * of one installation start together after one edit of the file, each reads
+ * the same record and each finds the same difference; the guard is what makes
+ * one of them the boot that recorded it and the others boots that found it
+ * recorded. Without it every replica would write the change and mail the
+ * addresses, once per replica.
+ */
+interface AppliedSettingsPort {
+    /** The record, or null before the first boot that could write one. */
+    readApplied(): Promise<AppliedSettingsRecord | null>;
+    /**
+     * Replaces the installation's record — there is only ever the one row —
+     * provided the stored record still carries `expectedFingerprint`: the
+     * fingerprint the caller read, or `null` where it read no record. Returns
+     * whether it did. `false` means the record moved between the caller's read
+     * and this write, and nothing was written: another boot got there first.
+     */
+    writeApplied(record: AppliedSettingsRecord, expectedFingerprint: string | null): Promise<boolean>;
+    /**
+     * Appends a change a boot noticed and replaces the record it supersedes, in
+     * one step: both land, or neither does. Guarded like `writeApplied`, on the
+     * fingerprint of the record the change was noticed against. Returns the
+     * change as stored — the id is the adapter's to assign — or `null` where
+     * the record had already moved on: another boot noticed first, and the
+     * change is that boot's to report.
+     */
+    recordChange(change: NewSettingsChange, record: AppliedSettingsRecord, expectedFingerprint: string): Promise<SettingsChangeRecord | null>;
+    /**
+     * Changes, the most recently recorded first: the order the record went
+     * through them, which the database numbers at each write — not the order
+     * of the moments they carry, which are the recording starts' clocks.
+     */
+    listChanges(filter?: SettingsChangeFilter): Promise<SettingsChangeRecord[]>;
+    /**
+     * Marks a change as seen. Returns the updated record, or null where no
+     * change has that id. A change already acknowledged keeps its first
+     * acknowledgement — repeating the action changes nothing.
+     */
+    acknowledgeChange(id: string, acknowledgedBy: string, acknowledgedAt: Date): Promise<SettingsChangeRecord | null>;
 }
 
 /** Class reference usable as a DI token (e.g. the consumer's `PrismaService`). */
@@ -3565,12 +5071,20 @@ interface SaaSiCatPersistenceCore {
     auditQuery?: PersistenceProvider<AuditQueryPort>;
     /** Aggregation for the admin stats dashboard. */
     auditStats?: PersistenceProvider<AuditStatsPort>;
+    /**
+     * The record of the applied configuration (`SettingsModule`). Optional so
+     * an adapter written before it existed keeps working; without it the
+     * platform says once at boot that it is not recording.
+     */
+    appliedSettings?: PersistenceProvider<AppliedSettingsPort>;
 }
 /** Repositories for the entitlement/contract loop (`EntitlementModule`). */
 interface SaaSiCatPersistenceEntitlement {
     subscriptionRepository: PersistenceProvider<SubscriptionRepository>;
     planVersionRepository: PersistenceProvider<PlanVersionRepository>;
     subscriptionContractRepository?: PersistenceProvider<SubscriptionContractRepository>;
+    /** The parties contracts are concluded with; required wherever contracts are written. */
+    subscriberRepository?: PersistenceProvider<SubscriberRepository>;
     subscriptionBundleRepository?: PersistenceProvider<SubscriptionBundleRepository>;
     bundleRepository?: PersistenceProvider<BundleRepository>;
 }
@@ -3597,6 +5111,15 @@ interface SaaSiCatPersistenceTenantBilling {
     subscriptionWritePort: PersistenceProvider<TenantSubscriptionWritePort>;
     usageSnapshotPort?: PersistenceProvider<UsageSnapshotPort>;
 }
+/**
+ * The record of payment gateway callbacks and the payment methods they confirm
+ * (`payments` in `SaaSiCatModule.forRoot`). Both are written on the transaction
+ * a callback is handled on, so they come from the adapter that runs it.
+ */
+interface SaaSiCatPersistencePayments {
+    paymentEventLog: PersistenceProvider<PaymentEventLog>;
+    subscriberPaymentMethodRepository: PersistenceProvider<SubscriberPaymentMethodRepository>;
+}
 /** Read/write backing for the standard SuperAdmin resource pages. */
 interface SaaSiCatPersistenceAdminResources {
     resources: PersistenceProvider<AdminResourcesPort>;
@@ -3613,6 +5136,8 @@ interface SaaSiCatPersistencePromo {
     validationLogRepository: PersistenceProvider<PromoCodeValidationLogRepository>;
     subscriptionLookup: PersistenceProvider<PromoSubscriptionLookup>;
     revenueAggregator: PersistenceProvider<PromoRevenueDeductionAggregator>;
+    /** The slots a code keeps for checkouts; left out, no checkout holds one. */
+    holdRepository?: PersistenceProvider<PromoCodeHoldRepository>;
 }
 /**
  * Aggregate persistence bundle. Produced by adapter factories such as
@@ -3631,6 +5156,8 @@ interface SaaSiCatPersistenceAdapter {
     /** Tenant, user, audit and subscription resources for the SuperAdmin UI. */
     adminResources?: SaaSiCatPersistenceAdminResources;
     promo?: SaaSiCatPersistencePromo;
+    /** Payment gateway callbacks and subscriber payment methods. */
+    payments?: SaaSiCatPersistencePayments;
     /** DB hydration of the plan catalog at boot (`PlanCatalogModule`). */
     planCatalogReadSink?: PersistenceProvider<PlanCatalogReadSink>;
     /** One-shot `saas.yaml → DB` import. */
@@ -3703,6 +5230,8 @@ declare const CATALOG_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -3720,6 +5249,12 @@ declare const CATALOG_ERROR_CODES: {
     readonly FEATURE_NOT_FOUND: "FEATURE_NOT_FOUND";
     readonly QUOTA_NOT_FOUND: "QUOTA_NOT_FOUND";
     readonly PROMOTION_NOT_FOUND: "PROMOTION_NOT_FOUND";
+    /**
+     * A promotion's value is not one its type takes: a percentage above 0 and
+     * at most 100, an amount above 0, an intro price of at least 0 for a whole
+     * number of months, or a whole number of free months.
+     */
+    readonly PROMOTION_VALUE_INVALID: "PROMOTION_VALUE_INVALID";
     readonly MARKETING_PROJECTION_NOT_FOUND: "MARKETING_PROJECTION_NOT_FOUND";
     readonly PLAN_ALREADY_EXISTS: "PLAN_ALREADY_EXISTS";
     readonly BUNDLE_ALREADY_EXISTS: "BUNDLE_ALREADY_EXISTS";
@@ -3730,6 +5265,10 @@ declare const CATALOG_ERROR_CODES: {
     readonly QUOTA_NOT_IN_DISCOVERY_SNAPSHOT: "QUOTA_NOT_IN_DISCOVERY_SNAPSHOT";
     readonly DISCOVERY_STATUS_TRANSITION_INVALID: "DISCOVERY_STATUS_TRANSITION_INVALID";
     readonly DISCOVERY_NOT_INITIALIZED: "DISCOVERY_NOT_INITIALIZED";
+    /** The uploaded document is not a plan catalog — unparseable, or not an object. */
+    readonly PLAN_CATALOG_UNREADABLE: "PLAN_CATALOG_UNREADABLE";
+    /** It parsed, and then failed the schema or a cross-field rule. */
+    readonly PLAN_CATALOG_INVALID: "PLAN_CATALOG_INVALID";
 };
 type CatalogErrorCode = (typeof CATALOG_ERROR_CODES)[keyof typeof CATALOG_ERROR_CODES];
 /** Bundle bookings on a tenant subscription. */
@@ -3743,6 +5282,8 @@ declare const BILLING_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3756,8 +5297,79 @@ declare const BILLING_ERROR_CODES: {
     readonly PLAN_NOT_IN_CATALOG: "PLAN_NOT_IN_CATALOG";
     /** Plan exists but cannot be booked via self-service. */
     readonly PLAN_NOT_SELF_SERVICE: "PLAN_NOT_SELF_SERVICE";
+    /**
+     * Plan carries no price for the requested billing cycle, so it is not sold
+     * in it: a plan without a yearly price is a monthly plan.
+     */
+    readonly PLAN_NOT_SOLD_IN_CYCLE: "PLAN_NOT_SOLD_IN_CYCLE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
+    /**
+     * The subscription moved between the read a request was decided on and the
+     * write it attempted, so nothing was written. The caller reloads and asks
+     * again.
+     */
+    readonly SUBSCRIPTION_CHANGED: "SUBSCRIPTION_CHANGED";
+    /**
+     * The tenant has no subscription to act on.
+     *
+     * `SUBSCRIPTION_NOT_FOUND` states the same fact on the read routes. Both
+     * are already on the wire and a code is renamed only deliberately, so both
+     * are named here rather than one being dropped behind a consumer's back.
+     */
+    readonly NO_SUBSCRIPTION: "NO_SUBSCRIPTION";
+    /**
+     * The cancellation date the reader was shown is no longer the one the rules
+     * return, so the confirmation is refused rather than silently applied.
+     * Carries the recomputed dates, so the page can re-ask instead of guessing.
+     */
+    readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /** The subscription has ended; its plan can no longer be changed. */
+    readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
+    /** An active special contract blocks self-service plan changes. */
+    readonly PLAN_LOCKED: "PLAN_LOCKED";
+    /** Current usage of one quota exceeds what the target plan allows. */
+    readonly QUOTA_OVER_TARGET: "QUOTA_OVER_TARGET";
+    /** The change drops features the tenant has today. */
+    readonly FEATURE_LOST: "FEATURE_LOST";
+    readonly FEATURES_LOST: "FEATURES_LOST";
+    /** Target plan and cycle already match what is in place. */
+    readonly NO_CHANGE: "NO_CHANGE";
+    /** A shorter cycle cannot start inside the term already running. */
+    readonly CYCLE_SHORTENS_AT_TERM_END: "CYCLE_SHORTENS_AT_TERM_END";
+    /** A cancelled subscription cannot change its billing cycle. */
+    readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
+    /**
+     * A bundle the tenant already holds runs past the cycle they are moving to.
+     *
+     * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
+     * same rule about a booking that has not been made yet. The two need
+     * different sentences: this one can name the day the obstacle lifts and
+     * tell the reader to cancel the booking, and that advice is wrong for
+     * someone who is only about to book. One template cannot serve both.
+     */
+    readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * Features of the previewed bundle are already covered by the plan or by
+     * another booked bundle. A warning rather than a blocker: paying twice is
+     * the customer's decision, and the preview only has to say so first.
+     */
+    readonly REDUNDANT_FEATURES: "REDUNDANT_FEATURES";
+    /**
+     * A booking's minimum term outlasts the period being cancelled, so the
+     * cancellation takes effect at the end of the term, not of the period.
+     */
+    readonly MINIMUM_TERM_BINDS: "MINIMUM_TERM_BINDS";
+    /**
+     * The previewed bundle requires features that neither the plan nor an
+     * active booking provides.
+     *
+     * The same string is a `StrictModeWarningCode` in `bundle.types.ts`, where
+     * it names the catalogue-authoring reading of the rule and travels with its
+     * own message. This declaration is the booking preview's blocker, which a
+     * tenant reads and therefore needs a shipped text for.
+     */
+    readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
     readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
@@ -3778,20 +5390,66 @@ declare const CONTRACT_ERROR_CODES: {
     readonly CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED";
     readonly CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE: "CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE";
     readonly CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED: "CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED";
+    readonly CHECKOUT_OFFER_PLAN_NOT_OFFERED: "CHECKOUT_OFFER_PLAN_NOT_OFFERED";
+    readonly CHECKOUT_OFFER_BUNDLE_NOT_OFFERED: "CHECKOUT_OFFER_BUNDLE_NOT_OFFERED";
+    readonly CHECKOUT_OFFER_PROMO_CODE_NOT_ACCEPTED: "CHECKOUT_OFFER_PROMO_CODE_NOT_ACCEPTED";
+    readonly CHECKOUT_OFFER_PRICE_NOT_CURRENT: "CHECKOUT_OFFER_PRICE_NOT_CURRENT";
     readonly SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED: "SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED: "SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_INVALID_DATE: "SUBSCRIPTION_CONTRACT_INVALID_DATE";
     readonly SUBSCRIPTION_CONTRACT_INVALID_WINDOW: "SUBSCRIPTION_CONTRACT_INVALID_WINDOW";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH";
+    readonly SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_PERCENT: "SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_PERCENT";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH";
+    /**
+     * The lines do not add up to a total the contract states, counted as often
+     * as each falls due in one period. `field` names the total.
+     */
+    readonly SUBSCRIPTION_CONTRACT_LINES_DO_NOT_ADD_UP: "SUBSCRIPTION_CONTRACT_LINES_DO_NOT_ADD_UP";
+    /** Something that takes money off states a negative amount. */
+    readonly SUBSCRIPTION_CONTRACT_DISCOUNT_NEGATIVE: "SUBSCRIPTION_CONTRACT_DISCOUNT_NEGATIVE";
     readonly SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START: "SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START";
     readonly CHECKOUT_OFFER_NOT_FOUND: "CHECKOUT_OFFER_NOT_FOUND";
     readonly CHECKOUT_OFFER_EXPIRED: "CHECKOUT_OFFER_EXPIRED";
     readonly CHECKOUT_OFFER_ALREADY_CONSUMED: "CHECKOUT_OFFER_ALREADY_CONSUMED";
     readonly CHECKOUT_OFFER_NOT_CONSUMED: "CHECKOUT_OFFER_NOT_CONSUMED";
+    /**
+     * The offer changed between the checks of `conclude` and the transaction
+     * that consumed it, so the contract checked is not the one the offer now
+     * describes. Nothing was written; load the offer and conclude it again.
+     */
+    readonly CHECKOUT_OFFER_CHANGED: "CHECKOUT_OFFER_CHANGED";
     readonly SUBSCRIPTION_CONTRACT_NOT_FOUND: "SUBSCRIPTION_CONTRACT_NOT_FOUND";
     readonly NO_ACTIVE_SUBSCRIPTION_CONTRACT: "NO_ACTIVE_SUBSCRIPTION_CONTRACT";
     readonly SUBSCRIPTION_CONTRACT_ALREADY_CLOSED: "SUBSCRIPTION_CONTRACT_ALREADY_CLOSED";
 };
 type ContractErrorCode = (typeof CONTRACT_ERROR_CODES)[keyof typeof CONTRACT_ERROR_CODES];
+/** The parties contracts are concluded with (`SubscriberService`), and their absence. */
+declare const SUBSCRIBER_ERROR_CODES: {
+    /**
+     * A contract, a plan change or a booking for a tenant that has no
+     * subscriber. Nothing is agreed or charged without the party to it.
+     * Carries `tenantId`.
+     */
+    readonly SUBSCRIBER_REQUIRED: "SUBSCRIBER_REQUIRED";
+    /** The tenant already has a live subscriber. Carries `tenantId`. */
+    readonly SUBSCRIBER_ALREADY_EXISTS: "SUBSCRIBER_ALREADY_EXISTS";
+    readonly SUBSCRIBER_NOT_FOUND: "SUBSCRIBER_NOT_FOUND";
+    readonly SUBSCRIBER_LEGAL_NAME_REQUIRED: "SUBSCRIBER_LEGAL_NAME_REQUIRED";
+    /**
+     * A detail that has a form — the country, the invoice email — is not in it,
+     * or one sign-up requires — the billing address — is missing. Carries `field`.
+     */
+    readonly SUBSCRIBER_DETAIL_INVALID: "SUBSCRIBER_DETAIL_INVALID";
+    /** A contact change named a field of the legal identity. Carries `field`. */
+    readonly SUBSCRIBER_IDENTITY_NOT_A_CONTACT: "SUBSCRIBER_IDENTITY_NOT_A_CONTACT";
+    readonly SUBSCRIBER_CORRECTION_REASON_REQUIRED: "SUBSCRIBER_CORRECTION_REASON_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_ACTOR_REQUIRED: "SUBSCRIBER_CORRECTION_ACTOR_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
+    /** The operator declared another legal entity: that is a transfer, not an edit. */
+    readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
+};
+type SubscriberErrorCode = (typeof SUBSCRIBER_ERROR_CODES)[keyof typeof SUBSCRIBER_ERROR_CODES];
 /** Self-service registration funnel (`PendingRegistration`). */
 declare const REGISTRATION_ERROR_CODES: {
     readonly PENDING_REGISTRATION_NOT_FOUND: "PENDING_REGISTRATION_NOT_FOUND";
@@ -3820,6 +5478,12 @@ declare const AUTH_ERROR_CODES: {
     /** Neither `tenantId` nor `userId` could be resolved from the request. */
     readonly TENANT_CONTEXT_MISSING: "TENANT_CONTEXT_MISSING";
     readonly TENANT_ADMIN_REQUIRED: "TENANT_ADMIN_REQUIRED";
+    /**
+     * The tenant's billing area — its payment method, and later its invoices
+     * and account — needs the billing permission, which the application maps
+     * to its roles and the tenant's administrator holds by default.
+     */
+    readonly BILLING_PERMISSION_REQUIRED: "BILLING_PERMISSION_REQUIRED";
     readonly SUPER_ADMIN_REQUIRED: "SUPER_ADMIN_REQUIRED";
     /** TOTP MFA has never been set up for this user. */
     readonly MFA_NOT_SET_UP: "MFA_NOT_SET_UP";
@@ -3850,6 +5514,30 @@ declare const PROMO_ERROR_CODES: {
     readonly PROMO_MAX_REDEMPTIONS_LOWERED: "PROMO_MAX_REDEMPTIONS_LOWERED";
 };
 type PromoErrorCode = (typeof PROMO_ERROR_CODES)[keyof typeof PROMO_ERROR_CODES];
+/** Payment methods and the gateways that confirm them. */
+declare const PAYMENT_ERROR_CODES: {
+    /**
+     * No gateway account takes new payment methods:
+     * `config/saas.yaml#payments.newPaymentMethods` names none.
+     */
+    readonly PAYMENTS_NOT_CONFIGURED: "PAYMENTS_NOT_CONFIGURED";
+    /** A callback arrived for an account `config/saas.yaml#payments.accounts` does not name. Carries `account`. */
+    readonly PAYMENT_GATEWAY_ACCOUNT_UNKNOWN: "PAYMENT_GATEWAY_ACCOUNT_UNKNOWN";
+    /** A callback the gateway did not send: its signature does not verify. */
+    readonly PAYMENT_CALLBACK_REJECTED: "PAYMENT_CALLBACK_REJECTED";
+    /**
+     * A success or cancel URL at an origin `config/saas.yaml#payments.returnUrlOrigins`
+     * does not name. Carries `field`.
+     */
+    readonly PAYMENT_RETURN_URL_NOT_ALLOWED: "PAYMENT_RETURN_URL_NOT_ALLOWED";
+};
+type PaymentErrorCode = (typeof PAYMENT_ERROR_CODES)[keyof typeof PAYMENT_ERROR_CODES];
+/** Codes of the settings record (`GET /admin/settings`, the acknowledgement). */
+declare const SETTINGS_ERROR_CODES: {
+    /** No recorded change has this id, or the installation keeps no record at all. */
+    readonly SETTINGS_CHANGE_NOT_FOUND: "SETTINGS_CHANGE_NOT_FOUND";
+};
+type SettingsErrorCode = (typeof SETTINGS_ERROR_CODES)[keyof typeof SETTINGS_ERROR_CODES];
 /**
  * Every exception code the platform emits, in one object.
  *
@@ -3858,6 +5546,22 @@ type PromoErrorCode = (typeof PROMO_ERROR_CODES)[keyof typeof PROMO_ERROR_CODES]
  * removing one may not.
  */
 declare const PLATFORM_ERROR_CODES: {
+    /** No recorded change has this id, or the installation keeps no record at all. */
+    readonly SETTINGS_CHANGE_NOT_FOUND: "SETTINGS_CHANGE_NOT_FOUND";
+    /**
+     * No gateway account takes new payment methods:
+     * `config/saas.yaml#payments.newPaymentMethods` names none.
+     */
+    readonly PAYMENTS_NOT_CONFIGURED: "PAYMENTS_NOT_CONFIGURED";
+    /** A callback arrived for an account `config/saas.yaml#payments.accounts` does not name. Carries `account`. */
+    readonly PAYMENT_GATEWAY_ACCOUNT_UNKNOWN: "PAYMENT_GATEWAY_ACCOUNT_UNKNOWN";
+    /** A callback the gateway did not send: its signature does not verify. */
+    readonly PAYMENT_CALLBACK_REJECTED: "PAYMENT_CALLBACK_REJECTED";
+    /**
+     * A success or cancel URL at an origin `config/saas.yaml#payments.returnUrlOrigins`
+     * does not name. Carries `field`.
+     */
+    readonly PAYMENT_RETURN_URL_NOT_ALLOWED: "PAYMENT_RETURN_URL_NOT_ALLOWED";
     readonly PENDING_REGISTRATION_NOT_FOUND: "PENDING_REGISTRATION_NOT_FOUND";
     readonly PENDING_REGISTRATION_EXPIRED: "PENDING_REGISTRATION_EXPIRED";
     readonly INVALID_REGISTRATION_STATE: "INVALID_REGISTRATION_STATE";
@@ -3873,20 +5577,62 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_NOT_AVAILABLE: "PLAN_NOT_AVAILABLE";
     readonly PLAN_NOT_SELECTED: "PLAN_NOT_SELECTED";
     readonly MODEL_NOT_AVAILABLE: "MODEL_NOT_AVAILABLE";
+    /**
+     * A contract, a plan change or a booking for a tenant that has no
+     * subscriber. Nothing is agreed or charged without the party to it.
+     * Carries `tenantId`.
+     */
+    readonly SUBSCRIBER_REQUIRED: "SUBSCRIBER_REQUIRED";
+    /** The tenant already has a live subscriber. Carries `tenantId`. */
+    readonly SUBSCRIBER_ALREADY_EXISTS: "SUBSCRIBER_ALREADY_EXISTS";
+    readonly SUBSCRIBER_NOT_FOUND: "SUBSCRIBER_NOT_FOUND";
+    readonly SUBSCRIBER_LEGAL_NAME_REQUIRED: "SUBSCRIBER_LEGAL_NAME_REQUIRED";
+    /**
+     * A detail that has a form — the country, the invoice email — is not in it,
+     * or one sign-up requires — the billing address — is missing. Carries `field`.
+     */
+    readonly SUBSCRIBER_DETAIL_INVALID: "SUBSCRIBER_DETAIL_INVALID";
+    /** A contact change named a field of the legal identity. Carries `field`. */
+    readonly SUBSCRIBER_IDENTITY_NOT_A_CONTACT: "SUBSCRIBER_IDENTITY_NOT_A_CONTACT";
+    readonly SUBSCRIBER_CORRECTION_REASON_REQUIRED: "SUBSCRIBER_CORRECTION_REASON_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_ACTOR_REQUIRED: "SUBSCRIBER_CORRECTION_ACTOR_REQUIRED";
+    readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
+    /** The operator declared another legal entity: that is a transfer, not an edit. */
+    readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
     readonly CHECKOUT_OFFER_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_LINE_ITEMS_REQUIRED";
     readonly CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED: "CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED";
     readonly CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED";
     readonly CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE: "CHECKOUT_OFFER_BUNDLE_VERSION_NOT_BOOKABLE";
     readonly CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED: "CHECKOUT_OFFER_FEATURE_DEPENDENCY_UNSATISFIED";
+    readonly CHECKOUT_OFFER_PLAN_NOT_OFFERED: "CHECKOUT_OFFER_PLAN_NOT_OFFERED";
+    readonly CHECKOUT_OFFER_BUNDLE_NOT_OFFERED: "CHECKOUT_OFFER_BUNDLE_NOT_OFFERED";
+    readonly CHECKOUT_OFFER_PROMO_CODE_NOT_ACCEPTED: "CHECKOUT_OFFER_PROMO_CODE_NOT_ACCEPTED";
+    readonly CHECKOUT_OFFER_PRICE_NOT_CURRENT: "CHECKOUT_OFFER_PRICE_NOT_CURRENT";
     readonly SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED: "SUBSCRIPTION_CONTRACT_LINE_ITEMS_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED: "SUBSCRIPTION_CONTRACT_PLAN_LINE_ITEM_REQUIRED";
     readonly SUBSCRIPTION_CONTRACT_INVALID_DATE: "SUBSCRIPTION_CONTRACT_INVALID_DATE";
     readonly SUBSCRIPTION_CONTRACT_INVALID_WINDOW: "SUBSCRIPTION_CONTRACT_INVALID_WINDOW";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_TAX_MISMATCH";
+    readonly SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_PERCENT: "SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_PERCENT";
+    readonly SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH: "SUBSCRIPTION_CONTRACT_LINE_ITEM_CURRENCY_MISMATCH";
+    /**
+     * The lines do not add up to a total the contract states, counted as often
+     * as each falls due in one period. `field` names the total.
+     */
+    readonly SUBSCRIPTION_CONTRACT_LINES_DO_NOT_ADD_UP: "SUBSCRIPTION_CONTRACT_LINES_DO_NOT_ADD_UP";
+    /** Something that takes money off states a negative amount. */
+    readonly SUBSCRIPTION_CONTRACT_DISCOUNT_NEGATIVE: "SUBSCRIPTION_CONTRACT_DISCOUNT_NEGATIVE";
     readonly SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START: "SUBSCRIPTION_CONTRACT_TERMINATION_BEFORE_START";
     readonly CHECKOUT_OFFER_NOT_FOUND: "CHECKOUT_OFFER_NOT_FOUND";
     readonly CHECKOUT_OFFER_EXPIRED: "CHECKOUT_OFFER_EXPIRED";
     readonly CHECKOUT_OFFER_ALREADY_CONSUMED: "CHECKOUT_OFFER_ALREADY_CONSUMED";
     readonly CHECKOUT_OFFER_NOT_CONSUMED: "CHECKOUT_OFFER_NOT_CONSUMED";
+    /**
+     * The offer changed between the checks of `conclude` and the transaction
+     * that consumed it, so the contract checked is not the one the offer now
+     * describes. Nothing was written; load the offer and conclude it again.
+     */
+    readonly CHECKOUT_OFFER_CHANGED: "CHECKOUT_OFFER_CHANGED";
     readonly SUBSCRIPTION_CONTRACT_NOT_FOUND: "SUBSCRIPTION_CONTRACT_NOT_FOUND";
     readonly NO_ACTIVE_SUBSCRIPTION_CONTRACT: "NO_ACTIVE_SUBSCRIPTION_CONTRACT";
     readonly SUBSCRIPTION_CONTRACT_ALREADY_CLOSED: "SUBSCRIPTION_CONTRACT_ALREADY_CLOSED";
@@ -3899,6 +5645,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3912,8 +5660,79 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_NOT_IN_CATALOG: "PLAN_NOT_IN_CATALOG";
     /** Plan exists but cannot be booked via self-service. */
     readonly PLAN_NOT_SELF_SERVICE: "PLAN_NOT_SELF_SERVICE";
+    /**
+     * Plan carries no price for the requested billing cycle, so it is not sold
+     * in it: a plan without a yearly price is a monthly plan.
+     */
+    readonly PLAN_NOT_SOLD_IN_CYCLE: "PLAN_NOT_SOLD_IN_CYCLE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
+    /**
+     * The subscription moved between the read a request was decided on and the
+     * write it attempted, so nothing was written. The caller reloads and asks
+     * again.
+     */
+    readonly SUBSCRIPTION_CHANGED: "SUBSCRIPTION_CHANGED";
+    /**
+     * The tenant has no subscription to act on.
+     *
+     * `SUBSCRIPTION_NOT_FOUND` states the same fact on the read routes. Both
+     * are already on the wire and a code is renamed only deliberately, so both
+     * are named here rather than one being dropped behind a consumer's back.
+     */
+    readonly NO_SUBSCRIPTION: "NO_SUBSCRIPTION";
+    /**
+     * The cancellation date the reader was shown is no longer the one the rules
+     * return, so the confirmation is refused rather than silently applied.
+     * Carries the recomputed dates, so the page can re-ask instead of guessing.
+     */
+    readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /** The subscription has ended; its plan can no longer be changed. */
+    readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
+    /** An active special contract blocks self-service plan changes. */
+    readonly PLAN_LOCKED: "PLAN_LOCKED";
+    /** Current usage of one quota exceeds what the target plan allows. */
+    readonly QUOTA_OVER_TARGET: "QUOTA_OVER_TARGET";
+    /** The change drops features the tenant has today. */
+    readonly FEATURE_LOST: "FEATURE_LOST";
+    readonly FEATURES_LOST: "FEATURES_LOST";
+    /** Target plan and cycle already match what is in place. */
+    readonly NO_CHANGE: "NO_CHANGE";
+    /** A shorter cycle cannot start inside the term already running. */
+    readonly CYCLE_SHORTENS_AT_TERM_END: "CYCLE_SHORTENS_AT_TERM_END";
+    /** A cancelled subscription cannot change its billing cycle. */
+    readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
+    /**
+     * A bundle the tenant already holds runs past the cycle they are moving to.
+     *
+     * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
+     * same rule about a booking that has not been made yet. The two need
+     * different sentences: this one can name the day the obstacle lifts and
+     * tell the reader to cancel the booking, and that advice is wrong for
+     * someone who is only about to book. One template cannot serve both.
+     */
+    readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * Features of the previewed bundle are already covered by the plan or by
+     * another booked bundle. A warning rather than a blocker: paying twice is
+     * the customer's decision, and the preview only has to say so first.
+     */
+    readonly REDUNDANT_FEATURES: "REDUNDANT_FEATURES";
+    /**
+     * A booking's minimum term outlasts the period being cancelled, so the
+     * cancellation takes effect at the end of the term, not of the period.
+     */
+    readonly MINIMUM_TERM_BINDS: "MINIMUM_TERM_BINDS";
+    /**
+     * The previewed bundle requires features that neither the plan nor an
+     * active booking provides.
+     *
+     * The same string is a `StrictModeWarningCode` in `bundle.types.ts`, where
+     * it names the catalogue-authoring reading of the rule and travels with its
+     * own message. This declaration is the booking preview's blocker, which a
+     * tenant reads and therefore needs a shipped text for.
+     */
+    readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
     readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
@@ -3952,6 +5771,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -3969,6 +5790,12 @@ declare const PLATFORM_ERROR_CODES: {
     readonly FEATURE_NOT_FOUND: "FEATURE_NOT_FOUND";
     readonly QUOTA_NOT_FOUND: "QUOTA_NOT_FOUND";
     readonly PROMOTION_NOT_FOUND: "PROMOTION_NOT_FOUND";
+    /**
+     * A promotion's value is not one its type takes: a percentage above 0 and
+     * at most 100, an amount above 0, an intro price of at least 0 for a whole
+     * number of months, or a whole number of free months.
+     */
+    readonly PROMOTION_VALUE_INVALID: "PROMOTION_VALUE_INVALID";
     readonly MARKETING_PROJECTION_NOT_FOUND: "MARKETING_PROJECTION_NOT_FOUND";
     readonly PLAN_ALREADY_EXISTS: "PLAN_ALREADY_EXISTS";
     readonly BUNDLE_ALREADY_EXISTS: "BUNDLE_ALREADY_EXISTS";
@@ -3979,6 +5806,10 @@ declare const PLATFORM_ERROR_CODES: {
     readonly QUOTA_NOT_IN_DISCOVERY_SNAPSHOT: "QUOTA_NOT_IN_DISCOVERY_SNAPSHOT";
     readonly DISCOVERY_STATUS_TRANSITION_INVALID: "DISCOVERY_STATUS_TRANSITION_INVALID";
     readonly DISCOVERY_NOT_INITIALIZED: "DISCOVERY_NOT_INITIALIZED";
+    /** The uploaded document is not a plan catalog — unparseable, or not an object. */
+    readonly PLAN_CATALOG_UNREADABLE: "PLAN_CATALOG_UNREADABLE";
+    /** It parsed, and then failed the schema or a cross-field rule. */
+    readonly PLAN_CATALOG_INVALID: "PLAN_CATALOG_INVALID";
     readonly PROMO_CODE_NOT_FOUND: "PROMO_CODE_NOT_FOUND";
     readonly PROMO_CODE_ALREADY_EXISTS: "PROMO_CODE_ALREADY_EXISTS";
     readonly PROMO_CODE_HAS_REDEMPTIONS: "PROMO_CODE_HAS_REDEMPTIONS";
@@ -4001,6 +5832,12 @@ declare const PLATFORM_ERROR_CODES: {
     /** Neither `tenantId` nor `userId` could be resolved from the request. */
     readonly TENANT_CONTEXT_MISSING: "TENANT_CONTEXT_MISSING";
     readonly TENANT_ADMIN_REQUIRED: "TENANT_ADMIN_REQUIRED";
+    /**
+     * The tenant's billing area — its payment method, and later its invoices
+     * and account — needs the billing permission, which the application maps
+     * to its roles and the tenant's administrator holds by default.
+     */
+    readonly BILLING_PERMISSION_REQUIRED: "BILLING_PERMISSION_REQUIRED";
     readonly SUPER_ADMIN_REQUIRED: "SUPER_ADMIN_REQUIRED";
     /** TOTP MFA has never been set up for this user. */
     readonly MFA_NOT_SET_UP: "MFA_NOT_SET_UP";
@@ -4021,7 +5858,7 @@ declare const PLATFORM_ERROR_CODES: {
     /** Email already taken (mapped from `PlatformUserExistsError`). */
     readonly EMAIL_EXISTS: "EMAIL_EXISTS";
 };
-type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | RegistrationErrorCode;
+type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | SubscriberErrorCode | RegistrationErrorCode | PaymentErrorCode | SettingsErrorCode;
 /**
  * Shape of a coded error response.
  *
@@ -4242,7 +6079,25 @@ interface PendingRegistration {
     billingCycle: 'MONTHLY' | 'YEARLY' | null;
     /** Plaintext code (UI display). Validation runs fresh every time. */
     appliedPromoCode: string | null;
+    /**
+     * The billing address and tax identifiers step 4 asks for, which the
+     * subscriber is created with. The address is required before a payment
+     * method is set up; the tax identifiers stay optional.
+     */
+    addressLine1: string | null;
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string | null;
+    vatId: string | null;
+    taxNumber: string | null;
+    /** The gateway's session for the payment method, unique within `checkoutGatewayAccount`. */
     checkoutSessionId: string | null;
+    /** The account in `config/saas.yaml#payments.accounts` the session was opened at. */
+    checkoutGatewayAccount: string | null;
+    /** The customer the gateway created for the sign-up, reused when step 4 is repeated. */
+    gatewayCustomerRef: string | null;
     checkoutStartedAt: Date | null;
     expiresAt: Date;
     createdAt: Date;
@@ -4274,7 +6129,16 @@ interface PendingRegistrationUpdateInput {
     configJson?: RegistrationConfigSelection | null;
     billingCycle?: 'MONTHLY' | 'YEARLY' | null;
     appliedPromoCode?: string | null;
+    addressLine1?: string | null;
+    addressLine2?: string | null;
+    postalCode?: string | null;
+    city?: string | null;
+    country?: string | null;
+    vatId?: string | null;
+    taxNumber?: string | null;
     checkoutSessionId?: string | null;
+    checkoutGatewayAccount?: string | null;
+    gatewayCustomerRef?: string | null;
     checkoutStartedAt?: Date | null;
     expiresAt?: Date;
 }
@@ -4282,14 +6146,24 @@ interface PendingRegistrationUpdateInput {
 interface PendingRegistrationRepository {
     findById(id: string): Promise<PendingRegistration | null>;
     findByEmail(email: string): Promise<PendingRegistration | null>;
-    /** Webhook lookup: finds the pending record for the provider session. */
-    findByCheckoutSession(sessionId: string): Promise<PendingRegistration | null>;
+    /**
+     * Finds the pending record a gateway session belongs to. A session
+     * identifier is unique only within its account, so both are matched.
+     */
+    findByCheckoutSession(gatewayAccount: string, sessionId: string): Promise<PendingRegistration | null>;
     /**
      * Cleanup lookup: all pending records with `expiresAt < now`, max
      * `limit` entries per call (batch protection). Ordering irrelevant, the
      * cron service iterates sequentially.
      */
     findExpired(now: Date, limit: number): Promise<PendingRegistration[]>;
+    /**
+     * Every gateway account a checkout session is still open at: the distinct
+     * `checkoutGatewayAccount` of records in `CHECKOUT_STARTED` whose
+     * `expiresAt` is after `now`. The start refuses when one of them is no
+     * longer configured, because that sign-up's confirmation could not arrive.
+     */
+    findOpenCheckoutAccounts(now: Date): Promise<string[]>;
     create(input: PendingRegistrationCreateInput): Promise<PendingRegistration>;
     update(id: string, input: PendingRegistrationUpdateInput): Promise<PendingRegistration>;
     /**
@@ -4299,7 +6173,13 @@ interface PendingRegistrationRepository {
      * value is the authoritative threshold for the lockout check.
      */
     incrementOtpAttemptCount(id: string): Promise<number>;
-    delete(id: string): Promise<void>;
+    /**
+     * Removes the record. With `tx` it is removed on that transaction and comes
+     * back with its rollback — an activation deletes the sign-up on the
+     * transaction that creates the tenant, so a sign-up is either still waiting
+     * or activated, never both.
+     */
+    delete(id: string, tx?: TransactionContext): Promise<void>;
 }
 /** Adapter port: detects whether a full user account (verified) exists for this email. */
 interface UserAccountLookup {
@@ -4309,67 +6189,42 @@ interface UserAccountLookup {
 interface SlugAvailabilityCheck {
     isSlugAvailable(slug: string): Promise<boolean>;
 }
-/** Wire format of a created checkout session (provider-agnostic). */
-interface CheckoutSession {
-    /** Provider-specific session ID (e.g. Stripe `cs_…`). */
-    sessionId: string;
-    /** Payment URL to be opened by the frontend. */
-    checkoutUrl: string;
-    /** Optional: provider name (`stripe`, `dev-stub`) for logging/audit. */
-    provider?: string;
-}
-type PaymentEventStatus = 'SUCCEEDED' | 'FAILED';
-/**
- * Adapter port: idempotency log for payment webhooks. Stripe (and most
- * other providers) deliver events at-least-once — the service calls
- * `tryClaim` as an atomic race guard BEFORE it triggers the final
- * activation.
- */
-interface PaymentEventLog {
-    /**
-     * Tries to insert an event record via `@unique` INSERT. Returns
-     * `true` if it was newly created (webhook seen for the first time),
-     * `false` if it already exists (duplicate → silently drop).
-     *
-     * Implementations must return a DB unique-constraint-violation error
-     * (Prisma P2002) as `false`.
-     */
-    tryClaim(eventId: string, payload: {
-        provider: string;
-        sessionId: string | null;
-        status: PaymentEventStatus;
-        rawPayload?: unknown;
-    }): Promise<boolean>;
-}
 interface FinalActivationResult {
     userId: string;
     tenantId: string;
     subscriptionId: string;
+    /**
+     * The subscriber created for the tenant in the same transaction — the party
+     * its contracts are concluded with. `subscriberFromRegistration(pending)`
+     * says what it is created with.
+     */
+    subscriberId: string;
+}
+/** The transaction a sign-up is activated on. */
+interface RegistrationActivation {
+    /**
+     * Opened by the platform, which has already claimed the gateway's
+     * confirmation on it and records the confirmed payment method on it once
+     * `activate` returns. Every row the activation writes goes through it, so
+     * a failure anywhere rolls back all of it — the claim included, and the
+     * gateway's retry is handled rather than discarded as a duplicate.
+     */
+    tx: TransactionContext;
 }
 /**
- * Adapter port: orchestrates the final creation of User + Tenant +
- * Subscription after successful payment. App-specific — each app has its
- * own schema (e.g. Tenant + TenantUser + Role + UserRole +
- * Subscription).
+ * Adapter port: creates User + Tenant + Subscriber + Subscription once the
+ * gateway confirmed the sign-up's payment method. App-specific — each app has
+ * its own schema (e.g. Tenant + TenantUser + Role + UserRole + Subscription).
  *
- * Implementations MUST perform the creation in a DB transaction so that
- * partial creations are fully rolled back on errors.
+ * Implementations write on `activation.tx` and open no transaction of their
+ * own: a write beside it would survive the rollback that undoes the rest. The
+ * subscriber is created there too, before any contract:
+ * `SubscriberService.createForTenant(tenantId, subscriberFromRegistration(pending),
+ * activation.tx)`, or `CheckoutOfferService.conclude` with `subscriber` and
+ * that transaction.
  */
 interface ActivationOrchestrator {
-    activate(pending: PendingRegistration): Promise<FinalActivationResult>;
-}
-interface HandlePaymentEventInput {
-    eventId: string;
-    sessionId: string | null;
-    provider: string;
-    status: PaymentEventStatus;
-    rawPayload?: unknown;
-}
-type HandlePaymentEventReason = 'ALREADY_PROCESSED' | 'PAYMENT_NOT_SUCCEEDED' | 'MISSING_SESSION_ID' | 'PENDING_REGISTRATION_NOT_FOUND' | 'INVALID_STATE';
-interface HandlePaymentEventResult {
-    activated: boolean;
-    reason?: HandlePaymentEventReason;
-    result?: FinalActivationResult;
+    activate(pending: PendingRegistration, activation: RegistrationActivation): Promise<FinalActivationResult>;
 }
 interface CleanupResult {
     /** Number of deleted PendingRegistration records. */
@@ -4380,7 +6235,7 @@ interface CleanupResult {
      */
     moreAvailable: boolean;
 }
-type RegistrationAuditEventType = 'REGISTRATION_STARTED' | 'REGISTRATION_NEUTRAL_ACTIVE_USER' | 'REGISTRATION_NEUTRAL_REPLAY' | 'REGISTRATION_NEUTRAL_EXPIRED' | 'OTP_VERIFIED' | 'OTP_VERIFY_FAILED' | 'OTP_RESEND_REQUESTED' | 'OTP_RATE_LIMIT_HIT' | 'PLAN_SELECTED' | 'CHECKOUT_STARTED' | 'PAYMENT_RECEIVED' | 'PAYMENT_DUPLICATE_IGNORED' | 'PAYMENT_FAILED' | 'ACTIVATION_COMPLETED' | 'LOGIN_SUCCEEDED' | 'LOGIN_INVALID_CREDENTIALS' | 'LOGIN_ONBOARDING_REQUIRED';
+type RegistrationAuditEventType = 'REGISTRATION_STARTED' | 'REGISTRATION_NEUTRAL_ACTIVE_USER' | 'REGISTRATION_NEUTRAL_REPLAY' | 'REGISTRATION_NEUTRAL_EXPIRED' | 'OTP_VERIFIED' | 'OTP_VERIFY_FAILED' | 'OTP_RESEND_REQUESTED' | 'OTP_RATE_LIMIT_HIT' | 'PLAN_SELECTED' | 'CHECKOUT_STARTED' | 'PAYMENT_RECEIVED' | 'PAYMENT_FAILED' | 'ACTIVATION_COMPLETED' | 'LOGIN_SUCCEEDED' | 'LOGIN_INVALID_CREDENTIALS' | 'LOGIN_ONBOARDING_REQUIRED';
 /**
  * Context information that the audit layer records per event.
  * IP is expected as a hashed fingerprint — no plaintext IPs in the
@@ -4431,8 +6286,6 @@ interface ConfiguratorModel {
     popular?: boolean;
 }
 interface ConfiguratorCatalog {
-    /** Factor `yearlyNet = monthlyNet * cycleDiscount` (typically 10 = 2 months free). */
-    cycleDiscount: number;
     currency: string;
     vatRate: number;
     models: ConfiguratorModel[];
@@ -4457,6 +6310,10 @@ interface ConfiguratorPriceBreakdown {
     modelMonthlyNet: number;
     subtotalMonthlyNet: number;
     subtotalNet: number;
+    /**
+     * Net amount taken off `subtotalNet`: the promo preview's gross discount
+     * converted at `vatRate`.
+     */
     discountAmount: number;
     totalNet: number;
     vatRate: number;
@@ -4533,8 +6390,6 @@ interface ConfiguratorPlanMarketing {
  */
 interface ConfiguratorMarketingProvider {
     listPlanMarketing(): ConfiguratorPlanMarketing[];
-    /** Factor `yearlyNet = monthlyNet * cycleDiscount`. Default `10`. */
-    getCycleDiscount(): number;
     getVatRate(): number;
     getCurrency(): string;
 }
@@ -4555,6 +6410,7 @@ interface RegistrationPromoPreview {
         reason?: string;
         percent?: number;
         label?: string;
+        /** The discount in gross, reckoned against `subtotalGross`. */
         discountAmount?: number;
     }>;
 }
@@ -4626,6 +6482,8 @@ interface PendingRegistrationSnapshot {
     config: RegistrationConfigSelection | null;
     billingCycle: 'MONTHLY' | 'YEARLY' | null;
     appliedPromoCode: string | null;
+    /** The billing details step 4 already took, to fill its form again. */
+    billingDetails: RegistrationBillingDetails | null;
     checkoutSessionId: string | null;
 }
 interface ResumeRegistrationResult {
@@ -4634,27 +6492,6 @@ interface ResumeRegistrationResult {
     nextStep: RegistrationStep;
     snapshot: PendingRegistrationSnapshot;
 }
-/** Adapter port: payment provider (Stripe, Dev-Stub, Mollie, ...). */
-interface PaymentProvider {
-    /**
-     * Creates a checkout session at the payment provider and returns the URL
-     * that the frontend should redirect to.
-     *
-     * @param params.pendingRegistrationId Stored as `client_reference_id` (or similar)
-     *   in the provider — the webhook needs it to link back.
-     * @param params.planId The chosen plan (Stripe price/product mapping lives
-     *   in the adapter).
-     * @param params.successUrl Where to go after successful payment.
-     * @param params.cancelUrl Where to go on cancellation.
-     */
-    createCheckoutSession(params: {
-        pendingRegistrationId: string;
-        planId: string;
-        email: string;
-        successUrl: string;
-        cancelUrl: string;
-    }): Promise<CheckoutSession>;
-}
 /** Adapter port: OTP delivery via email (or another channel). */
 interface RegistrationOtpDelivery {
     sendVerificationOtp(params: {
@@ -4720,10 +6557,38 @@ interface SelectPlanResult {
     nextStep: RegistrationStep;
     selectedPlanId: string;
 }
+/**
+ * The billing address and tax identifiers a sign-up gives in step 4, which its
+ * subscriber is created with. The address is required; the tax identifiers
+ * stay optional until the tax adapter says when one is needed.
+ */
+interface RegistrationBillingDetails {
+    addressLine1: string;
+    addressLine2?: string | null;
+    postalCode: string;
+    city: string;
+    /** ISO 3166-1 alpha-2, upper case. */
+    country: string;
+    vatId?: string | null;
+    taxNumber?: string | null;
+}
 interface StartCheckoutInput {
     pendingRegistrationId: string;
+    billingDetails: RegistrationBillingDetails;
+    /** Where the gateway's form sends the person once the payment method is set up. */
     successUrl: string;
+    /** Where the gateway's form sends the person who leaves it. */
     cancelUrl: string;
+    /**
+     * The checkout offer the sign-up concludes on activation. When it carries a
+     * promo code, a slot of that code is held for it from this step until a
+     * confirmation of the gateway's form can no longer arrive
+     * (`PaymentMethodSetupSession.confirmableUntil`), so the code cannot run
+     * out between this step and the payment confirmation; a code that cannot
+     * be held refuses the step before the gateway's form opens. Left out,
+     * nothing is held.
+     */
+    checkoutOfferId?: string | null;
 }
 interface StartCheckoutResult {
     pendingRegistrationId: string;
@@ -4766,6 +6631,344 @@ interface SetupConfirmMfaResponse {
     ok: boolean;
 }
 
+/** What the adapter's schema can actually answer about a version's dates. */
+interface PlanVersionMappingFields {
+    /** `validFrom`/`validUntil` are maintained; otherwise both read as null. */
+    validityWindows: boolean;
+    /** `endsAt` exists; otherwise the field is left off the record entirely. */
+    endsAt: boolean;
+}
+/** A `plans` row as either adapter reads it back. */
+interface CanonicalPlanRow {
+    id: string;
+    planKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/** A `plan_versions` row as either adapter reads it back. */
+interface CanonicalPlanVersionRow {
+    id: string;
+    version: number;
+    baseVersionId: string | null;
+    features: unknown;
+    quotas: unknown;
+    monthlyNet: unknown;
+    yearlyNet: unknown;
+    marketed: boolean;
+    publishedAt: Date | null;
+    supersededAt: Date | null;
+    publishedChanges: unknown;
+    changeNote: string;
+    nonRegressive: boolean;
+    validFrom?: Date | null;
+    validUntil?: Date | null;
+    endsAt?: Date | null;
+    createdByUserId: string | null;
+    publishedByUserId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+declare function toPlanRow(row: CanonicalPlanRow): PlanRow;
+/**
+ * `planKey` is passed rather than read off the row: the canonical schema stores
+ * the plan key in `planId`, but an adapter translating a consumer schema with a
+ * real foreign key has to resolve it first, and only the adapter knows which
+ * shape it is looking at.
+ */
+declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string, fields: PlanVersionMappingFields): PlanVersionRow;
+
+/**
+ * The legal identity of the issuer a catalogue names, or none where it names no
+ * issuer.
+ *
+ * Settled through the same reader as the recorded side, and that symmetry is
+ * the point rather than tidiness: the record is a verbatim copy of the file, so
+ * a value whose two sides were settled differently would differ from itself. A
+ * legal name written with a trailing space would then refuse the SECOND start on
+ * a file nobody touched, and no declaration could make it stop happening.
+ */
+declare function issuerIdentityOf(issuer: PlanCatalogIssuer | undefined): LegalIdentity | null;
+/**
+ * The issuer identity a recorded settings tree holds.
+ *
+ * Read defensively rather than cast: the record is JSON as some earlier version
+ * of this platform wrote it, and a tree without an issuer, or with one whose
+ * legal name is not a name, is read as "no identity was recorded" — which is
+ * the first naming, not a change. The schema keeps a name of only whitespace out
+ * of the file; this keeps one out of a record written before it did.
+ */
+declare function recordedIssuerIdentity(settings: AppliedSettingsValues | null | undefined): LegalIdentity | null;
+/** Why `issuer.correctionOf` does not cover the change it is there to declare. */
+type IssuerCorrectionFault = 
+/** There is no declaration at all. */
+{
+    kind: 'absent';
+}
+/**
+ * The file names no issuer for a declaration to be about — the block is
+ * gone, or it is there with a name that reads as nothing. Never a
+ * correction, whatever is declared: there is no entity on this side for the
+ * recorded one to be the same as.
+ */
+ | {
+    kind: 'names-no-issuer';
+}
+/**
+ * It names a value the record does not hold. Either the declaration is
+ * stale — it belongs to a correction already applied — or it is about
+ * another entity than the one this installation recorded.
+ */
+ | {
+    kind: 'names-another-value';
+    field: LegalIdentityField;
+    declared: string | null;
+    recorded: string | null;
+}
+/** It says nothing about a field the change moves, so that field is undeclared. */
+ | {
+    kind: 'leaves-a-field-out';
+    field: LegalIdentityField;
+    recorded: string | null;
+};
+/** What a start finds when it compares the file's issuer with the recorded one. */
+type IssuerIdentityChange = 
+/** Neither the record nor the file names an issuer. */
+{
+    kind: 'none-named';
+}
+/** The same entity, whatever the address and the contact details did. */
+ | {
+    kind: 'unchanged';
+    identity: LegalIdentity;
+}
+/**
+ * The first issuer this installation names. No contract can have been
+ * concluded under another one, so nothing is declared for it.
+ */
+ | {
+    kind: 'first-naming';
+    identity: LegalIdentity;
+}
+/** The same entity, corrected as the file declares. `current` is never absent. */
+ | {
+    kind: 'corrected';
+    recorded: LegalIdentity;
+    current: LegalIdentity;
+    moved: readonly LegalIdentityField[];
+    reason: string;
+}
+/** Another identity, with no declaration that covers it. Refused. */
+ | {
+    kind: 'undeclared';
+    recorded: LegalIdentity;
+    /** `null` where the file names no issuer that has a name — see `names-no-issuer`. */
+    current: LegalIdentity | null;
+    moved: readonly LegalIdentityField[];
+    fault: IssuerCorrectionFault;
+};
+/**
+ * What the issuer in the file is, against the identity the record holds.
+ *
+ * `recorded` is `null` on the very first start, and on an installation that
+ * has never named an issuer.
+ */
+declare function classifyIssuerChange(recorded: LegalIdentity | null, issuer: PlanCatalogIssuer | undefined): IssuerIdentityChange;
+
+/** A `subscribers` row as either adapter reads it back. */
+interface CanonicalSubscriberRow {
+    id: string;
+    customerSequence: number;
+    customerNumberPrefix: string;
+    legalName: string;
+    addressLine1: string | null;
+    addressLine2: string | null;
+    postalCode: string | null;
+    city: string | null;
+    country: string | null;
+    vatId: string | null;
+    taxNumber: string | null;
+    invoiceEmail: string | null;
+    migrated: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** A `subscriber_corrections` row as either adapter reads it back. */
+interface CanonicalSubscriberCorrectionRow {
+    id: string;
+    subscriberId: string;
+    previous: unknown;
+    corrected: unknown;
+    reason: string;
+    correctedBy: string;
+    correctedAt: Date;
+}
+/**
+ * The customer number a subscriber is known by: the prefix it was assigned
+ * with, then the number. Kept apart in storage so the number orders and the
+ * prefix stays what it was on the day it was assigned.
+ */
+declare function formatCustomerNumber(prefix: string, sequence: number): string;
+/** `tenantId` is the tenant the subscriber's live link names, read beside the row. */
+declare function toSubscriberRecord(row: CanonicalSubscriberRow, tenantId: string | null): SubscriberRecord;
+declare function toSubscriberCorrectionRecord(row: CanonicalSubscriberCorrectionRow): SubscriberCorrectionRecord;
+/**
+ * The part of a correction that changes something: every corrected field whose
+ * stored value differs, with the value it replaces. Both adapters decide this
+ * the same way, under the lock they read `current` with.
+ */
+declare function identityCorrectionDelta(current: Pick<SubscriberRecord, LegalIdentityField>, corrected: SubscriberIdentityValues): SubscriberIdentityDelta;
+/**
+ * Who a new contract is between: the subscriber as it stands, and the issuer as
+ * the running configuration names it — or no issuer, where it names none.
+ */
+declare function contractPartiesOf(subscriber: SubscriberRecord, issuer: PlanCatalog['issuer']): SubscriptionContractParties;
+/**
+ * The subscriber a completed sign-up is created with: the name the tenant was
+ * registered under as its legal name, the address the registration was
+ * verified with as its invoice email, and the billing address and tax
+ * identifiers step 4 took.
+ */
+declare function subscriberFromRegistration(pending: Pick<PendingRegistration, 'tenantName' | 'email' | 'addressLine1' | 'addressLine2' | 'postalCode' | 'city' | 'country' | 'vatId' | 'taxNumber'>): NewSubscriberDetails;
+
+/** The payment method types, in the order a form offers them. */
+declare const PAYMENT_METHOD_TYPES: readonly PaymentMethodType[];
+/** A `subscriber_payment_methods` row as either adapter reads it back. */
+interface CanonicalSubscriberPaymentMethodRow {
+    id: string;
+    subscriberId: string;
+    gatewayAccount: string;
+    provider: string;
+    customerRef: string;
+    paymentMethodRef: string;
+    type: string;
+    brand: string | null;
+    last4: string;
+    expiryMonth: number | null;
+    expiryYear: number | null;
+    country: string | null;
+    bankCode: string | null;
+    mandateReference: string | null;
+    status: string;
+    confirmedAt: Date;
+    replacedAt: Date | null;
+    createdAt: Date;
+}
+/**
+ * Reads a row back as a record.
+ *
+ * The two text columns with a closed set of values are checked rather than
+ * cast: a value written by hand or by an older release would otherwise reach a
+ * screen as a type nobody handles.
+ */
+declare function toSubscriberPaymentMethodRecord(row: CanonicalSubscriberPaymentMethodRow): SubscriberPaymentMethodRecord;
+/** The columns a confirmed payment method is written with, and nothing a caller added beside them. */
+declare function subscriberPaymentMethodColumns(data: RecordSubscriberPaymentMethodData): Omit<CanonicalSubscriberPaymentMethodRow, 'id' | 'status' | 'replacedAt' | 'createdAt'>;
+/**
+ * A confirmation naming a reference that belongs to another subscriber.
+ *
+ * `(gatewayAccount, paymentMethodRef)` is unique account-wide rather than per
+ * subscriber, and that is what makes the reference one subscriber's for good:
+ * the second row cannot be written. This is the same boundary drawn for the
+ * caller, so that a confirmation is refused rather than answered as the
+ * duplicate of a payment method that is not this subscriber's — on a gateway
+ * callback, which arrives without a session and with the tenant policy lifted,
+ * so nothing else there bounds the question.
+ *
+ * That a provider issues a reference once per payer is a property of that
+ * provider and no promise of this platform's, which is why the condition is
+ * checked rather than assumed.
+ *
+ * It names neither the subscriber that holds the reference nor the tenant
+ * behind it: whoever reads the log of the refused confirmation is on the other
+ * side of the boundary this refusal draws. The account and the reference are
+ * carried as fields so that a caller can say which confirmation was refused
+ * without taking the sentence apart.
+ */
+declare class ForeignPaymentMethodReferenceError extends Error {
+    readonly gatewayAccount: string;
+    readonly paymentMethodRef: string;
+    readonly code = "FOREIGN_PAYMENT_METHOD_REFERENCE";
+    constructor(gatewayAccount: string, paymentMethodRef: string);
+}
+/** Realm-safe type guard, like `isPaymentCallbackRejectedError`. */
+declare function isForeignPaymentMethodReferenceError(error: unknown): error is ForeignPaymentMethodReferenceError;
+/**
+ * Refuses a reference of `gatewayAccount` that another subscriber already
+ * holds, where the row could be read.
+ *
+ * A write cannot rely on this alone: a read does not see a row a concurrent
+ * transaction has not committed. What the reference's unique key refuses is
+ * refused with the same error — see `SubscriberPaymentMethodRepository`.
+ */
+declare function refuseForeignPaymentMethodReference(recorded: Pick<CanonicalSubscriberPaymentMethodRow, 'subscriberId' | 'gatewayAccount' | 'paymentMethodRef'>, subscriberId: string): void;
+
+/** A `subscription_contracts` row as either adapter reads it back. */
+interface CanonicalContractRow {
+    id: string;
+    tenantId: string;
+    subscriberId: string;
+    subscriberSnapshot: unknown;
+    issuerSnapshot: unknown;
+    partiesMigrated: boolean;
+    status: string;
+    effectiveFrom: Date;
+    effectiveUntil: Date | null;
+    originalOfferId: string | null;
+    originalPlanVersionId: string | null;
+    originalBundleVersionIds: unknown;
+    entitlementSnapshot: unknown;
+    priceSnapshot: unknown;
+    promotionSnapshots: unknown;
+    promoCodeSnapshots: unknown;
+    termsSnapshot: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** A `contract_line_items` row as either adapter reads it back. */
+interface CanonicalContractLineItemRow {
+    id: string;
+    contractId: string;
+    kind: string;
+    sourceKey: string;
+    sourceVersionId: string | null;
+    titleSnapshot: string;
+    descriptionSnapshot: string | null;
+    quantity: number;
+    unit: string | null;
+    priceNet: unknown;
+    priceGross: unknown;
+    billingCycle: string;
+    currency: string;
+    taxRate: unknown;
+    taxAmount: unknown;
+    minimumTermUntil: Date | null;
+    featuresSnapshot: unknown;
+    quotaEffectsSnapshot: unknown;
+    metadata: unknown;
+    createdAt: Date;
+}
+declare function toSubscriptionContractRecord(row: CanonicalContractRow, lineItems: CanonicalContractLineItemRow[]): SubscriptionContractRecord;
+declare function toContractLineItemRecord(row: CanonicalContractLineItemRow): ContractLineItemRecord;
+/**
+ * The columns the issuer check reads off a running contract. A narrow row of
+ * its own, because that query selects four columns rather than the whole
+ * contract with its lines: it runs at every start, and an installation with
+ * thousands of running contracts should not load them to count them.
+ */
+interface CanonicalRunningContractRow {
+    id: string;
+    tenantId: string;
+    issuerSnapshot: unknown;
+    effectiveFrom: Date;
+}
+/** One running contract, and the legal name on its issuer copy where it has one. */
+declare function toRunningContractIssuer(row: CanonicalRunningContractRow): RunningContractIssuer;
+
 /** Why a version is editable (for UI badges + audit logs). */
 type VersionEditableReason = 'draft' | 'pre-active';
 interface VersionEditability {
@@ -4780,6 +6983,30 @@ interface VersionEditability {
  */
 declare function isVersionEditable(v: VersionedEntityBase, now?: Date): VersionEditability;
 
+/** The part of a plan card this rule reads and writes. */
+interface RecommendablePlan {
+    planKey: string;
+    highlight: boolean;
+}
+/**
+ * Leaves the mark on at most one plan, in place, and returns the winner.
+ *
+ * `inRequestedLocale` holds the keys of the plans whose card was described in
+ * the language that was asked for. Where a caller has no fallback to model —
+ * the SuperAdmin edits one language at a time — passing every key, or none,
+ * gives the same answer: the first plan in the list order wins.
+ *
+ * The list order is the caller's, and it is what the reader sees, so the
+ * answer is the first recommended card on the page. Said exactly, because it
+ * is easy to overstate: the tie-break inherits whatever order the caller
+ * arranged, and where two plans are equal by every criterion it sorted on,
+ * that order is the repository's. `PlanRepository.list` promises none, so an
+ * adapter that returns rows in a different order each time would move the mark
+ * between two otherwise indistinguishable plans. The shipped adapters order
+ * totally.
+ */
+declare function keepOneRecommended<T extends RecommendablePlan>(plans: T[], inRequestedLocale: ReadonlySet<string>): T | null;
+
 declare const ERROR_MESSAGES_EN: Record<PlatformErrorCode, string>;
 /** Values available for interpolation into a message template. */
 type ErrorMessageParams = Record<string, unknown>;
@@ -4789,6 +7016,23 @@ type ErrorMessageParams = Record<string, unknown>;
  * vanishing.
  */
 declare function formatErrorMessage(template: string, params?: ErrorMessageParams): string;
+/**
+ * An error body this function can read.
+ *
+ * `code` is widened past `PlatformErrorCode` on purpose. The function checks
+ * `typeof body.code === 'string'` and resolves whatever it finds, and the
+ * `overrides` parameter exists so a consumer can bring its own codes — one
+ * consumer carries 98 of them against the platform's 135, overlapping in five.
+ * A closed union here would reject exactly the case the parameter is for, and
+ * the cast that works around it is one a reader has to be told is deliberate.
+ *
+ * `PlatformErrorBody` stays closed: a body the *platform* produces really does
+ * carry a platform code. It is the reader that has to accept more. The same
+ * shape appears in `SaLocale` next door, for the same reason.
+ */
+type ResolvableErrorBody = Omit<Partial<PlatformErrorBody>, 'code'> & Record<string, unknown> & {
+    code?: PlatformErrorCode | (string & {});
+};
 /**
  * Turns an error body into display text.
  *
@@ -4802,8 +7046,8 @@ declare function formatErrorMessage(template: string, params?: ErrorMessageParam
  * second, so a template may name either without the value being duplicated on
  * the wire.
  */
-declare function resolveErrorMessage(body: Partial<PlatformErrorBody> & Record<string, unknown>, overrides?: Partial<Record<string, string>>, defaults?: Partial<Record<string, string>>): string;
+declare function resolveErrorMessage(body: ResolvableErrorBody, overrides?: Partial<Record<string, string>>, defaults?: Partial<Record<string, string>>): string;
 
 declare const ERROR_MESSAGES_DE: Record<PlatformErrorCode, string>;
 
-export { AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionFilter, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SetCatalogEntryReviewData, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, missingRequiresFor, pickActivePromo, promoStatus, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, startOfUtcDay };
+export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CanonicalRunningContractRow, type CanonicalSubscriberCorrectionRow, type CanonicalSubscriberPaymentMethodRow, type CanonicalSubscriberRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferSelection, type CheckoutOfferSelectionUpdate, type CheckoutOfferStatus, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ConfirmedPaymentMethod, type ContractErrorCode, type ContractIssuerParty, type ContractLineItemKind, type ContractLineItemRecord, type ContractSubscriberParty, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriberData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, ForeignPaymentMethodReferenceError, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type IssuerCorrectionFault, type IssuerIdentityChange, type KpiCardDef, type KpiDisplayHint, LEGAL_IDENTITY_FIELDS, type LegalIdentity, type LegalIdentityField, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MaskedPaymentMethod, type MfaPort, type NewContractLineItemData, type NewSettingsChange, type NewSubscriberDetails, type NewSubscriptionContractData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PAYMENT_ERROR_CODES, PAYMENT_METHOD_TYPES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PartyAddress, type PasswordHasher, type PasswordResetCliResult, PaymentCallbackRejectedError, type PaymentErrorCode, type PaymentEventClaim, type PaymentEventLog, type PaymentGateway, type PaymentGatewayCallback, type PaymentGatewayEvent, type PaymentMethodHolder, type PaymentMethodSetupSession, type PaymentMethodSetupSubject, type PaymentMethodType, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogIssuer, type PlanCatalogIssuerCorrection, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogPaymentAccount, type PlanCatalogPayments, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogSettings, type PlanCatalogSubscribers, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeHoldRecord, type PromoCodeHoldRepository, type PromoCodeHoldTaken, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionOnPrice, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicNewPaymentMethods, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RecommendablePlan, type RecordSubscriberPaymentMethodData, type RecordSubscriberPaymentMethodOutcome, type RecordSubscriberPaymentMethodResult, type RedeemPromoInTransactionCallback, type RegistrationActivation, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationBillingDetails, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, type RunningContractIssuer, type RunningContractIssuers, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, SUBSCRIBER_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePayments, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartPaymentMethodSetupInput, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type SubscriberContact, type SubscriberContactChange, type SubscriberCorrectionData, type SubscriberCorrectionRecord, type SubscriberCorrectionResult, type SubscriberDetails, type SubscriberErrorCode, type SubscriberIdentityCorrection, type SubscriberIdentityDelta, type SubscriberIdentityValues, type SubscriberPaymentMethodRecord, type SubscriberPaymentMethodReference, type SubscriberPaymentMethodRepository, type SubscriberPaymentMethodSetupData, type SubscriberPaymentMethodSetupMatch, type SubscriberPaymentMethodStatus, type SubscriberRecord, type SubscriberRepository, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractParties, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, canonicalJson, classifyBundleVersionDiff, classifyIssuerChange, classifyPlanDiff, collectUnsatisfiedRequires, contractPartiesOf, coverageExcludingSelf, definedFields, diffSettings, formatCustomerNumber, formatErrorMessage, identityCorrectionDelta, isBundleRedundant, isForeignPaymentMethodReferenceError, isPaymentCallbackRejectedError, isPlatformUserExistsError, isVersionEditable, issuerIdentityOf, keepOneRecommended, missingRequiresFor, movedIdentityFields, pickActivePromo, planCatalogSettingsOf, previousUtcDay, promoStatus, promotionOnPrice, readQuotaRecord, readQuotaValue, recordedIssuerIdentity, refuseForeignPaymentMethodReference, resolveBundleAvailability, resolveErrorMessage, sameLegalIdentity, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, subscriberFromRegistration, subscriberPaymentMethodColumns, toBundleStemRow, toContractLineItemRecord, toPlanRow, toPlanVersionRow, toRunningContractIssuer, toSubscriberCorrectionRecord, toSubscriberPaymentMethodRecord, toSubscriberRecord, toSubscriptionContractRecord };