@saasicat/core 1.0.0-rc.5 → 1.0.0-rc.7

package/dist/index.d.cts

@@ -1,5 +1,17 @@
 /** Start of day (00:00 UTC) of the moment — for day-inclusive date comparisons. */
 declare function startOfUtcDay(date: Date): Date;
+/**
+ * The day before `value` — how a validity window closes when its successor
+ * opens (`validUntil = successor.validFrom − 1 day`, the rule this module's
+ * header states and `startOfUtcDay` above is the reading half of).
+ *
+ * It lived as three separate expressions before 2026-08-27: one in each
+ * adapter's publish path and one in the bundle repository, all agreeing by
+ * coincidence rather than by construction. Day arithmetic rather than
+ * `− 24 * 60 * 60 * 1000`: the subtraction is only equivalent while the value
+ * is a UTC midnight, and nothing in the type says it is.
+ */
+declare function previousUtcDay(value: Date): Date;
 /** `<=` upper bound for a date (structurally Prisma-compatible). */
 interface DateAtOrBefore {
     lte: Date;
@@ -73,256 +85,6 @@ type ActiveVersionWhereWithEndsAt = ActivePlanVersionWhereWithEndsAt;
  */
 declare const buildActiveVersionWhere: typeof buildActivePlanVersionWhere;
 
-type FeatureKey = string;
-type PlanId = string;
-type QuotaKey = string;
-interface FeatureDef {
-    key: FeatureKey;
-    label?: string;
-    icon?: string;
-    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
-    tier?: string;
-    plannedOnly?: boolean;
-}
-interface PlanDef {
-    id: PlanId;
-    name?: string;
-    tagline?: string;
-    /** false = not selectable in self-service onboarding. Default: true. */
-    marketed?: boolean;
-    /** Highlighted card in onboarding (max. 1 per catalog). */
-    popular?: boolean;
-    /** Net monthly price. null = on request. */
-    monthlyNet?: number | null;
-    /** Net total amount per year. null = monthly only. */
-    yearlyNet?: number | null;
-    /** Map quotaKey → max value. -1 = unlimited. */
-    quotas: Record<QuotaKey, number>;
-    features: FeatureKey[];
-}
-/** App-wide marketing configuration. */
-interface PlanCatalogMarketing {
-    /**
-     * Allowed language pool that the app may market. First = default
-     * locale. From it, the SuperAdmin activates a subset in the marketing
-     * catalog (LocaleManager).
-     */
-    availableLocales: string[];
-}
-/**
- * App identity block for branding + version. Consumed by the `AdminPublicBootController`
- * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
- * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
- *
- * `name` = brand display name (e.g. "DemoApp", "ClubApp").
- * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
- * `version` = app version string (build info).
- * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
- * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
- *             instead of the initials badge.
- */
-interface PlanCatalogApp {
-    name: string;
-    label?: string;
-    version?: string;
-    icon?: string;
-    logoUrl?: string;
-}
-interface PlanCatalog {
-    schemaVersion: 1;
-    projectKey: string;
-    /** App identity (branding + version), see PlanCatalogApp. Optional. */
-    app?: PlanCatalogApp;
-    /** ISO-4217 currency code. */
-    currency: string;
-    /** VAT rate in percent. */
-    vatRate: number;
-    /** App-wide marketing configuration. Optional. */
-    marketing?: PlanCatalogMarketing;
-    features?: FeatureDef[];
-    /**
-     * Optional. When omitted, plans come exclusively from the
-     * AdminUI / DB table (Plans/PlanVersions lifecycle).
-     */
-    plans?: PlanDef[];
-}
-
-/** Backend capability key, convention: domain.action[.action]. */
-type CapabilityKey = string;
-/** Frontend action-registry key. Same convention as CapabilityKey. */
-type ActionKey = CapabilityKey;
-/** Lookup key in the static extensions: map of the UI build. */
-type ComponentKey = string;
-interface AdminManifest {
-    schemaVersion: 1;
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-        /**
-         * Allowed locale pool from the app config (`saas.yaml`
-         * `marketing.availableLocales`). First = default..
-         */
-        availableLocales?: string[];
-        /** Default locale; equals `availableLocales[0]`. */
-        defaultLocale?: string;
-    };
-    build: {
-        platformPackageVersion: string;
-        appVersion: string;
-        manifestHash: string;
-    };
-    planCatalogSnapshot: {
-        source: string;
-        hash: string;
-        currency: string;
-        vatRate: number;
-        features?: FeatureDef[];
-        plans: PlanDef[];
-    };
-    /** Map CapabilityKey → boolean. Manifest is never a security source. */
-    capabilities: Record<CapabilityKey, boolean>;
-    navigation: {
-        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory';
-interface StandardPageDef {
-    enabled: boolean;
-    requiredCapability?: CapabilityKey;
-}
-interface ProjectPageDef {
-    /** `<projectKey>.<area>`, e.g. `demoapp.datev`. */
-    id: string;
-    label: string;
-    icon?: string;
-    /** Frontend route, e.g. `/admin/datev`. */
-    route: string;
-    navSection?: string;
-    /** Lookup in the static extensions: map of the shell build. */
-    componentKey: ComponentKey;
-    requiredCapability?: CapabilityKey;
-    prefetchOnIdle?: boolean;
-}
-interface KpiCardDef {
-    id: string;
-    label: string;
-    /** Required path: /api/v1/admin/(extras|dashboard)/... */
-    endpoint: string;
-    displayHint: KpiDisplayHint;
-    /** 0–100; UI sorts descending. */
-    slotPriority?: number;
-    requiredCapability?: CapabilityKey;
-}
-interface KpiDisplayHint {
-    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
-    icon?: string;
-}
-interface TenantColumnDef {
-    key: string;
-    label: string;
-    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
-    endpoint: string;
-    requiredCapability?: CapabilityKey;
-}
-interface TenantActionDef {
-    /** `<projectKey>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
-    id: string;
-    label: string;
-    /** Lookup in the static actions: map of the shell build. */
-    actionKey: ActionKey;
-    requiredCapability?: CapabilityKey;
-    requiresMfa?: boolean;
-    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
-}
-interface AuditActionDef {
-    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
-    key: string;
-    label: string;
-    severity?: 'info' | 'low' | 'medium' | 'high';
-}
-interface ManifestContribution {
-    capabilities?: Record<CapabilityKey, boolean>;
-    navigation?: {
-        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
-        projectPages?: ProjectPageDef[];
-    };
-    dashboard?: {
-        kpiCards?: KpiCardDef[];
-    };
-    tenants?: {
-        columns?: TenantColumnDef[];
-        actions?: TenantActionDef[];
-    };
-    audit?: {
-        actions?: AuditActionDef[];
-    };
-}
-interface PublicBootResponse {
-    project: {
-        key: string;
-        displayName: string;
-        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
-        label?: string;
-        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
-        icon?: string;
-        logoUrl?: string;
-        environment?: 'production' | 'staging' | 'development';
-    };
-}
-
-/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
-type ActorTag = string;
-interface AuditEntry {
-    id: string;
-    /** null = platform action without tenant context (SUPER_ADMIN). */
-    tenantId: string | null;
-    /** null = system / cron-triggered. */
-    userId: string | null;
-    /** Convenience field; backend resolves it from userId. */
-    userEmail: string | null;
-    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
-    entity: string;
-    entityId: string;
-    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
-    action: string;
-    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
-    changes: Record<string, unknown> | null;
-    actorTag: ActorTag | null;
-    ipAddress: string | null;
-    userAgent: string | null;
-    createdAt: string;
-}
-interface AuditQuery {
-    tenantId?: string;
-    userId?: string;
-    entity?: string;
-    entityId?: string;
-    action?: string;
-    /** Wildcard-capable, e.g. 'cli:*'. */
-    actorTag?: string;
-    from?: string;
-    to?: string;
-    page?: number;
-    pageSize?: number;
-}
-
 /**
  * Approval lifecycle of a feature or a quota. Approval happens per
  * FEATURE/QUOTA — not per capability (#20); only `approved` entries
@@ -385,7 +147,6 @@ type CatalogEntryI18n = Record<string, CatalogEntryI18nFields>;
  */
 interface CapabilityCatalogEntryRow {
     id: string;
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -422,7 +183,6 @@ type FeatureTier = 'CORE' | 'ADVANCED' | 'PRO' | 'ENTERPRISE' | string;
  */
 interface FeatureCatalogEntryRow {
     id: string;
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -477,7 +237,6 @@ interface FeatureCatalogEntryRow {
  */
 interface QuotaCatalogEntryRow {
     id: string;
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -521,7 +280,6 @@ interface QuotaCatalogEntryRow {
  * matching field is relevant.
  */
 interface CatalogEntryFilter {
-    projectKey: string;
     discoveryStatus?: DiscoveryStatus;
     codeStatus?: CapabilityCodeStatus;
 }
@@ -635,7 +393,6 @@ declare const MARKETING_PRIORITY_MAX = 10000;
  */
 interface MarketingProjectionRow {
     id: string;
-    projectKey: string;
     targetType: MarketingTargetType;
     targetVersionId: string;
     /** ISO-639-1, optionally with region suffix (`de`, `en`, `de-AT`). */
@@ -680,15 +437,13 @@ interface MarketingProjectionRow {
     createdAt: string;
     updatedAt: string;
 }
-/** Filter for `MarketingProjectionRepository.list()`. At least projectKey. */
+/** Filter for `MarketingProjectionRepository.list()`. */
 interface MarketingProjectionFilter {
-    projectKey: string;
     targetType?: MarketingTargetType;
     targetVersionId?: string;
     locale?: string;
 }
 interface CreateMarketingProjectionData {
-    projectKey: string;
     targetType: MarketingTargetType;
     targetVersionId: string;
     locale?: string;
@@ -718,14 +473,87 @@ interface UpdateMarketingProjectionData {
     highlight?: boolean;
 }
 
-type PromoCodeValueType = 'PERCENT' | 'ABSOLUTE';
-type PromoCodeDurationType = 'ONCE' | 'MONTHS' | 'BILLING_CYCLES';
-type PromoCodeStatus = 'ACTIVE' | 'PAUSED' | 'EXHAUSTED' | 'EXPIRED';
-type PromoCodeRedemptionStatus = 'ACTIVE' | 'REVERSED' | 'EXPIRED';
-type BillingCycle = 'MONTHLY' | 'YEARLY';
-type PromoCodeValidationResult = 'VALID' | 'EXPIRED' | 'EXHAUSTED' | 'NOT_FOUND' | 'PAUSED' | 'NOT_APPLICABLE' | 'FIRST_TIME_ONLY' | 'ZERO_INVOICE_BLOCKED' | 'MIN_AMOUNT_NOT_REACHED' | 'RATE_LIMITED';
-interface CreatePromoCodeRequest {
-    /** A–Z, 0–9, '-' and '_'; 4–32 characters; case-insensitive, stored in UPPER. */
+type FeatureKey = string;
+type PlanId = string;
+type QuotaKey = string;
+interface FeatureDef {
+    key: FeatureKey;
+    label?: string;
+    icon?: string;
+    /** CORE / ADVANCED / PRO / BUSINESS / ENTERPRISE_ONLY — convention. */
+    tier?: string;
+    plannedOnly?: boolean;
+}
+interface PlanDef {
+    id: PlanId;
+    name?: string;
+    tagline?: string;
+    /** false = not selectable in self-service onboarding. Default: true. */
+    marketed?: boolean;
+    /** Highlighted card in onboarding (max. 1 per catalog). */
+    popular?: boolean;
+    /** Net monthly price. null = on request. */
+    monthlyNet?: number | null;
+    /** Net total amount per year. null = monthly only. */
+    yearlyNet?: number | null;
+    /** Map quotaKey → max value. -1 = unlimited. */
+    quotas: Record<QuotaKey, number>;
+    features: FeatureKey[];
+}
+/** App-wide marketing configuration. */
+interface PlanCatalogMarketing {
+    /**
+     * Allowed language pool that the app may market. First = default
+     * locale. From it, the SuperAdmin activates a subset in the marketing
+     * catalog (LocaleManager).
+     */
+    availableLocales: string[];
+}
+/**
+ * App identity block for branding + version. Consumed by the `AdminPublicBootController`
+ * and the `AdminManifestConfigFactory`; the SuperAdmin UI (platform
+ * LoginPage, AdminLayout brand block) reads the same fields via PublicBoot.
+ *
+ * `name` = brand display name (e.g. "DemoApp", "ClubApp").
+ * `label` = tag/subtitle in the brand block (e.g. "SuperAdmin").
+ * `version` = app version string (build info).
+ * `icon` = 2-character abbreviation for the logo badge (e.g. "ma", "da").
+ * `logoUrl` = optional URL to a PNG/SVG; if set, the UI renders an <img>
+ *             instead of the initials badge.
+ */
+interface PlanCatalogApp {
+    name: string;
+    label?: string;
+    version?: string;
+    icon?: string;
+    logoUrl?: string;
+}
+interface PlanCatalog {
+    schemaVersion: 1;
+    /** App identity (branding + version), see PlanCatalogApp. */
+    app: PlanCatalogApp;
+    /** ISO-4217 currency code. */
+    currency: string;
+    /** VAT rate in percent. */
+    vatRate: number;
+    /** App-wide marketing configuration. Optional. */
+    marketing?: PlanCatalogMarketing;
+    features?: FeatureDef[];
+    /**
+     * Optional. When omitted, plans come exclusively from the
+     * AdminUI / DB table (Plans/PlanVersions lifecycle).
+     */
+    plans?: PlanDef[];
+}
+
+type PromoCodeValueType = 'PERCENT' | 'ABSOLUTE';
+type PromoCodeDurationType = 'ONCE' | 'MONTHS' | 'BILLING_CYCLES';
+type PromoCodeStatus = 'ACTIVE' | 'PAUSED' | 'EXHAUSTED' | 'EXPIRED';
+type PromoCodeRedemptionStatus = 'ACTIVE' | 'REVERSED' | 'EXPIRED';
+type BillingCycle = 'MONTHLY' | 'YEARLY';
+type PromoCodeValidationResult = 'VALID' | 'EXPIRED' | 'EXHAUSTED' | 'NOT_FOUND' | 'PAUSED' | 'NOT_APPLICABLE' | 'FIRST_TIME_ONLY' | 'ZERO_INVOICE_BLOCKED' | 'MIN_AMOUNT_NOT_REACHED' | 'RATE_LIMITED';
+interface CreatePromoCodeRequest {
+    /** A–Z, 0–9, '-' and '_'; 4–32 characters; case-insensitive, stored in UPPER. */
     code: string;
     valueType: PromoCodeValueType;
     /** For PERCENT: 0.01–100. For ABSOLUTE: > 0 in catalog currency. */
@@ -914,7 +742,7 @@ interface VersionedEntityBase {
  *   own migration).
  * - `startedAt` is the contract start of this booking.
  * - `minimumTermEndsAt` = end of the minimum term; `null` = no minimum term
- *   (platform default = 12 months, set service-side).
+ *   (platform default = no commitment, set service-side).
  * - `canceledAt` / `canceledEffectiveAt`: cancellation anchor vs. effective
  *   date. Before the minimum term ends, `canceledEffectiveAt =
  *   minimumTermEndsAt`, otherwise the subscription's period end.
@@ -931,6 +759,18 @@ interface SubscriptionBundleRecord {
     minimumTermEndsAt: Date | null;
     canceledAt: Date | null;
     canceledEffectiveAt: Date | null;
+    /**
+     * The rhythm this booking is billed in, and the window it is billed for.
+     *
+     * A bundle's periods end on the day its plan's do — the first one short,
+     * from the booking to the next occurrence of that day, and every one after
+     * it anchor to anchor. Null on a booking made before these fields existed,
+     * or on one whose plan has no period; readers fall back to the plan's
+     * cycle, which is what every booking used before.
+     */
+    billingCycle: string | null;
+    currentPeriodStart: Date | null;
+    currentPeriodEnd: Date | null;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -944,14 +784,27 @@ interface SubscriptionBundleRecord {
 interface SubscriptionBundleView extends SubscriptionBundleRecord {
     bundleKey: string | null;
     label: string | null;
-    monthlyNet: string | null;
+    /**
+     * What this booking is billed at, in the rhythm it was booked in and with
+     * the plan's pricing override applied.
+     *
+     * It was `monthlyNet` until 2026-08-27 and carried the bundle's base
+     * monthly price whatever the booking was — so a yearly booking of a bundle
+     * priced 10 monthly and 100 yearly reported 10. The name was half the
+     * defect: a field called `monthlyNet` on a yearly booking cannot be right.
+     */
+    priceNet: number | null;
 }
 interface CreateSubscriptionBundleData {
     subscriptionId: string;
     bundleVersionId: string;
     startedAt: Date;
-    /** Default = startedAt + 12 months, unless set. */
+    /** Null unless a commitment was configured or asked for. */
     minimumTermEndsAt?: Date | null;
+    /** The rhythm and window worked out above this port. */
+    billingCycle?: string | null;
+    currentPeriodStart?: Date | null;
+    currentPeriodEnd?: Date | null;
 }
 interface CancelSubscriptionBundleData {
     canceledAt: Date;
@@ -1000,7 +853,6 @@ interface BundlePricingOverride {
  */
 interface BundleRow {
     id: string;
-    projectKey: string;
     bundleKey: string;
     label: string;
     description: string | null;
@@ -1039,7 +891,6 @@ interface BundleVersionRow extends VersionedEntityBase {
  * first BundleVersion via `CreateBundleVersionDraftData`.
  */
 interface CreateBundleData {
-    projectKey: string;
     bundleKey: string;
     label: string;
     description?: string | null;
@@ -1048,9 +899,9 @@ interface CreateBundleData {
     i18n?: CatalogEntryI18n;
 }
 /**
- * Fields that may be changed on the bundle master. `bundleKey` and
- * `projectKey` are intentionally not here — master identity is immutable;
- * whoever wants to change them creates a new bundle and retires the old one.
+ * Fields that may be changed on the bundle master. `bundleKey` is
+ * intentionally not here — master identity is immutable; whoever wants to
+ * change it creates a new bundle and retires the old one.
  */
 interface UpdateBundleData {
     label?: string;
@@ -1116,73 +967,330 @@ interface UpdateBundleVersionDraftData {
     validFrom?: string | null;
     validUntil?: string | null;
 }
-/**
- * Input for `publishBundleVersion()`. `nonRegressive` and
- * `publishedChanges` are computed by the service from the diff against the
- * predecessor version; the caller supplies only confirmation
- * + user tag + validity dates.
- *
- * `validFrom` is **required** at publish (analogous to `PublishPlanVersionData`).
- * If the draft already carries a `validFrom`, it is optional here. The
- * service validates strictly > `validFrom` of the predecessor version and sets
- * its `validUntil` via auto succession to `validFrom - 1 day`.
- */
-interface PublishBundleVersionData {
-    publishedByUserId: string | null;
-    /**
-     * If true and the diff classifies the version as regressive,
-     * it is published anyway — relevant for bulk-publish MFA confirmation
-     * ( editor-UI obligations).
-     */
-    forceRegressive?: boolean;
-    /**
-     * Allows publish despite an explicit price of 0.00. Default false: an
-     * explicit 0.00 publish is blocked (protection against seed placeholders).
-     * `null` prices (override resolution) are not affected.
-     */
-    allowZeroPrice?: boolean;
-    /**
-     * Required at publish if the draft has no `validFrom`. Must lie
-     * strictly after `validFrom` of the predecessor version. ISO-8601
-     * (`YYYY-MM-DD` or full timestamp).
-     */
-    validFrom?: string | null;
-    /**
-     * Optional; null = valid indefinitely (fits the last version
-     * of a bundle). When a successor version is created it is automatically
-     * overwritten by the service.
-     */
-    validUntil?: string | null;
+/**
+ * Input for `publishBundleVersion()`. `nonRegressive` and
+ * `publishedChanges` are computed by the service from the diff against the
+ * predecessor version; the caller supplies only confirmation
+ * + user tag + validity dates.
+ *
+ * `validFrom` is **required** at publish (analogous to `PublishPlanVersionData`).
+ * If the draft already carries a `validFrom`, it is optional here. The
+ * service validates strictly > `validFrom` of the predecessor version and sets
+ * its `validUntil` via auto succession to `validFrom - 1 day`.
+ */
+interface PublishBundleVersionData {
+    publishedByUserId: string | null;
+    /**
+     * If true and the diff classifies the version as regressive,
+     * it is published anyway — relevant for bulk-publish MFA confirmation
+     * ( editor-UI obligations).
+     */
+    forceRegressive?: boolean;
+    /**
+     * Allows publish despite an explicit price of 0.00. Default false: an
+     * explicit 0.00 publish is blocked (protection against seed placeholders).
+     * `null` prices (override resolution) are not affected.
+     */
+    allowZeroPrice?: boolean;
+    /**
+     * Required at publish if the draft has no `validFrom`. Must lie
+     * strictly after `validFrom` of the predecessor version. ISO-8601
+     * (`YYYY-MM-DD` or full timestamp).
+     */
+    validFrom?: string | null;
+    /**
+     * Optional; null = valid indefinitely (fits the last version
+     * of a bundle). When a successor version is created it is automatically
+     * overwritten by the service.
+     */
+    validUntil?: string | null;
+}
+/**
+ * Code of a strict-mode violation. lists the eight rules
+ * that are checked; each rule has its own code so the UI can show
+ * focused help texts.
+ */
+type StrictModeWarningCode = 'CAPABILITY_MISSING' | 'CAPABILITY_RETIRED' | 'FEATURE_MISSING' | 'FEATURE_PLANNED_ONLY' | 'BUNDLE_FEATURE_UNKNOWN' | 'BUNDLE_PLAN_KEY_UNKNOWN' | 'PLAN_FEATURE_UNKNOWN' | 'PLAN_FEATURE_NOT_APPROVED' | 'BUNDLE_FEATURE_NOT_APPROVED' | 'PLAN_FEATURE_DEPENDENCY_UNSATISFIED' | 'BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED' | 'QUOTA_MISSING' | 'QUOTA_NOT_APPROVED' | 'VERSION_PUBLISH_OVERLAP';
+/**
+ * A strict-mode violation. `field` points to the violating field
+ * (e.g. `'features[3]'`), `value` is the concrete value (e.g. `'INVENTORY'`).
+ */
+interface StrictModeWarning {
+    code: StrictModeWarningCode;
+    /** Human-readable reason (German). */
+    message: string;
+    /** Path to the violating field; optional. */
+    field?: string;
+    /** The concrete violating value; optional. */
+    value?: string;
+}
+/**
+ * Service result for mutating Bundle operations
+ * (createDraft, updateDraft, publish): returns the persisted row plus
+ * a list of strict-mode warnings. In `warn-only` mode the
+ * warnings go into the UI as a banner; in `blocking` mode the service throws
+ * HTTP 422 instead, with the same warning list as the body.
+ */
+interface BundleVersionMutationResult {
+    bundleVersion: BundleVersionRow;
+    warnings: StrictModeWarning[];
+}
+
+/**
+ * The column values a new BundleVersion draft starts from.
+ *
+ * Every adapter has to apply the same defaults — an absent quota map is `{}`,
+ * an absent price is null rather than zero, an unstated `marketed` is true —
+ * and two adapters spelling that out separately is the same decision written
+ * twice. It is also the variant jscpd does catch, which is how this came out:
+ * `adapter-drizzle` learning about bundles put a second copy beside
+ * `adapter-prisma`'s.
+ *
+ * Validity windows are deliberately absent. Whether a draft carries
+ * `validFrom`/`validUntil` is an adapter capability rather than a default, and
+ * an adapter that does not maintain those columns must not write them.
+ */
+declare function bundleDraftDefaults(data: CreateBundleVersionDraftData): {
+    baseVersionId: string | null;
+    features: string[];
+    quotas: Record<string, number>;
+    compatibility: Record<string, unknown>;
+    pricingOverrides: unknown[];
+    monthlyNet: string | null;
+    yearlyNet: string | null;
+    marketed: boolean;
+    changeNote: string;
+    createdByUserId: string | null;
+};
+/**
+ * The column values a new Bundle stem starts from.
+ *
+ * The same defaulting rule as above, one level up: an absent description or
+ * icon is null rather than an empty string, an unstated sort order is 0, an
+ * absent translation map is `{}`. Written out in five places before this — two
+ * adapters and two fakes — which is four opportunities for one of them to
+ * decide differently.
+ */
+declare function bundleStemDefaults(data: CreateBundleData): {
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: CatalogEntryI18n;
+};
+/** The stored shape both adapters read a bundle stem back from. */
+interface StoredBundleStem {
+    id: string;
+    bundleKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    i18n: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/**
+ * A stored bundle stem as the port describes it.
+ *
+ * The two stores spell the columns identically, so the mapping was identical
+ * too — and an identical mapping in two files is one place for a field to be
+ * forgotten when the row grows. `i18n` arrives as JSON of unknown shape from
+ * both, and a non-object becomes `{}` rather than reaching a caller that
+ * expects a map.
+ */
+declare function toBundleStemRow(row: StoredBundleStem): BundleRow;
+/**
+ * The fields a caller actually gave, as a patch.
+ *
+ * The update DTOs in this codebase mean three different things by three
+ * different values: a value changes the column, an explicit `null` clears it,
+ * and an **omitted** field leaves it alone. Only the last one needs care, and
+ * it was written out as `...(data.x !== undefined ? { x: data.x } : {})` more
+ * than fifty times across five repositories — one decision, fifty
+ * opportunities to spell it differently, and the duplication ratchet is what
+ * finally pointed at it.
+ *
+ * `null` is deliberately kept: it is a value a caller chose, not an absence.
+ */
+declare function definedFields<T extends object, K extends keyof T>(data: T, keys: readonly K[]): Partial<Pick<T, K>>;
+
+/** Backend capability key, convention: domain.action[.action]. */
+type CapabilityKey = string;
+/** Frontend action-registry key. Same convention as CapabilityKey. */
+type ActionKey = CapabilityKey;
+/** Lookup key in the static extensions: map of the UI build. */
+type ComponentKey = string;
+interface AdminManifest {
+    schemaVersion: 1;
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+        /**
+         * Allowed locale pool from the app config (`saas.yaml`
+         * `marketing.availableLocales`). First = default..
+         */
+        availableLocales?: string[];
+        /** Default locale; equals `availableLocales[0]`. */
+        defaultLocale?: string;
+    };
+    build: {
+        platformPackageVersion: string;
+        appVersion: string;
+        manifestHash: string;
+    };
+    planCatalogSnapshot: {
+        source: string;
+        hash: string;
+        currency: string;
+        vatRate: number;
+        features?: FeatureDef[];
+        plans: PlanDef[];
+    };
+    /** Map CapabilityKey → boolean. Manifest is never a security source. */
+    capabilities: Record<CapabilityKey, boolean>;
+    navigation: {
+        standardPages: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
+}
+type StandardPageKey = 'dashboard' | 'tenants' | 'subscriptions' | 'promoCodes' | 'plans' | 'audit' | 'users' | 'pilots' | 'discovery' | 'bundles' | 'marketingCatalog' | 'platformEmail' | 'platformEmailHistory';
+interface StandardPageDef {
+    enabled: boolean;
+    requiredCapability?: CapabilityKey;
+}
+interface ProjectPageDef {
+    /** `<app>.<area>`, e.g. `demoapp.datev`. */
+    id: string;
+    label: string;
+    icon?: string;
+    /** Frontend route, e.g. `/admin/datev`. */
+    route: string;
+    navSection?: string;
+    /** Lookup in the static extensions: map of the shell build. */
+    componentKey: ComponentKey;
+    requiredCapability?: CapabilityKey;
+    prefetchOnIdle?: boolean;
+}
+interface KpiCardDef {
+    id: string;
+    label: string;
+    /** Required path: /api/v1/admin/(extras|dashboard)/... */
+    endpoint: string;
+    displayHint: KpiDisplayHint;
+    /** 0–100; UI sorts descending. */
+    slotPriority?: number;
+    requiredCapability?: CapabilityKey;
+}
+interface KpiDisplayHint {
+    type: 'value' | 'value+timestamp' | 'value+spark8w' | 'value+delta';
+    icon?: string;
+}
+interface TenantColumnDef {
+    key: string;
+    label: string;
+    /** Required path: /api/v1/admin/extras/...; MUST be batch-capable, no {slug}/{tenantId}. */
+    endpoint: string;
+    requiredCapability?: CapabilityKey;
+}
+interface TenantActionDef {
+    /** `<app>.<area>.<verb>`, e.g. `demoapp.datev.runExport`. */
+    id: string;
+    label: string;
+    /** Lookup in the static actions: map of the shell build. */
+    actionKey: ActionKey;
+    requiredCapability?: CapabilityKey;
+    requiresMfa?: boolean;
+    confirmType?: 'none' | 'simple' | 'typed-slug' | 'typed-production' | 'date';
 }
-/**
- * Code of a strict-mode violation. lists the eight rules
- * that are checked; each rule has its own code so the UI can show
- * focused help texts.
- */
-type StrictModeWarningCode = 'CAPABILITY_MISSING' | 'CAPABILITY_RETIRED' | 'FEATURE_MISSING' | 'FEATURE_PLANNED_ONLY' | 'BUNDLE_FEATURE_UNKNOWN' | 'BUNDLE_PLAN_KEY_UNKNOWN' | 'PLAN_FEATURE_UNKNOWN' | 'PLAN_FEATURE_NOT_APPROVED' | 'BUNDLE_FEATURE_NOT_APPROVED' | 'PLAN_FEATURE_DEPENDENCY_UNSATISFIED' | 'BUNDLE_FEATURE_DEPENDENCY_UNSATISFIED' | 'QUOTA_MISSING' | 'QUOTA_NOT_APPROVED' | 'VERSION_PUBLISH_OVERLAP';
-/**
- * A strict-mode violation. `field` points to the violating field
- * (e.g. `'features[3]'`), `value` is the concrete value (e.g. `'INVENTORY'`).
- */
-interface StrictModeWarning {
-    code: StrictModeWarningCode;
-    /** Human-readable reason (German). */
-    message: string;
-    /** Path to the violating field; optional. */
-    field?: string;
-    /** The concrete violating value; optional. */
-    value?: string;
+interface AuditActionDef {
+    /** SCREAMING_SNAKE_CASE; matched to the AuditLog.action column. */
+    key: string;
+    label: string;
+    severity?: 'info' | 'low' | 'medium' | 'high';
 }
-/**
- * Service result for mutating Bundle operations
- * (createDraft, updateDraft, publish): returns the persisted row plus
- * a list of strict-mode warnings. In `warn-only` mode the
- * warnings go into the UI as a banner; in `blocking` mode the service throws
- * HTTP 422 instead, with the same warning list as the body.
- */
-interface BundleVersionMutationResult {
-    bundleVersion: BundleVersionRow;
-    warnings: StrictModeWarning[];
+interface ManifestContribution {
+    capabilities?: Record<CapabilityKey, boolean>;
+    navigation?: {
+        standardPages?: Partial<Record<StandardPageKey, StandardPageDef>>;
+        projectPages?: ProjectPageDef[];
+    };
+    dashboard?: {
+        kpiCards?: KpiCardDef[];
+    };
+    tenants?: {
+        columns?: TenantColumnDef[];
+        actions?: TenantActionDef[];
+    };
+    audit?: {
+        actions?: AuditActionDef[];
+    };
+}
+interface PublicBootResponse {
+    project: {
+        key: string;
+        displayName: string;
+        /** Tag/subtitle (e.g. "SuperAdmin"). From `saas.yaml#app.label`. */
+        label?: string;
+        /** Short abbreviation for the logo badge (e.g. "ma", "da"). From `saas.yaml#app.icon`. */
+        icon?: string;
+        logoUrl?: string;
+        environment?: 'production' | 'staging' | 'development';
+    };
+}
+
+/** Format: 'web:<email>:<sessionId>' or 'cli:<email>:<host>'. */
+type ActorTag = string;
+interface AuditEntry {
+    id: string;
+    /** null = platform action without tenant context (SUPER_ADMIN). */
+    tenantId: string | null;
+    /** null = system / cron-triggered. */
+    userId: string | null;
+    /** Convenience field; backend resolves it from userId. */
+    userEmail: string | null;
+    /** e.g. 'Tenant', 'PromoCode', 'Subscription', 'PlanVersion', 'User'. */
+    entity: string;
+    entityId: string;
+    /** SCREAMING_SNAKE_CASE; past-tense oriented. */
+    action: string;
+    /** Freely structured. Convention: { field: { old, new } } or { reason, ... }. */
+    changes: Record<string, unknown> | null;
+    actorTag: ActorTag | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: string;
+}
+interface AuditQuery {
+    tenantId?: string;
+    userId?: string;
+    entity?: string;
+    entityId?: string;
+    action?: string;
+    /** Wildcard-capable, e.g. 'cli:*'. */
+    actorTag?: string;
+    from?: string;
+    to?: string;
+    page?: number;
+    pageSize?: number;
 }
 
 /** Promotion type. */
@@ -1213,7 +1321,6 @@ type PromotionI18n = Record<string, PromotionI18nFields>;
 /** Wire format of a `promotions` row. */
 interface PromotionRow {
     id: string;
-    projectKey: string;
     /** Internal label (not public). */
     internalLabel: string;
     type: PromotionType;
@@ -1239,11 +1346,7 @@ interface PromotionRow {
     createdAt: string;
     updatedAt: string;
 }
-interface PromotionFilter {
-    projectKey: string;
-}
 interface CreatePromotionData {
-    projectKey: string;
     internalLabel: string;
     type: PromotionType;
     value: PromotionValue;
@@ -1366,7 +1469,6 @@ type CheckoutOfferStatus = 'open' | 'consumed' | 'expired';
 /** Wire format of a `checkout_offers` row. */
 interface CheckoutOfferRow {
     id: string;
-    projectKey: string;
     /** Plan selected on the website. */
     planKey: string;
     /** Resolved plan version, if known. */
@@ -1397,12 +1499,10 @@ interface CheckoutOfferRow {
     updatedAt: string;
 }
 interface CheckoutOfferFilter {
-    projectKey: string;
     status?: CheckoutOfferStatus;
 }
 /** Body of `POST /public/checkout-offer` — called from the website. */
 interface CreateCheckoutOfferData {
-    projectKey: string;
     planKey: string;
     planVersionId?: string | null;
     billingCycle: 'monthly' | 'yearly';
@@ -1438,7 +1538,6 @@ interface UpdateCheckoutOfferData {
 
 /** Wire format of the `marketing_settings` row. */
 interface MarketingSettingsRow {
-    projectKey: string;
     /** Runtime-activated subset of the `availableLocales` pool. */
     activeLocales: string[];
     updatedAt: string;
@@ -1556,7 +1655,6 @@ interface PublicComparisonRow {
 }
 /** Response of `GET /public/marketing-catalog`. */
 interface PublicMarketingCatalogResponse {
-    projectKey: string;
     locale: string;
     currency: string;
     /** VAT rate in percent — for the CheckoutOffer price breakdown. */
@@ -1666,7 +1764,7 @@ interface DiscoverySnapshot {
     /** ISO timestamp of the boot-time scan. */
     scannedAt: string;
     app: {
-        /** projectKey, same concept as in the catalog tables. */
+        /** The application's name, from `saas.yaml#app.name`. */
         key: string;
         /** Backend version, e.g. from package.json. */
         version: string;
@@ -1838,7 +1936,6 @@ interface OnboardingPromoRedemption {
 
 interface PlanRow {
     id: string;
-    projectKey: string;
     planKey: string;
     label: string;
     description: string | null;
@@ -1855,7 +1952,6 @@ interface PlanRow {
  * creation (follows in M6 Pack 2).
  */
 interface CreatePlanData {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1863,9 +1959,9 @@ interface CreatePlanData {
     sortOrder?: number;
 }
 /**
- * Fields that may be changed on the plan stem. `planKey` and `projectKey`
- * are deliberately not here — stem identity is immutable; whoever wants to
- * change it creates a new plan and retires the old one.
+ * Fields that may be changed on the plan stem. `planKey` is deliberately not
+ * here — stem identity is immutable; whoever wants to change it creates a new
+ * plan and retires the old one.
  */
 interface UpdatePlanData {
     label?: string;
@@ -1929,7 +2025,6 @@ interface UpsertResult {
     skipReason?: string;
 }
 interface UpsertPlanInput {
-    projectKey: string;
     planKey: string;
     label: string;
     description?: string | null;
@@ -1949,7 +2044,6 @@ interface UpsertPlanVersionInput {
     changeNote: string;
 }
 interface UpsertFeatureCatalogEntryInput {
-    projectKey: string;
     featureKey: FeatureKey;
     label?: string;
     icon?: string;
@@ -1995,7 +2089,7 @@ interface PlanCatalogReadSnapshot {
  * implement it against their Prisma tables.
  */
 interface PlanCatalogReadSink {
-    loadSnapshot(projectKey: string): Promise<PlanCatalogReadSnapshot>;
+    loadSnapshot(): Promise<PlanCatalogReadSnapshot>;
 }
 
 /**
@@ -2439,6 +2533,26 @@ interface PromoRevenueDeductionAggregator {
 
 type ContractLineItemKind = 'plan' | 'bundle' | 'discount';
 type SubscriptionContractStatus = 'active' | 'scheduled' | 'terminated' | 'superseded';
+/**
+ * The statuses a contract is looked up under when asking "what is this tenant
+ * on right now" — `scheduled` included, because a contract that starts today
+ * and has not been switched to `active` yet is still the one in force at its
+ * own `effectiveFrom`.
+ *
+ * One list rather than one per adapter: the two adapters have to answer
+ * `findActiveByTenantId` the same way, and a status added here must not reach
+ * only whichever of them somebody remembered.
+ */
+/**
+ * How many bundle versions one price lookup may name.
+ *
+ * One number rather than two: the server validates against it and the client
+ * batches to stay inside it, and a client that learned the cap by receiving a
+ * 400 would fail silently — the lookup answers with an empty map, and every
+ * card falls back to a catalogue price the tenant may not be charged.
+ */
+declare const BUNDLE_PRICE_LOOKUP_LIMIT = 200;
+declare const ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES: readonly SubscriptionContractStatus[];
 interface ContractLineItemRecord {
     id: string;
     contractId: string;
@@ -2469,7 +2583,6 @@ interface SubscriptionContractPriceSnapshot {
 }
 interface SubscriptionContractRecord {
     id: string;
-    projectKey: string;
     tenantId: string;
     status: SubscriptionContractStatus;
     effectiveFrom: Date;
@@ -2488,7 +2601,6 @@ interface SubscriptionContractRecord {
 }
 type NewContractLineItemData = Omit<ContractLineItemRecord, 'id' | 'contractId' | 'createdAt'>;
 interface CreateSubscriptionContractData {
-    projectKey: string;
     tenantId: string;
     status?: SubscriptionContractStatus;
     effectiveFrom: Date;
@@ -2505,10 +2617,22 @@ interface CreateSubscriptionContractData {
 }
 interface TerminateSubscriptionContractData {
     effectiveUntil: Date;
-    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'>;
+    /**
+     * The terminal status, or `null` to end the contract by date alone.
+     *
+     * `findActiveByTenantId` already asks its question as a window —
+     * `effectiveFrom <= asOf` and `effectiveUntil` null or after it — so a
+     * contract given an end in the FUTURE is found until that moment and not
+     * afterwards, with no scheduled job to flip anything.
+     *
+     * Writing a terminal status instead makes the contract disappear from that
+     * lookup at once, which for a cancellation declared months ahead removes an
+     * agreement the customer is still under. Null is how a caller says "it ends
+     * then", and a status is how it says "it is over now".
+     */
+    status: Extract<SubscriptionContractStatus, 'terminated' | 'superseded'> | null;
 }
 interface SubscriptionContractFilter {
-    projectKey?: string;
     tenantId?: string;
     status?: SubscriptionContractStatus;
     asOf?: Date;
@@ -2530,7 +2654,6 @@ interface InvoiceLineItemSnapshot {
 }
 interface SubscriptionContractInvoiceSnapshot {
     contractId: string;
-    projectKey: string;
     tenantId: string;
     originalOfferId: string | null;
     currency: string;
@@ -2564,6 +2687,24 @@ interface SubscriptionRecord {
     } | null;
     planVersionId: string;
     planVersion: PlanVersionRecord;
+    /**
+     * When a cancellation was declared, and when it takes effect.
+     *
+     * Required, and required together, because entitlement resolution ends a
+     * subscription by reading them: without the second date it cannot tell a
+     * subscription that ends next January from one that ended last January, and
+     * it grants the latter everything. Nothing else in the platform would
+     * notice — no repository filters a cancelled subscription out, and stopping
+     * the billing period is a different decision from ending what a tenant may
+     * do.
+     *
+     * `null` on both means no cancellation. On a row written before the two
+     * fields separated, `canceledAt` carries the effective date and
+     * `canceledEffectiveAt` is genuinely null; every reader in the platform
+     * applies `canceledEffectiveAt ?? canceledAt` for that reason.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
 }
 /** Snapshot of a `PlanVersion` row. */
 interface PlanVersionRecord {
@@ -2620,11 +2761,10 @@ interface SubscriptionRepository {
     countByBundleVersionId?(bundleVersionId: string): Promise<number>;
     /**
      * Counts active subscriptions (status `ACTIVE` or `TRIAL`) per plan key,
-     * platform-wide across all tenants of the project — feeds the tenant
-     * column of the SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
+     * platform-wide across every tenant — feeds the tenant column of the
+     * SuperAdmin plan list (`GET /admin/catalog/plans/tenant-counts`).
      * Cross-version: counts the plan, not a single PlanVersion
-     * (subscriptions on superseded versions are included). `projectKey` is
-     * informational for single-project consumers.
+     * (subscriptions on superseded versions are included).
      *
      * Returns a map `planKey → count`; plans without an active subscription
      * are missing (UI defaults to 0). Platform-wide count across all tenants →
@@ -2632,7 +2772,7 @@ interface SubscriptionRepository {
      *
      * Optional — if not implemented, the tenant column stays 0.
      */
-    countActiveByPlanKey?(projectKey: string): Promise<Record<string, number>>;
+    countActiveByPlanKey?(): Promise<Record<string, number>>;
 }
 /**
  * Adapter for the `subscription_bundles` junction.
@@ -2724,6 +2864,40 @@ interface SubscriptionUsageRecord {
     /** Current period window — for proration and change-effective date. */
     currentPeriodStart: Date | null;
     currentPeriodEnd: Date | null;
+    /**
+     * End of what was committed to, which the period end need not equal.
+     *
+     * The cancellation rules measure against this: a subscription cancelled
+     * inside its term keeps running until the term ends, not until the period
+     * does. Null on a trial, and on any subscription written before the field
+     * existed — readers treat that as "the period end is the answer".
+     */
+    minimumTermUntil?: Date | null;
+    /**
+     * The day of the month the subscription is billed on, 1–31.
+     *
+     * Read by the cancellation rules: a declaration after the notice window
+     * lands one period past the term end, and that step has to measure from the
+     * billing day rather than from a term end that may already have been
+     * clamped by a short month.
+     *
+     * Optional, because an adapter that does not store the column keeps today's
+     * behaviour — the step then takes its day from the term end, which is
+     * correct except in the month after a clamp.
+     */
+    billingAnchorDay?: number | null;
+    /**
+     * When a cancellation was declared, and when it lands.
+     *
+     * Required for the reason the same pair is required on
+     * `SubscriptionRecord`: the tenant billing route reads them to refuse a
+     * plan change on a subscription that has ended, and a record that omits
+     * them answers "not cancelled" — so the change is applied and prorated
+     * while entitlement resolution, which reads a record that does carry them,
+     * grants nothing.
+     */
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
     pendingPlan: string | null;
     pendingBillingCycle: string | null;
     pendingEffectiveAt: Date | null;
@@ -2799,12 +2973,29 @@ interface ImmediatePlanChangeInput {
      * change, or target package without trial). A `Date` is persisted.
      */
     trialEndsAt?: Date | null;
+    /**
+     * `canceledAt` as the caller read it, so the write can claim the row only
+     * while that is still true.
+     *
+     * Three of the plan route's decisions depend on the cancellation — whether
+     * the change is refused at all, whether the billing cycle may move, and
+     * whether a fresh period is opened — and a read and a write are two
+     * moments. A cancellation declared in between made every one of them answer
+     * about a state that no longer existed, and the write went ahead anyway: a
+     * plan term recorded past the date the subscription ends.
+     *
+     * `null` is a value here rather than an absence. It claims a row that has
+     * no cancellation, and loses against one that has acquired one.
+     */
+    expectedCanceledAt: Date | null;
 }
 /** Input for `schedulePlanChange` (change at period end). */
 interface ScheduledPlanChangeInput {
     pendingPlan: string;
     pendingBillingCycle: string;
     pendingEffectiveAt: Date;
+    /** See `ImmediatePlanChangeInput.expectedCanceledAt`. */
+    expectedCanceledAt: Date | null;
 }
 /**
  * Input for `applyOnboardingSelection`. Plan-change fields that the
@@ -2813,6 +3004,12 @@ interface ScheduledPlanChangeInput {
 interface ApplyOnboardingSelectionInput {
     planId: string;
     cycle: string;
+    /**
+     * See `ImmediatePlanChangeInput.expectedCanceledAt`. The atomic path needs
+     * it for the same reason the sequential one does: without it, the preferred
+     * implementation is the one where the race stays open.
+     */
+    expectedCanceledAt: Date | null;
     /** For TRIAL → null, otherwise period start from `initialPeriodWindow`. */
     periodStart: Date | null;
     periodEnd: Date | null;
@@ -2829,6 +3026,12 @@ interface ApplyOnboardingSelectionResult {
     subscriptionId: string;
     /** null if no redeemPromo callback was provided or the callback returned null. */
     promoRedemption: PromoCodeRedemptionRecord | null;
+    /**
+     * False when the row's cancellation moved since the caller read it, in
+     * which case nothing was written — including the promo redemption, which
+     * shares the transaction.
+     */
+    claimed: boolean;
 }
 /**
  * Callback signature for promo-code redemption WITHIN the onboarding
@@ -2846,14 +3049,46 @@ type RedeemPromoInTransactionCallback = (tx: TransactionContext, subscriptionId:
  * app-specific. The platform service calls `invalidateTenant` in the
  * EntitlementService after a successful adapter call.
  */
+/** What `cancelSubscription` is told to write. Named so both adapters spell
+ * the same shape once rather than each restating it. */
+interface CancelSubscriptionInput {
+    canceledAt: Date;
+    effectiveAt: Date;
+    terminateNow: boolean;
+    minimumTermUntil?: Date;
+}
+/** What `cancelSubscription` answers with. */
+interface CancelSubscriptionResult {
+    canceledAt: Date | null;
+    canceledEffectiveAt: Date | null;
+    status: string;
+    /**
+     * True when a cancellation was already recorded and this call changed
+     * nothing — the stored dates are returned instead.
+     *
+     * The caller checks first, but a check and a write are two moments, and two
+     * requests can pass the check before either writes. Straddling a notice
+     * deadline that costs a billing cycle: the first declaration lands on time,
+     * the second recomputes against a later `now`, and an unconditional write
+     * replaces the first answer with one a period further out. An
+     * implementation therefore claims the row only while both cancellation
+     * fields are still empty, and answers `true` here when the claim finds
+     * nothing to claim.
+     */
+    alreadyCanceled: boolean;
+}
 interface TenantSubscriptionWritePort {
     /** Immediate change: set plan + cycle, clear pending fields, optionally reset the period. */
     changePlanImmediate(tenantId: string, input: ImmediatePlanChangeInput): Promise<{
         plan: string;
         billingCycle: string;
+        /** False when the row's cancellation moved since the caller read it. */
+        claimed: boolean;
     }>;
     /** Change at period end: set pending fields. */
-    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<void>;
+    schedulePlanChange(tenantId: string, input: ScheduledPlanChangeInput): Promise<{
+        claimed: boolean;
+    }>;
     /**
      * Marks the pending PlanVersion as accepted. Idempotent — a duplicate
      * accept is a no-op. Returns `alreadyAccepted: true` if the status was
@@ -2866,13 +3101,30 @@ interface TenantSubscriptionWritePort {
         alreadyAccepted: boolean;
     }>;
     /**
-     * Cancel the subscription. `immediate=true` → status CANCELED from now;
-     * `false` → canceledAt = currentPeriodEnd, status is preserved.
+     * Record a cancellation. The dates are decided above this port.
+     *
+     * `canceledAt` is when the customer said it; `effectiveAt` is when it
+     * lands. They differ for every ordinary cancellation, because a
+     * subscription cancelled inside its term keeps running, keeps being billed
+     * and keeps its entitlements until the term ends. An adapter that computed
+     * the second from the first — which this one did, as
+     * `immediate ? now : currentPeriodEnd` — was deciding a commercial
+     * question in a persistence layer, and could not see the minimum term or
+     * the notice period at all.
+     *
+     * `terminateNow` flips the status immediately, and is set when the
+     * cancellation is already effective: an operator ending a contract, or the
+     * rules finding nothing left to run — no period, no term, as on a trial.
+     * It is never a client's request. A tenant may always declare a
+     * cancellation and may never shorten the term they are in; what decides
+     * this flag is the date the rules returned, not the date they asked for.
+     *
+     * `minimumTermUntil` extends the stored commitment, and is set only when
+     * the cancellation itself extends it: a declaration made after the notice
+     * deadline buys the following period. Left unset the stored term end is
+     * unchanged, which is the ordinary case.
      */
-    cancelSubscription(tenantId: string, immediate: boolean, now: Date): Promise<{
-        canceledAt: Date | null;
-        status: string;
-    }>;
+    cancelSubscription(tenantId: string, input: CancelSubscriptionInput): Promise<CancelSubscriptionResult>;
     /**
      * Atomic onboarding creation: sets plan + cycle + period window
      * AND optionally calls a promo-redeem callback — all in a
@@ -3124,7 +3376,6 @@ interface RlsBypassPort {
 
 /** Filter for `PlanRepository.list()`. */
 interface PlanListFilter {
-    projectKey: string;
     /** Exclude soft-deleted plans — default `true`. */
     excludeDeleted?: boolean;
     /**
@@ -3158,7 +3409,7 @@ interface PlanListFilter {
 interface PlanRepository {
     list(filter: PlanListFilter): Promise<PlanRow[]>;
     findById(planId: string): Promise<PlanRow | null>;
-    findByKey(projectKey: string, planKey: string): Promise<PlanRow | null>;
+    findByKey(planKey: string): Promise<PlanRow | null>;
     create(data: CreatePlanData): Promise<PlanRow>;
     update(planId: string, data: UpdatePlanData): Promise<PlanRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted plans are filtered from `list` by default. */
@@ -3259,10 +3510,24 @@ interface PlanRepository {
 }
 /** Filter for `BundleRepository.list()`. */
 interface BundleListFilter {
-    projectKey: string;
     /** Exclude soft-deleted bundles — default `true`. */
     excludeDeleted?: boolean;
 }
+/**
+ * What publishing a bundle draft records.
+ *
+ * Named because it was written out three times — the port, and each adapter's
+ * implementation of it — and a signature restated is a contract restated: the
+ * copies can drift, and nothing but a reader would notice.
+ */
+interface PublishBundleVersionMeta {
+    publishedByUserId: string | null;
+    publishedChanges: VersionChange[];
+    nonRegressive: boolean;
+    /** Required — validated by the service before the repository call. */
+    validFrom: Date;
+    validUntil: Date | null;
+}
 /**
  * Adapter for `Bundle` + `BundleVersion` persistence. Consumers implement
  * this against their Prisma tables (`bundles` + `bundle_versions`).
@@ -3281,7 +3546,7 @@ interface BundleListFilter {
 interface BundleRepository {
     list(filter: BundleListFilter): Promise<BundleRow[]>;
     findById(bundleId: string): Promise<BundleRow | null>;
-    findByKey(projectKey: string, bundleKey: string): Promise<BundleRow | null>;
+    findByKey(bundleKey: string): Promise<BundleRow | null>;
     create(data: CreateBundleData): Promise<BundleRow>;
     update(bundleId: string, data: UpdateBundleData): Promise<BundleRow>;
     /** Sets `deletedAt` to NOW(); soft-deleted bundles are filtered from `list` by default. */
@@ -3340,14 +3605,7 @@ interface BundleRepository {
      * if the predecessor carries a `validUntil` — the adapter only
      * persists, it does not validate again.
      */
-    publishDraft(versionId: string, publishMeta: {
-        publishedByUserId: string | null;
-        publishedChanges: VersionChange[];
-        nonRegressive: boolean;
-        /** Required — validated by the service before the repository call. */
-        validFrom: Date;
-        validUntil: Date | null;
-    }, tx?: TransactionContext): Promise<BundleVersionRow>;
+    publishDraft(versionId: string, publishMeta: PublishBundleVersionMeta, tx?: TransactionContext): Promise<BundleVersionRow>;
     /**
      * Hard-discards a draft version (`publishedAt === null`) from the DB.
      * Throws if the version was already published — published versions
@@ -3385,7 +3643,6 @@ interface MarketingProjectionRepository {
 }
 /** Upsert input for a capability from the discovery sync. */
 interface UpsertCapabilityEntryData {
-    projectKey: string;
     capabilityKey: string;
     label: string;
     description: string | null;
@@ -3402,7 +3659,6 @@ interface UpsertCapabilityEntryData {
 }
 /** Upsert input for a feature from the discovery sync. */
 interface UpsertFeatureEntryData {
-    projectKey: string;
     featureKey: string;
     label: string;
     description: string | null;
@@ -3416,7 +3672,6 @@ interface UpsertFeatureEntryData {
 }
 /** Upsert input for a quota from the discovery sync. */
 interface UpsertQuotaEntryData {
-    projectKey: string;
     quotaKey: string;
     label: string;
     description: string | null;
@@ -3446,7 +3701,7 @@ interface SetCatalogEntryReviewData {
  * Prisma tables.
  *
  * Binding:
- * - `upsert*` matches on (`projectKey`, `<key>`) and leaves `i18n`,
+ * - `upsert*` matches on `<key>` and leaves `i18n`,
  *   `sortOrder`, `createdAt` as well as the approval fields (`approvedAt`/
  *   `approvedBy`/`approvedSignature`) **untouched** on an update —
  *   only the code-derived fields + the status (resolved by the service)
@@ -3462,7 +3717,7 @@ interface CatalogEntryRepository {
     upsertCapability(data: UpsertCapabilityEntryData): Promise<CapabilityCatalogEntryRow>;
     upsertFeature(data: UpsertFeatureEntryData): Promise<FeatureCatalogEntryRow>;
     upsertQuota(data: UpsertQuotaEntryData): Promise<QuotaCatalogEntryRow>;
-    retireMissing(projectKey: string, type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
+    retireMissing(type: 'capability' | 'feature' | 'quota', presentKeys: string[]): Promise<number>;
     /**
      * Sets or clears the successor pointer of a feature/quota
      * (#39). The sync calls this when a key disappears from the snapshot
@@ -3471,17 +3726,17 @@ interface CatalogEntryRepository {
      * adapters without a `successor_key` column omit the methods, and the sync
      * then skips the pointers with a warn log.
      */
-    setFeatureSuccessor?(projectKey: string, featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
-    setQuotaSuccessor?(projectKey: string, quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
-    findFeature(projectKey: string, featureKey: string): Promise<FeatureCatalogEntryRow | null>;
-    findQuota(projectKey: string, quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
-    setFeatureReview(projectKey: string, featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
-    setQuotaReview(projectKey: string, quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
-    setFeatureI18n(projectKey: string, featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
-    setQuotaI18n(projectKey: string, quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
+    setFeatureSuccessor?(featureKey: string, successorKey: string | null): Promise<FeatureCatalogEntryRow>;
+    setQuotaSuccessor?(quotaKey: string, successorKey: string | null): Promise<QuotaCatalogEntryRow>;
+    findFeature(featureKey: string): Promise<FeatureCatalogEntryRow | null>;
+    findQuota(quotaKey: string): Promise<QuotaCatalogEntryRow | null>;
+    setFeatureReview(featureKey: string, data: SetCatalogEntryReviewData): Promise<FeatureCatalogEntryRow>;
+    setQuotaReview(quotaKey: string, data: SetCatalogEntryReviewData): Promise<QuotaCatalogEntryRow>;
+    setFeatureI18n(featureKey: string, i18n: CatalogEntryI18n): Promise<FeatureCatalogEntryRow>;
+    setQuotaI18n(quotaKey: string, i18n: CatalogEntryI18n): Promise<QuotaCatalogEntryRow>;
     /** Sets the editable base fields (default locale `label`/`description`). */
-    setFeatureBase(projectKey: string, featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
-    setQuotaBase(projectKey: string, quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
+    setFeatureBase(featureKey: string, data: UpdateCatalogEntryBaseData): Promise<FeatureCatalogEntryRow>;
+    setQuotaBase(quotaKey: string, data: UpdateCatalogEntryBaseData): Promise<QuotaCatalogEntryRow>;
 }
 /**
  * Adapter for `promotions`. **No versioning** — promotions are edited
@@ -3489,7 +3744,7 @@ interface CatalogEntryRepository {
  * this against their `promotions` Prisma table.
  */
 interface PromotionRepository {
-    list(filter: PromotionFilter): Promise<PromotionRow[]>;
+    list(): Promise<PromotionRow[]>;
     findById(id: string): Promise<PromotionRow | null>;
     create(data: CreatePromotionData): Promise<PromotionRow>;
     update(id: string, data: UpdatePromotionData): Promise<PromotionRow>;
@@ -3497,13 +3752,14 @@ interface PromotionRepository {
     delete(id: string): Promise<void>;
 }
 /**
- * Adapter for `marketing_settings` — one row per project. `get` returns
- * `null` as long as the SuperAdmin has saved nothing (then the full
- * `availableLocales` pool counts as active). `upsert` creates the row or replaces it.
+ * Adapter for `marketing_settings` — at most one row, which a `CHECK` on the
+ * canonical schema holds rather than convention. `get` returns `null` as long
+ * as the SuperAdmin has saved nothing (then the full `availableLocales` pool
+ * counts as active). `upsert` creates the row or replaces it.
  */
 interface MarketingSettingsRepository {
-    get(projectKey: string): Promise<MarketingSettingsRow | null>;
-    upsert(projectKey: string, data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
+    get(): Promise<MarketingSettingsRow | null>;
+    upsert(data: UpdateMarketingSettingsData): Promise<MarketingSettingsRow>;
 }
 
 /**
@@ -3715,6 +3971,8 @@ declare const CATALOG_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -3759,6 +4017,8 @@ declare const BILLING_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3915,6 +4175,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_ALREADY_SUBSCRIBED: "BUNDLE_ALREADY_SUBSCRIBED";
     readonly BUNDLE_INCOMPATIBLE_WITH_PLAN: "BUNDLE_INCOMPATIBLE_WITH_PLAN";
     readonly BUNDLE_NOT_SELF_SERVICE: "BUNDLE_NOT_SELF_SERVICE";
+    readonly BUNDLE_CYCLE_EXCEEDS_PLAN: "BUNDLE_CYCLE_EXCEEDS_PLAN";
+    readonly BUNDLE_NOT_PRICED_FOR_THIS_PLAN: "BUNDLE_NOT_PRICED_FOR_THIS_PLAN";
     readonly SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED: "SUBSCRIPTION_BUNDLE_ALREADY_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_NOT_CANCELLED: "SUBSCRIPTION_BUNDLE_NOT_CANCELLED";
     readonly SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE: "SUBSCRIPTION_BUNDLE_CANCELLATION_EFFECTIVE";
@@ -3968,6 +4230,8 @@ declare const PLATFORM_ERROR_CODES: {
     readonly BUNDLE_VERSION_SUPERSEDED: "BUNDLE_VERSION_SUPERSEDED";
     readonly BUNDLE_VERSION_REGRESSION: "BUNDLE_VERSION_REGRESSION";
     readonly BUNDLE_VERSION_ZERO_PRICE: "BUNDLE_VERSION_ZERO_PRICE";
+    readonly BUNDLE_VERSION_NO_PRICE: "BUNDLE_VERSION_NO_PRICE";
+    readonly BUNDLE_VERSION_NOT_PRICED_FOR_PLAN: "BUNDLE_VERSION_NOT_PRICED_FOR_PLAN";
     readonly BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED: "BUNDLE_VERSION_DISCARD_NOT_IMPLEMENTED";
     readonly BUNDLE_VERSION_VALID_FROM_REQUIRED: "BUNDLE_VERSION_VALID_FROM_REQUIRED";
     readonly BUNDLE_VERSION_VALID_FROM_INVALID: "BUNDLE_VERSION_VALID_FROM_INVALID";
@@ -4786,6 +5050,98 @@ interface SetupConfirmMfaResponse {
     ok: boolean;
 }
 
+/** What the adapter's schema can actually answer about a version's dates. */
+interface PlanVersionMappingFields {
+    /** `validFrom`/`validUntil` are maintained; otherwise both read as null. */
+    validityWindows: boolean;
+    /** `endsAt` exists; otherwise the field is left off the record entirely. */
+    endsAt: boolean;
+}
+/** A `plans` row as either adapter reads it back. */
+interface CanonicalPlanRow {
+    id: string;
+    planKey: string;
+    label: string;
+    description: string | null;
+    icon: string | null;
+    sortOrder: number;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+/** A `plan_versions` row as either adapter reads it back. */
+interface CanonicalPlanVersionRow {
+    id: string;
+    version: number;
+    baseVersionId: string | null;
+    features: unknown;
+    quotas: unknown;
+    monthlyNet: unknown;
+    yearlyNet: unknown;
+    marketed: boolean;
+    publishedAt: Date | null;
+    supersededAt: Date | null;
+    publishedChanges: unknown;
+    changeNote: string;
+    nonRegressive: boolean;
+    validFrom?: Date | null;
+    validUntil?: Date | null;
+    endsAt?: Date | null;
+    createdByUserId: string | null;
+    publishedByUserId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+declare function toPlanRow(row: CanonicalPlanRow): PlanRow;
+/**
+ * `planKey` is passed rather than read off the row: the canonical schema stores
+ * the plan key in `planId`, but an adapter translating a consumer schema with a
+ * real foreign key has to resolve it first, and only the adapter knows which
+ * shape it is looking at.
+ */
+declare function toPlanVersionRow(row: CanonicalPlanVersionRow, planKey: string, fields: PlanVersionMappingFields): PlanVersionRow;
+
+/** A `subscription_contracts` row as either adapter reads it back. */
+interface CanonicalContractRow {
+    id: string;
+    tenantId: string;
+    status: string;
+    effectiveFrom: Date;
+    effectiveUntil: Date | null;
+    originalOfferId: string | null;
+    originalPlanVersionId: string | null;
+    originalBundleVersionIds: unknown;
+    entitlementSnapshot: unknown;
+    priceSnapshot: unknown;
+    promotionSnapshots: unknown;
+    promoCodeSnapshots: unknown;
+    termsSnapshot: unknown;
+    createdAt: Date;
+    updatedAt: Date;
+}
+/** A `contract_line_items` row as either adapter reads it back. */
+interface CanonicalContractLineItemRow {
+    id: string;
+    contractId: string;
+    kind: string;
+    sourceKey: string;
+    sourceVersionId: string | null;
+    titleSnapshot: string;
+    descriptionSnapshot: string | null;
+    quantity: number;
+    unit: string | null;
+    priceNet: unknown;
+    priceGross: unknown;
+    billingCycle: string;
+    minimumTermUntil: Date | null;
+    featuresSnapshot: unknown;
+    quotaEffectsSnapshot: unknown;
+    metadata: unknown;
+    createdAt: Date;
+}
+declare function toSubscriptionContractRecord(row: CanonicalContractRow, lineItems: CanonicalContractLineItemRow[]): SubscriptionContractRecord;
+declare function toContractLineItemRecord(row: CanonicalContractLineItemRow): ContractLineItemRecord;
+
 /** Why a version is editable (for UI badges + audit logs). */
 type VersionEditableReason = 'draft' | 'pre-active';
 interface VersionEditability {
@@ -4826,4 +5182,4 @@ declare function resolveErrorMessage(body: Partial<PlatformErrorBody> & Record<s
 
 declare const ERROR_MESSAGES_DE: Record<PlatformErrorCode, string>;
 
-export { AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionFilter, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SetCatalogEntryReviewData, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, missingRequiresFor, pickActivePromo, promoStatus, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, startOfUtcDay };
+export { ACTIVE_SUBSCRIPTION_CONTRACT_STATUSES, AUTH_ERROR_CODES, type ActionKey, type ActivationOrchestrator, type ActivePlanVersionWhere, type ActivePlanVersionWhereWithEndsAt, type ActiveVersionWhere, type ActiveVersionWhereWithEndsAt, type ActorTag, type AdminActor, type AdminAuditListFilter, type AdminManifest, type AdminResourcesPort, type AdminSubscriptionListRow, type AdminTenantDetail, type AdminTenantListFilter, type AdminTenantListRow, type AdminTenantStateResult, type AdminUserListFilter, type AdminUserListRow, type ApplyOnboardingSelectionInput, type ApplyOnboardingSelectionResult, type ApprovedCatalogKeys, type AuditActionDef, type AuditEntry, type AuditPort, type AuditQuery, type AuditQueryPort, type AuditStatsPort, type AuditStatsSnapshot, type AuthErrorCode, BILLING_ERROR_CODES, BUNDLE_PRICE_LOOKUP_LIMIT, type BillingCycle, type BillingErrorCode, type BundleAvailabilityState, type BundleCompatibility, type BundleFeatureShape, type BundleListFilter, type BundlePricingOverride, type BundleRepository, type BundleRow, type BundleVersionFields, type BundleVersionMutationResult, type BundleVersionRow, CATALOG_ERROR_CODES, CONTRACT_ERROR_CODES, type CancelSubscriptionBundleData, type CancelSubscriptionInput, type CancelSubscriptionResult, type CanonicalContractLineItemRow, type CanonicalContractRow, type CanonicalPlanRow, type CanonicalPlanVersionRow, type CapabilityCatalogEntryRow, type CapabilityCodeStatus, type CapabilityKey, type CapabilityKind, type CatalogEntryFilter, type CatalogEntryI18n, type CatalogEntryI18nFields, type CatalogEntryRepository, type CatalogErrorCode, type ChangeDirection, type CheckoutOfferFilter, type CheckoutOfferLineItem, type CheckoutOfferLineItemKind, type CheckoutOfferPriceBreakdown, type CheckoutOfferPromoCodeSnapshot, type CheckoutOfferPromotionSnapshot, type CheckoutOfferRepository, type CheckoutOfferRow, type CheckoutOfferStatus, type CheckoutSession, type CleanupResult, type CliUserRow, type ComponentKey, type ConfiguratorCatalog, type ConfiguratorMarketingProvider, type ConfiguratorModel, type ConfiguratorPlanMarketing, type ConfiguratorPlanVersionRow, type ConfiguratorPriceBreakdown, type ConfiguratorSourcesLookup, type ContractErrorCode, type ContractLineItemKind, type ContractLineItemRecord, type CreateBundleData, type CreateBundleVersionDraftData, type CreateCheckoutOfferData, type CreateMarketingProjectionData, type CreatePlanData, type CreatePlanVersionDraftData, type CreatePromoCodeData, type CreatePromoCodeRequest, type CreatePromotionData, type CreateSubscriptionBundleData, type CreateSubscriptionContractData, type CreateSuperAdminCliInput, type CreateTenantInput, type DiffResult, type DiscoveredCapability, type DiscoveredFeature, type DiscoveredQuota, type DiscoveredQuotaPolicy, type DiscoveryCodeStatus, type DiscoverySnapshot, type DiscoveryStatus, ERROR_MESSAGES_DE, ERROR_MESSAGES_EN, type EffectiveLimitsSnapshot, type ErrorMessageParams, FEATURE_NOT_LICENSED, type FeatureCatalogEntryRow, type FeatureDef, type FeatureKey, type FeatureNotLicensedBody, type FeatureRequiresIndex, type FeatureTier, type FeatureUiMeta, type FeatureUiRegistry, type FinalActivationResult, type FirstTimeCustomerCheck, type HandlePaymentEventInput, type HandlePaymentEventReason, type HandlePaymentEventResult, type ImmediatePlanChangeInput, type InvoiceLineItemSnapshot, type KpiCardDef, type KpiDisplayHint, MARKETING_PRIORITY_MAX, MARKETING_PRIORITY_MIN, type ManifestAccessPort, type ManifestContribution, type MarketingProjectionFilter, type MarketingProjectionRepository, type MarketingProjectionRow, type MarketingSettingsRepository, type MarketingSettingsRow, type MarketingTargetType, type MarketingTopFeature, type MfaPort, type NewContractLineItemData, OTP_RATE_LIMIT_MAX_SENDS, OTP_RATE_LIMIT_WINDOW_MINUTES, OTP_TTL_MINUTES, OTP_VERIFY_MAX_ATTEMPTS, type OnboardingPromoRedemption, type OnboardingSelectionRequest, type OnboardingSelectionResponse, PASSWORD_RESET_TTL_MINUTES, PENDING_CHECKOUT_TTL_DAYS, PENDING_EMAIL_TTL_HOURS, PENDING_ONBOARDING_TTL_DAYS, PLATFORM_ERROR_CODES, PROMO_ERROR_CODES, type Paginated, type PasswordHasher, type PasswordResetCliResult, type PaymentEventLog, type PaymentEventStatus, type PaymentProvider, type PendingRegistration, type PendingRegistrationCreateInput, type PendingRegistrationRepository, type PendingRegistrationSnapshot, type PendingRegistrationUpdateInput, type PersistenceCapabilities, PersistenceCapabilityError, type PersistenceClassRef, type PersistenceInjectionToken, type PersistenceProvider, type PlanCatalog, type PlanCatalogApp, type PlanCatalogImportReport, type PlanCatalogImportSink, type PlanCatalogLookup, type PlanCatalogMarketing, type PlanCatalogReadSink, type PlanCatalogReadSnapshot, type PlanDef, type PlanId, type PlanListFilter, type PlanRepository, type PlanRow, type PlanVersion, type PlanVersionFields, type PlanVersionMappingFields, type PlanVersionMutationResult, type PlanVersionRecord, type PlanVersionRepository, type PlanVersionRow, type PlatformErrorBody, type PlatformErrorCode, type PlatformRole, type PlatformUserDto, PlatformUserExistsError, type ProjectPageDef, type PromoCode, type PromoCodeDurationType, type PromoCodeFilter, type PromoCodeRecord, type PromoCodeRedemption, type PromoCodeRedemptionListItem, type PromoCodeRedemptionRecord, type PromoCodeRedemptionRepository, type PromoCodeRedemptionStatus, type PromoCodeRepository, type PromoCodeStatsPort, type PromoCodeStatsSnapshot, type PromoCodeStatus, type PromoCodeValidationLog, type PromoCodeValidationLogRepository, type PromoCodeValidationResult, type PromoCodeValueType, type PromoErrorCode, type PromoPreviewInvalidReason, type PromoPreviewRequest, type PromoPreviewResponse, type PromoPreviewValidResponse, type PromoRevenueDeductionAggregator, type PromoSubscriptionLookup, type PromotionBillingCycle, type PromotionI18n, type PromotionI18nFields, type PromotionRepository, type PromotionResult, type PromotionRow, type PromotionStatus, type PromotionTargetType, type PromotionType, type PromotionValue, type PublicBootResponse, type PublicComparisonRow, type PublicMarketingBundle, type PublicMarketingCatalogResponse, type PublicMarketingPlan, type PublicMarketingPromo, type PublicSignupPlan, type PublishBundleVersionData, type PublishBundleVersionMeta, type PublishPlanVersionData, type QuotaCatalogEntryRow, type QuotaEnforcementMode, type QuotaKey, type QuotaProvider, REGISTRATION_ERROR_CODES, REGISTRATION_RESUME_TTL_MINUTES, REGISTRATION_STEP_BY_STATUS, type ReassignTenantAdminCliResult, type RedeemPromoInTransactionCallback, type RegistrationAuditContext, type RegistrationAuditEvent, type RegistrationAuditEventType, type RegistrationAuditLogger, type RegistrationConfigSelection, type RegistrationConfiguratorLookup, type RegistrationErrorCode, type RegistrationOtpDelivery, type RegistrationPromoPreview, type RegistrationResumeDelivery, type RegistrationResumeTokenSigner, type RegistrationStatus, type RegistrationStep, type RequiredCapabilities, type ResumeRegistrationInput, type ResumeRegistrationResult, type ReviewCatalogEntryData, type RlsBypassPort, SETUP_ERROR_CODES, type SaaSiCatPersistenceAdapter, type SaaSiCatPersistenceAdminResources, type SaaSiCatPersistenceCatalog, type SaaSiCatPersistenceCore, type SaaSiCatPersistenceEntitlement, type SaaSiCatPersistencePromo, type SaaSiCatPersistenceTenantBilling, type SaveRegistrationConfigInput, type SaveRegistrationConfigResult, type ScheduledPlanChangeInput, type SelectPlanInput, type SelectPlanResult, type SelectableBundleShape, type SetCatalogEntryReviewData, type SetupConfirmMfaRequest, type SetupConfirmMfaResponse, type SetupErrorCode, type SetupRequest, type SetupResult, type SetupStatusResponse, type SlugAvailabilityCheck, type StandardPageDef, type StandardPageKey, type StartCheckoutInput, type StartCheckoutResult, type StartRegistrationInput, type StartRegistrationResult, type StoredBundleStem, type StrictModeWarning, type StrictModeWarningCode, type Subscription, type SubscriptionBundleRecord, type SubscriptionBundleRepository, type SubscriptionBundleView, type SubscriptionContractFilter, type SubscriptionContractInvoiceSnapshot, type SubscriptionContractPriceSnapshot, type SubscriptionContractRecord, type SubscriptionContractRepository, type SubscriptionContractStatus, type SubscriptionRecord, type SubscriptionRepository, type SubscriptionStatsPort, type SubscriptionStatsSnapshot, type SubscriptionStatus, type SubscriptionUsagePort, type SubscriptionUsageRecord, type SuperAdminProvisioningPort, type SyncDiscoveryResult, type TenantActionDef, type TenantColumnDef, type TenantDto, type TenantListFilter, type TenantPort, type TenantSubscriptionWritePort, type TerminateSubscriptionContractData, type TopPromoCode, type TransactionContext, type TransactionRunner, type UpdateBundleData, type UpdateBundleVersionDraftData, type UpdateCatalogEntryBaseData, type UpdateCatalogEntryI18nData, type UpdateCheckoutOfferData, type UpdateMarketingProjectionData, type UpdateMarketingSettingsData, type UpdatePlanData, type UpdatePlanVersionDraftData, type UpdatePromoCodeData, type UpdatePromoCodeRequest, type UpdatePromotionData, type UpsellOffer, type UpsellOfferResolver, type UpsertCapabilityEntryData, type UpsertFeatureCatalogEntryInput, type UpsertFeatureEntryData, type UpsertPlanInput, type UpsertPlanVersionInput, type UpsertQuotaEntryData, type UpsertResult, type UsageSnapshotPort, type UserAccountLookup, type UserListFilter, type UserManagementPort, type UserPort, type VerifyRegistrationOtpResult, type VersionChange, type VersionChangeDirection, type VersionEditability, type VersionEditableReason, type VersionedEntityBase, applyPromo, assertPersistenceCapabilities, buildActivePlanVersionWhere, buildActiveVersionWhere, buildFeatureRequiresIndex, bundleDraftDefaults, bundleStemDefaults, classifyBundleVersionDiff, classifyPlanDiff, collectUnsatisfiedRequires, coverageExcludingSelf, definedFields, formatErrorMessage, isBundleRedundant, isPlatformUserExistsError, isVersionEditable, missingRequiresFor, pickActivePromo, previousUtcDay, promoStatus, resolveBundleAvailability, resolveErrorMessage, selectChargeableBundles, startOfUtcDay, toBundleStemRow, toContractLineItemRecord, toPlanRow, toPlanVersionRow, toSubscriptionContractRecord };