@saasicat/core 1.0.0-rc.23 → 1.0.0-rc.25

package/dist/index.d.cts

@@ -24,11 +24,17 @@ interface DateAtOrAfter {
 interface DateAfter {
     gt: Date;
 }
-/** `OR` block of the validity window; exactly one date field per variant. */
+/** `OR` block of the validity window; exactly one field per variant. */
 type ValidityWindowClause = {
     validFrom: DateAtOrBefore | null;
 } | {
     validUntil: DateAtOrAfter | null;
+} | {
+    supersededAt: null;
+} | {
+    validUntil: {
+        not: null;
+    };
 };
 /** Optional `OR` block for models with `endsAt` (precise admin termination). */
 type EndsAtClause = {
@@ -60,6 +66,7 @@ interface ActivePlanVersionWhereWithEndsAt {
  *   `publishedAt IS NOT NULL`
  *   `(validFrom IS NULL OR validFrom <= asOf)`
  *   `(validUntil IS NULL OR validUntil >= startOfUtcDay(asOf))`  // day-inclusive
+ *   `(supersededAt IS NULL OR validUntil IS NOT NULL)`  // superseded: only with a last day
  *   with `withEndsAt`: additionally `(endsAt IS NULL OR endsAt > asOf)`.  // precise
  *
  * `planId` stays with the caller (repo-specific type). Matching Prisma
@@ -79,6 +86,22 @@ declare function buildActivePlanVersionWhere(asOf: Date, options: {
 type ActiveVersionWhere = ActivePlanVersionWhere;
 /** Model-neutral counterpart that additionally checks an `endsAt` timestamp. */
 type ActiveVersionWhereWithEndsAt = ActivePlanVersionWhereWithEndsAt;
+/** The dates of a version that decide whether it takes bookings, as a row carries them. */
+interface VersionWindow {
+    validFrom?: string | Date | null;
+    validUntil?: string | Date | null;
+    endsAt?: string | Date | null;
+    supersededAt?: string | Date | null;
+}
+/**
+ * Whether a version that is published takes bookings at `asOf` — the same
+ * window {@link buildActivePlanVersionWhere} asks the database for, for a row
+ * already read: `validFrom` at or before `asOf`, `validUntil` not before the
+ * day of `asOf`, `endsAt` after `asOf`, and a superseded version only within
+ * a last day it carries. A date that is absent does not close the window.
+ * Whether the row is published is the caller's to know.
+ */
+declare function isVersionActiveAt(version: VersionWindow, asOf: Date): boolean;
 /**
  * Model-neutral alias for {@link buildActivePlanVersionWhere}. The original
  * export remains available for backwards compatibility.
@@ -770,9 +793,18 @@ interface SelfServiceBlockedPlans {
  * passed it in code" attached. The file is read at boot, so an edit lands on
  * the next restart.
  */
+/**
+ * Whether the operator may retire a plan version for the subscriptions already
+ * on it. It reaches contracts customers have made, so it rests on a clause in
+ * the operator's terms; `termsConfirmed` states that they carry it.
+ */
+interface OrderlyRetirementSettings {
+    termsConfirmed: boolean;
+}
 interface PlanCatalogTenantBilling {
     cancellationNoticeDays: CancellationNoticePeriods;
     selfServiceBlockedPlans: SelfServiceBlockedPlans;
+    orderlyRetirement: OrderlyRetirementSettings;
 }
 /**
  * Who is told when the settings in the file change between two starts.
@@ -846,6 +878,13 @@ interface PlanCatalogPayments {
     /** Every account taking new payment methods or holding a reference in use. */
     accounts: Record<string, PlanCatalogPaymentAccount>;
 }
+/** `config/saas.yaml#tax`: the adapter an installation names, and what the operator declares to it. */
+interface PlanCatalogTax {
+    /** The adapter's package name, such as `@saasicat/tax-de`. */
+    adapter: string;
+    /** The options the adapter's factory builds it with; the factory checks them. */
+    options?: Record<string, unknown>;
+}
 /**
  * The part of `config/saas.yaml` that is configuration rather than catalogue.
  *
@@ -858,8 +897,15 @@ interface PlanCatalogSettings {
     app: PlanCatalogApp;
     /** ISO-4217 currency code. */
     currency: string;
-    /** VAT rate in percent. */
-    vatRate: number;
+    /**
+     * VAT rate in percent. Every installation names it unless `tax` names a
+     * tax adapter, which is then the one source of every rate.
+     */
+    vatRate?: number;
+    /** The tax adapter that decides each charge's treatment, and its options. */
+    tax?: PlanCatalogTax;
+    /** The installation's time zone, an IANA name; required with `tax` (`SC-PRIC-045`). */
+    timeZone?: string;
     /** Commercial settings for the tenant self-service routes. */
     tenantBilling: PlanCatalogTenantBilling;
     /** App-wide marketing configuration. Optional. */
@@ -975,6 +1021,574 @@ interface PromoCodeValidationLog {
     createdAt: string;
 }
 
+/**
+ * A tenant's own limits beside its plan — a negotiated contract, a pilot.
+ * `quotas[key]` replaces the plan's value for that quota, `-1` meaning
+ * unlimited; `features` adds to the plan's. Stored as JSON in
+ * `subscriptions.customLimits`.
+ */
+interface CustomLimits {
+    quotas?: Record<QuotaKey, number>;
+    features?: FeatureKey[];
+}
+/**
+ * The keys a stored `customLimits` value is read by. The normative admin API
+ * schema (`CustomLimits` in `@saasicat/spec`) is held to the same list.
+ */
+declare const CUSTOM_LIMITS_KEYS: readonly ["quotas", "features"];
+/** What a stored `customLimits` value gave, and what in it went unread. */
+interface ReadCustomLimits {
+    limits: CustomLimits | null;
+    /**
+     * The parts of the stored value the platform does not read — a key it does
+     * not know, or a `quotas`/`features` of the wrong kind. Empty when every
+     * part was read.
+     */
+    unread: string[];
+}
+/**
+ * Reads a stored `customLimits` value the way the platform applies it.
+ *
+ * A shape the platform does not read is reported rather than refused: the
+ * tenant keeps its plan's limits and goes on working, as a limit nothing can
+ * count does not block anybody (`SC-ENTL-010`), and the caller says out loud
+ * which limits were not applied. Each quota value goes through
+ * `readQuotaValue`, the one reading of a quota in JSON.
+ */
+declare function readCustomLimits(value: unknown): ReadCustomLimits;
+/**
+ * Reads stored limits for an adapter, and reports what went unread once per
+ * subscription — every entitlement read passes through here, so reporting on
+ * each would bury the one line an operator needs under thousands.
+ */
+declare function customLimitsReader(report: (line: string) => void): (subscriptionId: string, stored: unknown) => CustomLimits | null;
+
+/** Alias for historical compatibility — equivalent to VersionChangeDirection. */
+type ChangeDirection = VersionChangeDirection;
+interface DiffResult {
+    nonRegressive: boolean;
+    changes: VersionChange[];
+}
+/**
+ * `Decimal | string | number` — the three forms in which prices appear
+ * in the platform. `Decimal` is the Prisma class (with
+ * `.toNumber()`), which is not imported directly in order to keep the
+ * platform Prisma-free — a structural view suffices.
+ */
+type DecimalLike = number | string | {
+    toNumber(): number;
+};
+interface PlanVersionFields {
+    features: FeatureKey[];
+    /**
+     * Quotas of the version. -1 = unlimited; missing key = 0.
+     *
+     * Every key either side carries is compared. Which keys exist is the
+     * installation's decision — they come from `@DefinesQuota` — so a fixed
+     * set here would have compared the three the platform happened to know by
+     * name and let every other one be lowered without the confirmation
+     * publishing a regression asks for.
+     */
+    quotas: Record<QuotaKey, number>;
+    monthlyNet: DecimalLike;
+    yearlyNet: DecimalLike;
+}
+interface BundleVersionFields {
+    features: FeatureKey[];
+    /** Quota contributions of the bundle. -1 = unlimited; missing key = 0. */
+    quotas: Record<QuotaKey, number>;
+    /** Default pricing; null = only override pricing possible. */
+    monthlyNet: DecimalLike | null;
+    yearlyNet: DecimalLike | null;
+}
+declare function classifyPlanDiff(oldV: PlanVersionFields, newV: PlanVersionFields): DiffResult;
+/**
+ * Classification of a BundleVersion diff for contract protection.
+ *
+ * Quotas are compared exactly as they are for a plan.
+ *
+ * Pricing can be `null` (the bundle only has override pricing); a switch
+ * from value ↔ null is classified as REGRESSION (value dropped) or IMPROVEMENT
+ * (value added, lowerIsBetter inverted). Both null
+ * stay NEUTRAL.
+ */
+declare function classifyBundleVersionDiff(oldV: BundleVersionFields, newV: BundleVersionFields): DiffResult;
+
+/**
+ * - `improvement` — nothing dearer in any rhythm, no feature missing, no quota
+ *   lower. Taken at once and free, the term kept.
+ * - `more-for-more` — nothing missing or lower, but dearer in at least one
+ *   rhythm. Taken like an upgrade: at once, the difference prorated. The rule
+ *   reads every rhythm, so in the subscriber's own the difference can be zero
+ *   or below — monthly 49 to 45 with yearly 490 to 500 is more for more for a
+ *   monthly subscriber too.
+ * - `takes-something-away` — a feature missing or a quota lower, whatever the
+ *   price. Taken like a downgrade: at the end of the running term, and only
+ *   when the subscriber asks for it.
+ * - `same` — the two agree on everything compared: there is nothing to offer.
+ */
+type VersionOfferClass = 'improvement' | 'more-for-more' | 'takes-something-away' | 'same';
+/**
+ * A version as the comparison reads it. A price may be absent: that is a
+ * rhythm the version is not sold in, and a rhythm that stops being sold counts
+ * against the candidate like a price that went up.
+ */
+type VersionOfferFields = BundleVersionFields;
+interface VersionOffer {
+    readonly class: VersionOfferClass;
+    /** Every difference, bound to candidate, as the catalogue's diff states it. */
+    readonly changes: readonly VersionChange[];
+}
+/** One version as a subscriber compares it. A price of null is a rhythm it is not sold in. */
+interface VersionOfferSide {
+    readonly planVersionId: string;
+    readonly version: number;
+    readonly features: readonly string[];
+    readonly quotas: Readonly<Record<string, number>>;
+    readonly monthlyNet: number | null;
+    readonly yearlyNet: number | null;
+    /** The last day it is sold on, where a successor closes its window — ISO, the whole day included. */
+    readonly validUntil: string | null;
+    /** When an operator ended it, where one did — ISO; from then it is not sold. */
+    readonly endsAt: string | null;
+}
+/**
+ * A newer version of the subscriber's plan, offered: the version bound and the
+ * one offered side by side, what kind of offer it is, and when a switch taken
+ * now would take effect — at once, or, for one that takes something away, at
+ * the end of the running term. `GET billing/version-offer` answers with it.
+ */
+interface VersionOfferView {
+    readonly plan: string;
+    readonly bound: VersionOfferSide;
+    readonly offered: VersionOfferSide;
+    readonly class: Exclude<VersionOfferClass, 'same'>;
+    readonly changes: readonly VersionChange[];
+    /** ISO instant. */
+    readonly takesEffectAt: string;
+}
+/**
+ * What taking an offer did: the version left and the one taken, and whether it
+ * applied at once or waits for `takesEffectAt`. `POST billing/version-offer/accept`
+ * answers with it.
+ */
+interface VersionSwitchResult {
+    readonly class: Exclude<VersionOfferClass, 'same'>;
+    readonly fromPlanVersionId: string;
+    readonly planVersionId: string;
+    readonly immediate: boolean;
+    /** ISO instant. */
+    readonly takesEffectAt: string;
+}
+/**
+ * Classifies `candidate` against `bound`. The comparison is the catalogue's
+ * own diff — prices with a rhythm that may be absent, as a bundle version's
+ * are — so an offer and a published version describe their changes alike.
+ */
+declare function classifyVersionOffer(bound: VersionOfferFields, candidate: VersionOfferFields): VersionOffer;
+
+/** A version, as an announcement names it. */
+interface RetiredVersionRef {
+    readonly planVersionId: string;
+    readonly planKey: string;
+    readonly version: number;
+}
+/** An announcement as it is kept: one per retirement, whoever it reaches. */
+interface VersionRetirementRecord {
+    readonly id: string;
+    /** The version retired. */
+    readonly retired: RetiredVersionRef;
+    /** The version its subscriptions continue on, named by the operator. */
+    readonly replacement: RetiredVersionRef;
+    readonly announcedAt: Date;
+    /** Who announced it — an actor tag, as the audit log writes it. */
+    readonly announcedBy: string;
+}
+type NewVersionRetirement = Omit<VersionRetirementRecord, 'id'>;
+/**
+ * The manifest capability that announces retiring a version. The platform sets
+ * it where it serves the routes, and the admin UI offers the action only where
+ * it is set. Whether the operator's terms allow it is a blocker the preview
+ * reports, so an operator who has not confirmed them learns what is missing.
+ */
+declare const VERSION_RETIREMENT_CAPABILITY = "planVersions.retire";
+/**
+ * One of the two versions of a retirement, as the subscriber compares them:
+ * price in each rhythm, quotas and features, with the plan it belongs to — the
+ * replacement may be a version of another plan.
+ */
+interface RetirementSide extends VersionOfferSide {
+    readonly planKey: string;
+}
+/**
+ * A plan version a subscription is on is being retired, and the subscription
+ * continues on the named replacement from its effective date. Sent once per
+ * subscription and retirement, when the retirement is announced, and kept as
+ * it was sent: the record shows what the subscriber was told, prices included.
+ */
+interface VersionRetiredNotice {
+    readonly kind: 'version-retired';
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly retirementId: string;
+    readonly retired: RetirementSide;
+    readonly replacement: RetirementSide;
+    /** Every difference, retired to replacement, as the catalogue's diff states it. */
+    readonly changes: readonly VersionChange[];
+    /**
+     * The rhythm the subscription is billed in when the retirement takes
+     * effect — a change of rhythm scheduled by then included — which says
+     * which of the two prices applies.
+     */
+    readonly billingCycle: string;
+    /** ISO 8601. */
+    readonly effectiveAt: string;
+    /** ISO date (`YYYY-MM-DD`), UTC. */
+    readonly lastDayToCancel: string;
+}
+/**
+ * The one reminder of a retirement, where staying put costs the subscription
+ * something (`SC-SUB-034`): sent 14 days before the retirement takes effect,
+ * once per subscription and retired version. It says again what the
+ * retirement notice said, and what a switch taken now would cost. Its
+ * `billingCycle` is still the rhythm billed at the date, read again from the
+ * subscription as it stands when the reminder is sent: a change of rhythm
+ * scheduled since the announcement is in it.
+ */
+interface VersionRetirementReminder extends Omit<VersionRetiredNotice, 'kind'> {
+    readonly kind: 'version-retirement-reminder';
+    /**
+     * What switching to the replacement now costs in the subscription's rhythm
+     * (`SC-SUB-032`), or null where it cannot switch now: in a trial, with a
+     * change scheduled, or where either plan is held for a special contract.
+     */
+    readonly switchTerms: RetirementSwitchTerms | null;
+}
+/**
+ * Why a retirement does not reach a subscription on the version:
+ *
+ * - `ended` — the subscription is over.
+ * - `cancelled-before` — its cancellation lands by the effective date.
+ * - `changes-before` — a scheduled change moves it to another plan, or to
+ *   another version of this one, by then.
+ * - `no-term` — it carries no date a term can be counted from.
+ * - `already-told` — an earlier announcement of this version reached it, and
+ *   stands.
+ */
+type RetirementSkipReason = 'ended' | 'cancelled-before' | 'changes-before' | 'no-term' | 'already-told';
+/** A refusal as the preview reports it and the announcement throws it. */
+interface RetirementBlocker {
+    readonly code: string;
+    readonly message: string;
+    readonly params: Record<string, string | number>;
+}
+/** A subscription a retirement reaches, with what it means there. */
+interface RetirementReachedRow {
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly status: string;
+    /** The rhythm it is billed in when the retirement takes effect. */
+    readonly billingCycle: string;
+    /** ISO 8601. */
+    readonly effectiveAt: string;
+    /** ISO date, UTC. */
+    readonly lastDayToCancel: string;
+    /** Reached by another retirement within the last twelve months: the announcement waits. */
+    readonly reachedRecently: boolean;
+}
+/** A subscription on the version a retirement does not reach, and why. */
+interface RetirementSkippedRow {
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly reason: RetirementSkipReason;
+}
+/** What announcing a retirement now would do. */
+interface RetirementPreview {
+    readonly retired: RetirementSide;
+    readonly replacement: RetirementSide;
+    /** Every difference, retired to replacement, as the subscribers will be told it. */
+    readonly changes: readonly VersionChange[];
+    /** ISO 8601: the moment it is computed for. */
+    readonly asOf: string;
+    readonly reached: readonly RetirementReachedRow[];
+    readonly skipped: readonly RetirementSkippedRow[];
+    /** Empty where it may be announced as it stands. */
+    readonly blockers: readonly RetirementBlocker[];
+}
+/** What an announcement did. */
+interface RetirementAnnounced {
+    readonly retirement: VersionRetirementRecord;
+    /** Notices sent now; the rest are sent by the next run. */
+    readonly told: number;
+    readonly failed: number;
+}
+/**
+ * Why a notice not told yet waits — for a subscription a plan version's
+ * retirement reached, or a booking an add-on version's did. The run that sends
+ * the notices asks the same questions in the same order.
+ */
+interface NotToldReasons {
+    /**
+     * What the notice announces would not fit at its date: the replacement's
+     * plan could not carry the add-ons held then, or the replacement add-on
+     * could not run beside a plan the booking meets. It waits until it would.
+     */
+    readonly doesNotFit: number;
+    /** Told of another retirement within the last twelve months: it waits until those are over. */
+    readonly twelveMonths: number;
+    /**
+     * No longer reached: something of the subscriber's own — a change taking
+     * it off the version, a cancellation landing first — came before the date.
+     * It will not be sent.
+     */
+    readonly noLongerReached: number;
+    /** Nothing holds it back: it has reached nobody yet, and the next run tries again. */
+    readonly nobodyYet: number;
+}
+/**
+ * How far a retirement has come, counted over the subscriptions — or, for an
+ * add-on version, the bookings — it reached (`SC-SUB-033`, `SC-BUN-053`).
+ */
+interface RetirementProgress {
+    /** Off the retired version: moved at their date, switched early, or changed on their own. */
+    readonly moved: number;
+    /** Still on the retired version, before their date. */
+    readonly waiting: number;
+    /** Still on the retired version after their date: the run has not moved them yet, or cannot. */
+    readonly overdue: number;
+    /**
+     * Still on the retired version, and ended by their date: there is nothing
+     * to move. A booking that ended after its date, before a move came, counts
+     * here too: nothing moves a booking that has ended.
+     */
+    readonly ended: number;
+    /**
+     * Still on the retired version, and not told yet: their notice has reached
+     * nobody, so their date is not set and nothing moves them (`SC-SUB-038`).
+     */
+    readonly notTold: number;
+    /**
+     * Why those counted `notTold` are not told yet, each counted once. Absent
+     * from a server that does not count them.
+     */
+    readonly notToldReasons?: NotToldReasons;
+    /**
+     * Reminded 14 days before their date (`SC-SUB-034`) — counted beside the
+     * four above, not instead of one: a subscription reminded moves later.
+     */
+    readonly reminded: number;
+}
+/** An announcement as the administration lists it, with how far it has come. */
+interface VersionRetirementView extends VersionRetirementRecord {
+    readonly progress: RetirementProgress;
+}
+/** What one run of the moves at the date did. */
+interface RetirementMoveRun {
+    /**
+     * Subscriptions, or bookings, moved onto their replacement, with the
+     * contract the move writes.
+     */
+    readonly moved: number;
+    /** Moves that could not be made, and are tried again by the next run. */
+    readonly failed: number;
+}
+/** What switching to the replacement before the date did (`SC-SUB-032`). */
+interface RetirementSwitchResult {
+    readonly fromPlanVersionId: string;
+    readonly planVersionId: string;
+    /** ISO date of the last day the price is held, or null where none is. */
+    readonly heldUntilDay: string | null;
+}
+
+/** What the switch costs, per period of the subscriber's rhythm. */
+interface RetirementSwitchTerms {
+    /** The replacement's net price. */
+    readonly priceNet: number;
+    /**
+     * Where the replacement costs more: the price the subscriber goes on paying,
+     * the difference that is held, and the last day it is held — the day before
+     * the date they were told. Null where it costs the same or less: its price
+     * then applies from the subscriber's next period.
+     */
+    readonly held: {
+        readonly priceNet: number;
+        readonly amountNet: number;
+        readonly lastDay: string;
+    } | null;
+}
+/**
+ * A side of a retirement as its prices are compared: what it costs in each
+ * rhythm, for a plan version or for an add-on version beside a plan.
+ */
+type RetirementPricedSide = Pick<RetirementSide, 'monthlyNet' | 'yearlyNet'>;
+/**
+ * What switching to the replacement now costs in `billingCycle`, or null where
+ * the replacement has no price in it. A plan version's retirement and an add-on
+ * version's are priced alike: each side by what it costs in each rhythm.
+ */
+declare function retirementSwitchTerms(notice: {
+    readonly retired: RetirementPricedSide;
+    readonly replacement: RetirementPricedSide;
+    readonly lastDayToCancel: string;
+}, billingCycle: string): RetirementSwitchTerms | null;
+
+/** An add-on version, as an announcement names it. */
+interface RetiredBundleVersionRef {
+    readonly bundleVersionId: string;
+    readonly bundleKey: string;
+    readonly version: number;
+}
+/** An add-on retirement as it is kept: one per announcement, whichever bookings it reaches. */
+interface BundleVersionRetirementRecord {
+    readonly id: string;
+    /** The version retired. */
+    readonly retired: RetiredBundleVersionRef;
+    /** The version of the same add-on its bookings continue on, named by the operator. */
+    readonly replacement: RetiredBundleVersionRef;
+    readonly announcedAt: Date;
+    /** Who announced it — an actor tag, as the audit log writes it. */
+    readonly announcedBy: string;
+}
+type NewBundleVersionRetirement = Omit<BundleVersionRetirementRecord, 'id'>;
+/**
+ * The manifest capability that announces retiring an add-on version. The
+ * platform sets it where it serves the routes, and the admin UI offers the
+ * action only where it is set.
+ */
+declare const BUNDLE_VERSION_RETIREMENT_CAPABILITY = "bundleVersions.retire";
+/**
+ * An add-on version as the subscriber compares it with another — the one
+ * retired and its replacement, or the one booked and the one offered: what it
+ * grants, and its price beside the subscription's plan in each rhythm —
+ * `pricingOverrides` included — or null where it has none there.
+ */
+interface BundleVersionSide {
+    readonly bundleVersionId: string;
+    readonly bundleKey: string;
+    readonly label: string;
+    readonly version: number;
+    readonly features: readonly string[];
+    readonly quotas: Readonly<Record<string, number>>;
+    readonly monthlyNet: number | null;
+    readonly yearlyNet: number | null;
+}
+/**
+ * An add-on version a booking is on is being retired, and the booking
+ * continues on the named replacement from its effective date. Sent once per
+ * booking and retirement, and kept as it was sent: the record shows what the
+ * subscriber was told, prices included.
+ */
+interface BundleVersionRetiredNotice {
+    readonly kind: 'bundle-version-retired';
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly subscriptionBundleId: string;
+    readonly retirementId: string;
+    /** The plan the add-on runs beside at the date, which both sides are priced for. */
+    readonly planKey: string;
+    readonly retired: BundleVersionSide;
+    readonly replacement: BundleVersionSide;
+    /** Every difference, retired to replacement, at the prices for `planKey`. */
+    readonly changes: readonly VersionChange[];
+    /** The rhythm the booking is billed in, which says which of the two prices applies. */
+    readonly billingCycle: string;
+    /** ISO 8601. */
+    readonly effectiveAt: string;
+    /** ISO date (`YYYY-MM-DD`), UTC: the last day it may be cancelled without its minimum term. */
+    readonly lastDayToCancel: string;
+}
+/**
+ * Why an add-on retirement does not reach a booking of the version:
+ *
+ * - `ended` — the subscription is over, or the booking's cancellation has
+ *   already landed.
+ * - `cancelled-before` — the booking's cancellation lands by the effective date.
+ * - `changes-before` — the booking's switch to a newer version, taken for the
+ *   end of its term, lands by the effective date.
+ * - `no-term` — it carries no period an end can be counted from.
+ * - `already-told` — an earlier announcement of this version reached it, and
+ *   stands.
+ */
+type BundleRetirementSkipReason = 'ended' | 'cancelled-before' | 'changes-before' | 'no-term' | 'already-told';
+/**
+ * What switching a booking to its retirement's replacement now would cost
+ * (`SC-BUN-054`), in the rhythm the booking is billed in now — its own, or
+ * else its plan's — which need not be the one its notice was told in.
+ */
+interface BundleRetirementSwitchTerms extends RetirementSwitchTerms {
+    readonly billingCycle: string;
+}
+/**
+ * The one reminder of an add-on retirement (`SC-BUN-056`): sent once, 14 days
+ * before the booking's date, where staying put costs it something. It says
+ * again what the booking was told, with both versions priced for the plan the
+ * add-on runs beside at the date as the catalogue prices them when it is sent,
+ * in the rhythm the booking is billed in then.
+ */
+interface BundleVersionRetirementReminder extends Omit<BundleVersionRetiredNotice, 'kind'> {
+    readonly kind: 'bundle-version-retirement-reminder';
+    /** What switching to the replacement now costs (`SC-BUN-054`), or null where the booking cannot. */
+    readonly switchTerms: BundleRetirementSwitchTerms | null;
+}
+/** What switching a booking to its retirement's replacement before the date did. */
+interface BundleRetirementSwitchResult {
+    readonly subscriptionBundleId: string;
+    readonly fromBundleVersionId: string;
+    readonly bundleVersionId: string;
+    /** ISO date of the last day the price is held, or null where none is. */
+    readonly heldUntilDay: string | null;
+}
+/** A booking an add-on retirement reaches, with what it means there. */
+interface BundleRetirementReachedRow {
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly subscriptionBundleId: string;
+    /** The plan the add-on runs beside when the retirement takes effect. */
+    readonly planKey: string;
+    /** The rhythm the plan is billed in then. */
+    readonly planCycle: string;
+    /** The rhythm the booking is billed in. */
+    readonly billingCycle: string;
+    /** ISO 8601. */
+    readonly effectiveAt: string;
+    /** ISO date, UTC. */
+    readonly lastDayToCancel: string;
+    /** Its subscription was reached by a retirement within the last twelve months: the announcement waits. */
+    readonly reachedRecently: boolean;
+}
+/** A booking of the version an add-on retirement does not reach, and why. */
+interface BundleRetirementSkippedRow {
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly subscriptionBundleId: string;
+    readonly reason: BundleRetirementSkipReason;
+}
+/** What announcing an add-on retirement now would do. */
+interface BundleRetirementPreview {
+    /** The two versions at their own prices, before any plan's override. */
+    readonly retired: BundleVersionSide;
+    readonly replacement: BundleVersionSide;
+    /** Every difference at those prices; each booking is told the one at its plan's. */
+    readonly changes: readonly VersionChange[];
+    /** ISO 8601: the moment it is computed for. */
+    readonly asOf: string;
+    readonly reached: readonly BundleRetirementReachedRow[];
+    readonly skipped: readonly BundleRetirementSkippedRow[];
+    /** Empty where it may be announced as it stands. */
+    readonly blockers: readonly RetirementBlocker[];
+}
+/** What an add-on announcement did. */
+interface BundleRetirementAnnounced {
+    readonly retirement: BundleVersionRetirementRecord;
+    /** Notices sent now; the rest are sent by the next run. */
+    readonly told: number;
+    readonly failed: number;
+}
+/** An add-on announcement as the administration lists it, with how far it has come. */
+interface BundleVersionRetirementView extends BundleVersionRetirementRecord {
+    readonly progress: RetirementProgress;
+}
+
 type SubscriptionStatus = 'TRIAL' | 'ACTIVE' | 'PAST_DUE' | 'CANCELED' | 'PENDING_SALES';
 interface Subscription {
     id: string;
@@ -984,8 +1598,8 @@ interface Subscription {
     planVersionId: string;
     billingCycle: BillingCycle;
     status: SubscriptionStatus;
-    /** Override per Tenant; unset fields fall back to the PlanVersion. */
-    customLimits?: Partial<Record<QuotaKey, number>>;
+    /** Override per tenant; unset fields fall back to the PlanVersion. */
+    customLimits?: CustomLimits | null;
     /** ENTERPRISE special contract. */
     customMonthlyNet?: number | null;
     isPilot: boolean;
@@ -996,15 +1610,7 @@ interface Subscription {
     canceledAt: string | null;
     currentPeriodStart: string | null;
     currentPeriodEnd: string | null;
-    /** Plan version migration (see ROADMAP §6). */
-    pendingPlanVersionId: string | null;
-    pendingPlanVersionEffectiveAt: string | null;
-    pendingPlanVersionAccepted: boolean;
-    pendingPlanVersionAcceptedAt: string | null;
-    pendingPlanVersionAcceptedByUserId: string | null;
-    pendingPlanVersionNotifiedAt: string | null;
-    pendingPlanVersionReminderSentAt: string | null;
-    /** Plan change at period end (orthogonal to pendingPlanVersionId). */
+    /** Plan change at period end. */
     pendingPlanId: PlanId | null;
     pendingBillingCycle: BillingCycle | null;
     pendingEffectiveAt: string | null;
@@ -1067,7 +1673,7 @@ interface VersionedEntityBase {
      * has become part of the contract. Optional for backwards-compat reasons;
      * the helper defensively interprets `undefined` as `>0` (= frozen). How the
      * adapter counts depends on the version type: PlanVersion via
-     * `Subscription.planVersionId` (+ `pendingPlanVersionId`), BundleVersion
+     * `Subscription.planVersionId` (+ `pendingChangeVersionId`), BundleVersion
      * via the respective app-specific Subscription→Bundle binding.
      */
     subscriptionCount?: number;
@@ -1079,9 +1685,11 @@ interface VersionedEntityBase {
  * their own minimum term + their own cancellation (user requirement from
  * P11.7.3).
  *
- * - `bundleVersionId` binds the booking to an *exact* BundleVersion
- *   (immutable; bundle updates only take effect after a new version with its
- *   own migration).
+ * - `bundleVersionId` binds the booking to an *exact* BundleVersion. A newer
+ *   version of the add-on does not change it by being published: an add-on
+ *   retirement moves the booking onto its replacement at its date
+ *   (`SC-BUN-049`), and the subscriber moves it by taking a newer version
+ *   offered (`SC-BUN-058`).
  * - `startedAt` is the contract start of this booking.
  * - `minimumTermEndsAt` = end of the minimum term; `null` = no minimum term
  *   (platform default = no commitment, set service-side).
@@ -1113,6 +1721,15 @@ interface SubscriptionBundleRecord {
     billingCycle: BillingCycle | null;
     currentPeriodStart: Date | null;
     currentPeriodEnd: Date | null;
+    /**
+     * A switch to another version of the add-on, taken for the end of the
+     * booking's running term because it takes something away (`SC-BUN-058`):
+     * the version the booking continues on, and from when. Both null where
+     * none is scheduled. The run that makes the switch at that moment clears
+     * them; until then the booking stays on `bundleVersionId`.
+     */
+    pendingBundleVersionId: string | null;
+    pendingVersionEffectiveAt: Date | null;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -1136,6 +1753,18 @@ interface SubscriptionBundleView extends SubscriptionBundleRecord {
      * defect: a field called `monthlyNet` on a yearly booking cannot be right.
      */
     priceNet: number | null;
+    /**
+     * The number of the version a switch scheduled for the end of the booking's
+     * term moves it to (`pendingBundleVersionId`); null where none is
+     * scheduled.
+     */
+    pendingVersion?: number | null;
+    /**
+     * The retirement of the add-on version this booking is on, as the
+     * subscriber was told it (`SC-BUN-046`); absent or null where none was
+     * told, or once the booking is on another version.
+     */
+    retirement?: BundleVersionRetiredNotice | null;
 }
 interface CreateSubscriptionBundleData {
     subscriptionId: string;
@@ -1627,7 +2256,13 @@ interface AuditQuery {
     entity?: string;
     entityId?: string;
     action?: string;
-    /** Wildcard-capable, e.g. 'cli:*'. */
+    /**
+     * A tag, matched exactly, or a pattern with `*` at its start, its end or
+     * both, matched without regard to case: `cli:*` is every entry from the
+     * command line, `*:ops@example.com:*` every entry of one person, whatever
+     * they acted through. Everything between the stars is literal. A tag reads
+     * `<source>:<email>:<context>`.
+     */
     actorTag?: string;
     from?: string;
     to?: string;
@@ -1780,6 +2415,23 @@ interface PromotionOnPrice {
  */
 declare function promotionOnPrice(promotions: PromotionRow[], targetKey: string, locale: string, cycle: 'monthly' | 'yearly', basePrice: number | null, today?: Date, targetType?: PromotionTargetType): PromotionOnPrice | null;
 
+/** An amount as written, to the cent. */
+declare function roundToCents(amount: number): number;
+/** The terms added as written, exactly, and rounded once to the cent. */
+declare function sumToCents(...terms: number[]): number;
+/** The amount in whole cents, rounded once. */
+declare function toCents(amount: number): number;
+/** `percent` % of `amount`, to the cent — the discount a percentage takes off. */
+declare function percentOf(amount: number, percent: number): number;
+/** `amount × part / whole`, to the cent — a share of a period, say. */
+declare function prorate(amount: number, part: number, whole: number): number;
+/** Gross from net at a tax rate in per cent: net × (100 + rate) / 100. */
+declare function grossFromNet(net: number, vatRate: number): number;
+/** Net from gross at a tax rate in per cent: gross × 100 / (100 + rate). */
+declare function netFromGross(gross: number, vatRate: number): number;
+/** The tax a gross amount includes at a rate in per cent: gross × rate / (100 + rate). */
+declare function computeIncludedVat(gross: number, vatRate: number): number;
+
 type CheckoutOfferLineItemKind = 'plan' | 'bundle' | 'discount';
 /** Frozen billable line item in the offer. */
 interface CheckoutOfferLineItem {
@@ -2087,6 +2739,12 @@ interface PublicMarketingCatalogResponse {
     currency: string;
     /** VAT rate in percent — for the CheckoutOffer price breakdown. */
     vatRate: number;
+    /**
+     * The country the rate applies to: the issuer's, where a tax adapter
+     * decides and a subscriber elsewhere may be charged another — the page says
+     * so (`SC-PRIC-037`). `null` where the one rate of the file applies to all.
+     */
+    vatRateShownFor: string | null;
     /** What a new payment method is taken with here, if one is taken. */
     newPaymentMethods: PublicNewPaymentMethods;
     /** Visible, marketed plans — sorted by `priority` DESC. */
@@ -2252,57 +2910,6 @@ declare function readQuotaValue(value: unknown): number | null;
  */
 declare function readQuotaRecord(value: unknown): Record<string, number>;
 
-/** Alias for historical compatibility — equivalent to VersionChangeDirection. */
-type ChangeDirection = VersionChangeDirection;
-interface DiffResult {
-    nonRegressive: boolean;
-    changes: VersionChange[];
-}
-/**
- * `Decimal | string | number` — the three forms in which prices appear
- * in the platform. `Decimal` is the Prisma class (with
- * `.toNumber()`), which is not imported directly in order to keep the
- * platform Prisma-free — a structural view suffices.
- */
-type DecimalLike = number | string | {
-    toNumber(): number;
-};
-interface PlanVersionFields {
-    features: FeatureKey[];
-    /**
-     * Quotas of the version. -1 = unlimited; missing key = 0.
-     *
-     * Every key either side carries is compared. Which keys exist is the
-     * installation's decision — they come from `@DefinesQuota` — so a fixed
-     * set here would have compared the three the platform happened to know by
-     * name and let every other one be lowered without the confirmation
-     * publishing a regression asks for.
-     */
-    quotas: Record<QuotaKey, number>;
-    monthlyNet: DecimalLike;
-    yearlyNet: DecimalLike;
-}
-interface BundleVersionFields {
-    features: FeatureKey[];
-    /** Quota contributions of the bundle. -1 = unlimited; missing key = 0. */
-    quotas: Record<QuotaKey, number>;
-    /** Default pricing; null = only override pricing possible. */
-    monthlyNet: DecimalLike | null;
-    yearlyNet: DecimalLike | null;
-}
-declare function classifyPlanDiff(oldV: PlanVersionFields, newV: PlanVersionFields): DiffResult;
-/**
- * Classification of a BundleVersion diff for contract protection.
- *
- * Quotas are compared exactly as they are for a plan.
- *
- * Pricing can be `null` (the bundle only has override pricing); a switch
- * from value ↔ null is classified as REGRESSION (value dropped) or IMPROVEMENT
- * (value added, lowerIsBetter inverted). Both null
- * stay NEUTRAL.
- */
-declare function classifyBundleVersionDiff(oldV: BundleVersionFields, newV: BundleVersionFields): DiffResult;
-
 interface PromoPreviewRequest {
     /** Promo code (case-insensitive, normalized to uppercase in the service). */
     code: string;
@@ -2578,6 +3185,264 @@ interface MaintenanceUnlockView {
     wasLocked: boolean;
 }
 
+/**
+ * A newer version of a booked add-on, offered beside the booking: the version
+ * booked and the one on sale side by side, what kind of offer it is, and when
+ * a switch taken now would take effect — at once, or, for one that takes
+ * something away, at the end of the booking's running term. The list of the
+ * tenant's bookings carries it on each booking, as `offer`.
+ */
+interface BundleVersionOfferView {
+    readonly subscriptionBundleId: string;
+    /** The plan both versions are priced beside: the one the subscription is on. */
+    readonly planKey: string;
+    /** The rhythm the booking is billed in, which the kind of offer is judged in. */
+    readonly billingCycle: BillingCycle;
+    readonly bound: BundleVersionSide;
+    readonly offered: BundleVersionSide;
+    readonly class: Exclude<VersionOfferClass, 'same'>;
+    /** Every difference, bound to offered, with the price in the booking's rhythm alone. */
+    readonly changes: readonly VersionChange[];
+    /** ISO instant. */
+    readonly takesEffectAt: string;
+}
+/**
+ * What taking an add-on offer did: the booking, the version left and the one
+ * taken, and whether it applied at once or waits for `takesEffectAt`.
+ */
+interface BundleVersionSwitchResult {
+    readonly class: Exclude<VersionOfferClass, 'same'>;
+    readonly subscriptionBundleId: string;
+    readonly fromBundleVersionId: string;
+    readonly bundleVersionId: string;
+    readonly immediate: boolean;
+    /** ISO instant. */
+    readonly takesEffectAt: string;
+}
+
+/** What a notice is about. */
+type SubscriptionNoticeKind = 'version-offered' | 'version-retired' | 'version-retirement-reminder' | 'bundle-version-retired' | 'bundle-version-retirement-reminder' | 'bundle-version-offered';
+/** Which notice: there is one per subscription, kind and subject. */
+interface SubscriptionNoticeKey {
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly kind: SubscriptionNoticeKind;
+    /**
+     * What it is about. For `version-offered`, the id of the version offered;
+     * for `version-retired`, the id of the version retired — so a subscription
+     * is told of a version's retirement once, whichever announcement it came
+     * with. The announcement is in the notice as `retirementId`. For
+     * `version-retirement-reminder`, the id of the version retired as well: a
+     * subscription is reminded of a version's retirement once. For
+     * `bundle-version-retired`, the id of the add-on version retired: a
+     * subscription holds one booking of an add-on, so that booking is told of
+     * the retirement once. For `bundle-version-retirement-reminder`, the id of
+     * the add-on version retired as well: that booking is reminded of it once.
+     * For `bundle-version-offered`, the id of the add-on version offered: that
+     * booking is told of the version once.
+     */
+    readonly subject: string;
+}
+/** Who a notice went to and how, in the application's own terms. */
+interface SubscriptionNoticeDelivery {
+    /** The addresses, or user ids, it was sent to. Empty where nobody could be told. */
+    readonly recipients: readonly string[];
+    /** The way it went — `email`, `in-app`, whatever the application calls it. */
+    readonly channel: string;
+}
+/** A notice as it is kept. */
+interface SubscriptionNoticeRecord extends SubscriptionNoticeKey {
+    readonly id: string;
+    /** The notice as it was last handed to the application: a `SubscriptionNotice`. */
+    readonly content: unknown;
+    readonly createdAt: Date;
+    /**
+     * When a run took it on to deliver it. Null where no run holds it — before
+     * the first attempt, and again after an attempt that failed.
+     */
+    readonly claimedAt: Date | null;
+    /** When the application confirmed it sent it; null until then. */
+    readonly deliveredAt: Date | null;
+    /** Who it went to and how; set together with `deliveredAt`. */
+    readonly delivery: SubscriptionNoticeDelivery | null;
+}
+/**
+ * A newer version of the subscription's plan is now offered to it. Sent once
+ * per version, when the offer appears beside the plan — the notice and the
+ * offer say the same thing.
+ */
+interface VersionOfferedNotice {
+    readonly kind: 'version-offered';
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    /** The offer as `GET billing/version-offer` answers it at the moment the notice is due. */
+    readonly offer: VersionOfferView;
+}
+/**
+ * A newer version of an add-on a booking is on is now offered to it. Sent once
+ * per booking and version, when the offer appears beside the add-on — the
+ * notice and the offer say the same thing.
+ */
+interface BundleVersionOfferedNotice {
+    readonly kind: 'bundle-version-offered';
+    readonly tenantId: string;
+    readonly subscriptionId: string;
+    readonly subscriptionBundleId: string;
+    /** The offer as the list of the tenant's bookings shows it at the moment the notice is due. */
+    readonly offer: BundleVersionOfferView;
+}
+/** A notice handed to the application to send. */
+type SubscriptionNotice = VersionOfferedNotice | VersionRetiredNotice | VersionRetirementReminder | BundleVersionRetiredNotice | BundleVersionRetirementReminder | BundleVersionOfferedNotice;
+
+/**
+ * A `subscription_notices` row as either adapter reads it back. The two JSON
+ * columns are `unknown`: the database holds whatever was written to them.
+ */
+interface CanonicalSubscriptionNoticeRow {
+    id: string;
+    tenantId: string;
+    subscriptionId: string;
+    kind: string;
+    subject: string;
+    content: unknown;
+    createdAt: Date;
+    claimedAt: Date | null;
+    deliveredAt: Date | null;
+    recipients: unknown;
+    channel: string | null;
+}
+/**
+ * Reads a row back as a record, naming each column rather than spreading the
+ * row. The kind and the delivery are checked rather than cast: the record is
+ * what a subscriber is later shown they were told, and a value nobody can read
+ * must stop at the read and name its row.
+ */
+declare function toSubscriptionNoticeRecord(row: CanonicalSubscriptionNoticeRow): SubscriptionNoticeRecord;
+
+/** The dates of a version that decide its state, as a row carries them. */
+interface VersionSaleDates extends VersionWindow {
+    readonly publishedAt?: string | Date | null;
+}
+/**
+ * Where a version stands. A day is an ISO date (`YYYY-MM-DD`, UTC):
+ * - `scheduled` — published and not on sale yet; `from` is its first day.
+ * - `on-sale` — on sale now; `until` is its last day, where one is known.
+ * - `off-sale` — no longer on sale; `since` is its first day off sale, where
+ *   one is known — a version superseded without a last day has none.
+ */
+type VersionSale = {
+    readonly kind: 'draft';
+} | {
+    readonly kind: 'scheduled';
+    readonly from: string;
+} | {
+    readonly kind: 'on-sale';
+    readonly until: string | null;
+} | {
+    readonly kind: 'off-sale';
+    readonly since: string | null;
+};
+type VersionSaleKind = VersionSale['kind'];
+/** The state of `version` at `now`. */
+declare function versionSale(version: VersionSaleDates, now: Date): VersionSale;
+/**
+ * The version on sale at `now` among one plan's or add-on's versions, in the
+ * order the platform picks it: the latest `validFrom`, a version without one
+ * last, then the highest number.
+ */
+declare function versionOnSale<V extends VersionSaleDates & {
+    readonly version?: number;
+}>(versions: readonly V[], now: Date): V | null;
+/**
+ * What a listing shows for a plan or add-on: the version on sale, otherwise
+ * the next one scheduled. A draft is not shown by this.
+ */
+declare function versionOnSaleOrNext<V extends VersionSaleDates & {
+    readonly version?: number;
+}>(versions: readonly V[], now: Date): V | null;
+
+/** A `version_retirements` row as either adapter reads it back. */
+interface CanonicalVersionRetirementRow {
+    id: string;
+    retiredPlanVersionId: string;
+    retiredPlanKey: string;
+    retiredVersion: number;
+    replacementPlanVersionId: string;
+    replacementPlanKey: string;
+    replacementVersion: number;
+    announcedAt: Date;
+    announcedBy: string;
+}
+/** Reads a row back as a record, naming each column rather than spreading the row. */
+declare function toVersionRetirementRecord(row: CanonicalVersionRetirementRow): VersionRetirementRecord;
+
+/** A `bundle_version_retirements` row as either adapter reads it back. */
+interface CanonicalBundleVersionRetirementRow {
+    id: string;
+    retiredBundleVersionId: string;
+    retiredBundleKey: string;
+    retiredVersion: number;
+    replacementBundleVersionId: string;
+    replacementBundleKey: string;
+    replacementVersion: number;
+    announcedAt: Date;
+    announcedBy: string;
+}
+/** Reads a row back as a record, naming each column rather than spreading the row. */
+declare function toBundleVersionRetirementRecord(row: CanonicalBundleVersionRetirementRow): BundleVersionRetirementRecord;
+
+/** A scheduled change as a subscription row holds it. */
+interface ScheduledChangeColumns {
+    readonly pendingPlan: string | null;
+    readonly pendingBillingCycle: string | null;
+    readonly pendingEffectiveAt: Date | null;
+    readonly pendingChangeVersionId: string | null;
+}
+/** No change scheduled: what a plan change writes where it does not keep one. */
+declare const NO_SCHEDULED_CHANGE: ScheduledChangeColumns;
+/**
+ * The scheduled-change columns a plan change writes onto `current`: all
+ * cleared, unless the write keeps the change. A kept change is left as it is,
+ * with one exception: a change that only moves the rhythm on the plan being
+ * left — the plan it was scheduled on, no version named — follows the
+ * subscription to its new plan. Recorded as it was, it would take the
+ * subscription back to the plan it left when it comes due.
+ */
+declare function scheduledChangeAfterWrite(current: {
+    readonly plan: string;
+} & ScheduledChangeColumns, input: {
+    readonly planId: string;
+    readonly keepsPendingChange?: boolean;
+}): Partial<ScheduledChangeColumns>;
+
+/** How many days before a retirement takes effect its reminder is due. */
+declare const RETIREMENT_REMINDER_LEAD_DAYS = 14;
+/**
+ * When the reminder of a retirement is due: 14 days before it takes effect, at
+ * the same time of day. UTC has no change of clocks, so that is the effective
+ * day less 14 calendar days.
+ */
+declare function retirementReminderDueAt(notice: Pick<VersionRetiredNotice, 'effectiveAt'>): Date;
+/**
+ * Whether the reminder is due at `now`: from its day until the retirement
+ * takes effect. A run that did not happen on the day is caught up by the next
+ * one before the date; after it there is nothing left to remind of.
+ */
+declare function retirementReminderIsDue(notice: Pick<VersionRetiredNotice, 'effectiveAt'>, now: Date): boolean;
+/**
+ * Whether staying put costs the subscription something when the retirement
+ * takes effect (D9): the replacement takes a feature or a quota away, or is
+ * dearer in `billingCycle`, the rhythm it is billed in then — or not sold in
+ * it. A price that rises only in another rhythm costs it nothing. A plan
+ * version's retirement and an add-on version's are judged alike.
+ */
+declare function retirementCostsTheSubscription(notice: {
+    readonly retired: RetirementPricedSide;
+    readonly replacement: RetirementPricedSide;
+    readonly changes: readonly VersionChange[];
+    readonly lastDayToCancel: string;
+}, billingCycle: string): boolean;
+
 /** A `maintenance_windows` row as either adapter reads it back. */
 type CanonicalMaintenanceWindowRow = MaintenanceWindowRecord;
 /**
@@ -2726,11 +3591,8 @@ interface PlanVersionRow extends VersionedEntityBase {
      * `endsAt` is user-initiated: `POST /admin/catalog/plan-versions/:id/terminate`
      * sets the field. When `endsAt < NOW()` the version is no longer live for
      * new bookings — existing subscriptions (P1) stay bound.
-     *
-     * Optional, because consumer backends add the column additively — if it
-     * is missing, there is no end date.
      */
-    endsAt?: string | null;
+    endsAt: string | null;
     /** @deprecated Read from `quotas['users']` once available. */
     maxUsers?: number;
     /** @deprecated Legacy field; read from `quotas['vehicles']`. */
@@ -2795,12 +3657,12 @@ interface PlanCatalogReadSnapshot {
     /** Plan stems (deletedAt IS NULL). */
     plans: PlanRow[];
     /**
-     * Live PlanVersions: per `planId` (= planKey) the currently published
-     * version (publishedAt IS NOT NULL AND supersededAt IS NULL).
-     * Apps with plans without a live version take over the plan, but without
-     * pricing/quotas — the importer probably emitted a warning.
+     * Per `planId` (= planKey) the version on sale at the moment the snapshot
+     * was asked for — the rule of `PlanRepository.findActivePlanVersion`, so
+     * the catalogue names the version a booking made at that moment binds.
+     * A plan with nothing on sale is taken over without pricing or quotas.
      */
-    livePlanVersions: PlanVersionRow[];
+    versionsOnSale: PlanVersionRow[];
     /** Feature catalog entries (deletedAt IS NULL). */
     featureEntries: FeatureCatalogEntryRow[];
 }
@@ -2809,7 +3671,8 @@ interface PlanCatalogReadSnapshot {
  * implement it against their Prisma tables.
  */
 interface PlanCatalogReadSink {
-    loadSnapshot(): Promise<PlanCatalogReadSnapshot>;
+    /** The catalogue as it stands at `asOf`. */
+    loadSnapshot(asOf: Date): Promise<PlanCatalogReadSnapshot>;
 }
 
 /**
@@ -3068,13 +3931,34 @@ interface EmailPort {
 }
 /** Adapter for MFA secret persistence. */
 interface MfaPort {
-    /** Returns the stored TOTP secret or null. */
+    /**
+     * Returns the stored secret or null. What is stored is the value the
+     * platform handed to `setSecret`: sealed by the installation's
+     * `SecretSealer`, and opened by the platform, not here.
+     */
     getSecret(userId: string): Promise<string | null>;
-    /** Persists or deletes (null) the TOTP secret. */
+    /** Persists or deletes (null) the sealed secret, as it is given. */
     setSecret(userId: string, secret: string | null): Promise<void>;
     /** The platform calls this during the mfa-setup command. */
     isEnabled(userId: string): Promise<boolean>;
 }
+/**
+ * Seals a secret before it is stored and opens it after it is read.
+ *
+ * The TOTP secret of a SuperAdmin is the second factor of the accounts that can
+ * change every tenant's plan, codes and contracts. Stored as it is, whoever
+ * holds a dump, a backup or a replica holds it too, and the second factor adds
+ * nothing against them. The key stays with the installation — in its
+ * configuration, not in the database the sealed value lives in.
+ *
+ * `open` refuses what it did not seal: a value from another key, a format it
+ * does not know, a secret stored before sealing. The platform then treats the
+ * code as wrong and the administrator enrols again.
+ */
+interface SecretSealer {
+    seal(plain: string): Promise<string>;
+    open(sealed: string): Promise<string>;
+}
 /**
  * Opaque transaction context. The consumer determines the concrete type
  * (e.g. `Prisma.TransactionClient`). Platform code only passes it
@@ -3205,8 +4089,18 @@ interface PromoCodeRedemptionListItem extends PromoCodeRedemptionRecord {
  */
 interface PromoCodeRepository {
     findById(id: string): Promise<PromoCodeRecord | null>;
+    /**
+     * The code with this name, deleted ones included: a deleted code keeps its
+     * name (`SC-PROMO-028`), so the platform's duplicate check has to see it.
+     * Every caller that redeems or previews checks `deletedAt` itself.
+     */
     findByCode(code: string, tx?: TransactionContext): Promise<PromoCodeRecord | null>;
     findMany(filter: PromoCodeFilter): Promise<PromoCodeRecord[]>;
+    /**
+     * Refuses a name that is taken — by a live or a deleted code — with
+     * `promoCodeTaken`: two creates can pass the platform's duplicate check
+     * together, and the second one's answer is the refusal, not a driver error.
+     */
     create(data: CreatePromoCodeData): Promise<PromoCodeRecord>;
     update(id: string, data: UpdatePromoCodeData): Promise<PromoCodeRecord>;
     softDelete(id: string): Promise<void>;
@@ -3228,7 +4122,8 @@ interface PromoCodeRepository {
     releaseSlot(id: string, tx?: TransactionContext): Promise<void>;
     /**
      * Bulk-expire cron: sets all codes with `validUntil < now` and status
-     * ACTIVE/PAUSED to EXPIRED. Returns: number of updated rows.
+     * ACTIVE/PAUSED to EXPIRED, leaving deleted codes as they were — a write
+     * to a row the operator removed. Returns: number of updated rows.
      */
     expireDueCodes(now: Date): Promise<number>;
 }
@@ -3328,7 +4223,14 @@ interface PromoCodeHoldRepository {
 interface PromoCodeRedemptionRepository {
     findBySubscription(subscriptionId: string, tx?: TransactionContext): Promise<PromoCodeRedemptionRecord | null>;
     create(data: Omit<PromoCodeRedemptionRecord, 'id' | 'redeemedAt' | 'status' | 'reversedAt'>, tx?: TransactionContext): Promise<PromoCodeRedemptionRecord>;
-    setReversed(id: string, tx?: TransactionContext): Promise<PromoCodeRedemptionRecord>;
+    /**
+     * Marks the redemption reversed while it is not reversed yet, in one
+     * conditional statement, and answers with it; `null` where it already was.
+     * Two reversals of one redemption at the same moment then find one winner,
+     * and only the winner gives the slot back — without the claim both would,
+     * and a limited code would gain a slot it never issued.
+     */
+    setReversed(id: string, tx?: TransactionContext): Promise<PromoCodeRedemptionRecord | null>;
     countByPromoCode(promoCodeId: string, status?: PromoCodeRedemptionStatus): Promise<number>;
     listByPromoCode(promoCodeId: string): Promise<PromoCodeRedemptionListItem[]>;
     expireDueRedemptions(now: Date): Promise<number>;
@@ -3373,48 +4275,208 @@ interface PromoRevenueDeductionAggregator {
     sumGrossForPromoCode(promoCodeId: string): Promise<string>;
 }
 
-type ContractLineItemKind = 'plan' | 'bundle' | 'discount';
-type SubscriptionContractStatus = 'active' | 'scheduled' | 'terminated' | 'superseded';
-/**
- * The statuses a contract is looked up under when asking "what is this tenant
- * on right now" — `scheduled` included, because a contract that starts today
- * and has not been switched to `active` yet is still the one in force at its
- * own `effectiveFrom`.
- *
- * One list rather than one per adapter: the two adapters have to answer
- * `findActiveByTenantId` the same way, and a status added here must not reach
- * only whichever of them somebody remembered.
- */
+/** The adapter that gave an answer, recorded beside the answer. */
+interface TaxAdapterIdentity {
+    /** The adapter's package name, such as `@saasicat/tax-de`. */
+    name: string;
+    /** The adapter's version as published, such as `1.0.0`. */
+    version: string;
+}
+/** The kinds of tax treatment every adapter shares, in the order they are named. */
+declare const TAX_TREATMENT_KINDS: readonly ["standard", "reduced", "exempt", "reverse-charge", "not-taxable", "small-business"];
 /**
- * How many bundle versions one price lookup may name.
+ * What a tax treatment is, in the words every adapter shares.
  *
- * One number rather than two: the server validates against it and the client
- * batches to stay inside it, and a client that learned the cap by receiving a
- * 400 would fail silently — the lookup answers with an empty map, and every
- * card falls back to a catalogue price the tenant may not be charged.
- */
-declare const BUNDLE_PRICE_LOOKUP_LIMIT = 200;
-declare const ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES: readonly SubscriptionContractStatus[];
-interface ContractLineItemRecord {
-    id: string;
-    contractId: string;
-    kind: ContractLineItemKind;
-    sourceKey: string;
-    sourceVersionId: string | null;
-    titleSnapshot: string;
-    descriptionSnapshot: string | null;
-    quantity: number;
-    unit: string | null;
+ * - `standard` and `reduced`: the issuer's country taxes the charge at a rate.
+ * - `exempt`: the charge is exempt in the issuer's country.
+ * - `reverse-charge`: the subscriber, a business in another country, owes the
+ *   tax instead of the issuer.
+ * - `not-taxable`: the charge is not taxable in the issuer's country at all,
+ *   such as a service to a business outside the European Union.
+ * - `small-business`: the issuer charges no tax under a small business scheme.
+ */
+type TaxTreatmentKind = (typeof TAX_TREATMENT_KINDS)[number];
+/** The treatment an adapter decided, as a contract and an invoice record it. */
+interface TaxTreatment {
+    kind: TaxTreatmentKind;
+    /** The rate in percent, such as `19`; `0` for every kind that charges no tax. */
+    rate: number;
+    /**
+     * The sentence the document has to carry for this treatment, such as the
+     * reference to the reverse charge; `null` where the law asks for none.
+     */
+    note: string | null;
+    /** Who decided it. */
+    adapter: TaxAdapterIdentity;
+}
+/**
+ * Where a subscriber stands for tax purposes, as its record stands: what an
+ * adapter decides a treatment from.
+ */
+interface SubscriberTaxOrigin {
+    /** The country of the billing address, ISO 3166-1 alpha-2; `null` while unknown. */
+    country: string | null;
     /**
-     * What the line costs over one of its billing periods, `quantity` already
-     * in it — not a unit price. A contract's totals take its lines as they
-     * stand, each counted as often as it falls due in one period of the
-     * contract, and are refused where they do not add up.
+     * Whether the subscriber is a business, as sign-up or the operator recorded
+     * it; `null` while nobody has said. Never derived from a tax identifier: a
+     * business outside the European Union may have none.
      */
-    priceNet: number;
-    /** `priceNet` with the line's share of the tax its rhythm owes. */
-    priceGross: number;
-    billingCycle: 'monthly' | 'yearly';
+    business: boolean | null;
+    /** The VAT identification number as entered, validated or not. */
+    vatId: string | null;
+    /**
+     * The same number, only when its latest completed check found it valid;
+     * otherwise `null`. An adapter decides as though a subscriber whose number
+     * is not validated had none (`SC-PRIC-040`).
+     */
+    validatedVatId: string | null;
+}
+/** The issuer as an adapter needs it: the operator, as `config/saas.yaml` names it. */
+interface TaxIssuer {
+    /** ISO 3166-1 alpha-2; `null` where the configuration names none. */
+    country: string | null;
+    vatId: string | null;
+}
+/** What an adapter decides a treatment for. */
+interface TaxDecisionRequest {
+    issuer: TaxIssuer;
+    origin: SubscriberTaxOrigin;
+    /**
+     * The period the charge covers, as a charge records it: from `from` up to
+     * `until`, which is the first moment after it. A rate that changed in
+     * between is the adapter's to see.
+     */
+    period: {
+        from: Date;
+        until: Date;
+    };
+    /**
+     * The installation's time zone, an IANA name such as `Europe/Berlin`: the
+     * calendar in which the days of the period count (`SC-PRIC-045`).
+     */
+    timeZone: string;
+}
+/**
+ * An adapter's answer: a treatment, or a sentence saying the case is not
+ * supported. An unsupported case is refused before a contract exists rather
+ * than invoiced with a guessed tax (`SC-PRIC-039`).
+ */
+type TaxDecision = {
+    supported: true;
+    treatment: TaxTreatment;
+} | {
+    supported: false;
+    reason: string;
+};
+/**
+ * A completed check of a VAT identification number, with its date and what
+ * the service returned (`SC-PRIC-040`). Every check is recorded for the
+ * subscriber and never rewritten: a reverse charge rests on the confirmation
+ * that held when the invoice was issued, and neither a later check nor a
+ * corrected number may take it away.
+ */
+interface VatIdCheck {
+    /** The number checked, exactly as it was stored when the check ran. */
+    vatId: string;
+    /**
+     * When the service's answer was received, by the platform's clock, to the
+     * millisecond. `keepsVatIdCheck` makes the check with the latest one count,
+     * so a date of day precision — such as the request date VIES returns —
+     * would make two checks of one day tie, and a date in the future would hold
+     * back every check after it. Such a date belongs in `confirmation`.
+     */
+    checkedAt: Date;
+    /** Whether the service confirmed the number as valid. */
+    valid: boolean;
+    /** The service that answered, such as `VIES`. */
+    service: string;
+    /**
+     * What the service returned as its confirmation — a request identifier, the
+     * name and address it holds for the number — as text, as the service sent it.
+     */
+    confirmation: Record<string, string>;
+}
+/**
+ * How a check ended. A check that could not complete, such as while the
+ * service is unavailable, is not a result: it leaves the number unvalidated
+ * and is never read as valid.
+ */
+type VatIdCheckOutcome = {
+    completed: true;
+    check: VatIdCheck;
+} | {
+    completed: false;
+    reason: string;
+};
+/**
+ * How an application binds a tax adapter, the way it binds a payment gateway:
+ * the adapter's name, which `config/saas.yaml#tax.adapter` names, and how to
+ * build it from the options the file gives it. The options come from the file,
+ * so the factory checks them and throws for one the adapter cannot take.
+ */
+interface TaxAdapterFactory {
+    /** The adapter's package name, such as `@saasicat/tax-de`. */
+    readonly adapterName: string;
+    create(options: Readonly<Record<string, unknown>>): TaxAdapter;
+}
+/**
+ * The tax adapter of an installation: a package for the country of its issuer,
+ * named in `config/saas.yaml`. An adapter is a template, not tax advice; its
+ * documentation says what it decides and on which basis.
+ */
+interface TaxAdapter extends TaxAdapterIdentity {
+    /** The treatment of a charge, or why the case is not supported. Decides only; writes nothing. */
+    decide(request: TaxDecisionRequest): TaxDecision;
+    /**
+     * Checks a VAT identification number with the service the adapter names.
+     * Resolves to an outcome whatever the service does: an error, a timeout and
+     * an answer the adapter cannot read are each a check that did not complete.
+     */
+    checkVatId(vatId: string, issuer: TaxIssuer): Promise<VatIdCheckOutcome>;
+}
+
+type ContractLineItemKind = 'plan' | 'bundle' | 'discount';
+type SubscriptionContractStatus = 'active' | 'scheduled' | 'terminated' | 'superseded';
+/**
+ * The statuses a contract is looked up under when asking "what is this tenant
+ * on right now" — `scheduled` included, because a contract that starts today
+ * and has not been switched to `active` yet is still the one in force at its
+ * own `effectiveFrom`.
+ *
+ * One list rather than one per adapter: the two adapters have to answer
+ * `findActiveByTenantId` the same way, and a status added here must not reach
+ * only whichever of them somebody remembered.
+ */
+/**
+ * How many bundle versions one price lookup may name.
+ *
+ * One number rather than two: the server validates against it and the client
+ * batches to stay inside it, and a client that learned the cap by receiving a
+ * 400 would fail silently — the lookup answers with an empty map, and every
+ * card falls back to a catalogue price the tenant may not be charged.
+ */
+declare const BUNDLE_PRICE_LOOKUP_LIMIT = 200;
+declare const ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES: readonly SubscriptionContractStatus[];
+interface ContractLineItemRecord {
+    id: string;
+    contractId: string;
+    kind: ContractLineItemKind;
+    sourceKey: string;
+    sourceVersionId: string | null;
+    titleSnapshot: string;
+    descriptionSnapshot: string | null;
+    quantity: number;
+    unit: string | null;
+    /**
+     * What the line costs over one of its billing periods, `quantity` already
+     * in it — not a unit price. A contract's totals take its lines as they
+     * stand, each counted as often as it falls due in one period of the
+     * contract, and are refused where they do not add up.
+     */
+    priceNet: number;
+    /** `priceNet` with the line's share of the tax its rhythm owes. */
+    priceGross: number;
+    billingCycle: 'monthly' | 'yearly';
     /**
      * ISO 4217, as the line was booked in.
      *
@@ -3488,6 +4550,14 @@ interface SubscriptionContractRecord extends SubscriptionContractParties {
      * never presented as what was agreed.
      */
     partiesMigrated: boolean;
+    /**
+     * The tax treatment the installation's tax adapter decided when the
+     * contract was concluded, with the adapter's name and version
+     * (`SC-PRIC-038`). `null` for a contract concluded without an adapter,
+     * before one existed, or by a path that does not ask one yet; each invoice
+     * then takes the adapter's answer when it is issued.
+     */
+    taxTreatment: TaxTreatment | null;
     status: SubscriptionContractStatus;
     effectiveFrom: Date;
     effectiveUntil: Date | null;
@@ -3534,8 +4604,19 @@ interface NewSubscriptionContractData extends CreateSubscriptionContractData {
      * means `false`.
      */
     partiesMigrated?: boolean;
+    /**
+     * The treatment the platform had the tax adapter decide, recorded as it
+     * was answered and never rewritten. Absent means `null`.
+     */
+    taxTreatment?: TaxTreatment | null;
 }
 interface TerminateSubscriptionContractData {
+    /**
+     * The tenant the caller read the contract under. The write matches it as
+     * well as the id, so an id that reaches the call by mistake cannot end
+     * another tenant's contract, whether or not a row policy would stop it.
+     */
+    tenantId: string;
     effectiveUntil: Date;
     /**
      * The terminal status, or `null` to end the contract by date alone.
@@ -3557,6 +4638,12 @@ interface TerminateSubscriptionContractData {
  * it is still as the caller read it.
  */
 interface SupersedeSubscriptionContractData {
+    /**
+     * The tenant the caller read the contract under. The write matches it as
+     * well as the id, so an id that reaches the call by mistake cannot end
+     * another tenant's contract, whether or not a row policy would stop it.
+     */
+    tenantId: string;
     /** When the successor takes over; written as the contract's `effectiveUntil`. */
     at: Date;
     /**
@@ -3630,16 +4717,115 @@ interface SubscriberContact extends PartyAddress {
     /** Where invoices will be sent. */
     invoiceEmail: string | null;
 }
+/**
+ * Whether the subscriber is a business: part of its tax origin beside the
+ * country and the VAT identification number (ADR 0013).
+ */
+interface SubscriberTaxStatus {
+    /**
+     * As sign-up or the operator recorded it; `null` while nobody has said.
+     * Never derived from a tax identifier: a business outside the European
+     * Union may have none, and is still a business.
+     */
+    business: boolean | null;
+}
+/**
+ * The address an invoice names. Sign-up asks for every one of them, and once
+ * given they can be changed but not cleared: without them nothing can be
+ * invoiced (`SC-PRIC-032`).
+ */
+declare const SUBSCRIBER_INVOICE_ADDRESS_FIELDS: readonly ["addressLine1", "postalCode", "city", "country"];
+type SubscriberInvoiceAddressField = (typeof SUBSCRIBER_INVOICE_ADDRESS_FIELDS)[number];
+/**
+ * Whether a subscriber can be given its next contract where a tax adapter
+ * decides (`SC-PRIC-032`, `SC-PRIC-039`): which fields of the address an
+ * invoice names are empty, and the adapter's sentence where it supports no
+ * treatment for the subscriber as it stands. Computed when it is read, from the
+ * record and the adapter as they are then.
+ */
+interface SubscriberReadiness {
+    ready: boolean;
+    missing: SubscriberInvoiceAddressField[];
+    /** The adapter's sentence, or `null` where it treats the subscriber. */
+    taxRefusal: string | null;
+}
+/**
+ * A tenant's subscriber as the operator sees it beside the tenant: who the
+ * contracts are concluded with, what a tax adapter decides from, and — where
+ * one decides — what holds its next contract back (`SC-PRIC-070`).
+ */
+interface AdminTenantSubscriber {
+    subscriber: {
+        id: string;
+        customerNumber: string;
+        legalName: string;
+        addressLine1: string | null;
+        addressLine2: string | null;
+        postalCode: string | null;
+        city: string | null;
+        country: string | null;
+        business: boolean | null;
+        vatId: string | null;
+        /** Whether the check that counts for the VAT id found it valid. */
+        vatIdValidated: boolean;
+        taxNumber: string | null;
+        /** Created from the application's own tenant record, not from what a customer entered. */
+        migrated: boolean;
+    } | null;
+    /** `null` where no tax adapter decides, or the tenant has no subscriber. */
+    readiness: SubscriberReadiness | null;
+}
+/**
+ * The manifest capability that announces the operator's view of a tenant's
+ * subscriber. The platform sets it where it serves the view.
+ */
+declare const SUBSCRIBER_STANDING_CAPABILITY = "subscribers.read";
+/**
+ * The manifest capability that says a tax adapter decides, so a subscriber can
+ * be held back from its next contract: the operator's lists ask which only
+ * where it is set, and are spared the question everywhere else.
+ */
+declare const SUBSCRIBER_ATTENTION_CAPABILITY = "subscribers.attention";
+/**
+ * How many tenants one question about attention may name: a page of a list,
+ * not the whole of it. A list longer than this asks in pages.
+ */
+declare const SUBSCRIBER_ATTENTION_PAGE_SIZE = 200;
+/**
+ * The manifest capability that announces the operator's corrections of a
+ * subscriber — its legal identity, its business status, a check of its VAT
+ * identification number — beside the subscriber's view.
+ */
+declare const SUBSCRIBER_CORRECTION_CAPABILITY = "subscribers.correct";
+/** A tenant whose subscriber cannot be given its next contract, and why. */
+interface AdminSubscriberAttention {
+    tenantId: string;
+    readiness: SubscriberReadiness;
+}
+/** A live subscriber with the check of its VAT id that counts now. */
+interface SubscriberWithCurrentCheck {
+    subscriber: SubscriberRecord;
+    currentVatIdCheck: SubscriberVatIdCheckRecord | null;
+}
 /** A subscriber's master data, as it stands. */
-type SubscriberDetails = LegalIdentity & SubscriberContact;
+type SubscriberDetails = LegalIdentity & SubscriberContact & SubscriberTaxStatus;
 /**
  * What a subscriber is created with.
  *
- * Only the legal name is required. The address, the tax identifiers and the
- * invoice email stay optional until sign-up asks for them and invoicing
- * requires them; an absent or blank value is recorded as unknown.
+ * Only the legal name is required. The address, the tax identifiers, the
+ * business status and the invoice email stay optional until sign-up asks for
+ * them and invoicing requires them; an absent or blank value is recorded as
+ * unknown.
  */
-type NewSubscriberDetails = Pick<SubscriberDetails, 'legalName'> & Partial<Omit<SubscriberDetails, 'legalName'>>;
+type NewSubscriberDetails = Pick<SubscriberDetails, 'legalName'> & Partial<Omit<SubscriberDetails, 'legalName'>> & {
+    /**
+     * A check of `vatId` made before the subscriber existed — in a
+     * sign-up's step 4, or by `SubscriberService.assessNewSubscriber` —
+     * recorded with it when it is created, so its first contract is
+     * decided from it. A check of another number is refused.
+     */
+    vatIdCheck?: VatIdCheck | null;
+};
 interface SubscriberRecord extends SubscriberDetails {
     id: string;
     /**
@@ -3693,13 +4879,15 @@ interface SubscriberIdentityDelta {
     previous: SubscriberIdentityValues;
     corrected: SubscriberIdentityValues;
 }
-/** What a repository writes for a correction the service has accepted. */
+/**
+ * What a repository writes for a correction the service has accepted. The
+ * repository dates it, while it holds the subscriber's row lock.
+ */
 interface SubscriberCorrectionData {
     /** The new values; a field equal to what is stored is not recorded. */
     corrected: SubscriberIdentityValues;
     reason: string;
     correctedBy: string;
-    correctedAt: Date;
 }
 /** One correction of a subscriber's legal identity, as it was recorded. */
 interface SubscriberCorrectionRecord {
@@ -3711,6 +4899,12 @@ interface SubscriberCorrectionRecord {
     corrected: SubscriberIdentityValues;
     reason: string;
     correctedBy: string;
+    /**
+     * When the write that made it held the subscriber's row lock, by the
+     * platform's clock. The list is in the order the database numbered the
+     * writes; on one clock these dates follow that order, while two instances
+     * whose clocks differ may date neighbouring corrections out of it.
+     */
     correctedAt: Date;
 }
 /** The outcome of writing a correction: nothing is recorded when no value moved. */
@@ -3718,11 +4912,147 @@ interface SubscriberCorrectionResult {
     subscriber: SubscriberRecord;
     correction: SubscriberCorrectionRecord | null;
 }
+/**
+ * The details a subscriber's tax origin consists of, and whose change is
+ * recorded with its date — in the order they are named and shown.
+ */
+declare const SUBSCRIBER_TAX_ORIGIN_FIELDS: readonly ["country", "business", "vatId"];
+type SubscriberTaxOriginField = (typeof SUBSCRIBER_TAX_ORIGIN_FIELDS)[number];
+/** Tax origin values by field, holding only the fields a change moved. */
+type SubscriberTaxOriginValues = Partial<Pick<SubscriberDetails, SubscriberTaxOriginField>>;
+/**
+ * One change of a subscriber's tax origin, as it was recorded: written in the
+ * same transaction as the change, whichever way it arrived — a contact change
+ * of the country, a correction of the VAT identification number, a change of
+ * the business status — and never rewritten. A change applies from the
+ * subscriber's next invoice (`SC-PRIC-043`).
+ */
+interface SubscriberTaxOriginChangeRecord {
+    id: string;
+    subscriberId: string;
+    /** The values the change replaced. */
+    previous: SubscriberTaxOriginValues;
+    /** The values it wrote. */
+    changed: SubscriberTaxOriginValues;
+    /** Who changed it, as an actor tag the audit log would write. */
+    changedBy: string;
+    /**
+     * When the write that made it held the subscriber's row lock, by the
+     * platform's clock. The list is in the order the database numbered the
+     * writes; on one clock these dates follow that order, while two instances
+     * whose clocks differ may date neighbouring changes out of it.
+     */
+    changedAt: Date;
+    /**
+     * Why it was changed: the reason of the correction or of the change of
+     * business status that made it; `null` for a change of the country, which
+     * comes with the contact details and states none.
+     */
+    reason: string | null;
+}
+/** What a repository writes for a change of the business status the service has accepted. */
+interface SubscriberBusinessStatusData {
+    business: boolean | null;
+    /** Who changes it, as an actor tag the audit log would write. */
+    changedBy: string;
+    /** Why, in the operator's words: whether it is a business decides the tax treatment. */
+    reason: string;
+}
+/** The outcome of writing a business status: nothing is recorded when it does not move. */
+interface SubscriberBusinessStatusResult {
+    subscriber: SubscriberRecord;
+    change: SubscriberTaxOriginChangeRecord | null;
+}
+/**
+ * One completed check of a subscriber's VAT identification number, as it was
+ * recorded: never rewritten, whether it counts now or not.
+ */
+interface SubscriberVatIdCheckRecord extends VatIdCheck {
+    id: string;
+    subscriberId: string;
+    /** When the check was recorded, by the platform's clock. */
+    recordedAt: Date;
+}
+/** The outcome of recording a check: the check as recorded, and the one that counts now. */
+interface RecordedVatIdCheck {
+    recorded: SubscriberVatIdCheckRecord;
+    /**
+     * The check that counts for the subscriber's number from now on: the one
+     * just recorded, one recorded earlier that completed later, or none — a
+     * check of a number the subscriber no longer has counts for nothing.
+     */
+    current: SubscriberVatIdCheckRecord | null;
+}
+/**
+ * What became of a check of a subscriber's VAT identification number: the
+ * check as it was recorded, and whether it counts for the number held — or why
+ * it did not complete, in which case nothing was recorded and the number stays
+ * as validated as it was (`SC-PRIC-040`).
+ */
+type SubscriberVatIdCheckResult = {
+    completed: true;
+    check: SubscriberVatIdCheckRecord;
+    counts: boolean;
+} | {
+    completed: false;
+    reason: string;
+};
+/** A check of a subscriber's VAT identification number, as the operator is shown it. */
+type AdminVatIdCheckOutcome = {
+    completed: true;
+    valid: boolean;
+    /** When the service answered, as an ISO string. */
+    checkedAt: string;
+    service: string;
+    /** Whether it is the check that counts for the number held now. */
+    counts: boolean;
+} | {
+    completed: false;
+    reason: string;
+};
+/**
+ * The answer to an operator's correction or check: the subscriber as it now
+ * stands, and the check a VAT identification number got, where one was made.
+ */
+interface AdminSubscriberCorrected {
+    subscriber: AdminTenantSubscriber;
+    vatIdCheck: AdminVatIdCheckOutcome | null;
+}
+/**
+ * One entry of a subscriber's history as the operator reads it, the latest
+ * first: a correction of its legal identity, a change of its country or
+ * business status, or a check of its VAT identification number. Dates are ISO
+ * strings.
+ */
+type AdminSubscriberHistoryEntry = {
+    kind: 'identity-corrected';
+    at: string;
+    by: string;
+    previous: SubscriberIdentityValues;
+    corrected: SubscriberIdentityValues;
+    reason: string;
+} | {
+    kind: 'tax-origin-changed';
+    at: string;
+    by: string;
+    previous: SubscriberTaxOriginValues;
+    changed: SubscriberTaxOriginValues;
+    /** `null` for a change of the country with the contact details. */
+    reason: string | null;
+} | {
+    kind: 'vat-id-checked';
+    at: string;
+    vatId: string;
+    valid: boolean;
+    service: string;
+    /** Whether it is the check that counts for the number held now. */
+    counts: boolean;
+};
 
 /**
- * What made the charge arise. activation: the first period of a subscription. renewal: a later period. planChange: what an immediate plan change adds. bundleBooking: the first, short period of an add-on. credit: a decision that reduces what is owed. correction: a counter-entry reversing an earlier charge, which is how the append-only journal answers a mistake.
+ * What made the charge arise. activation: the first period of a subscription. renewal: a later period. planChange: what an immediate plan change adds. bundleBooking: the first, short period of an add-on. bundleChange: what an add-on's switch to a dearer version adds for the rest of its period. credit: a decision that reduces what is owed. correction: a counter-entry reversing an earlier charge, which is how the append-only journal answers a mistake.
  */
-type SubscriberChargeOrigin = 'activation' | 'renewal' | 'planChange' | 'bundleBooking' | 'credit' | 'correction';
+type SubscriberChargeOrigin = 'activation' | 'renewal' | 'planChange' | 'bundleBooking' | 'bundleChange' | 'credit' | 'correction';
 /**
  * Which kind of contract line the charge realises.
  */
@@ -3854,10 +5184,7 @@ interface SubscriptionRecord {
     trialEntitlementPlan?: string | null;
     pendingPlan?: string | null;
     pendingEffectiveAt?: Date | null;
-    customLimits?: {
-        quotas?: Record<string, number>;
-        features?: string[];
-    } | null;
+    customLimits?: CustomLimits | null;
     planVersionId: string;
     planVersion: PlanVersionRecord;
     /**
@@ -3901,7 +5228,8 @@ interface SubscriptionRepository {
     findByTenantIdLocked(tenantId: string, tx: TransactionContext): Promise<SubscriptionRecord | null>;
     /**
      * Counts subscriptions that bind a specific PlanVersion — both
-     * via the active `planVersionId` and via the scheduled `pendingPlanVersionId`.
+     * via the active `planVersionId` and via the version a scheduled change will
+     * bind (`pendingChangeVersionId`).
      * Needed by the `PlanVersionsService` for the editability decision:
      * a published-but-future PlanVersion stays correctable only as long
      * as no booking references it.
@@ -3911,6 +5239,14 @@ interface SubscriptionRepository {
      * frozen (fail-closed). Implementation hint: count in a single
      * COUNT(*) over the subscription table with an OR over the two
      * FK columns — not in two separate queries, to avoid race conditions.
+     *
+     * Counts across every tenant. The platform calls it inside
+     * `RlsBypassPort`; an implementation on a tenant-scoped client has to see
+     * every tenant's rows there. Whether the frame lifts the policy for this
+     * query is up to the application's bypass and the database layer behind it
+     * — one that lifts only reads such as `find*` leaves a `count` filtered, and
+     * then the implementation lifts the policy itself. A subscriber hidden from
+     * the count counts as nobody, which opens the version for editing.
      */
     countByPlanVersionId?(planVersionId: string): Promise<number>;
     /**
@@ -3930,6 +5266,9 @@ interface SubscriptionRepository {
      *
      * Optional — if not implemented, the service defensively treats the
      * version as frozen (fail-closed).
+     *
+     * Counts across every tenant, inside `RlsBypassPort`, and has to see every
+     * tenant's rows there, as `countByPlanVersionId` does.
      */
     countByBundleVersionId?(bundleVersionId: string): Promise<number>;
     /**
@@ -3940,8 +5279,9 @@ interface SubscriptionRepository {
      * (subscriptions on superseded versions are included).
      *
      * Returns a map `planKey → count`; plans without an active subscription
-     * are missing (UI defaults to 0). Platform-wide count across all tenants →
-     * adapters must count RLS-exempt.
+     * are missing (UI defaults to 0). Platform-wide count across all tenants:
+     * the platform calls it inside `RlsBypassPort`, and an implementation has to
+     * see every tenant's rows there, as for `countByPlanVersionId`.
      *
      * Optional — if not implemented, the tenant column stays 0.
      */
@@ -3988,6 +5328,59 @@ interface SubscriptionBundleRepository {
      * implementations to avoid drift.
      */
     countActiveByBundleVersionId(bundleVersionId: string, asOf?: Date): Promise<number>;
+    /**
+     * Every booking of the add-on version `bundleVersionId`, in every tenant,
+     * whatever its state. The platform reads it to find the bookings an add-on
+     * retirement reaches, inside the RLS bypass, and decides itself which of
+     * them are still running.
+     *
+     * Optional, so a repository written before it keeps working; retiring an
+     * add-on version over one without it is refused at start-up.
+     */
+    listOfVersion?(bundleVersionId: string): Promise<SubscriptionBundleRecord[]>;
+    /**
+     * Moves the booking `subscriptionBundleId` from the add-on version `from`
+     * onto `to` and answers it as it now stands, or null where it is not on
+     * `from` any more, or gone. Nothing else changes: its period, its terms,
+     * its rhythm and its cancellation stay as they are. Conditional on `from`,
+     * so a move and the put-back of a move that could not write its contract
+     * never write over each other, nor two runs over one booking.
+     *
+     * An add-on retirement moves a booking at its date, and a subscriber by
+     * taking a newer version offered (`SC-BUN-058`). Optional, so a repository
+     * written before it keeps working; retiring an add-on version over one
+     * without it is refused at start-up, and no newer version is offered.
+     */
+    moveToVersion?(subscriptionBundleId: string, from: string, to: string): Promise<SubscriptionBundleRecord | null>;
+    /**
+     * Schedules the booking `subscriptionBundleId` to continue on the add-on
+     * version `to` from `effectiveAt` — `pendingBundleVersionId` and
+     * `pendingVersionEffectiveAt` — and answers it as it now stands, or null
+     * where it is not on `from` any more, already has a switch scheduled, or is
+     * gone. Nothing else changes, its version included: the switch is made at
+     * that moment by the run (`listScheduledVersionsDue`).
+     *
+     * Optional, and so are the two methods after it: without all three, a
+     * newer version that takes something away is not offered.
+     */
+    scheduleVersion?(subscriptionBundleId: string, switchTo: {
+        from: string;
+        to: string;
+        effectiveAt: Date;
+    }): Promise<SubscriptionBundleRecord | null>;
+    /**
+     * Clears the switch scheduled for the booking `subscriptionBundleId`, and
+     * answers it as it now stands; null where no switch to `to` is scheduled
+     * any more, or it is gone. Its version stays as it is.
+     */
+    unscheduleVersion?(subscriptionBundleId: string, to: string): Promise<SubscriptionBundleRecord | null>;
+    /**
+     * Every booking, in every tenant and whatever its state, with a switch
+     * scheduled to take effect at or before `asOf` — oldest first. The
+     * platform reads it inside the RLS bypass and decides itself which of
+     * them still move.
+     */
+    listScheduledVersionsDue?(asOf: Date): Promise<SubscriptionBundleRecord[]>;
 }
 /**
  * Append-only repository for V3 SubscriptionContracts. Contracts are the
@@ -4055,8 +5448,8 @@ interface SubscriptionContractRepository {
      *
      * Platform-wide: unlike every other read here it is anchored by no tenant,
      * no contract and no offer, and a start makes it before anything is served.
-     * An implementation on a tenant-scoped client must count RLS-exempt, as
-     * `countActiveByPlanKey` must — the platform wraps the call in
+     * An implementation on a tenant-scoped client counts inside the bypass
+     * frame, as `countActiveByPlanKey` does — the platform wraps the call in
      * `RlsBypassPort`, and one that answers with the caller's tenant scope
      * instead returns nothing at a boot, where there is no tenant. The
      * persistence contract runs with no policy forced, so it cannot catch that
@@ -4090,19 +5483,66 @@ interface SubscriberRepository {
     findById(subscriberId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
     /** The subscriber live for this tenant, or `null` when it has none. */
     findByTenantId(tenantId: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
-    /** Writes the members given and keeps the rest; `null` when no such subscriber exists. */
-    updateContact(subscriberId: string, change: SubscriberContactChange, tx?: TransactionContext): Promise<SubscriberRecord | null>;
+    /**
+     * Writes the members given and keeps the rest; `null` when no such
+     * subscriber exists. Read and written under the lock a correction takes. A
+     * change of the country is a change of the tax origin and is recorded as
+     * one in the same step, by `changedBy` and dated while the lock is held.
+     */
+    updateContact(subscriberId: string, change: SubscriberContactChange, changedBy: string, tx?: TransactionContext): Promise<SubscriberRecord | null>;
     /**
      * Writes a correction of the legal identity and records it, in one step:
      * the subscriber is read and changed under a lock, so the values recorded
      * as replaced are the ones this write replaced even when two corrections
-     * arrive at once. A field whose stored value already equals the corrected
-     * one is left out of the record, and when none differs nothing is written
-     * and `correction` is `null`. `null` when no such subscriber exists.
+     * arrive at once. The correction is dated while the lock is held and
+     * numbered by the database as it is written. A field whose stored value
+     * already equals the corrected one is left out of the record, and when none
+     * differs nothing is written and `correction` is `null`. `null` when no
+     * such subscriber exists.
+     *
+     * A corrected VAT identification number is a change of the tax origin and
+     * is recorded as one too, by the same actor and with the same date.
+     * The check that counted for the number it replaced counts no more — it
+     * would otherwise validate that number again should it come back — and
+     * stays recorded (`listVatIdChecks`); the number written is held from that
+     * date (`vatIdSince`), so no check completed before it counts for it.
      */
     correctIdentity(subscriberId: string, data: SubscriberCorrectionData, tx?: TransactionContext): Promise<SubscriberCorrectionResult | null>;
-    /** Every correction of this subscriber, the latest first. */
+    /** Every correction of this subscriber, the latest written first. */
     listCorrections(subscriberId: string): Promise<SubscriberCorrectionRecord[]>;
+    /**
+     * Writes whether the subscriber is a business and records the change of
+     * its tax origin, in one step and under the same lock as a correction,
+     * dated while the lock is held. When the stored status already equals the
+     * one given nothing is written and `change` is `null`. `null` when no such
+     * subscriber exists.
+     */
+    changeBusinessStatus(subscriberId: string, data: SubscriberBusinessStatusData, tx?: TransactionContext): Promise<SubscriberBusinessStatusResult | null>;
+    /**
+     * Records a completed check of the subscriber's VAT identification number.
+     * Every check is recorded and none is rewritten or removed: it is the
+     * evidence a reverse charge rests on. Under the lock a correction takes it
+     * then decides whether the check counts from now on — only for the number
+     * the subscriber holds, completed since it holds it, and never over a check
+     * that completed later (`keepsVatIdCheck` from `@saasicat/core` decides).
+     * `null` when no such subscriber exists.
+     */
+    recordVatIdCheck(subscriberId: string, check: VatIdCheck, tx?: TransactionContext): Promise<RecordedVatIdCheck | null>;
+    /**
+     * The check that counts for the subscriber's number now, or `null` while
+     * none does: never checked, or corrected since.
+     */
+    findCurrentVatIdCheck(subscriberId: string, tx?: TransactionContext): Promise<SubscriberVatIdCheckRecord | null>;
+    /** Every check recorded for this subscriber, counting or not, the latest checked first. */
+    listVatIdChecks(subscriberId: string): Promise<SubscriberVatIdCheckRecord[]>;
+    /**
+     * The live subscribers of these tenants, each with the check of its VAT id
+     * that counts now, in at most a few reads — what the operator's lists mark
+     * a subscriber from. A tenant without a live subscriber is left out.
+     */
+    listForTenants(tenantIds: readonly string[], tx?: TransactionContext): Promise<SubscriberWithCurrentCheck[]>;
+    /** Every recorded change of this subscriber's tax origin, the latest written first. */
+    listTaxOriginChanges(subscriberId: string): Promise<SubscriberTaxOriginChangeRecord[]>;
 }
 /**
  * The subscriber's account: the charges that became due, one per contract line
@@ -4133,7 +5573,7 @@ interface SubscriberLedgerRepository {
  *
  * The platform controller `GET /billing/usage` maps this form 1:1 into the
  * response body. The consumer adapter loads from its own subscription
- * table (Prisma include planVersion + pendingPlanVersion).
+ * table (Prisma include planVersion).
  */
 interface SubscriptionUsageRecord {
     /**
@@ -4192,6 +5632,17 @@ interface SubscriptionUsageRecord {
     pendingPlan: string | null;
     pendingBillingCycle: string | null;
     pendingEffectiveAt: Date | null;
+    /**
+     * The version a scheduled change binds when it lands, where it names one —
+     * a newer version taken for the end of the term, or the version a change
+     * to another plan was quoted at. Read where it matters whether the
+     * subscription stays on its version: a change on the same plan in the same
+     * rhythm is otherwise indistinguishable from staying put.
+     *
+     * Optional, because an adapter written before it does not pass it through;
+     * both shipped adapters do.
+     */
+    pendingChangeVersionId?: string | null;
     planVersion: {
         id: string;
         planId: string;
@@ -4200,18 +5651,6 @@ interface SubscriptionUsageRecord {
         supersededAt: Date | null;
         changeNote: string | null;
     };
-    pendingPlanVersion: {
-        id: string;
-        planId: string;
-        version: number;
-        nonRegressive: boolean;
-        changeNote: string | null;
-        /** Catalog diff form from version-publish; free-form JSON structure. */
-        publishedChanges: unknown;
-    } | null;
-    pendingPlanVersionEffectiveAt: Date | null;
-    pendingPlanVersionAccepted: boolean;
-    pendingPlanVersionAcceptedAt: Date | null;
     /**
      * P11.4: frozen package snapshot from the
      * `CheckoutOffer` that was activated during onboarding. Read-only —
@@ -4232,8 +5671,44 @@ interface SubscriptionUsageRecord {
  * Read adapter for the UI/display form of a subscription. Used by
  * `TenantBillingController.getUsage`.
  */
+/** A subscription read across tenants, with the tenant it belongs to. */
+interface TenantSubscriptionUsage {
+    readonly tenantId: string;
+    readonly subscription: SubscriptionUsageRecord & {
+        readonly id: string;
+    };
+}
 interface SubscriptionUsagePort {
     findForTenant(tenantId: string): Promise<SubscriptionUsageRecord | null>;
+    /**
+     * Every subscription of `planKey`, in every tenant, bound to a version of
+     * that plan numbered below `version`. The platform reads it to find the
+     * subscriptions a newer version is offered to, inside the RLS bypass.
+     *
+     * Optional, so a port written before it keeps working; an application that
+     * turns version notices on over a port without it is refused at start-up.
+     */
+    listBoundToEarlierVersions?(planKey: string, version: number): Promise<TenantSubscriptionUsage[]>;
+    /**
+     * Every subscription, in every tenant, bound to the plan version
+     * `planVersionId`, whatever its status. The platform reads it to find the
+     * subscriptions a retirement reaches, inside the RLS bypass, and decides
+     * itself which of them are still running.
+     *
+     * Optional, so a port written before it keeps working; a retirement over a
+     * port without it is refused at start-up.
+     */
+    listBoundToVersion?(planVersionId: string): Promise<TenantSubscriptionUsage[]>;
+    /**
+     * The subscriptions `subscriptionIds`, in whichever tenant, each with the
+     * tenant it belongs to; an id that names none is left out. The platform
+     * reads it inside the RLS bypass to find the subscription of each booking
+     * an add-on retirement reaches.
+     *
+     * Optional, so a port written before it keeps working; retiring an add-on
+     * version over a port without it is refused at start-up.
+     */
+    listByIds?(subscriptionIds: readonly string[]): Promise<TenantSubscriptionUsage[]>;
 }
 /**
  * Returns the current usage for all quotaKeys of a tenant declared via
@@ -4279,14 +5754,98 @@ interface ImmediatePlanChangeInput {
      * no cancellation, and loses against one that has acquired one.
      */
     expectedCanceledAt: Date | null;
+    /**
+     * Whether a change that leaves the plan as it is keeps the plan version
+     * the subscription is bound to.
+     *
+     * A scheduled change that only moves the rhythm passes `true`: the
+     * subscriber agreed to the version they are on, and moving them to a newer
+     * one is theirs to decide, by taking it when it is offered. A sale passes
+     * `false` — a change of plan, or onboarding, where the customer chose at
+     * the version in effect — and the write binds the version of `planId` in effect at
+     * `periodStart`. Where `planId` is another plan than the one bound, the
+     * version in effect is bound either way, and so it is where the
+     * subscription is bound to no version at all: it has none to keep.
+     */
+    keepsBoundVersion: boolean;
+    /**
+     * The version of `planId` the change was quoted at: a scheduled change to
+     * another plan passes the version its preview showed when it was
+     * scheduled, recorded as `pendingChangeVersionId`. The write binds it
+     * rather than the version in effect, so a version published in between
+     * does not reach the customer by a change they already agreed to. `null`
+     * binds the version in effect — a sale, onboarding, and a change quoted
+     * where no repository reads versions. A version kept by
+     * `keepsBoundVersion` wins over it.
+     */
+    quotedPlanVersionId: string | null;
+    /**
+     * `true`: bind `quotedPlanVersionId` or nothing. Where that version no
+     * longer takes bookings by `periodStart` (or now), the write claims nothing
+     * and answers `claimed: false`, rather than binding the version in effect.
+     * A switch to a version offered passes it: the subscriber agreed to that
+     * version, and what the switch answers and records names it. Left out, a
+     * version that stopped taking bookings gives way to the one in effect.
+     */
+    quotedVersionOnly?: boolean;
+    /**
+     * The version the caller read the subscription bound to, where its
+     * decision rests on it: the write claims the row only while that binding
+     * still holds. A switch to a version offered passes it — it writes back the
+     * plan it read, and a change made in between would otherwise be undone.
+     * `null` claims a row bound to no version. Left out, the binding is not
+     * claimed — and a write that binds no version (`bindsPlanVersion: false`)
+     * has none to claim.
+     */
+    expectedPlanVersionId?: string | null;
+    /**
+     * `true`: the change the subscription has scheduled survives the write. A
+     * retirement's move passes it — the change is the subscriber's own, and the
+     * move is not. One that only moves the rhythm on the plan being left follows
+     * the subscription to `planId` (`scheduledChangeAfterWrite`). The write then
+     * claims the row only while the scheduled change is still the one it read.
+     * Left out, the write clears it: a change the subscriber makes replaces the
+     * one they scheduled before.
+     */
+    keepsPendingChange?: boolean;
+    /**
+     * `true`: the write puts back a binding the subscription held a moment
+     * before, so `quotedPlanVersionId` counts whether or not it still takes
+     * bookings — it has to be a version of `planId`, nothing more. A
+     * retirement's move or switch passes it to bind the subscription back to
+     * the version retired, where the contract that has to come with the move
+     * could not be written: that version is off sale, often by its own end, and
+     * undoing a move is not a booking (`SC-PLAN-016` asks only of one). Left
+     * out, a version that no longer takes bookings is not bound.
+     */
+    restoresQuotedVersion?: boolean;
 }
 /** Input for `schedulePlanChange` (change at period end). */
 interface ScheduledPlanChangeInput {
     pendingPlan: string;
     pendingBillingCycle: string;
     pendingEffectiveAt: Date;
+    /**
+     * The version of `pendingPlan` the preview quoted, where the change does
+     * not keep the version bound — a change to another plan, or one on a
+     * subscription bound to none; stored as `pendingChangeVersionId` and bound
+     * when the change comes due. `null` where the plan stays on a bound
+     * version — the version bound then is kept, whatever it is by that day — or
+     * where no repository reads versions.
+     */
+    pendingChangeVersionId: string | null;
     /** See `ImmediatePlanChangeInput.expectedCanceledAt`. */
     expectedCanceledAt: Date | null;
+    /** See `ImmediatePlanChangeInput.expectedPlanVersionId`. */
+    expectedPlanVersionId?: string | null;
+    /**
+     * The change the caller read as scheduled, where its decision rests on it —
+     * `null` for nothing scheduled. The write claims the row only while that
+     * still holds. A switch to a version offered passes `null`: an offer is
+     * made only while nothing is scheduled, and a change scheduled in between
+     * would otherwise be written over. Left out, it is not claimed.
+     */
+    expectedPendingPlan?: string | null;
 }
 /**
  * Input for `applyOnboardingSelection`. Plan-change fields that the
@@ -4381,24 +5940,17 @@ interface TenantSubscriptionWritePort {
     changePlanImmediate(tenantId: string, input: ImmediatePlanChangeInput): Promise<{
         plan: string;
         billingCycle: string;
-        /** False when the row's cancellation moved since the caller read it. */
+        /**
+         * False when what the caller claimed moved since it read it — the
+         * cancellation, and the binding where it passed one — or when the
+         * version it required no longer takes bookings.
+         */
         claimed: boolean;
     }>;
     /** Change at period end: set pending fields. */
     schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<{
         claimed: boolean;
     }>;
-    /**
-     * Marks the pending PlanVersion as accepted. Idempotent — a duplicate
-     * accept is a no-op. Returns `alreadyAccepted: true` if the status was
-     * already set.
-     */
-    acceptPendingPlanVersion(tenantId: string, userId: string, now: Date): Promise<{
-        accepted: boolean;
-        acceptedAt: Date | null;
-        effectiveAt: Date | null;
-        alreadyAccepted: boolean;
-    }>;
     /**
      * Record a cancellation. The dates are decided above this port.
      *
@@ -4440,30 +5992,22 @@ interface TenantSubscriptionWritePort {
 /** Read adapter for PlanVersions. */
 interface PlanVersionRepository {
     /**
-     * Currently published (= live) PlanVersion of a plan:
-     * `publishedAt IS NOT NULL AND supersededAt IS NULL`. Optionally within a
-     * transaction.
-     *
-     * Note: ignores `validFrom`/`validUntil`. For time-aware
-     * resolution (onboarding, plan fallback for TRIAL) use `findActive`.
-     *
-     * A plan key no plan has finds `null`, not an error.
-     */
-    findLatestLive(planId: string, tx?: TransactionContext): Promise<PlanVersionRecord | null>;
-    /**
-     * PlanVersion of a plan active at `asOf`:
+     * The version of a plan on sale at `asOf` — what a booking made then
+     * binds — by the same rule as `PlanRepository.findActivePlanVersion`:
      *   `publishedAt IS NOT NULL`
      *   `(validFrom IS NULL OR validFrom <= asOf)`
      *   `(validUntil IS NULL OR validUntil >= startOfUtcDay(asOf))`
+     *   `(endsAt IS NULL OR endsAt > asOf)`
      *
      * `validUntil` is day-inclusive. If multiple versions match, adapters
-     * return the highest `validFrom`, explicitly ordering null start dates
-     * last as a legacy fallback. Adapters without validity columns may omit
-     * the method (consumers fall back to `findLatestLive`).
+     * return the highest `validFrom`, ordering null start dates last, then the
+     * highest version. Adapters build the WHERE with
+     * `buildActivePlanVersionWhere(asOf, { withEndsAt: true })`. Optionally
+     * within a transaction.
      *
      * A plan key no plan has finds `null`, not an error.
      */
-    findActive?(planId: string, asOf?: Date, tx?: TransactionContext): Promise<PlanVersionRecord | null>;
+    findActive(planId: string, asOf?: Date, tx?: TransactionContext): Promise<PlanVersionRecord | null>;
 }
 
 /** Aggregate snapshot of subscriptions, orchestrated by `AdminStatsService`. */
@@ -4482,6 +6026,11 @@ interface SubscriptionStatsSnapshot {
 /**
  * Stats adapter for subscriptions. Consumers implement this based on their
  * Prisma `subscription.groupBy(...)` / `count(...)` calls.
+ *
+ * The figures span every tenant: the platform reads them, together with the
+ * promo code and audit figures, inside `RlsBypassPort`, and an implementation
+ * has to see every tenant's rows there — as for
+ * `SubscriptionRepository.countByPlanVersionId`.
  */
 interface SubscriptionStatsPort {
     getStats(): Promise<SubscriptionStatsSnapshot>;
@@ -4528,6 +6077,19 @@ interface AdminActor {
     source: 'web' | 'cli';
     context: string;
 }
+/**
+ * A platform job acting on its own schedule — no person behind it, so no user:
+ * the canonical `audit_logs.userId` is nullable for exactly this. `context`
+ * names the job, and the actor tag reads `job:platform:<job>`.
+ */
+interface PlatformJobActor {
+    userId: null;
+    email: 'platform';
+    source: 'job';
+    context: string;
+}
+/** Whoever an audit entry names: a person, from the web or the CLI, or a platform job. */
+type AuditActor = AdminActor | PlatformJobActor;
 /**
  * Audit adapter: platform services write to the audit log through this
  * interface. The consumer implementation persists the records (e.g.
@@ -4539,7 +6101,7 @@ interface AdminActor {
  */
 interface AuditPort {
     write(input: {
-        actor: AdminActor;
+        actor: AuditActor;
         entity: string;
         entityId: string;
         action: string;
@@ -4620,7 +6182,9 @@ interface AdminUserListRow {
 }
 interface AdminSubscriptionListRow {
     id: string;
+    /** The tenant by its id too: what the operator's lists ask a subscriber's standing by. */
     tenant: {
+        id: string;
         slug: string;
         name: string;
     };
@@ -4682,6 +6246,14 @@ interface ManifestAccessPort {
  * good at boot as it is in a request.
  */
 interface RlsBypassPort {
+    /**
+     * Runs `fn` with the policy lifted. Where the installation keeps more than
+     * the flag in the frame — the user, the tenant, an audit actor — the bypass
+     * frame carries it over rather than replacing it: an operator's route runs
+     * inside it, and what the request's own frame held is still read there.
+     * `store.run({ ...store.getStore(), bypassRls: true }, fn)` rather than
+     * `store.run({ bypassRls: true }, fn)`.
+     */
     runWithBypass<T>(fn: () => Promise<T>): Promise<T>;
 }
 
@@ -4742,37 +6314,41 @@ interface PlanRepository {
     findVersionById?(versionId: string): Promise<PlanVersionRow | null>;
     findCurrentDraft?(planKey: string): Promise<PlanVersionRow | null>;
     /**
-     * Currently published (= live) PlanVersion of a plan:
+     * The newest published version of a plan:
      * `publishedAt IS NOT NULL AND supersededAt IS NULL`.
      *
-     * Note: returns the *newest* published version by
-     * `version` number and ignores `validFrom`/`validUntil`. For
-     * time-aware reads (onboarding, marketing catalog, entitlement
-     * fallback) use `findActivePlanVersion(planKey, asOf)`, which returns
-     * the version *active at a point in time*.
+     * The version a publish chains to, not the version on sale: a successor
+     * published today with a start next month is the newest at once, and its
+     * predecessor goes on selling until then. What is on sale — for a booking,
+     * a price, a catalogue, an offer — is `findActivePlanVersion`.
      */
     findLatestLivePlanVersion?(planKey: string, tx?: TransactionContext): Promise<PlanVersionRow | null>;
     /**
-     * PlanVersion of a plan active at `asOf` ( extended):
+     * The version of a plan on sale at `asOf` — the one a booking made then
+     * binds:
      *   `publishedAt IS NOT NULL`
      *   `(validFrom IS NULL OR validFrom <= asOf)`
      *   `(validUntil IS NULL OR validUntil >= startOfUtcDay(asOf))`  — day-inclusive
+     *   `(endsAt IS NULL OR endsAt > asOf)`
      *
-     * `validFrom IS NULL` is treated like "valid since forever" so that legacy data
-     * without a start date (published before the §4.2 publish requirement) does not
-     * fall out of the catalog. `validUntil` is day-inclusive (calendar day): the version
-     * is valid until the end of its validUntil day, not just until midnight.
-     * Adapters build the WHERE via `buildActivePlanVersionWhere`.
+     * `validFrom IS NULL` is treated like "valid since forever" so that a
+     * version published without a start date does not fall out of the
+     * catalogue. `validUntil` is day-inclusive (calendar day): the version is
+     * valid until the end of its validUntil day, not just until midnight.
+     * Adapters build the WHERE via
+     * `buildActivePlanVersionWhere(asOf, { withEndsAt: true })`.
      *
      * If multiple match: the one with the highest `validFrom` (= the
-     * "last active"). Adapters must request `NULLS LAST` explicitly so a
-     * null start date remains a genuine fallback. Default `asOf` is the call
-     * time.
+     * "last active"), then the highest version. Adapters must request
+     * `NULLS LAST` explicitly so a null start date remains a genuine fallback.
+     * Default `asOf` is the call time.
      *
-     * Usage: everything that concerns *new* bookings/plan changes
-     * (onboarding, public marketing, entitlement fallback on TRIAL).
-     * Existing subscriptions stay on their bound `planVersionId`
-     * (P1 contract protection).
+     * Every read of what is on sale goes through this — the catalogue, the
+     * plan-change preview, checkout, the public marketing catalogue, every
+     * booking and the offer to existing subscriptions — so all of them name
+     * the same version at the same moment. Existing subscriptions stay on
+     * their bound `planVersionId`. A repository that reads versions and
+     * leaves this out is refused at start-up.
      */
     findActivePlanVersion?(planKey: string, asOf?: Date, tx?: TransactionContext): Promise<PlanVersionRow | null>;
     /**
@@ -4870,27 +6446,30 @@ interface BundleRepository {
     findVersionById(versionId: string, tx?: TransactionContext): Promise<BundleVersionRow | null>;
     findCurrentDraft(bundleId: string): Promise<BundleVersionRow | null>;
     /**
-     * Currently published (= live) BundleVersion of a bundle:
+     * The newest published BundleVersion of a bundle:
      * `publishedAt IS NOT NULL AND supersededAt IS NULL`.
      *
-     * This deliberately ignores `validFrom`/`validUntil`. For new bookings
-     * and other time-aware catalog reads use `findActiveBundleVersion`.
+     * The version a publish chains to, not the version on sale: a successor
+     * published today with a start next month is the newest at once, and its
+     * predecessor goes on selling until then. What is on sale — for a booking,
+     * a catalogue, an upsell — is `findActiveBundleVersion`.
      */
     findLatestLive(bundleId: string, tx?: TransactionContext): Promise<BundleVersionRow | null>;
     /**
-     * BundleVersion active at `asOf`:
+     * The BundleVersion on sale at `asOf` — the one a booking made then may
+     * take:
      *   `publishedAt IS NOT NULL`
      *   `(validFrom IS NULL OR validFrom <= asOf)`
      *   `(validUntil IS NULL OR validUntil >= startOfUtcDay(asOf))`
+     *   `(supersededAt IS NULL OR validUntil IS NOT NULL)`
      *
-     * Both boundaries are inclusive. If multiple versions match, adapters
-     * return the highest `validFrom`, then the highest `version`; a null
-     * `validFrom` is a legacy fallback. Default `asOf` is the call time.
-     *
-     * Optional so adapters backed by legacy schemas without validity columns
-     * can omit the capability and consumers can fall back explicitly.
+     * Both boundaries are inclusive, and a superseded version sells only
+     * within a last day it carries — the rule of `buildActiveVersionWhere`.
+     * If multiple versions match, adapters return the highest `validFrom`,
+     * then the highest `version`; a null `validFrom` sorts last. Default
+     * `asOf` is the call time.
      */
-    findActiveBundleVersion?(bundleId: string, asOf?: Date, tx?: TransactionContext): Promise<BundleVersionRow | null>;
+    findActiveBundleVersion(bundleId: string, asOf?: Date, tx?: TransactionContext): Promise<BundleVersionRow | null>;
     /**
      * Creates a new draft version (`publishedAt = null`). Throws if
      * a draft already exists (partial unique index violation).
@@ -5413,15 +6992,116 @@ interface MaintenanceWindowPort {
     update(id: string, stage: MaintenanceWindowStage, changes: MaintenanceWindowChanges): Promise<MaintenanceWindowRecord | null>;
 }
 /**
- * Hears when a window is announced, moved or cancelled, so the application can
- * write to its users. Optional: without it tenants learn of a window from the
- * banner alone.
- *
- * Called after the change is recorded, and never waited on by the operator: a
- * notification that fails is logged, and the window stands as recorded.
+ * Hears when a window is announced, moved or cancelled, so the application can
+ * write to its users. Optional: without it tenants learn of a window from the
+ * banner alone.
+ *
+ * Called after the change is recorded, and never waited on by the operator: a
+ * notification that fails is logged, and the window stands as recorded.
+ */
+interface MaintenanceNotificationPort {
+    windowChanged(event: MaintenanceWindowEvent): Promise<void>;
+}
+
+/** A notice to record before anybody is told: its key and what it says. */
+interface NoticeToRecord extends SubscriptionNoticeKey {
+    readonly content: unknown;
+}
+/**
+ * Keeps the record of every notice sent to a subscriber: one per subscription,
+ * kind and subject, with when and to whom it went.
+ *
+ * Delivery takes three writes so that a notice is sent once even where several
+ * instances run the same job: a run claims the notice, the application sends
+ * it, and the run confirms it — or releases it where the sending failed, for the
+ * next run to try again. Each write is conditional on what the caller read; an
+ * adapter translates and does not decide.
+ */
+interface SubscriptionNoticeRepository {
+    /**
+     * Records the notice named by `key` where it is not recorded yet, and
+     * claims it for this run: where it is not delivered and no run holds it,
+     * or the run that holds it took it on before `staleBefore`. A claim stores
+     * `content` as what the notice says. Returns the notice as claimed, or null
+     * where it is delivered or another run holds a fresh claim — of two
+     * concurrent calls exactly one claims it.
+     */
+    claim(key: SubscriptionNoticeKey, content: unknown, now: Date, staleBefore: Date): Promise<SubscriptionNoticeRecord | null>;
+    /**
+     * Records the notice `id` as delivered, provided it is still held by the
+     * claim taken at `claimedAt` and not delivered. Returns false where it is
+     * not: the claim went stale and another run took the notice on.
+     */
+    confirm(id: string, claimedAt: Date, delivery: SubscriptionNoticeDelivery, now: Date): Promise<boolean>;
+    /**
+     * Lets go of the claim taken at `claimedAt`, so the next run tries again.
+     * Does nothing where the notice is delivered or held by another claim.
+     */
+    release(id: string, claimedAt: Date): Promise<void>;
+    /** The subscriptions a notice of `kind` about `subject` has been delivered to. */
+    listDeliveredSubscriptionIds(kind: SubscriptionNoticeKind, subject: string): Promise<string[]>;
+    /** Every notice of one subscription, the most recently recorded first. */
+    listForSubscription(subscriptionId: string): Promise<SubscriptionNoticeRecord[]>;
+    /**
+     * Records each notice where it is not recorded yet, unclaimed and not
+     * delivered — in the caller's transaction where one is given, so a notice
+     * exists exactly when what it tells of does. A notice already recorded
+     * under the same key is left as it is and not counted: the answer is how
+     * many were recorded now, so a caller can tell that another got there
+     * first — under a transaction running beside it as well.
+     */
+    record(notices: readonly NoticeToRecord[], now: Date, tx?: TransactionContext): Promise<number>;
+    /** Every notice of `kind` recorded at or after `since`, the most recent first. */
+    listOfKindSince(kind: SubscriptionNoticeKind, since: Date): Promise<SubscriptionNoticeRecord[]>;
+    /**
+     * The notices of `kind` that are not delivered and that no run holds — never
+     * claimed, released, or claimed before `staleBefore` — the oldest first.
+     */
+    listUndelivered(kind: SubscriptionNoticeKind, staleBefore: Date): Promise<SubscriptionNoticeRecord[]>;
+}
+/**
+ * Sends a notice to the administrators of the tenant it is for, in the
+ * application's words and through its channels. The platform decides when a
+ * notice is due; who the administrators are, what the message says and how it
+ * travels are the application's.
+ *
+ * Resolve with who it went to and how — the platform keeps that as the record.
+ * Throw where it could not be sent and should be tried again: the claim is
+ * released and the next run sends it. Resolving with no recipients records that
+ * nobody could be told, and the notice is not tried again — except a
+ * retirement's notice (`version-retired`, `bundle-version-retired`), which
+ * nobody was told of: it is tried again by every run until somebody is, and its
+ * date counts from then.
+ */
+interface SubscriptionNoticePort {
+    deliver(notice: SubscriptionNotice): Promise<SubscriptionNoticeDelivery>;
+}
+
+/**
+ * Keeps every add-on retirement announcement: which version, which
+ * replacement, when and by whom. What it means for each booking it reaches is
+ * kept beside it as a notice of kind `bundle-version-retired`, written in the
+ * same transaction.
+ */
+interface BundleVersionRetirementRepository {
+    /** Records an announcement, in the caller's transaction where one is given. */
+    create(data: NewBundleVersionRetirement, tx?: TransactionContext): Promise<BundleVersionRetirementRecord>;
+    /** Every announcement, the most recent first. */
+    list(): Promise<BundleVersionRetirementRecord[]>;
+    findById(id: string): Promise<BundleVersionRetirementRecord | null>;
+}
+
+/**
+ * Keeps every retirement announcement: which version, which replacement, when
+ * and by whom. What it means for each subscription it reaches is kept beside it
+ * as a notice of kind `version-retired`, written in the same transaction.
  */
-interface MaintenanceNotificationPort {
-    windowChanged(event: MaintenanceWindowEvent): Promise<void>;
+interface VersionRetirementRepository {
+    /** Records an announcement, in the caller's transaction where one is given. */
+    create(data: NewVersionRetirement, tx?: TransactionContext): Promise<VersionRetirementRecord>;
+    /** Every announcement, the most recent first. */
+    list(): Promise<VersionRetirementRecord[]>;
+    findById(id: string): Promise<VersionRetirementRecord | null>;
 }
 
 /** Class reference usable as a DI token (e.g. the consumer's `PrismaService`). */
@@ -5461,9 +7141,11 @@ interface PersistenceCapabilities {
      */
     pessimisticLocking: boolean;
     /**
-     * The adapter stack integrates with Postgres row-level security (the
-     * `RlsBypassPort` frame actually lifts RLS for SuperAdmin reads).
-     * Informational — RLS policies themselves remain consumer-owned.
+     * The adapter stack integrates with Postgres row-level security: the
+     * `RlsBypassPort` frame lifts the installation's policies for what the
+     * platform does across tenants, reads and writes alike. Informational —
+     * nothing in the platform reads it, and the policies themselves remain
+     * the installation's.
      */
     rowLevelSecurity: boolean;
     /** Advisory-lock support (`pg_advisory_*`). No platform path requires it today. */
@@ -5471,7 +7153,12 @@ interface PersistenceCapabilities {
 }
 /** Always-required slice: admin surface + transactions. */
 interface SaaSiCatPersistenceCore {
-    mfa: PersistenceProvider<MfaPort>;
+    /**
+     * Absent where the schema leaves the SuperAdmin MFA table out
+     * (`notAdopted: ['SuperAdminMfa']`); the application then passes its own
+     * `MfaPort` in `adapters`, and a start without one is refused.
+     */
+    mfa?: PersistenceProvider<MfaPort>;
     audit: PersistenceProvider<AuditPort>;
     rlsBypass: PersistenceProvider<RlsBypassPort>;
     transactionRunner: PersistenceProvider<TransactionRunner>;
@@ -5529,6 +7216,24 @@ interface SaaSiCatPersistenceTenantBilling {
     subscriptionUsagePort: PersistenceProvider<SubscriptionUsagePort>;
     subscriptionWritePort: PersistenceProvider<TenantSubscriptionWritePort>;
     usageSnapshotPort?: PersistenceProvider<UsageSnapshotPort>;
+    /**
+     * The record of what each subscriber was told (`tenantBilling.versionNotices`).
+     * Optional so an adapter written before it keeps working; an installation
+     * that turns notices on without one is refused at start-up.
+     */
+    subscriptionNotices?: PersistenceProvider<SubscriptionNoticeRepository>;
+    /**
+     * The record of every retirement announcement. Optional so an adapter
+     * written before it keeps working; an installation that lets an operator
+     * retire versions without one is refused at start-up.
+     */
+    versionRetirements?: PersistenceProvider<VersionRetirementRepository>;
+    /**
+     * The record of every add-on retirement announcement. Optional so an
+     * adapter written before it keeps working; without it, retiring an add-on
+     * version is off, and retiring a plan version is not affected.
+     */
+    bundleVersionRetirements?: PersistenceProvider<BundleVersionRetirementRepository>;
 }
 /**
  * The record of payment gateway callbacks and the payment methods they confirm
@@ -5643,10 +7348,41 @@ declare const CATALOG_ERROR_CODES: {
     readonly PLAN_TERMINATE_INVALID_DATE: "PLAN_TERMINATE_INVALID_DATE";
     readonly PLAN_TERMINATE_DATE_NOT_FUTURE: "PLAN_TERMINATE_DATE_NOT_FUTURE";
     readonly PLAN_TERMINATE_NOT_IMPLEMENTED: "PLAN_TERMINATE_NOT_IMPLEMENTED";
+    /**
+     * Subscriptions told of a retirement still move onto this version, and
+     * nothing moves onto a version that has ended. Carries the version, its
+     * plan key and the first day it may end: the day after the last move.
+     */
+    readonly PLAN_TERMINATE_BEFORE_RETIREMENT_MOVES: "PLAN_TERMINATE_BEFORE_RETIREMENT_MOVES";
+    /**
+     * Subscriptions told of a retirement are past their date and still to be
+     * moved onto this version — a move the platform could not make yet — so it
+     * cannot end until they have moved. Carries how many, the version and its
+     * plan key.
+     */
+    readonly PLAN_TERMINATE_WHILE_MOVES_OVERDUE: "PLAN_TERMINATE_WHILE_MOVES_OVERDUE";
+    /**
+     * Subscriptions on a retired version have not yet been told of their move
+     * onto this version — their notice has reached nobody, so their date is not
+     * set — and it cannot end until they have been. Carries how many, the
+     * version and its plan key.
+     */
+    readonly PLAN_TERMINATE_WHILE_NOTICES_UNDELIVERED: "PLAN_TERMINATE_WHILE_NOTICES_UNDELIVERED";
     readonly BUNDLE_VERSION_ALREADY_PUBLISHED: "BUNDLE_VERSION_ALREADY_PUBLISHED";
     readonly BUNDLE_VERSION_NOT_EDITABLE: "BUNDLE_VERSION_NOT_EDITABLE";
     readonly BUNDLE_VERSION_NOT_PUBLISHED: "BUNDLE_VERSION_NOT_PUBLISHED";
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
+    /**
+     * The bundle version is published, and its window has not opened: it goes
+     * on sale on `validFrom`, and until then its predecessor is the one sold.
+     */
+    readonly BUNDLE_VERSION_NOT_YET_ON_SALE: "BUNDLE_VERSION_NOT_YET_ON_SALE";
+    /**
+     * The add-on itself has been deleted from the catalogue. Deleting it leaves
+     * its versions' dates as they were, so the version asked for can still be
+     * inside its window; it is not on offer all the same.
+     */
+    readonly BUNDLE_DELETED: "BUNDLE_DELETED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
     readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
@@ -5664,6 +7400,13 @@ declare const CATALOG_ERROR_CODES: {
     readonly PLAN_NOT_FOUND: "PLAN_NOT_FOUND";
     readonly PLAN_VERSION_NOT_FOUND: "PLAN_VERSION_NOT_FOUND";
     readonly BUNDLE_NOT_FOUND: "BUNDLE_NOT_FOUND";
+    /**
+     * Bookings told that their add-on version is being retired have still to
+     * move onto a version of this add-on — waiting for their notice, for their
+     * date, or past it — and a deleted add-on is booked by nothing, the move
+     * included. Carries how many, and the add-on's key.
+     */
+    readonly BUNDLE_DELETE_WHILE_RETIREMENT_MOVES_PENDING: "BUNDLE_DELETE_WHILE_RETIREMENT_MOVES_PENDING";
     readonly BUNDLE_VERSION_NOT_FOUND: "BUNDLE_VERSION_NOT_FOUND";
     readonly FEATURE_NOT_FOUND: "FEATURE_NOT_FOUND";
     readonly QUOTA_NOT_FOUND: "QUOTA_NOT_FOUND";
@@ -5703,6 +7446,22 @@ declare const BILLING_ERROR_CODES: {
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
     readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
     readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
+    /**
+     * The bundle cannot run on a plan the subscription is already set to move
+     * to — by a scheduled change, or by a retirement it has been told of — and
+     * the booking would still be running then: that plan does not book it, or
+     * has no price for it. Carries that plan's key, the rhythm it is billed in
+     * there, and the day the move takes effect from, which can lie in the past
+     * while the move has not run yet.
+     */
+    readonly BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN: "BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN";
+    /**
+     * As `BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN`, where only the rhythm stands in
+     * the way: a yearly bundle, and the subscription billed monthly from the
+     * day of the move — a switch of rhythm on the plan it keeps, for one, where
+     * naming the plan would point at the one it is already on. Same values.
+     */
+    readonly BUNDLE_CANNOT_RUN_ON_UPCOMING_CYCLE: "BUNDLE_CANNOT_RUN_ON_UPCOMING_CYCLE";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -5721,6 +7480,12 @@ declare const BILLING_ERROR_CODES: {
      * in it: a plan without a yearly price is a monthly plan.
      */
     readonly PLAN_NOT_SOLD_IN_CYCLE: "PLAN_NOT_SOLD_IN_CYCLE";
+    /**
+     * The subscription is bound to a plan version the plan repository does not
+     * find, or finds as a version of another plan. What the subscription pays
+     * cannot be read, so no change is quoted until the binding is repaired.
+     */
+    readonly BOUND_PLAN_VERSION_UNREADABLE: "BOUND_PLAN_VERSION_UNREADABLE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
     /**
@@ -5743,6 +7508,175 @@ declare const BILLING_ERROR_CODES: {
      * Carries the recomputed dates, so the page can re-ask instead of guessing.
      */
     readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /**
+     * The version the caller asked to switch to is no longer the one offered —
+     * another is on sale, the subscription moved, or there is no offer. Nothing
+     * was switched. Carries the current `offer`, or `null`, so the page can show
+     * it instead of guessing.
+     */
+    readonly VERSION_OFFER_CHANGED: "VERSION_OFFER_CHANGED";
+    /**
+     * The version a change to another plan named is not the one on sale when
+     * the change was submitted: its preview was shown at another moment.
+     * Nothing was changed. Carries the current `preview`, so the page shows
+     * what the change binds now instead of what it would have.
+     */
+    readonly PLAN_CHANGE_QUOTE_CHANGED: "PLAN_CHANGE_QUOTE_CHANGED";
+    /**
+     * A change to another plan named no version, where its preview names one:
+     * nothing says which price and terms the customer was shown, so nothing
+     * is changed.
+     */
+    readonly PLAN_CHANGE_VERSION_NOT_NAMED: "PLAN_CHANGE_VERSION_NOT_NAMED";
+    /**
+     * A version that takes something away takes effect when the term ends, and
+     * the subscription's cancellation lands no later: the switch would never
+     * happen, so it is refused rather than recorded. Carries both dates.
+     */
+    readonly VERSION_SWITCH_AFTER_CANCELLATION: "VERSION_SWITCH_AFTER_CANCELLATION";
+    /**
+     * A version that takes something away takes effect when the term ends, and
+     * it stops being sold before then — by its window or because an operator
+     * ended it — so it could not be bound when the change comes due. Refused
+     * rather than recorded; carries the dates.
+     */
+    readonly VERSION_ENDS_BEFORE_SWITCH: "VERSION_ENDS_BEFORE_SWITCH";
+    /**
+     * The operator's terms are not confirmed to carry the clause a retirement
+     * rests on (`tenantBilling.orderlyRetirement.termsConfirmed` in
+     * `config/saas.yaml`), so none is accepted.
+     */
+    readonly RETIREMENT_TERMS_NOT_CONFIRMED: "RETIREMENT_TERMS_NOT_CONFIRMED";
+    /**
+     * The version is still on sale: a subscription booked after the
+     * announcement would be on it without having been told. Carries the plan
+     * key and the version.
+     */
+    readonly RETIREMENT_VERSION_ON_SALE: "RETIREMENT_VERSION_ON_SALE";
+    /** The replacement is not on sale, so nobody can continue on it. Carries plan key and version. */
+    readonly RETIREMENT_REPLACEMENT_NOT_ON_SALE: "RETIREMENT_REPLACEMENT_NOT_ON_SALE";
+    /**
+     * The replacement has no price in the rhythm some of the subscriptions it
+     * reaches are billed in, so they cannot continue on it. Carries how many,
+     * and the replacement's plan key and version.
+     */
+    readonly RETIREMENT_REPLACEMENT_NOT_SOLD_IN_RHYTHM: "RETIREMENT_REPLACEMENT_NOT_SOLD_IN_RHYTHM";
+    /**
+     * Some of the subscriptions the retirement reaches hold an add-on that
+     * cannot run on the replacement's plan, so they cannot continue on it.
+     * Carries how many, and the replacement's plan key and version.
+     */
+    readonly RETIREMENT_REPLACEMENT_CANNOT_CARRY_BUNDLES: "RETIREMENT_REPLACEMENT_CANNOT_CARRY_BUNDLES";
+    /** The replacement named is the version being retired. */
+    readonly RETIREMENT_REPLACEMENT_IS_RETIRED: "RETIREMENT_REPLACEMENT_IS_RETIRED";
+    /** No running subscription is on the version: there is nobody to tell. Carries plan key and version. */
+    readonly RETIREMENT_NOTHING_AFFECTED: "RETIREMENT_NOTHING_AFFECTED";
+    /**
+     * Some of the subscriptions it reaches were reached by a retirement within
+     * the last twelve months, and a subscription is reached at most once in that
+     * time. Carries how many and which.
+     */
+    readonly RETIREMENT_WITHIN_TWELVE_MONTHS: "RETIREMENT_WITHIN_TWELVE_MONTHS";
+    /**
+     * The subscriptions the retirement reaches, or their dates, changed since
+     * the preview the operator confirmed. Carries the preview as it stands.
+     */
+    readonly RETIREMENT_PREVIEW_CHANGED: "RETIREMENT_PREVIEW_CHANGED";
+    /** No retirement of the subscription's version waits for its date: there is nothing to switch to. */
+    readonly RETIREMENT_SWITCH_NOT_PENDING: "RETIREMENT_SWITCH_NOT_PENDING";
+    /** The switch opens once the trial has converted: a trial has no contract to hold the price on. */
+    readonly RETIREMENT_SWITCH_IN_TRIAL: "RETIREMENT_SWITCH_IN_TRIAL";
+    /**
+     * An add-on running today cannot run beside the replacement's plan, which
+     * the switch would move the subscription onto today. Carries the add-on,
+     * the plan and the earliest day the booking can end. Its own code rather
+     * than a plan change's: the switch has no other plan to choose and no day
+     * to pick, so the way past it is the add-on ending.
+     */
+    readonly RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW: "RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW";
+    /**
+     * As `RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW`, where only the version the
+     * add-on continues on from a retirement's date cannot run beside the
+     * replacement's plan. The version it is on can, so cancelling it — it then
+     * ends before that date — lets the switch through. Given while that date
+     * is ahead and the add-on is not cancelled yet; otherwise the earlier code
+     * names the day it can end. Carries the add-on, that version, its date and
+     * the plan.
+     */
+    readonly RETIREMENT_SWITCH_BUNDLE_REPLACEMENT_CANNOT_FOLLOW: "RETIREMENT_SWITCH_BUNDLE_REPLACEMENT_CANNOT_FOLLOW";
+    /**
+     * The subscription takes no switch now: a change is scheduled, it has
+     * ended, or its plan is held for a special contract.
+     */
+    readonly RETIREMENT_SWITCH_NOT_OPEN: "RETIREMENT_SWITCH_NOT_OPEN";
+    /**
+     * The version named is not the replacement the retirement names. Carries
+     * the retirement as it now stands.
+     */
+    readonly RETIREMENT_SWITCH_CHANGED: "RETIREMENT_SWITCH_CHANGED";
+    /**
+     * The add-on version is still on sale: a booking made after the
+     * announcement would be on it without having been told. Carries the
+     * add-on key and the version.
+     */
+    readonly BUNDLE_RETIREMENT_VERSION_ON_SALE: "BUNDLE_RETIREMENT_VERSION_ON_SALE";
+    /** The replacement is not on sale, so no booking can continue on it. Carries add-on key and version. */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_NOT_ON_SALE: "BUNDLE_RETIREMENT_REPLACEMENT_NOT_ON_SALE";
+    /**
+     * The replacement is a version of another add-on. A booking continues on
+     * a version of its own add-on, so it stays the same booking with its term.
+     * Carries both add-on keys.
+     */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_OF_ANOTHER_BUNDLE: "BUNDLE_RETIREMENT_REPLACEMENT_OF_ANOTHER_BUNDLE";
+    /**
+     * Some of the bookings it reaches run, at their date, beside a plan the
+     * replacement cannot run beside: not allowed there, without a price there
+     * in the booking's rhythm, or in a longer rhythm than the plan's. Carries
+     * how many, and the replacement's add-on key and version.
+     */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_CANNOT_RUN: "BUNDLE_RETIREMENT_REPLACEMENT_CANNOT_RUN";
+    /** No running booking is on the version: there is nobody to tell. Carries add-on key and version. */
+    readonly BUNDLE_RETIREMENT_NOTHING_AFFECTED: "BUNDLE_RETIREMENT_NOTHING_AFFECTED";
+    /**
+     * The booking is on an add-on version being retired, and was cancelled to
+     * end before it would move, so it was never told and nothing moves it.
+     * Reinstated, it would run on past the date on a version nobody sells;
+     * booking the replacement once it has ended is the way. Carries the add-on
+     * key, the version, the replacement's version and the day it can be booked
+     * from.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_REFUSED: "BUNDLE_RETIREMENT_REINSTATE_REFUSED";
+    /**
+     * As `BUNDLE_RETIREMENT_REINSTATE_REFUSED`, where the replacement cannot
+     * run beside the plan the subscription is on when the booking ends, or
+     * beside one it is already set to move to after that, in any rhythm it
+     * could be booked in, so there is no version of the add-on to book.
+     * Carries the add-on key, the version and the replacement's version.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_REPLACEMENT_CANNOT_RUN: "BUNDLE_RETIREMENT_REINSTATE_REPLACEMENT_CANNOT_RUN";
+    /**
+     * As `BUNDLE_RETIREMENT_REINSTATE_REFUSED`, where the subscription ends by
+     * the day the replacement could be booked from, so there is no day to
+     * name. Carries the add-on key, the version and the replacement's version.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_SUBSCRIPTION_ENDS: "BUNDLE_RETIREMENT_REINSTATE_SUBSCRIPTION_ENDS";
+    /**
+     * The plan the add-on runs beside, or the rhythm it is billed in, changes
+     * before the date the booking was told — by a change scheduled, or by a
+     * retirement told that moves the subscription to another plan — so the
+     * price a switch now would hold is not the one the booking pays until
+     * then. Switching once the plan has changed, or waiting for the
+     * date, is the way. Carries the add-on and the date.
+     */
+    readonly BUNDLE_RETIREMENT_SWITCH_PLAN_CHANGES: "BUNDLE_RETIREMENT_SWITCH_PLAN_CHANGES";
+    /**
+     * The add-on version the caller asked to switch a booking to is no longer
+     * the one offered beside it — another is on sale, the booking moved, or
+     * there is no offer. Nothing was switched. Carries the version named
+     * (`bundleVersionId`) and the current `offer`, or `null`, so the page can
+     * show it instead of guessing.
+     */
+    readonly BUNDLE_VERSION_OFFER_CHANGED: "BUNDLE_VERSION_OFFER_CHANGED";
     /** The subscription has ended; its plan can no longer be changed. */
     readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
     /** An active special contract blocks self-service plan changes. */
@@ -5760,14 +7694,33 @@ declare const BILLING_ERROR_CODES: {
     readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
     /**
      * A bundle the tenant already holds runs past the cycle they are moving to.
+     * Carries the bundle, the earliest day the booking can end, and the two
+     * rhythms.
      *
      * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
      * same rule about a booking that has not been made yet. The two need
      * different sentences: this one can name the day the obstacle lifts and
-     * tell the reader to cancel the booking, and that advice is wrong for
-     * someone who is only about to book. One template cannot serve both.
+     * tell the reader how to get past it, and that advice is wrong for someone
+     * who is only about to book. One template cannot serve both.
      */
     readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * A bundle the tenant already holds cannot run on the plan they are moving
+     * to: that plan may not book it, or it has no price there in the rhythm
+     * the booking is billed in. Carries the bundle, the plan and the earliest
+     * day the booking can end.
+     */
+    readonly BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN: "BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN";
+    /**
+     * A bundle the tenant already holds can run on the plan they are moving
+     * to, but the version it continues on from a retirement's date cannot.
+     * Cancelling it lets the change through at once: the booking then ends
+     * before that date and never reaches the version. Given while that date is
+     * ahead and the booking is not cancelled yet; otherwise
+     * `BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN` names the day it can end.
+     * Carries the bundle, that version, its date and the plan.
+     */
+    readonly BUNDLE_REPLACEMENT_DOES_NOT_FIT_TARGET_PLAN: "BUNDLE_REPLACEMENT_DOES_NOT_FIT_TARGET_PLAN";
     /**
      * Features of the previewed bundle are already covered by the plan or by
      * another booked bundle. A warning rather than a blocker: paying twice is
@@ -5789,7 +7742,6 @@ declare const BILLING_ERROR_CODES: {
      * tenant reads and therefore needs a shipped text for.
      */
     readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
-    readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
     /**
@@ -5838,6 +7790,21 @@ declare const CONTRACT_ERROR_CODES: {
      * describes. Nothing was written; load the offer and conclude it again.
      */
     readonly CHECKOUT_OFFER_CHANGED: "CHECKOUT_OFFER_CHANGED";
+    /**
+     * An offer concludes a tenant's first contract, and this tenant has a
+     * contract in force at the moment the offer's would take effect, or one
+     * beginning after it. Concluded, the two would run side by side. Nothing
+     * was written; a running subscription changes through its plan and its
+     * add-ons. Carries the offer and the contract that runs.
+     */
+    readonly CHECKOUT_OFFER_CONTRACT_IN_FORCE: "CHECKOUT_OFFER_CONTRACT_IN_FORCE";
+    /**
+     * The offer names a version of an add-on the tenant has booked in another
+     * version. Concluded, the contract would name a version the booking is not
+     * on. Nothing was written; a booking changes its version through the offer
+     * beside it. Carries the offer, the add-on, the booking and both versions.
+     */
+    readonly CHECKOUT_OFFER_ADD_ON_BOOKED_IN_ANOTHER_VERSION: "CHECKOUT_OFFER_ADD_ON_BOOKED_IN_ANOTHER_VERSION";
     readonly SUBSCRIPTION_CONTRACT_NOT_FOUND: "SUBSCRIPTION_CONTRACT_NOT_FOUND";
     readonly NO_ACTIVE_SUBSCRIPTION_CONTRACT: "NO_ACTIVE_SUBSCRIPTION_CONTRACT";
     readonly SUBSCRIPTION_CONTRACT_ALREADY_CLOSED: "SUBSCRIPTION_CONTRACT_ALREADY_CLOSED";
@@ -5849,6 +7816,11 @@ declare const CONTRACT_ERROR_CODES: {
      * would take effect. Nothing was written.
      */
     readonly SUBSCRIPTION_CONTRACT_CHANGED: "SUBSCRIPTION_CONTRACT_CHANGED";
+    /**
+     * A contract states a tax rate — `field` names where — other than the one
+     * the installation's tax adapter decides for its subscriber.
+     */
+    readonly SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_DECIDED: "SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_DECIDED";
 };
 type ContractErrorCode = (typeof CONTRACT_ERROR_CODES)[keyof typeof CONTRACT_ERROR_CODES];
 /** The parties contracts are concluded with (`SubscriberService`), and their absence. */
@@ -5875,6 +7847,29 @@ declare const SUBSCRIBER_ERROR_CODES: {
     readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
     /** The operator declared another legal entity: that is a transfer, not an edit. */
     readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
+    /**
+     * A contact change named whether the subscriber is a business. That is part
+     * of its tax origin and changes as a recorded change naming who made it.
+     */
+    readonly SUBSCRIBER_BUSINESS_STATUS_NOT_A_CONTACT: "SUBSCRIBER_BUSINESS_STATUS_NOT_A_CONTACT";
+    /** A change of the subscriber's contact details or business status did not say who makes it. */
+    readonly SUBSCRIBER_CHANGE_ACTOR_REQUIRED: "SUBSCRIBER_CHANGE_ACTOR_REQUIRED";
+    /**
+     * Where a tax adapter decides, a contract names its subscriber only once
+     * the address an invoice names is complete (`SC-PRIC-032`): a party copied
+     * onto a contract incomplete cannot be completed afterwards. Carries
+     * `missing`, the empty fields, for a screen to name by their labels; the
+     * shipped sentence names all four rather than the keys.
+     */
+    readonly SUBSCRIBER_IDENTITY_INCOMPLETE: "SUBSCRIBER_IDENTITY_INCOMPLETE";
+    /**
+     * A change of whether the subscriber is a business states no reason. It
+     * decides the tax treatment of the next invoice, so the change log keeps
+     * why it moved (`SC-PRIC-043`).
+     */
+    readonly SUBSCRIBER_BUSINESS_STATUS_REASON_REQUIRED: "SUBSCRIBER_BUSINESS_STATUS_REASON_REQUIRED";
+    /** A check of the subscriber's VAT identification number was asked for, and it holds none. */
+    readonly SUBSCRIBER_VAT_ID_MISSING: "SUBSCRIBER_VAT_ID_MISSING";
 };
 type SubscriberErrorCode = (typeof SUBSCRIBER_ERROR_CODES)[keyof typeof SUBSCRIBER_ERROR_CODES];
 /** Self-service registration funnel (`PendingRegistration`). */
@@ -5992,6 +7987,31 @@ declare const MAINTENANCE_ERROR_CODES: {
     readonly MAINTENANCE_MESSAGE_TOO_LONG: "MAINTENANCE_MESSAGE_TOO_LONG";
 };
 type MaintenanceErrorCode = (typeof MAINTENANCE_ERROR_CODES)[keyof typeof MAINTENANCE_ERROR_CODES];
+/** Codes of the installation's tax adapter (ADR 0013). */
+declare const TAX_ERROR_CODES: {
+    /**
+     * The tax adapter answers that it does not support the subscriber's case;
+     * `adapter` names it and `reason` is its sentence. Nothing is concluded with
+     * a guessed tax (`SC-PRIC-039`).
+     */
+    readonly TAX_TREATMENT_NOT_SUPPORTED: "TAX_TREATMENT_NOT_SUPPORTED";
+    /**
+     * The tax adapter needs the VAT identification number checked to treat the
+     * case, and the check did not complete — the service is unavailable, timed
+     * out, or answered in a way the adapter cannot read (`503`). Nothing is
+     * decided in the subscriber's favour on a number not checked
+     * (`SC-PRIC-040`): try again later. `adapter` names the adapter and
+     * `reason` says why.
+     */
+    readonly TAX_VAT_ID_CHECK_NOT_COMPLETED: "TAX_VAT_ID_CHECK_NOT_COMPLETED";
+    /**
+     * A VAT identification number was to be checked, and `config/saas.yaml`
+     * names no tax adapter, which is what names the service to check with
+     * (`409`).
+     */
+    readonly TAX_VAT_ID_CHECK_NOT_AVAILABLE: "TAX_VAT_ID_CHECK_NOT_AVAILABLE";
+};
+type TaxErrorCode = (typeof TAX_ERROR_CODES)[keyof typeof TAX_ERROR_CODES];
 /**
  * Every exception code the platform emits, in one object.
  *
@@ -6000,6 +8020,27 @@ type MaintenanceErrorCode = (typeof MAINTENANCE_ERROR_CODES)[keyof typeof MAINTE
  * removing one may not.
  */
 declare const PLATFORM_ERROR_CODES: {
+    /**
+     * The tax adapter answers that it does not support the subscriber's case;
+     * `adapter` names it and `reason` is its sentence. Nothing is concluded with
+     * a guessed tax (`SC-PRIC-039`).
+     */
+    readonly TAX_TREATMENT_NOT_SUPPORTED: "TAX_TREATMENT_NOT_SUPPORTED";
+    /**
+     * The tax adapter needs the VAT identification number checked to treat the
+     * case, and the check did not complete — the service is unavailable, timed
+     * out, or answered in a way the adapter cannot read (`503`). Nothing is
+     * decided in the subscriber's favour on a number not checked
+     * (`SC-PRIC-040`): try again later. `adapter` names the adapter and
+     * `reason` says why.
+     */
+    readonly TAX_VAT_ID_CHECK_NOT_COMPLETED: "TAX_VAT_ID_CHECK_NOT_COMPLETED";
+    /**
+     * A VAT identification number was to be checked, and `config/saas.yaml`
+     * names no tax adapter, which is what names the service to check with
+     * (`409`).
+     */
+    readonly TAX_VAT_ID_CHECK_NOT_AVAILABLE: "TAX_VAT_ID_CHECK_NOT_AVAILABLE";
     /** The application is locked for maintenance; the body carries the window. */
     readonly MAINTENANCE: "MAINTENANCE";
     /** A window is already open: move or cancel it before announcing another. */
@@ -6076,6 +8117,29 @@ declare const PLATFORM_ERROR_CODES: {
     readonly SUBSCRIBER_CORRECTION_CHANGES_NOTHING: "SUBSCRIBER_CORRECTION_CHANGES_NOTHING";
     /** The operator declared another legal entity: that is a transfer, not an edit. */
     readonly SUBSCRIBER_TAKEOVER_IS_A_TRANSFER: "SUBSCRIBER_TAKEOVER_IS_A_TRANSFER";
+    /**
+     * A contact change named whether the subscriber is a business. That is part
+     * of its tax origin and changes as a recorded change naming who made it.
+     */
+    readonly SUBSCRIBER_BUSINESS_STATUS_NOT_A_CONTACT: "SUBSCRIBER_BUSINESS_STATUS_NOT_A_CONTACT";
+    /** A change of the subscriber's contact details or business status did not say who makes it. */
+    readonly SUBSCRIBER_CHANGE_ACTOR_REQUIRED: "SUBSCRIBER_CHANGE_ACTOR_REQUIRED";
+    /**
+     * Where a tax adapter decides, a contract names its subscriber only once
+     * the address an invoice names is complete (`SC-PRIC-032`): a party copied
+     * onto a contract incomplete cannot be completed afterwards. Carries
+     * `missing`, the empty fields, for a screen to name by their labels; the
+     * shipped sentence names all four rather than the keys.
+     */
+    readonly SUBSCRIBER_IDENTITY_INCOMPLETE: "SUBSCRIBER_IDENTITY_INCOMPLETE";
+    /**
+     * A change of whether the subscriber is a business states no reason. It
+     * decides the tax treatment of the next invoice, so the change log keeps
+     * why it moved (`SC-PRIC-043`).
+     */
+    readonly SUBSCRIBER_BUSINESS_STATUS_REASON_REQUIRED: "SUBSCRIBER_BUSINESS_STATUS_REASON_REQUIRED";
+    /** A check of the subscriber's VAT identification number was asked for, and it holds none. */
+    readonly SUBSCRIBER_VAT_ID_MISSING: "SUBSCRIBER_VAT_ID_MISSING";
     readonly CHECKOUT_OFFER_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_LINE_ITEMS_REQUIRED";
     readonly CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED: "CHECKOUT_OFFER_PLAN_LINE_ITEM_REQUIRED";
     readonly CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED: "CHECKOUT_OFFER_BUNDLE_LINE_ITEMS_REQUIRED";
@@ -6110,6 +8174,21 @@ declare const PLATFORM_ERROR_CODES: {
      * describes. Nothing was written; load the offer and conclude it again.
      */
     readonly CHECKOUT_OFFER_CHANGED: "CHECKOUT_OFFER_CHANGED";
+    /**
+     * An offer concludes a tenant's first contract, and this tenant has a
+     * contract in force at the moment the offer's would take effect, or one
+     * beginning after it. Concluded, the two would run side by side. Nothing
+     * was written; a running subscription changes through its plan and its
+     * add-ons. Carries the offer and the contract that runs.
+     */
+    readonly CHECKOUT_OFFER_CONTRACT_IN_FORCE: "CHECKOUT_OFFER_CONTRACT_IN_FORCE";
+    /**
+     * The offer names a version of an add-on the tenant has booked in another
+     * version. Concluded, the contract would name a version the booking is not
+     * on. Nothing was written; a booking changes its version through the offer
+     * beside it. Carries the offer, the add-on, the booking and both versions.
+     */
+    readonly CHECKOUT_OFFER_ADD_ON_BOOKED_IN_ANOTHER_VERSION: "CHECKOUT_OFFER_ADD_ON_BOOKED_IN_ANOTHER_VERSION";
     readonly SUBSCRIPTION_CONTRACT_NOT_FOUND: "SUBSCRIPTION_CONTRACT_NOT_FOUND";
     readonly NO_ACTIVE_SUBSCRIPTION_CONTRACT: "NO_ACTIVE_SUBSCRIPTION_CONTRACT";
     readonly SUBSCRIPTION_CONTRACT_ALREADY_CLOSED: "SUBSCRIPTION_CONTRACT_ALREADY_CLOSED";
@@ -6121,6 +8200,11 @@ declare const PLATFORM_ERROR_CODES: {
      * would take effect. Nothing was written.
      */
     readonly SUBSCRIPTION_CONTRACT_CHANGED: "SUBSCRIPTION_CONTRACT_CHANGED";
+    /**
+     * A contract states a tax rate — `field` names where — other than the one
+     * the installation's tax adapter decides for its subscriber.
+     */
+    readonly SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_DECIDED: "SUBSCRIPTION_CONTRACT_TAX_RATE_NOT_DECIDED";
     /**
      * Feature not covered by the plan. Defined in `upsell.types.ts` because the
      * upsell body type is built around it; re-exported here so an exhaustive
@@ -6132,6 +8216,22 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
     readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
     readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
+    /**
+     * The bundle cannot run on a plan the subscription is already set to move
+     * to — by a scheduled change, or by a retirement it has been told of — and
+     * the booking would still be running then: that plan does not book it, or
+     * has no price for it. Carries that plan's key, the rhythm it is billed in
+     * there, and the day the move takes effect from, which can lie in the past
+     * while the move has not run yet.
+     */
+    readonly BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN: "BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN";
+    /**
+     * As `BUNDLE_CANNOT_RUN_ON_UPCOMING_PLAN`, where only the rhythm stands in
+     * the way: a yearly bundle, and the subscription billed monthly from the
+     * day of the move — a switch of rhythm on the plan it keeps, for one, where
+     * naming the plan would point at the one it is already on. Same values.
+     */
+    readonly BUNDLE_CANNOT_RUN_ON_UPCOMING_CYCLE: "BUNDLE_CANNOT_RUN_ON_UPCOMING_CYCLE";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -6150,6 +8250,12 @@ declare const PLATFORM_ERROR_CODES: {
      * in it: a plan without a yearly price is a monthly plan.
      */
     readonly PLAN_NOT_SOLD_IN_CYCLE: "PLAN_NOT_SOLD_IN_CYCLE";
+    /**
+     * The subscription is bound to a plan version the plan repository does not
+     * find, or finds as a version of another plan. What the subscription pays
+     * cannot be read, so no change is quoted until the binding is repaired.
+     */
+    readonly BOUND_PLAN_VERSION_UNREADABLE: "BOUND_PLAN_VERSION_UNREADABLE";
     /** Plan change refused. Carries `blockers[]` with their own codes. */
     readonly PLAN_CHANGE_BLOCKED: "PLAN_CHANGE_BLOCKED";
     /**
@@ -6172,6 +8278,175 @@ declare const PLATFORM_ERROR_CODES: {
      * Carries the recomputed dates, so the page can re-ask instead of guessing.
      */
     readonly CANCELLATION_TERMS_CHANGED: "CANCELLATION_TERMS_CHANGED";
+    /**
+     * The version the caller asked to switch to is no longer the one offered —
+     * another is on sale, the subscription moved, or there is no offer. Nothing
+     * was switched. Carries the current `offer`, or `null`, so the page can show
+     * it instead of guessing.
+     */
+    readonly VERSION_OFFER_CHANGED: "VERSION_OFFER_CHANGED";
+    /**
+     * The version a change to another plan named is not the one on sale when
+     * the change was submitted: its preview was shown at another moment.
+     * Nothing was changed. Carries the current `preview`, so the page shows
+     * what the change binds now instead of what it would have.
+     */
+    readonly PLAN_CHANGE_QUOTE_CHANGED: "PLAN_CHANGE_QUOTE_CHANGED";
+    /**
+     * A change to another plan named no version, where its preview names one:
+     * nothing says which price and terms the customer was shown, so nothing
+     * is changed.
+     */
+    readonly PLAN_CHANGE_VERSION_NOT_NAMED: "PLAN_CHANGE_VERSION_NOT_NAMED";
+    /**
+     * A version that takes something away takes effect when the term ends, and
+     * the subscription's cancellation lands no later: the switch would never
+     * happen, so it is refused rather than recorded. Carries both dates.
+     */
+    readonly VERSION_SWITCH_AFTER_CANCELLATION: "VERSION_SWITCH_AFTER_CANCELLATION";
+    /**
+     * A version that takes something away takes effect when the term ends, and
+     * it stops being sold before then — by its window or because an operator
+     * ended it — so it could not be bound when the change comes due. Refused
+     * rather than recorded; carries the dates.
+     */
+    readonly VERSION_ENDS_BEFORE_SWITCH: "VERSION_ENDS_BEFORE_SWITCH";
+    /**
+     * The operator's terms are not confirmed to carry the clause a retirement
+     * rests on (`tenantBilling.orderlyRetirement.termsConfirmed` in
+     * `config/saas.yaml`), so none is accepted.
+     */
+    readonly RETIREMENT_TERMS_NOT_CONFIRMED: "RETIREMENT_TERMS_NOT_CONFIRMED";
+    /**
+     * The version is still on sale: a subscription booked after the
+     * announcement would be on it without having been told. Carries the plan
+     * key and the version.
+     */
+    readonly RETIREMENT_VERSION_ON_SALE: "RETIREMENT_VERSION_ON_SALE";
+    /** The replacement is not on sale, so nobody can continue on it. Carries plan key and version. */
+    readonly RETIREMENT_REPLACEMENT_NOT_ON_SALE: "RETIREMENT_REPLACEMENT_NOT_ON_SALE";
+    /**
+     * The replacement has no price in the rhythm some of the subscriptions it
+     * reaches are billed in, so they cannot continue on it. Carries how many,
+     * and the replacement's plan key and version.
+     */
+    readonly RETIREMENT_REPLACEMENT_NOT_SOLD_IN_RHYTHM: "RETIREMENT_REPLACEMENT_NOT_SOLD_IN_RHYTHM";
+    /**
+     * Some of the subscriptions the retirement reaches hold an add-on that
+     * cannot run on the replacement's plan, so they cannot continue on it.
+     * Carries how many, and the replacement's plan key and version.
+     */
+    readonly RETIREMENT_REPLACEMENT_CANNOT_CARRY_BUNDLES: "RETIREMENT_REPLACEMENT_CANNOT_CARRY_BUNDLES";
+    /** The replacement named is the version being retired. */
+    readonly RETIREMENT_REPLACEMENT_IS_RETIRED: "RETIREMENT_REPLACEMENT_IS_RETIRED";
+    /** No running subscription is on the version: there is nobody to tell. Carries plan key and version. */
+    readonly RETIREMENT_NOTHING_AFFECTED: "RETIREMENT_NOTHING_AFFECTED";
+    /**
+     * Some of the subscriptions it reaches were reached by a retirement within
+     * the last twelve months, and a subscription is reached at most once in that
+     * time. Carries how many and which.
+     */
+    readonly RETIREMENT_WITHIN_TWELVE_MONTHS: "RETIREMENT_WITHIN_TWELVE_MONTHS";
+    /**
+     * The subscriptions the retirement reaches, or their dates, changed since
+     * the preview the operator confirmed. Carries the preview as it stands.
+     */
+    readonly RETIREMENT_PREVIEW_CHANGED: "RETIREMENT_PREVIEW_CHANGED";
+    /** No retirement of the subscription's version waits for its date: there is nothing to switch to. */
+    readonly RETIREMENT_SWITCH_NOT_PENDING: "RETIREMENT_SWITCH_NOT_PENDING";
+    /** The switch opens once the trial has converted: a trial has no contract to hold the price on. */
+    readonly RETIREMENT_SWITCH_IN_TRIAL: "RETIREMENT_SWITCH_IN_TRIAL";
+    /**
+     * An add-on running today cannot run beside the replacement's plan, which
+     * the switch would move the subscription onto today. Carries the add-on,
+     * the plan and the earliest day the booking can end. Its own code rather
+     * than a plan change's: the switch has no other plan to choose and no day
+     * to pick, so the way past it is the add-on ending.
+     */
+    readonly RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW: "RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW";
+    /**
+     * As `RETIREMENT_SWITCH_BUNDLE_CANNOT_FOLLOW`, where only the version the
+     * add-on continues on from a retirement's date cannot run beside the
+     * replacement's plan. The version it is on can, so cancelling it — it then
+     * ends before that date — lets the switch through. Given while that date
+     * is ahead and the add-on is not cancelled yet; otherwise the earlier code
+     * names the day it can end. Carries the add-on, that version, its date and
+     * the plan.
+     */
+    readonly RETIREMENT_SWITCH_BUNDLE_REPLACEMENT_CANNOT_FOLLOW: "RETIREMENT_SWITCH_BUNDLE_REPLACEMENT_CANNOT_FOLLOW";
+    /**
+     * The subscription takes no switch now: a change is scheduled, it has
+     * ended, or its plan is held for a special contract.
+     */
+    readonly RETIREMENT_SWITCH_NOT_OPEN: "RETIREMENT_SWITCH_NOT_OPEN";
+    /**
+     * The version named is not the replacement the retirement names. Carries
+     * the retirement as it now stands.
+     */
+    readonly RETIREMENT_SWITCH_CHANGED: "RETIREMENT_SWITCH_CHANGED";
+    /**
+     * The add-on version is still on sale: a booking made after the
+     * announcement would be on it without having been told. Carries the
+     * add-on key and the version.
+     */
+    readonly BUNDLE_RETIREMENT_VERSION_ON_SALE: "BUNDLE_RETIREMENT_VERSION_ON_SALE";
+    /** The replacement is not on sale, so no booking can continue on it. Carries add-on key and version. */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_NOT_ON_SALE: "BUNDLE_RETIREMENT_REPLACEMENT_NOT_ON_SALE";
+    /**
+     * The replacement is a version of another add-on. A booking continues on
+     * a version of its own add-on, so it stays the same booking with its term.
+     * Carries both add-on keys.
+     */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_OF_ANOTHER_BUNDLE: "BUNDLE_RETIREMENT_REPLACEMENT_OF_ANOTHER_BUNDLE";
+    /**
+     * Some of the bookings it reaches run, at their date, beside a plan the
+     * replacement cannot run beside: not allowed there, without a price there
+     * in the booking's rhythm, or in a longer rhythm than the plan's. Carries
+     * how many, and the replacement's add-on key and version.
+     */
+    readonly BUNDLE_RETIREMENT_REPLACEMENT_CANNOT_RUN: "BUNDLE_RETIREMENT_REPLACEMENT_CANNOT_RUN";
+    /** No running booking is on the version: there is nobody to tell. Carries add-on key and version. */
+    readonly BUNDLE_RETIREMENT_NOTHING_AFFECTED: "BUNDLE_RETIREMENT_NOTHING_AFFECTED";
+    /**
+     * The booking is on an add-on version being retired, and was cancelled to
+     * end before it would move, so it was never told and nothing moves it.
+     * Reinstated, it would run on past the date on a version nobody sells;
+     * booking the replacement once it has ended is the way. Carries the add-on
+     * key, the version, the replacement's version and the day it can be booked
+     * from.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_REFUSED: "BUNDLE_RETIREMENT_REINSTATE_REFUSED";
+    /**
+     * As `BUNDLE_RETIREMENT_REINSTATE_REFUSED`, where the replacement cannot
+     * run beside the plan the subscription is on when the booking ends, or
+     * beside one it is already set to move to after that, in any rhythm it
+     * could be booked in, so there is no version of the add-on to book.
+     * Carries the add-on key, the version and the replacement's version.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_REPLACEMENT_CANNOT_RUN: "BUNDLE_RETIREMENT_REINSTATE_REPLACEMENT_CANNOT_RUN";
+    /**
+     * As `BUNDLE_RETIREMENT_REINSTATE_REFUSED`, where the subscription ends by
+     * the day the replacement could be booked from, so there is no day to
+     * name. Carries the add-on key, the version and the replacement's version.
+     */
+    readonly BUNDLE_RETIREMENT_REINSTATE_SUBSCRIPTION_ENDS: "BUNDLE_RETIREMENT_REINSTATE_SUBSCRIPTION_ENDS";
+    /**
+     * The plan the add-on runs beside, or the rhythm it is billed in, changes
+     * before the date the booking was told — by a change scheduled, or by a
+     * retirement told that moves the subscription to another plan — so the
+     * price a switch now would hold is not the one the booking pays until
+     * then. Switching once the plan has changed, or waiting for the
+     * date, is the way. Carries the add-on and the date.
+     */
+    readonly BUNDLE_RETIREMENT_SWITCH_PLAN_CHANGES: "BUNDLE_RETIREMENT_SWITCH_PLAN_CHANGES";
+    /**
+     * The add-on version the caller asked to switch a booking to is no longer
+     * the one offered beside it — another is on sale, the booking moved, or
+     * there is no offer. Nothing was switched. Carries the version named
+     * (`bundleVersionId`) and the current `offer`, or `null`, so the page can
+     * show it instead of guessing.
+     */
+    readonly BUNDLE_VERSION_OFFER_CHANGED: "BUNDLE_VERSION_OFFER_CHANGED";
     /** The subscription has ended; its plan can no longer be changed. */
     readonly SUBSCRIPTION_ENDED: "SUBSCRIPTION_ENDED";
     /** An active special contract blocks self-service plan changes. */
@@ -6189,14 +8464,33 @@ declare const PLATFORM_ERROR_CODES: {
     readonly CANCELLATION_LOCKS_THE_CYCLE: "CANCELLATION_LOCKS_THE_CYCLE";
     /**
      * A bundle the tenant already holds runs past the cycle they are moving to.
+     * Carries the bundle, the earliest day the booking can end, and the two
+     * rhythms.
      *
      * Its own code rather than `BUNDLE_CYCLE_EXCEEDS_PLAN`, which states the
      * same rule about a booking that has not been made yet. The two need
      * different sentences: this one can name the day the obstacle lifts and
-     * tell the reader to cancel the booking, and that advice is wrong for
-     * someone who is only about to book. One template cannot serve both.
+     * tell the reader how to get past it, and that advice is wrong for someone
+     * who is only about to book. One template cannot serve both.
      */
     readonly BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE: "BUNDLE_BOOKING_OUTLASTS_TARGET_CYCLE";
+    /**
+     * A bundle the tenant already holds cannot run on the plan they are moving
+     * to: that plan may not book it, or it has no price there in the rhythm
+     * the booking is billed in. Carries the bundle, the plan and the earliest
+     * day the booking can end.
+     */
+    readonly BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN: "BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN";
+    /**
+     * A bundle the tenant already holds can run on the plan they are moving
+     * to, but the version it continues on from a retirement's date cannot.
+     * Cancelling it lets the change through at once: the booking then ends
+     * before that date and never reaches the version. Given while that date is
+     * ahead and the booking is not cancelled yet; otherwise
+     * `BUNDLE_BOOKING_DOES_NOT_FIT_TARGET_PLAN` names the day it can end.
+     * Carries the bundle, that version, its date and the plan.
+     */
+    readonly BUNDLE_REPLACEMENT_DOES_NOT_FIT_TARGET_PLAN: "BUNDLE_REPLACEMENT_DOES_NOT_FIT_TARGET_PLAN";
     /**
      * Features of the previewed bundle are already covered by the plan or by
      * another booked bundle. A warning rather than a blocker: paying twice is
@@ -6218,7 +8512,6 @@ declare const PLATFORM_ERROR_CODES: {
      * tenant reads and therefore needs a shipped text for.
      */
     readonly BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED: "BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED";
-    readonly NO_PENDING_PLAN_VERSION: "NO_PENDING_PLAN_VERSION";
     readonly ONBOARDING_CREATE_FAILED: "ONBOARDING_CREATE_FAILED";
     readonly BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS: "BUNDLE_PREVIEW_ARGUMENT_AMBIGUOUS";
     /**
@@ -6250,10 +8543,41 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_TERMINATE_INVALID_DATE: "PLAN_TERMINATE_INVALID_DATE";
     readonly PLAN_TERMINATE_DATE_NOT_FUTURE: "PLAN_TERMINATE_DATE_NOT_FUTURE";
     readonly PLAN_TERMINATE_NOT_IMPLEMENTED: "PLAN_TERMINATE_NOT_IMPLEMENTED";
+    /**
+     * Subscriptions told of a retirement still move onto this version, and
+     * nothing moves onto a version that has ended. Carries the version, its
+     * plan key and the first day it may end: the day after the last move.
+     */
+    readonly PLAN_TERMINATE_BEFORE_RETIREMENT_MOVES: "PLAN_TERMINATE_BEFORE_RETIREMENT_MOVES";
+    /**
+     * Subscriptions told of a retirement are past their date and still to be
+     * moved onto this version — a move the platform could not make yet — so it
+     * cannot end until they have moved. Carries how many, the version and its
+     * plan key.
+     */
+    readonly PLAN_TERMINATE_WHILE_MOVES_OVERDUE: "PLAN_TERMINATE_WHILE_MOVES_OVERDUE";
+    /**
+     * Subscriptions on a retired version have not yet been told of their move
+     * onto this version — their notice has reached nobody, so their date is not
+     * set — and it cannot end until they have been. Carries how many, the
+     * version and its plan key.
+     */
+    readonly PLAN_TERMINATE_WHILE_NOTICES_UNDELIVERED: "PLAN_TERMINATE_WHILE_NOTICES_UNDELIVERED";
     readonly BUNDLE_VERSION_ALREADY_PUBLISHED: "BUNDLE_VERSION_ALREADY_PUBLISHED";
     readonly BUNDLE_VERSION_NOT_EDITABLE: "BUNDLE_VERSION_NOT_EDITABLE";
     readonly BUNDLE_VERSION_NOT_PUBLISHED: "BUNDLE_VERSION_NOT_PUBLISHED";
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
+    /**
+     * The bundle version is published, and its window has not opened: it goes
+     * on sale on `validFrom`, and until then its predecessor is the one sold.
+     */
+    readonly BUNDLE_VERSION_NOT_YET_ON_SALE: "BUNDLE_VERSION_NOT_YET_ON_SALE";
+    /**
+     * The add-on itself has been deleted from the catalogue. Deleting it leaves
+     * its versions' dates as they were, so the version asked for can still be
+     * inside its window; it is not on offer all the same.
+     */
+    readonly BUNDLE_DELETED: "BUNDLE_DELETED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
     readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
@@ -6271,6 +8595,13 @@ declare const PLATFORM_ERROR_CODES: {
     readonly PLAN_NOT_FOUND: "PLAN_NOT_FOUND";
     readonly PLAN_VERSION_NOT_FOUND: "PLAN_VERSION_NOT_FOUND";
     readonly BUNDLE_NOT_FOUND: "BUNDLE_NOT_FOUND";
+    /**
+     * Bookings told that their add-on version is being retired have still to
+     * move onto a version of this add-on — waiting for their notice, for their
+     * date, or past it — and a deleted add-on is booked by nothing, the move
+     * included. Carries how many, and the add-on's key.
+     */
+    readonly BUNDLE_DELETE_WHILE_RETIREMENT_MOVES_PENDING: "BUNDLE_DELETE_WHILE_RETIREMENT_MOVES_PENDING";
     readonly BUNDLE_VERSION_NOT_FOUND: "BUNDLE_VERSION_NOT_FOUND";
     readonly FEATURE_NOT_FOUND: "FEATURE_NOT_FOUND";
     readonly QUOTA_NOT_FOUND: "QUOTA_NOT_FOUND";
@@ -6343,7 +8674,7 @@ declare const PLATFORM_ERROR_CODES: {
     /** Email already taken (mapped from `PlatformUserExistsError`). */
     readonly EMAIL_EXISTS: "EMAIL_EXISTS";
 };
-type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | SubscriberErrorCode | RegistrationErrorCode | PaymentErrorCode | SettingsErrorCode | MaintenanceErrorCode;
+type PlatformErrorCode = SetupErrorCode | AuthErrorCode | PromoErrorCode | CatalogErrorCode | BillingErrorCode | ContractErrorCode | SubscriberErrorCode | RegistrationErrorCode | PaymentErrorCode | SettingsErrorCode | MaintenanceErrorCode | TaxErrorCode;
 /**
  * Shape of a coded error response.
  *
@@ -6381,6 +8712,161 @@ declare class PlatformUserExistsError extends Error {
  * when thrower and catcher see the class from different module instances.
  */
 declare function isPlatformUserExistsError(err: unknown): err is PlatformUserExistsError;
+/**
+ * What a refused write found instead of the state its caller had read:
+ * `gone` — the row no longer exists; `moved` — it exists, but no longer in the
+ * state the write required, because a concurrent request changed it first.
+ */
+type PersistenceRefusalReason = 'gone' | 'moved';
+/**
+ * A write an adapter refused because the row was no longer what the caller
+ * read, carrying the platform's error code for that case.
+ *
+ * The platform checks these conditions before it writes and answers with the
+ * same code. The adapter's own guard is what holds when two requests pass
+ * that check together — a double click, two operators — and throwing this
+ * rather than a plain `Error` gives the loser of that race the answer the
+ * check would have given, instead of a 500 that reads like a crash in the log.
+ * The adapter says what it found; the platform decides what that is on the
+ * wire.
+ */
+declare class PersistenceRefusal extends Error {
+    readonly code: string;
+    readonly reason: PersistenceRefusalReason;
+    readonly params: Readonly<Record<string, unknown>>;
+    constructor(code: string, reason: PersistenceRefusalReason, message: string, params?: Readonly<Record<string, unknown>>);
+}
+/** Realm-safe type guard, like `isPlatformUserExistsError`. */
+declare function isPersistenceRefusal(err: unknown): err is PersistenceRefusal;
+
+/**
+ * The canonical models a schema may leave out, each with the persistence
+ * bundle members that need it.
+ *
+ * `saasicat schema check` lists every canonical model it does not find as not
+ * adopted. Naming one of these in a bundle's `notAdopted` leaves its members
+ * out of the bundle, so the platform decides at start what it can do without
+ * them — and says so where it cannot — instead of the first request failing
+ * against a table that is not there. Any other model the bundle needs: an
+ * application that leaves it out brings its own adapter for it.
+ */
+declare const OPTIONAL_CANONICAL_MODELS: {
+    readonly SuperAdminUser: readonly ["core.superAdminProvisioning"];
+    readonly SuperAdminMfa: readonly ["core.mfa"];
+    readonly AppliedSettings: readonly ["core.appliedSettings"];
+    readonly SettingsChange: readonly ["core.appliedSettings"];
+    readonly MaintenanceWindow: readonly ["core.maintenanceWindows"];
+    readonly SubscriptionNotice: readonly ["tenantBilling.subscriptionNotices"];
+    readonly VersionRetirement: readonly ["tenantBilling.versionRetirements"];
+    readonly BundleVersionRetirement: readonly ["tenantBilling.bundleVersionRetirements"];
+    readonly SubscriberLedgerEntry: readonly ["entitlement.subscriberLedgerRepository"];
+    readonly PromoCodeHold: readonly ["promo.holdRepository"];
+};
+type OptionalCanonicalModel = keyof typeof OPTIONAL_CANONICAL_MODELS;
+/** A bundle member one of the optional models is needed by. */
+type OptionalBundleMember = (typeof OPTIONAL_CANONICAL_MODELS)[OptionalCanonicalModel][number];
+/**
+ * The bundle members a `notAdopted` list leaves out.
+ *
+ * A name that is not one of the optional models is refused rather than
+ * ignored: a typo would otherwise leave a member in that fails at its first
+ * request, and a model the bundle cannot run without needs the application's
+ * own adapter, which only the application can supply.
+ */
+declare function membersLeftOut(notAdopted?: readonly string[]): ReadonlySet<OptionalBundleMember>;
+
+/** Admits a piece of work when a place is free; see `concurrencyGate`. */
+type ConcurrencyGate = <T>(work: () => Promise<T>) => Promise<T>;
+/**
+ * Admits at most `limit` pieces of work at once and queues the rest in the
+ * order they arrived.
+ *
+ * Meant for transactions. Each holds a pooled connection for its whole life,
+ * and the platform's transactions take row locks and then read further. Run
+ * as many at once as there are requests, and every connection can end up held
+ * by a transaction waiting for a lock — or for a connection a sibling needs —
+ * while the statements that would let them finish wait for the pool: the
+ * service stalls until transactions time out. A limit below the pool size
+ * keeps connections free for the work outside a transaction.
+ *
+ * A place is handed to the next in line when work ends, however it ends, so
+ * the count never rises above the limit and nobody waiting is overtaken.
+ */
+declare function concurrencyGate(limit: number): ConcurrencyGate;
+/**
+ * The one gate of a pool: every caller naming the same `pool` — the client or
+ * database handle the transactions run on — gets the same queue.
+ *
+ * A bound is a property of the pool, not of whoever builds a runner. Where
+ * the client is an injection token, Nest builds a runner once for every module
+ * that asks for one, all on the same client; a gate per runner would admit the
+ * limit once per module, and a gate per configuration object would join two
+ * pools that happen to share one. A second, different limit for a pool already
+ * bounded is refused rather than split.
+ */
+declare function concurrencyGateOf(pool: object, limit: number): ConcurrencyGate;
+
+/** The two versioned catalogue entities, by the name their rows go by. */
+type CatalogVersionKind = 'PlanVersion' | 'BundleVersion';
+/** A publish of a version that is not there, refused with the platform's code. */
+declare function catalogVersionGone(kind: CatalogVersionKind, versionId: string): PersistenceRefusal;
+/**
+ * A publish or discard of a version somebody published first. A published
+ * version is what tenants may have booked, so it is neither published a second
+ * time — which would rewrite when and by whom — nor discarded.
+ */
+declare function catalogVersionAlreadyPublished(kind: CatalogVersionKind, versionId: string): PersistenceRefusal;
+/**
+ * A draft asked for where the plan or bundle already has one: there is one
+ * draft at a time, so that publishing it is never a choice between two.
+ */
+declare function catalogDraftExists(kind: CatalogVersionKind, key: string, draftVersion: number): PersistenceRefusal;
+
+/** A plan key a plan already carries. */
+declare function planKeyTaken(planKey: string): PersistenceRefusal;
+/** A bundle key a bundle already carries. */
+declare function bundleKeyTaken(bundleKey: string): PersistenceRefusal;
+/** A marketing projection for a version and locale that already has one. */
+declare function marketingProjectionTaken(target: {
+    targetType: string;
+    targetVersionId: string;
+    locale: string;
+}): PersistenceRefusal;
+
+/**
+ * The decimal a number was written as, for a `numeric` column.
+ *
+ * `toFixed` rounds the binary double rather than the decimal somebody typed:
+ * `(1.005).toFixed(2)` is `'1.00'` and `(2.675).toFixed(2)` is `'2.67'`, while
+ * `(10.005).toFixed(2)` is `'10.01'` — which way a value goes depends on its
+ * binary representation, not on a rule anyone chose. The shortest decimal that
+ * reads back as the same number is what was written; handed to the column, the
+ * database applies its one rounding rule, half away from zero. Where the
+ * platform validates an amount to the column's places at its boundary, nothing
+ * is rounded at all.
+ */
+declare function toDecimalString(value: number): string;
+
+/**
+ * A code whose name is taken — by a live code, or by a deleted one, since a
+ * deleted code keeps its name (`SC-PROMO-028`). The platform checks before it
+ * creates; this is what the unique index answers when two creates race past
+ * that check.
+ */
+declare function promoCodeTaken(code: string): PersistenceRefusal;
+
+/** The tenant has no subscription to write to. */
+declare function subscriptionGone(tenantId: string): PersistenceRefusal;
+/** The plan to bind has no version in effect at `asOf`. */
+declare function noActivePlanVersion(planId: string, asOf: Date): PersistenceRefusal;
+/** The plan to bind is not in the catalogue, or was retired in the meantime. */
+declare function planNotInCatalog(planKey: string): PersistenceRefusal;
+/** The booking to cancel does not exist. */
+declare function subscriptionBundleGone(subscriptionBundleId: string): PersistenceRefusal;
+/** The booking to cancel was cancelled first, by another request. */
+declare function subscriptionBundleAlreadyCancelled(subscriptionBundleId: string): PersistenceRefusal;
+/** No contract of the tenant named carries the id. */
+declare function subscriptionContractGone(contractId: string): PersistenceRefusal;
 
 /** Feature key → its `requires` keys (from Discovery/FeatureCatalogEntry). */
 type FeatureRequiresIndex = ReadonlyMap<string, readonly string[]>;
@@ -6577,6 +9063,14 @@ interface PendingRegistration {
     country: string | null;
     vatId: string | null;
     taxNumber: string | null;
+    /** Whether the sign-up is a business, as step 4 says; `null` where it did not say. */
+    business: boolean | null;
+    /**
+     * The check of `vatId` step 4 made, outside any transaction, where the tax
+     * adapter needed a validated number to treat the sign-up; `null` where it
+     * needed none. The subscriber takes it over when it is created.
+     */
+    vatIdCheck: VatIdCheck | null;
     /** The gateway's session for the payment method, unique within `checkoutGatewayAccount`. */
     checkoutSessionId: string | null;
     /** The account in `config/saas.yaml#payments.accounts` the session was opened at. */
@@ -6621,6 +9115,8 @@ interface PendingRegistrationUpdateInput {
     country?: string | null;
     vatId?: string | null;
     taxNumber?: string | null;
+    business?: boolean | null;
+    vatIdCheck?: VatIdCheck | null;
     checkoutSessionId?: string | null;
     checkoutGatewayAccount?: string | null;
     gatewayCustomerRef?: string | null;
@@ -6875,7 +9371,12 @@ interface ConfiguratorPlanMarketing {
  */
 interface ConfiguratorMarketingProvider {
     listPlanMarketing(): ConfiguratorPlanMarketing[];
-    getVatRate(): number;
+    /**
+     * The rate the configurator shows. Required where config/saas.yaml names no
+     * tax adapter; left out where it names one, whose rate for a subscriber in
+     * the issuer's country is shown instead.
+     */
+    getVatRate?(): number;
     getCurrency(): string;
 }
 /**
@@ -7056,6 +9557,13 @@ interface RegistrationBillingDetails {
     country: string;
     vatId?: string | null;
     taxNumber?: string | null;
+    /**
+     * Whether the sign-up is a business. A tax adapter decides from it — a
+     * business elsewhere in the European Union, for instance, is charged under
+     * the reverse charge — and refuses the step where it needs it and it is
+     * missing.
+     */
+    business?: boolean | null;
 }
 interface StartCheckoutInput {
     pendingRegistrationId: string;
@@ -7116,13 +9624,6 @@ interface SetupConfirmMfaResponse {
     ok: boolean;
 }
 
-/** What the adapter's schema can actually answer about a version's dates. */
-interface PlanVersionMappingFields {
-    /** `validFrom`/`validUntil` are maintained; otherwise both read as null. */
-    validityWindows: boolean;
-    /** `endsAt` exists; otherwise the field is left off the record entirely. */
-    endsAt: boolean;
-}
 /** A `plans` row as either adapter reads it back. */
 interface CanonicalPlanRow {
     id: string;
@@ -7150,9 +9651,9 @@ interface CanonicalPlanVersionRow {
     publishedChanges: unknown;
     changeNote: string;
     nonRegressive: boolean;
-    validFrom?: Date | null;
-    validUntil?: Date | null;
-    endsAt?: Date | null;
+    validFrom: Date | null;
+    validUntil: Date | null;
+    endsAt: Date | null;
     createdByUserId: string | null;
     publishedByUserId: string | null;
     createdAt: Date;
@@ -7165,7 +9666,7 @@ declare function toPlanRow(row: CanonicalPlanRow): PlanRow;
  * real foreign key has to resolve it first, and only the adapter knows which
  * shape it is looking at.
  */
-declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string, fields: PlanVersionMappingFields): PlanVersionRow;
+declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string): PlanVersionRow;
 
 /**
  * The legal identity of the issuer a catalogue names, or none where it names no
@@ -7319,10 +9820,21 @@ interface CanonicalSubscriberRow {
     vatId: string | null;
     taxNumber: string | null;
     invoiceEmail: string | null;
+    business: boolean | null;
     migrated: boolean;
     createdAt: Date;
     updatedAt: Date;
 }
+/** A `subscriber_tax_origin_changes` row as either adapter reads it back. */
+interface CanonicalSubscriberTaxOriginChangeRow {
+    id: string;
+    subscriberId: string;
+    previous: unknown;
+    changed: unknown;
+    changedBy: string;
+    changedAt: Date;
+    reason: string | null;
+}
 /** A `subscriber_corrections` row as either adapter reads it back. */
 interface CanonicalSubscriberCorrectionRow {
     id: string;
@@ -7342,6 +9854,7 @@ declare function formatCustomerNumber(prefix: string, sequence: number): string;
 /** `tenantId` is the tenant the subscriber's live link names, read beside the row. */
 declare function toSubscriberRecord(row: CanonicalSubscriberRow, tenantId: string | null): SubscriberRecord;
 declare function toSubscriberCorrectionRecord(row: CanonicalSubscriberCorrectionRow): SubscriberCorrectionRecord;
+declare function toSubscriberTaxOriginChangeRecord(row: CanonicalSubscriberTaxOriginChangeRow): SubscriberTaxOriginChangeRecord;
 /**
  * The part of a correction that changes something: every corrected field whose
  * stored value differs, with the value it replaces. Both adapters decide this
@@ -7359,7 +9872,7 @@ declare function contractPartiesOf(subscriber: SubscriberRecord, issuer: PlanCat
  * verified with as its invoice email, and the billing address and tax
  * identifiers step 4 took.
  */
-declare function subscriberFromRegistration(pending: Pick<PendingRegistration, 'tenantName' | 'email' | 'addressLine1' | 'addressLine2' | 'postalCode' | 'city' | 'country' | 'vatId' | 'taxNumber'>): NewSubscriberDetails;
+declare function subscriberFromRegistration(pending: Pick<PendingRegistration, 'tenantName' | 'email' | 'addressLine1' | 'addressLine2' | 'postalCode' | 'city' | 'country' | 'vatId' | 'taxNumber' | 'business' | 'vatIdCheck'>): NewSubscriberDetails;
 
 /** The payment method types, in the order a form offers them. */
 declare const PAYMENT_METHOD_TYPES: readonly PaymentMethodType[];
@@ -7436,9 +9949,10 @@ declare function refuseForeignPaymentMethodReference(recorded: Pick<CanonicalSub
 /**
  * A `subscription_bundles` row as either adapter reads it back.
  *
- * The three billing columns are optional because a Prisma client generated from
- * a schema that predates them returns a row without them; an absent column
- * reads as null, the same as a booking made before they existed.
+ * The three billing columns and the two of a scheduled switch are optional
+ * because a Prisma client generated from a schema that predates them returns a
+ * row without them; an absent column reads as null, the same as a booking made
+ * before they existed.
  */
 interface CanonicalSubscriptionBundleRow {
     id: string;
@@ -7449,6 +9963,8 @@ interface CanonicalSubscriptionBundleRow {
     billingCycle?: string | null;
     currentPeriodStart?: Date | null;
     currentPeriodEnd?: Date | null;
+    pendingBundleVersionId?: string | null;
+    pendingVersionEffectiveAt?: Date | null;
     canceledAt: Date | null;
     canceledEffectiveAt: Date | null;
     createdAt: Date;
@@ -7472,6 +9988,8 @@ interface CanonicalContractRow {
     subscriberSnapshot: unknown;
     issuerSnapshot: unknown;
     partiesMigrated: boolean;
+    /** JSON; see `toTaxTreatment`. */
+    taxTreatment: unknown;
     status: string;
     effectiveFrom: Date;
     effectiveUntil: Date | null;
@@ -7526,6 +10044,100 @@ interface CanonicalRunningContractRow {
 /** One running contract, and the legal name on its issuer copy where it has one. */
 declare function toRunningContractIssuer(row: CanonicalRunningContractRow): RunningContractIssuer;
 
+/**
+ * A VAT identification number in the one form it is stored, compared and
+ * checked in: upper case, without the spaces, dots and hyphens it is often
+ * written with. `atu 123.456-78` is `ATU12345678` — the same number, so
+ * entering it in another spelling moves nothing. `null` where nothing is left.
+ * The platform settles every number it is given with this, and a form that
+ * asks whether a number changed compares with it too.
+ */
+declare function canonicalVatId(written: string): string | null;
+/** A `subscriber_vat_id_checks` row as either adapter reads it back. */
+interface CanonicalSubscriberVatIdCheckRow {
+    id: string;
+    subscriberId: string;
+    vatId: string;
+    checkedAt: Date;
+    valid: boolean;
+    service: string;
+    confirmation: unknown;
+    recordedAt: Date;
+}
+/**
+ * What an adapter decides a subscriber's treatment from: the record as it
+ * stands, and the check that counts for its number now. The number counts as
+ * validated only when that check is of the number the subscriber has and found
+ * it valid.
+ */
+declare function taxOriginOf(subscriber: Pick<SubscriberRecord, SubscriberTaxOriginField>, currentCheck: VatIdCheck | null): SubscriberTaxOrigin;
+/** The subscriber's number, and since when it holds it. */
+interface HeldVatId {
+    vatId: string | null;
+    /**
+     * When the number was last set by a correction; `null` while it is the one
+     * the subscriber was created with.
+     */
+    vatIdSince: Date | null;
+}
+/**
+ * Whether a check just recorded is the one that counts from now on, given the
+ * subscriber's number and the check that counts now. Only a check of the
+ * number the subscriber holds, completed while it held it, and never over a
+ * check that completed later:
+ *
+ * - A check completed before the number was last set says nothing about it:
+ *   the number was away in between, and may have been revoked meanwhile.
+ * - Two checks of one number can run side by side, and the one written last
+ *   is not the latest — an older "valid" written after a newer "invalid" would
+ *   validate a number the latest check refused. Of two checks with the same
+ *   date, the one written last counts.
+ *
+ * `vatIdSince` and `checkedAt` are both the platform's clock; between two
+ * instances, the window this leaves is the difference between their clocks.
+ */
+declare function keepsVatIdCheck(held: HeldVatId, counting: VatIdCheck | null, check: VatIdCheck): boolean;
+/** A recorded check read back; a confirmation of another shape reads as empty. */
+declare function toSubscriberVatIdCheckRecord(row: CanonicalSubscriberVatIdCheckRow): SubscriberVatIdCheckRecord;
+/** A treatment as it is stored on a contract. */
+declare function taxTreatmentToJson(treatment: TaxTreatment): Record<string, unknown>;
+/** A stored treatment read back, or `null` where none is stored or it has another shape. */
+declare function toTaxTreatment(value: unknown): TaxTreatment | null;
+/** What a write moves of a subscriber's tax origin, and what follows from it. */
+interface TaxOriginWrite {
+    /** The values the write replaces, holding only the fields it moves. */
+    previous: SubscriberTaxOriginValues;
+    /** The values it writes, holding only the fields it moves. */
+    changed: SubscriberTaxOriginValues;
+    /** Whether it moves anything, and so has a change to record. */
+    moved: boolean;
+    /**
+     * Whether it moves the VAT identification number. The check that counted
+     * for the old number then counts no more — it says nothing about the new
+     * one, nor about the old one should it come back later — while the check
+     * itself stays recorded; and the number held is held since this write
+     * (`HeldVatId.vatIdSince`).
+     */
+    endsCountingVatIdCheck: boolean;
+}
+/**
+ * What a write moves of the tax origin: every field named whose stored value
+ * differs, with the value it replaces. Every adapter asks this under the lock
+ * it read `current` with, and applies the answer: a change is recorded only
+ * when it moved something.
+ */
+declare function taxOriginWrite(current: Pick<SubscriberRecord, SubscriberTaxOriginField>, next: SubscriberTaxOriginValues): TaxOriginWrite;
+/** Stored tax origin values read back, holding only the fields that are there. */
+declare function toTaxOriginValues(value: unknown): SubscriberTaxOriginValues;
+/**
+ * A check of a VAT identification number as a store gives it back. A sign-up
+ * keeps its check where the application's repository puts it — often a JSON
+ * column, which hands `checkedAt` back as text — so it is read again here,
+ * once. Anything that is not a whole check reads as none: a number never
+ * counts as validated on a record that cannot say so.
+ */
+declare function vatIdCheckFromStore(value: unknown): VatIdCheck | null;
+
 /** Why a version is editable (for UI badges + audit logs). */
 type VersionEditableReason = 'draft' | 'pre-active';
 interface VersionEditability {
@@ -7607,4 +10219,4 @@ declare function resolveErrorMessage(body: ResolvableErrorBody, overrides?: Part
 
 declare const ERROR_MESSAGES_DE: Record<PlatformErrorCode, string>;
 
-export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminAccountEntry, type AdminAccountHolder, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriberAccount, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalMaintenanceWindowRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CanonicalRunningContractRow, type CanonicalSubscriberChargeRow, type CanonicalSubscriberCorrectionRow, type CanonicalSubscriberPaymentMethodRow, type CanonicalSubscriberRow, type CanonicalSubscriptionBundleRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferSelection, type CheckoutOfferSelectionUpdate, type CheckoutOfferStatus, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ConfirmedPaymentMethod, type ContractErrorCode, type ContractIssuerParty, type ContractLineItemKind, type ContractLineItemRecord, type ContractSubscriberParty, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriberData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, ForeignPaymentMethodReferenceError, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type IssuerCorrectionFault, type IssuerIdentityChange, type KpiCardDef, type KpiDisplayHint, LEGAL_IDENTITY_FIELDS, type LegalIdentity, type LegalIdentityField, MAINTENANCE_CAPABILITY, MAINTENANCE_ERROR_CODES, MAINTENANCE_MESSAGE_MAX_LENGTH, MAINTENANCE_STATE_MAX_AGE_SECONDS, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type MaintenanceErrorCode, type MaintenanceLockView, type MaintenanceNotificationPort, type MaintenanceOverview, type MaintenanceStatusView, type MaintenanceUnlockView, type MaintenanceWindowChanges, type MaintenanceWindowEvent, type MaintenanceWindowPort, type MaintenanceWindowRecord, type MaintenanceWindowStage, type MaintenanceWindowStatus, type MaintenanceWindowView, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MaskedPaymentMethod, type MfaPort, type NewContractLineItemData, type NewMaintenanceWindow, type NewSettingsChange, type NewSubscriberCharge, type NewSubscriberDetails, type NewSubscriptionContractData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PAYMENT_ERROR_CODES, PAYMENT_METHOD_TYPES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PartyAddress, type PasswordHasher, type PasswordResetCliResult, PaymentCallbackRejectedError, type PaymentErrorCode, type PaymentEventClaim, type PaymentEventLog, type PaymentGateway, type PaymentGatewayCallback, type PaymentGatewayEvent, type PaymentMethodHolder, type PaymentMethodSetupSession, type PaymentMethodSetupSubject, type PaymentMethodType, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogIssuer, type PlanCatalogIssuerCorrection, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogPaymentAccount, type PlanCatalogPayments, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogSettings, type PlanCatalogSubscribers, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeHoldRecord, type PromoCodeHoldRepository, type PromoCodeHoldTaken, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionOnPrice, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicNewPaymentMethods, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RecommendablePlan, type RecordSubscriberPaymentMethodData, type RecordSubscriberPaymentMethodOutcome, type RecordSubscriberPaymentMethodResult, type RedeemPromoInTransactionCallback, type RegistrationActivation, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationBillingDetails, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, type RunningContractIssuer, type RunningContractIssuers, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, SUBSCRIBER_ACCOUNT_CAPABILITY, SUBSCRIBER_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePayments, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartPaymentMethodSetupInput, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type SubscriberCharge, type SubscriberChargeOrigin, type SubscriberChargeRecord, type SubscriberChargeSource, type SubscriberContact, type SubscriberContactChange, type SubscriberCorrectionData, type SubscriberCorrectionRecord, type SubscriberCorrectionResult, type SubscriberDetails, type SubscriberErrorCode, type SubscriberIdentityCorrection, type SubscriberIdentityDelta, type SubscriberIdentityValues, type SubscriberLedgerRepository, type SubscriberPaymentMethodRecord, type SubscriberPaymentMethodReference, type SubscriberPaymentMethodRepository, type SubscriberPaymentMethodSetupData, type SubscriberPaymentMethodSetupMatch, type SubscriberPaymentMethodStatus, type SubscriberRecord, type SubscriberRepository, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractParties, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SupersedeSubscriptionContractData, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, canonicalJson, classifyBundleVersionDiff, classifyIssuerChange, classifyPlanDiff, collectUnsatisfiedRequires, contractPartiesOf, coverageExcludingSelf, definedFields, diffSettings, formatCustomerNumber, formatErrorMessage, identityCorrectionDelta, isBundleRedundant, isForeignPaymentMethodReferenceError, isMaintenanceAnnouncementLapsed, isMaintenanceOverrun, isPaymentCallbackRejectedError, isPlatformUserExistsError, isVersionEditable, issuerIdentityOf, keepOneRecommended, maintenanceRetryAfterSeconds, maintenanceStatusOf, maintenanceWindowStatusOf, maintenanceWindowViewOf, missingRequiresFor, movedIdentityFields, parseZonedInstant, pickActivePromo, planCatalogSettingsOf, previousUtcDay, promoStatus, promotionOnPrice, readQuotaRecord, readQuotaValue, recordedIssuerIdentity, refuseForeignPaymentMethodReference, resolveBundleAvailability, resolveErrorMessage, sameLegalIdentity, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, subscriberChargeColumns, subscriberFromRegistration, subscriberPaymentMethodColumns, toBundleStemRow, toContractLineItemRecord, toMaintenanceWindowRecord, toPlanRow, toPlanVersionRow, toRunningContractIssuer, toSubscriberChargeRecord, toSubscriberCorrectionRecord, toSubscriberPaymentMethodRecord, toSubscriberRecord, toSubscriptionBundleRecord, toSubscriptionContractRecord };
+export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminAccountEntry, type AdminAccountHolder, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriberAccount, type AdminSubscriberAttention, type AdminSubscriberCorrected, type AdminSubscriberHistoryEntry, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminTenantSubscriber, type AdminUserListFilter, type AdminUserListRow, type AdminVatIdCheckOutcome, type AppliedSettingsPort, type AppliedSettingsRecord, type AppliedSettingsValues, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditActor, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, BUNDLE_VERSION_RETIREMENT_CAPABILITY, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRetirementAnnounced, type BundleRetirementPreview, type BundleRetirementReachedRow, type BundleRetirementSkipReason, type BundleRetirementSkippedRow, type BundleRetirementSwitchResult, type BundleRetirementSwitchTerms, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionOfferView, type BundleVersionOfferedNotice, type BundleVersionRetiredNotice, type BundleVersionRetirementRecord, type BundleVersionRetirementReminder, type BundleVersionRetirementRepository, type BundleVersionRetirementView, type BundleVersionRow, type BundleVersionSide, type BundleVersionSwitchResult, CATALOGUE_KEYS, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, CUSTOM_LIMITS_KEYS, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CancellationNoticePeriods, type CanonicalBundleVersionRetirementRow, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalMaintenanceWindowRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CanonicalRunningContractRow, type CanonicalSubscriberChargeRow, type CanonicalSubscriberCorrectionRow, type CanonicalSubscriberPaymentMethodRow, type CanonicalSubscriberRow, type CanonicalSubscriberTaxOriginChangeRow, type CanonicalSubscriberVatIdCheckRow, type CanonicalSubscriptionBundleRow, type CanonicalSubscriptionNoticeRow, type CanonicalVersionRetirementRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type CatalogVersionKind, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferSelection, type CheckoutOfferSelectionUpdate, type CheckoutOfferStatus, type CleanupResult, type CliUserRow, type ComponentKey, type ConcurrencyGate, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ConfirmedPaymentMethod, type ContractErrorCode, type ContractIssuerParty, type ContractLineItemKind, type ContractLineItemRecord, type ContractSubscriberParty, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriberData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type CustomLimits, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type EmailPort, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, ForeignPaymentMethodReferenceError, type HeldVatId, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type IssuerCorrectionFault, type IssuerIdentityChange, type KpiCardDef, type KpiDisplayHint, LEGAL_IDENTITY_FIELDS, type LegalIdentity, type LegalIdentityField, MAINTENANCE_CAPABILITY, MAINTENANCE_ERROR_CODES, MAINTENANCE_MESSAGE_MAX_LENGTH, MAINTENANCE_STATE_MAX_AGE_SECONDS, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type MaintenanceErrorCode, type MaintenanceLockView, type MaintenanceNotificationPort, type MaintenanceOverview, type MaintenanceStatusView, type MaintenanceUnlockView, type MaintenanceWindowChanges, type MaintenanceWindowEvent, type MaintenanceWindowPort, type MaintenanceWindowRecord, type MaintenanceWindowStage, type MaintenanceWindowStatus, type MaintenanceWindowView, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MaskedPaymentMethod, type MfaPort, NO_SCHEDULED_CHANGE, type NewBundleVersionRetirement, type NewContractLineItemData, type NewMaintenanceWindow, type NewSettingsChange, type NewSubscriberCharge, type NewSubscriberDetails, type NewSubscriptionContractData, type NewVersionRetirement, type NotToldReasons, type NoticeToRecord, OPTIONAL_CANONICAL_MODELS, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, type OptionalBundleMember, type OptionalCanonicalModel, type OrderlyRetirementSettings, PASSWORD_RESET_TTL_MINUTES, PAYMENT_ERROR_CODES, PAYMENT_METHOD_TYPES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PartyAddress, type PasswordHasher, type PasswordResetCliResult, PaymentCallbackRejectedError, type PaymentErrorCode, type PaymentEventClaim, type PaymentEventLog, type PaymentGateway, type PaymentGatewayCallback, type PaymentGatewayEvent, type PaymentMethodHolder, type PaymentMethodSetupSession, type PaymentMethodSetupSubject, type PaymentMethodType, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, PersistenceRefusal, type PersistenceRefusalReason, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogIssuer, type PlanCatalogIssuerCorrection, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogNotifications, type PlanCatalogPaymentAccount, type PlanCatalogPayments, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanCatalogSettings, type PlanCatalogSubscribers, type PlanCatalogTax, type PlanCatalogTenantBilling, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformJobActor, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeHoldRecord, type PromoCodeHoldRepository, type PromoCodeHoldTaken, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionOnPrice, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicNewPaymentMethods, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, RETIREMENT_REMINDER_LEAD_DAYS, type ReadCustomLimits, type ReassignTenantAdminCliResult, type RecommendablePlan, type RecordSubscriberPaymentMethodData, type RecordSubscriberPaymentMethodOutcome, type RecordSubscriberPaymentMethodResult, type RecordedVatIdCheck, type RedeemPromoInTransactionCallback, type RegistrationActivation, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationBillingDetails, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResolvableErrorBody, type ResumeRegistrationInput, type ResumeRegistrationResult, type RetiredBundleVersionRef, type RetiredVersionRef, type RetirementAnnounced, type RetirementBlocker, type RetirementMoveRun, type RetirementPreview, type RetirementPricedSide, type RetirementProgress, type RetirementReachedRow, type RetirementSide, type RetirementSkipReason, type RetirementSkippedRow, type RetirementSwitchResult, type RetirementSwitchTerms, type ReviewCatalogEntryData, type RlsBypassPort, type RunningContractIssuer, type RunningContractIssuers, SETTINGS_ERROR_CODES, SETUP_ERROR_CODES, SUBSCRIBER_ACCOUNT_CAPABILITY, SUBSCRIBER_ATTENTION_CAPABILITY, SUBSCRIBER_ATTENTION_PAGE_SIZE, SUBSCRIBER_CORRECTION_CAPABILITY, SUBSCRIBER_ERROR_CODES, SUBSCRIBER_INVOICE_ADDRESS_FIELDS, SUBSCRIBER_STANDING_CAPABILITY, SUBSCRIBER_TAX_ORIGIN_FIELDS, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePayments, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledChangeColumns, type ScheduledPlanChangeInput, type SecretSealer, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SelfServiceBlockedPlans, type SetCatalogEntryReviewData, type SettingsChangeFilter, type SettingsChangeRecord, type SettingsDifference, type SettingsErrorCode, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartPaymentMethodSetupInput, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type SubscriberBusinessStatusData, type SubscriberBusinessStatusResult, type SubscriberCharge, type SubscriberChargeOrigin, type SubscriberChargeRecord, type SubscriberChargeSource, type SubscriberContact, type SubscriberContactChange, type SubscriberCorrectionData, type SubscriberCorrectionRecord, type SubscriberCorrectionResult, type SubscriberDetails, type SubscriberErrorCode, type SubscriberIdentityCorrection, type SubscriberIdentityDelta, type SubscriberIdentityValues, type SubscriberInvoiceAddressField, type SubscriberLedgerRepository, type SubscriberPaymentMethodRecord, type SubscriberPaymentMethodReference, type SubscriberPaymentMethodRepository, type SubscriberPaymentMethodSetupData, type SubscriberPaymentMethodSetupMatch, type SubscriberPaymentMethodStatus, type SubscriberReadiness, type SubscriberRecord, type SubscriberRepository, type SubscriberTaxOrigin, type SubscriberTaxOriginChangeRecord, type SubscriberTaxOriginField, type SubscriberTaxOriginValues, type SubscriberTaxStatus, type SubscriberVatIdCheckRecord, type SubscriberVatIdCheckResult, type SubscriberWithCurrentCheck, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractParties, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionNotice, type SubscriptionNoticeDelivery, type SubscriptionNoticeKey, type SubscriptionNoticeKind, type SubscriptionNoticePort, type SubscriptionNoticeRecord, type SubscriptionNoticeRepository, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SupersedeSubscriptionContractData, type SyncDiscoveryResult, TAX_ERROR_CODES, TAX_TREATMENT_KINDS, type TaxAdapter, type TaxAdapterFactory, type TaxAdapterIdentity, type TaxDecision, type TaxDecisionRequest, type TaxErrorCode, type TaxIssuer, type TaxOriginWrite, type TaxTreatment, type TaxTreatmentKind, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionUsage, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, VERSION_RETIREMENT_CAPABILITY, type VatIdCheck, type VatIdCheckOutcome, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionOffer, type VersionOfferClass, type VersionOfferFields, type VersionOfferSide, type VersionOfferView, type VersionOfferedNotice, type VersionRetiredNotice, type VersionRetirementRecord, type VersionRetirementReminder, type VersionRetirementRepository, type VersionRetirementView, type VersionSale, type VersionSaleDates, type VersionSaleKind, type VersionSwitchResult, type VersionWindow, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleKeyTaken, bundleStemDefaults, canonicalJson, canonicalVatId, catalogDraftExists, catalogVersionAlreadyPublished, catalogVersionGone, classifyBundleVersionDiff, classifyIssuerChange, classifyPlanDiff, classifyVersionOffer, collectUnsatisfiedRequires, computeIncludedVat, concurrencyGate, concurrencyGateOf, contractPartiesOf, coverageExcludingSelf, customLimitsReader, definedFields, diffSettings, formatCustomerNumber, formatErrorMessage, grossFromNet, identityCorrectionDelta, isBundleRedundant, isForeignPaymentMethodReferenceError, isMaintenanceAnnouncementLapsed, isMaintenanceOverrun, isPaymentCallbackRejectedError, isPersistenceRefusal, isPlatformUserExistsError, isVersionActiveAt, isVersionEditable, issuerIdentityOf, keepOneRecommended, keepsVatIdCheck, maintenanceRetryAfterSeconds, maintenanceStatusOf, maintenanceWindowStatusOf, maintenanceWindowViewOf, marketingProjectionTaken, membersLeftOut, missingRequiresFor, movedIdentityFields, netFromGross, noActivePlanVersion, parseZonedInstant, percentOf, pickActivePromo, planCatalogSettingsOf, planKeyTaken, planNotInCatalog, previousUtcDay, promoCodeTaken, promoStatus, promotionOnPrice, prorate, readCustomLimits, readQuotaRecord, readQuotaValue, recordedIssuerIdentity, refuseForeignPaymentMethodReference, resolveBundleAvailability, resolveErrorMessage, retirementCostsTheSubscription, retirementReminderDueAt, retirementReminderIsDue, retirementSwitchTerms, roundToCents, sameLegalIdentity, scheduledChangeAfterWrite, selectChargeableBundles, settingsSubtreeOf, startOfUtcDay, subscriberChargeColumns, subscriberFromRegistration, subscriberPaymentMethodColumns, subscriptionBundleAlreadyCancelled, subscriptionBundleGone, subscriptionContractGone, subscriptionGone, sumToCents, taxOriginOf, taxOriginWrite, taxTreatmentToJson, toBundleStemRow, toBundleVersionRetirementRecord, toCents, toContractLineItemRecord, toDecimalString, toMaintenanceWindowRecord, toPlanRow, toPlanVersionRow, toRunningContractIssuer, toSubscriberChargeRecord, toSubscriberCorrectionRecord, toSubscriberPaymentMethodRecord, toSubscriberRecord, toSubscriberTaxOriginChangeRecord, toSubscriberVatIdCheckRecord, toSubscriptionBundleRecord, toSubscriptionContractRecord, toSubscriptionNoticeRecord, toTaxOriginValues, toTaxTreatment, toVersionRetirementRecord, vatIdCheckFromStore, versionOnSale, versionOnSaleOrNext, versionSale };