# Plans & licensing
URL: https://lsd.tools/docs/pkg-plans-licensing
Updated: 2026-07-17

> A paid package has one or more plans. A plan is one-time (perpetual) or a subscription, grants a number of concurrent seats, and picks a delivery mode — sealed, source, or server. Buyers choose a seat quantity at checkout (price × N users). Activated packages carry a signed 30-day lease so they keep working offline.

A paid package is sold through one or more **plans**. A plan sets how the buyer pays, how many
people can use it at once, and how the code is delivered.

## One-time vs subscription

Every plan is one of two kinds:

- **One-time (perpetual)** — a single purchase that never expires.
- **Subscription** — a recurring charge over a period; access lapses if it isn't renewed.

A package can offer both — for example a perpetual plan *and* a monthly subscription — and the buyer
picks one at checkout.

## Concurrent seats

A plan grants a number of **concurrent seats**. A seat is one **live device** using the package at
the same time — not a named user, and not a total install count. A 3-seat plan lets up to three
connected devices run the package concurrently; the host enforces the limit live (see
[Collaboration & seats](/docs/pkg-collab-seats)). A seat count of **0 means unlimited**.

### Buying seats by quantity

At checkout the buyer chooses a **seat quantity**, and the price scales with it:

```
# → total = plan price × N users
# → a 1-seat plan bought ×3 → entitles 3 concurrent seats
```

Re-buying at a higher quantity upgrades the entitlement.

## Offline leases

Activating a paid package issues a **signed lease** valid for **30 days**. While the lease verifies,
the package runs **offline** — no per-run server call. The lease is checked against a cached copy of
the store's signing keys, must match the device it was issued to, and is guarded against clock
roll-back (a high-water-mark of the newest server time seen). When the lease expires, the client
re-activates; a revoked entitlement or a lapsed subscription then fails and the package freezes — so
changes bite within the lease window without any always-on connection.

## Delivery: sealed, source, or server

Each plan picks how the code reaches the buyer:

| Delivery | What ships | Protection |
|---|---|---|
| **sealed** | Encrypted `.lsdpkg` bytecode, device-keyed | Strong deterrent (locally-run code is decompilable) |
| **source** | Readable source, on purpose | None — for open or trusted packages |
| **server** | Nothing sensitive; the code runs on the store's servers | The only true anti-theft — crown-jewel logic never ships |

Choose **server** delivery when the package's logic must never leave your control; the buyer's steps
call your server and only results come back. Otherwise **sealed** is the common default for paid
packages, and **source** for packages you are happy to ship openly.

## Related

**Learn** — [Publish to the store](/docs/pkg-publish) · [Buy & install](/docs/pkg-store-install) · [Collaboration & seats](/docs/pkg-collab-seats)

**API** — [lsd_package.json](/docs/api-manifest) · [PackageManager](/docs/api-package-manager)

**Examples** — [A complete package](/docs/ex-full-package)

## FAQ
### What is a seat?

A seat is one live device using the package at the same time. A plan with 3 seats lets up to three connected devices run it concurrently; a fourth device makes the host freeze the package until one disconnects. Seats of 0 mean unlimited.

### Does a paid package need the internet to run?

Not continuously. Activation issues a signed lease valid for 30 days, so sealed and source packages run offline within that window. A revoked entitlement or a lapsed subscription bites within the lease period. Server-delivery packages do need the server, by design.