fix(billing): register new-product AWS Marketplace buyers, meet the listing guidelines, and handle agreement events

- ResolveCustomer leaves CustomerIdentifier empty for new SaaS products, so registration now
  requires the account ID and keys off it and the license ARN. customer_identifier is nullable,
  customer_aws_account_id is required (not unique), and agreement_id is stored. No license ARN
  yet means a future-dated agreement: nothing is saved and the buyer is told to return on the
  start date.
- Listing guidelines: the claim step collects a contact email and optional company, the buyer
  gets a confirmation with turnaround and support contact, organization members see subscription
  status on the billing page through a contracted read, and the team is emailed when a license's
  status, quantity, or expiry changes, or when an event names a license nobody registered.
- Agreement events: Ended re-verifies the licenses of that agreement; a RENEW tells the team once
  across both seller roles and links nothing; agreements for other products are dropped quietly.
- Every writer of entitlement fields honours the newest read, so a slow registration or claim
  cannot restore a lapsed license, and a claim is refused if a newer read says inactive.
- Post-commit notices, lookups included, never fail the request. Re-verifies order by last attempt,
  so failing licenses cannot starve the batch. The reconcile has a 6-minute wall-clock budget and
  a per-message abort that fit the receive visibility timeout and the cron lock.
- The fulfillment URL redirects a GET to onboarding and accepts multipart forms under the same cap.

Author: waleedlatif1

apps/sim/app/api/cron/aws-marketplace-reconcile/route.ts

@@ -11,7 +11,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 const logger = createLogger('AwsMarketplaceReconcileCron')
 
 const LOCK_KEY = 'aws-marketplace-reconcile-lock'
-/** Covers a full drain plus the re-verification batch; the schedule runs every 15 minutes. */
+/** Outlasts the reconcile's 6-minute run budget; the schedule runs every 15 minutes. */
 const LOCK_TTL_SECONDS = 10 * 60
 
 export const dynamic = 'force-dynamic'

apps/sim/app/api/marketplace/aws/claim/link/route.ts

@@ -22,6 +22,8 @@ export const POST = defineInternalJsonRoute({
   mapInput: ({ body }, { request }) => ({
     organizationId: body.organizationId,
     licenseId: body.licenseId,
+    contactEmail: body.contactEmail,
+    companyName: body.companyName || null,
     claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
   }),
   present: (_linked, { input }) => ({

apps/sim/app/api/marketplace/aws/claim/register-account/route.ts

@@ -21,6 +21,8 @@ export const POST = defineInternalJsonRoute({
   staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
   mapInput: ({ body }, { request }) => ({
     licenseId: body.licenseId,
+    contactEmail: body.contactEmail,
+    companyName: body.companyName || null,
     claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
   }),
   present: () => ({ success: true as const }),

apps/sim/app/api/marketplace/aws/register/route.ts

@@ -17,6 +17,9 @@ export const dynamic = 'force-dynamic'
 
 const logger = createLogger('AwsMarketplaceRegisterAPI')
 
+/** AWS posts a URL-encoded form; multipart is accepted too, under the same cap. */
+const FORM_MEDIA_TYPES = new Set(['application/x-www-form-urlencoded', 'multipart/form-data'])
+
 /** The form carries one opaque token; anything larger is not from AWS. */
 const MAX_FORM_BYTES = 16 * 1024
 
@@ -34,7 +37,7 @@ function redirectToOnboarding(error?: AwsMarketplaceOnboardingError): NextRespon
 
 async function readRegistrationToken(request: NextRequest): Promise<string | null> {
   const mediaType = request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase()
-  if (mediaType !== 'application/x-www-form-urlencoded') return null
+  if (!mediaType || !FORM_MEDIA_TYPES.has(mediaType)) return null
   let form: FormData
   try {
     form = await readFormDataWithLimit(request, {
@@ -44,8 +47,9 @@ async function readRegistrationToken(request: NextRequest): Promise<string | nul
   } catch {
     return null
   }
+  const token = form.get('x-amzn-marketplace-token')
   const parsed = awsMarketplaceRegistrationFormSchema.safeParse({
-    'x-amzn-marketplace-token': form.get('x-amzn-marketplace-token'),
+    'x-amzn-marketplace-token': typeof token === 'string' ? token : undefined,
   })
   return parsed.success ? parsed.data['x-amzn-marketplace-token'] : null
 }
@@ -81,3 +85,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   response.headers.set('Cache-Control', 'no-store')
   return response
 })
+
+/** A refresh, back button, or bookmark of the fulfillment URL lands on the onboarding page. */
+export const GET = withRouteHandler(async () => {
+  if (!getAwsMarketplaceProductCode())
+    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  return redirectToOnboarding()
+})

apps/sim/app/api/organizations/[id]/aws-marketplace-licenses/route.ts

@@ -0,0 +1,26 @@
+import { listOrganizationAwsMarketplaceLicensesContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { listOrganizationAwsMarketplaceLicenses } from '@/lib/billing/aws-marketplace/application/use-cases'
+
+export const GET = defineInternalJsonRoute({
+  contract: listOrganizationAwsMarketplaceLicensesContract,
+  operation: listOrganizationAwsMarketplaceLicenses.operation,
+  useCase: listOrganizationAwsMarketplaceLicenses,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-licenses' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: ({ params }) => ({ organizationId: params.id }),
+  present: (licenses) => ({
+    licenses: licenses.map((license) => ({
+      ...license,
+      expiresAt: license.expiresAt?.toISOString() ?? null,
+      lastVerifiedAt: license.lastVerifiedAt.toISOString(),
+    })),
+  }),
+})

apps/sim/app/marketplace/aws/aws-marketplace-onboarding.tsx

@@ -1,17 +1,26 @@
 'use client'
 
-import { useState } from 'react'
-import { AuthField, AuthFormMessage, AuthSelect, AuthTag } from '@sim/auth-ui'
+import { type ReactNode, useState } from 'react'
+import {
+  AuthField,
+  AuthFormMessage,
+  AuthInput,
+  AuthSelect,
+  AuthTag,
+  AuthTextLink,
+} from '@sim/auth-ui'
 import { useRouter } from 'next/navigation'
 import type { AwsMarketplaceClaim } from '@/lib/api/contracts/aws-marketplace'
 import { useSession } from '@/lib/auth/client'
 import {
   AWS_MARKETPLACE_ONBOARDING_PATH,
+  AWS_MARKETPLACE_SETUP_TURNAROUND,
   type AwsMarketplaceOnboardingError,
 } from '@/lib/billing/aws-marketplace/onboarding'
 import { APP_ENTRY_PATH } from '@/lib/navigation/paths'
 import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import { InviteLayout, InviteStatusCard } from '@/app/invite/components'
+import { useBrandConfig } from '@/ee/whitelabeling'
 import {
   useAwsMarketplaceClaim,
   useLinkAwsMarketplaceLicense,
@@ -30,6 +39,11 @@ const REGISTRATION_ERROR_COPY: Record<
     description:
       'AWS Marketplace has no active Sim subscription for this AWS account. Subscribe to Sim in AWS Marketplace, then choose Set up your account to return here.',
   },
+  'not-started': {
+    title: 'Your agreement has not started',
+    description:
+      'Come back to AWS Marketplace on your agreement start date and choose Set up your account.',
+  },
   invalid: {
     title: 'This setup link did not work',
     description: RESTART_FROM_AWS,
@@ -47,6 +61,21 @@ function authLink(path: '/login' | '/signup'): string {
   })
 }
 
+const SETUP_NEXT_STEP = `Our team will set up your Enterprise workspace ${AWS_MARKETPLACE_SETUP_TURNAROUND} and email you when it is ready.`
+
+interface SupportContactProps {
+  supportEmail: string
+}
+
+/** AWS requires support contact options on the fulfillment landing page. */
+function SupportContact({ supportEmail }: SupportContactProps) {
+  return (
+    <p className='au:text-center au:text-sm'>
+      Questions? Email <AuthTextLink href={`mailto:${supportEmail}`}>{supportEmail}</AuthTextLink>
+    </p>
+  )
+}
+
 function formatDate(iso: string): string {
   return new Date(iso).toLocaleDateString(undefined, { dateStyle: 'medium' })
 }
@@ -66,6 +95,8 @@ export function AwsMarketplaceOnboarding({
   const claimQuery = useAwsMarketplaceClaim(registrationError ? null : viewerId)
   const linkLicense = useLinkAwsMarketplaceLicense()
   const registerToAccount = useRegisterAwsMarketplaceLicenseToAccount()
+  const { supportEmail } = useBrandConfig()
+  const supportContact = supportEmail ? <SupportContact supportEmail={supportEmail} /> : undefined
   const returnHome = { label: 'Return to Home', onClick: () => router.push('/') }
 
   if (registrationError) {
@@ -117,7 +148,8 @@ export function AwsMarketplaceOnboarding({
         <InviteStatusCard
           type='success'
           title='Subscription linked'
-          description='Your AWS Marketplace subscription is linked to your organization. Our team will finish setting up your plan and contact you.'
+          description={`Your AWS Marketplace subscription is linked to your organization. ${SETUP_NEXT_STEP}`}
+          details={supportContact}
           actions={[{ label: 'Go to Sim', onClick: () => router.push(APP_ENTRY_PATH) }]}
         />
       </InviteLayout>
@@ -130,7 +162,8 @@ export function AwsMarketplaceOnboarding({
         <InviteStatusCard
           type='success'
           title='Subscription registered'
-          description='Our team will set up your Enterprise workspace and email you when it is ready.'
+          description={SETUP_NEXT_STEP}
+          details={supportContact}
           actions={[{ label: 'Go to Sim', onClick: () => router.push(APP_ENTRY_PATH) }]}
         />
       </InviteLayout>
@@ -176,31 +209,40 @@ export function AwsMarketplaceOnboarding({
   return (
     <LinkLicenseCard
       claim={claim}
+      defaultContactEmail={session.user.email ?? ''}
+      supportContact={supportContact}
       pending={pending}
       linking={linkLicense.isPending}
       registering={registerToAccount.isPending}
       error={(linkLicense.error ?? registerToAccount.error)?.message ?? null}
-      onLink={(organizationId) => {
+      onLink={(organizationId, contact) => {
         registerToAccount.reset()
-        linkLicense.mutate({ licenseId: claim.license.id, organizationId })
+        linkLicense.mutate({ licenseId: claim.license.id, organizationId, ...contact })
       }}
-      onRegister={() => {
+      onRegister={(contact) => {
         linkLicense.reset()
-        registerToAccount.mutate({ licenseId: claim.license.id })
+        registerToAccount.mutate({ licenseId: claim.license.id, ...contact })
       }}
       onCancel={returnHome.onClick}
     />
   )
 }
 
+interface BuyerContact {
+  contactEmail: string
+  companyName?: string
+}
+
 interface LinkLicenseCardProps {
   claim: Extract<AwsMarketplaceClaim, { status: 'ready' }>
+  defaultContactEmail: string
+  supportContact: ReactNode
   pending: boolean
   linking: boolean
   registering: boolean
   error: string | null
-  onLink: (organizationId: string) => void
-  onRegister: () => void
+  onLink: (organizationId: string, contact: BuyerContact) => void
+  onRegister: (contact: BuyerContact) => void
   onCancel: () => void
 }
 
@@ -210,6 +252,8 @@ interface LinkLicenseCardProps {
  */
 function LinkLicenseCard({
   claim,
+  defaultContactEmail,
+  supportContact,
   pending,
   linking,
   registering,
@@ -220,6 +264,13 @@ function LinkLicenseCard({
 }: LinkLicenseCardProps) {
   const { license, organizations } = claim
   const [selectedOrganizationId, setSelectedOrganizationId] = useState<string>()
+  const [contactEmail, setContactEmail] = useState(defaultContactEmail)
+  const [companyName, setCompanyName] = useState('')
+  const contact: BuyerContact = {
+    contactEmail: contactEmail.trim(),
+    ...(companyName.trim() && { companyName: companyName.trim() }),
+  }
+  const hasContact = contact.contactEmail.length > 0
   const linkedOrganization = organizations.find((org) => org.id === license.organizationId)
   const organizationId =
     selectedOrganizationId ??
@@ -238,8 +289,8 @@ function LinkLicenseCard({
   const hasOrganizations = organizations.length > 0
   const registerAction = {
     label: hasOrganizations ? 'Register to my account instead' : 'Register to my account',
-    onClick: onRegister,
-    disabled: pending,
+    onClick: () => onRegister(contact),
+    disabled: pending || !hasContact,
     loading: registering,
   }
 
@@ -254,8 +305,8 @@ function LinkLicenseCard({
         }
         description={
           hasOrganizations
-            ? 'Choose the organization this subscription is for, or register it to your account. Our team will finish setting up your plan.'
-            : 'Register this subscription to your account. Our team will set up your Enterprise workspace and email you.'
+            ? `Choose the organization this subscription is for, or register it to your account. ${SETUP_NEXT_STEP}`
+            : `Register this subscription to your account. ${SETUP_NEXT_STEP}`
         }
         details={
           <div className='au:w-full au:space-y-4'>
@@ -285,16 +336,35 @@ function LinkLicenseCard({
                 />
               </AuthField>
             )}
+            <AuthField htmlFor='aws-marketplace-contact-email' label='Contact email'>
+              <AuthInput
+                id='aws-marketplace-contact-email'
+                type='email'
+                autoComplete='email'
+                value={contactEmail}
+                onChange={(event) => setContactEmail(event.target.value)}
+                required
+              />
+            </AuthField>
+            <AuthField htmlFor='aws-marketplace-company' label='Company (optional)'>
+              <AuthInput
+                id='aws-marketplace-company'
+                autoComplete='organization'
+                value={companyName}
+                onChange={(event) => setCompanyName(event.target.value)}
+              />
+            </AuthField>
             {error && <AuthFormMessage type='error'>{error}</AuthFormMessage>}
+            {supportContact}
           </div>
         }
         actions={[
           ...(hasOrganizations
             ? [
                 {
                   label: 'Link subscription',
-                  onClick: () => organizationId && onLink(organizationId),
-                  disabled: !organizationId || pending,
+                  onClick: () => organizationId && onLink(organizationId, contact),
+                  disabled: !organizationId || !hasContact || pending,
                   loading: linking,
                 },
               ]

apps/sim/app/workspace/[workspaceId]/settings/components/billing/billing.tsx

@@ -45,6 +45,7 @@ import {
 } from '@/lib/billing/subscriptions/utils'
 import { buildUpgradeHref } from '@/lib/billing/upgrade-reasons'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import { AwsMarketplaceSubscriptionSection } from '@/app/workspace/[workspaceId]/settings/components/billing/components/aws-marketplace-subscription-section/aws-marketplace-subscription-section'
 import { CreditUsageSection } from '@/app/workspace/[workspaceId]/settings/components/billing/components/credit-usage-section/credit-usage-section'
 import { UsageLimitField } from '@/app/workspace/[workspaceId]/settings/components/billing/components/usage-limit-field/usage-limit-field'
 import { getSubscriptionPermissions } from '@/app/workspace/[workspaceId]/settings/components/billing/subscription-permissions'
@@ -660,6 +661,10 @@ export function Billing({ scope, organizationId, creditUsageHref }: BillingProps
         </SettingsSection>
       )}
 
+      {billingOrganizationId && (
+        <AwsMarketplaceSubscriptionSection organizationId={billingOrganizationId} />
+      )}
+
       {!subscription.isFree && invoices.length > 0 && (
         <SettingsSection label='Invoices'>
           <div className='-mx-2 flex flex-col gap-y-0.5'>

apps/sim/app/workspace/[workspaceId]/settings/components/billing/components/aws-marketplace-subscription-section/aws-marketplace-subscription-section.tsx

@@ -0,0 +1,55 @@
+'use client'
+
+import { Badge } from '@sim/emcn'
+import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
+import { useOrganizationAwsMarketplaceLicenses } from '@/hooks/queries/aws-marketplace'
+
+function formatDate(iso: string): string {
+  return new Date(iso).toLocaleDateString()
+}
+
+interface AwsMarketplaceSubscriptionSectionProps {
+  organizationId: string
+}
+
+/** Read-only: AWS requires buyers to see their subscription status in the product. */
+export function AwsMarketplaceSubscriptionSection({
+  organizationId,
+}: AwsMarketplaceSubscriptionSectionProps) {
+  const { data: licenses } = useOrganizationAwsMarketplaceLicenses(organizationId)
+  if (!licenses?.length) return null
+
+  return (
+    <SettingsSection label='AWS Marketplace subscription'>
+      <div className='flex flex-col gap-6'>
+        {licenses.map((license) => {
+          const rows = [
+            { label: 'Plan', value: license.dimension ?? 'Not specified' },
+            { label: 'Quantity', value: license.quantity?.toLocaleString() ?? 'Not specified' },
+            {
+              label: 'Expires',
+              value: license.expiresAt ? formatDate(license.expiresAt) : 'No expiry',
+            },
+            { label: 'Last verified', value: formatDate(license.lastVerifiedAt) },
+          ]
+          return (
+            <div key={license.id} className='flex flex-col gap-4'>
+              <div className='flex items-center justify-between'>
+                <span className='text-[var(--text-body)] text-small'>Status</span>
+                <Badge variant={license.status === 'active' ? 'green' : 'gray'} size='sm'>
+                  {license.status === 'active' ? 'Active' : 'Inactive'}
+                </Badge>
+              </div>
+              {rows.map((row) => (
+                <div key={row.label} className='flex items-center justify-between'>
+                  <span className='text-[var(--text-body)] text-small'>{row.label}</span>
+                  <span className='text-[var(--text-muted)] text-small'>{row.value}</span>
+                </div>
+              ))}
+            </div>
+          )
+        })}
+      </div>
+    </SettingsSection>
+  )
+}