@@ -0,0 +1,29 @@
+import { registerAwsMarketplaceLicenseToAccountContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { registerAwsMarketplaceLicenseToAccount } from '@/lib/billing/aws-marketplace/application/use-cases'
+import {
+  AWS_MARKETPLACE_CLAIM_COOKIE,
+  serializeClaimCookie,
+} from '@/lib/billing/aws-marketplace/claim'
+
+export const POST = defineInternalJsonRoute({
+  contract: registerAwsMarketplaceLicenseToAccountContract,
+  operation: registerAwsMarketplaceLicenseToAccount.operation,
+  useCase: registerAwsMarketplaceLicenseToAccount,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-link' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: ({ body }, { request }) => ({
+    licenseId: body.licenseId,
+    claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
+  }),
+  present: () => ({ success: true as const }),
+  /** The claim is spent once the registration commits; the cookie that carried it goes with it. */
+  finalizeResponse: () => ({ headers: { 'set-cookie': serializeClaimCookie(null) } }),
+})
@@ -4,7 +4,7 @@ import { useState } from 'react'
 import { AuthField, AuthFormMessage, AuthSelect, AuthTag } from '@sim/auth-ui'
 import { useRouter } from 'next/navigation'
 import type { AwsMarketplaceClaim } from '@/lib/api/contracts/aws-marketplace'
-import { client, useSession } from '@/lib/auth/client'
+import { useSession } from '@/lib/auth/client'
 import {
   AWS_MARKETPLACE_ONBOARDING_PATH,
   type AwsMarketplaceOnboardingError,
@@ -15,6 +15,7 @@ import { InviteLayout, InviteStatusCard } from '@/app/invite/components'
 import {
   useAwsMarketplaceClaim,
   useLinkAwsMarketplaceLicense,
+  useRegisterAwsMarketplaceLicenseToAccount,
 } from '@/hooks/queries/aws-marketplace'
 
 const RESTART_FROM_AWS =
@@ -64,6 +65,7 @@ export function AwsMarketplaceOnboarding({
   const viewerId = session?.user?.id ?? null
   const claimQuery = useAwsMarketplaceClaim(registrationError ? null : viewerId)
   const linkLicense = useLinkAwsMarketplaceLicense()
+  const registerToAccount = useRegisterAwsMarketplaceLicenseToAccount()
   const returnHome = { label: 'Return to Home', onClick: () => router.push('/') }
 
   if (registrationError) {
@@ -122,6 +124,19 @@ export function AwsMarketplaceOnboarding({
     )
   }
 
+  if (registerToAccount.isSuccess) {
+    return (
+      <InviteLayout>
+        <InviteStatusCard
+          type='success'
+          title='Subscription registered'
+          description='Our team will set up your Enterprise workspace and email you when it is ready.'
+          actions={[{ label: 'Go to Sim', onClick: () => router.push(APP_ENTRY_PATH) }]}
+        />
+      </InviteLayout>
+    )
+  }
+
   if (claimQuery.isPending) {
     return (
       <InviteLayout>
@@ -157,50 +172,52 @@ export function AwsMarketplaceOnboarding({
     )
   }
 
-  if (claim.organizations.length === 0) {
-    return (
-      <InviteLayout>
-        <InviteStatusCard
-          type='warning'
-          title='No organization to link'
-          description='Only an owner or admin of a Sim organization can link this subscription. Sign in with that account in this browser.'
-          actions={[
-            {
-              label: 'Sign in with a different account',
-              onClick: async () => {
-                await client.signOut()
-                router.push(authLink('/login'))
-              },
-            },
-            returnHome,
-          ]}
-        />
-      </InviteLayout>
-    )
-  }
-
+  const pending = linkLicense.isPending || registerToAccount.isPending
   return (
     <LinkLicenseCard
       claim={claim}
+      pending={pending}
       linking={linkLicense.isPending}
-      error={linkLicense.error?.message ?? null}
-      onLink={(organizationId) =>
+      registering={registerToAccount.isPending}
+      error={(linkLicense.error ?? registerToAccount.error)?.message ?? null}
+      onLink={(organizationId) => {
+        registerToAccount.reset()
         linkLicense.mutate({ licenseId: claim.license.id, organizationId })
-      }
+      }}
+      onRegister={() => {
+        linkLicense.reset()
+        registerToAccount.mutate({ licenseId: claim.license.id })
+      }}
       onCancel={returnHome.onClick}
     />
   )
 }
 
 interface LinkLicenseCardProps {
   claim: Extract<AwsMarketplaceClaim, { status: 'ready' }>
+  pending: boolean
   linking: boolean
+  registering: boolean
   error: string | null
   onLink: (organizationId: string) => void
+  onRegister: () => void
   onCancel: () => void
 }
 
-function LinkLicenseCard({ claim, linking, error, onLink, onCancel }: LinkLicenseCardProps) {
+/**
+ * Links the license to an organization the viewer administers, or registers it to their
+ * account when they administer none or would rather not pick one.
+ */
+function LinkLicenseCard({
+  claim,
+  pending,
+  linking,
+  registering,
+  error,
+  onLink,
+  onRegister,
+  onCancel,
+}: LinkLicenseCardProps) {
   const { license, organizations } = claim
   const [selectedOrganizationId, setSelectedOrganizationId] = useState<string>()
   const linkedOrganization = organizations.find((org) => org.id === license.organizationId)
@@ -218,12 +235,28 @@ function LinkLicenseCard({ claim, linking, error, onLink, onCancel }: LinkLicens
     },
   ]
 
+  const hasOrganizations = organizations.length > 0
+  const registerAction = {
+    label: hasOrganizations ? 'Register to my account instead' : 'Register to my account',
+    onClick: onRegister,
+    disabled: pending,
+    loading: registering,
+  }
+
   return (
     <InviteLayout>
       <InviteStatusCard
         type='invitation'
-        title='Link your AWS Marketplace subscription'
-        description='Choose the organization this subscription is for. Our team will finish setting up your plan after you link it.'
+        title={
+          hasOrganizations
+            ? 'Link your AWS Marketplace subscription'
+            : 'Set up your AWS Marketplace subscription'
+        }
+        description={
+          hasOrganizations
+            ? 'Choose the organization this subscription is for, or register it to your account. Our team will finish setting up your plan.'
+            : 'Register this subscription to your account. Our team will set up your Enterprise workspace and email you.'
+        }
         details={
           <div className='au:w-full au:space-y-4'>
             <dl className='au:w-full au:space-y-2 au:text-sm au:tabular-nums'>
@@ -240,26 +273,33 @@ function LinkLicenseCard({ claim, linking, error, onLink, onCancel }: LinkLicens
                 </dd>
               </div>
             </dl>
-            <AuthField htmlFor='aws-marketplace-organization' label='Organization'>
-              <AuthSelect
-                id='aws-marketplace-organization'
-                options={organizations.map((org) => ({ label: org.name, value: org.id }))}
-                value={organizationId}
-                onChange={setSelectedOrganizationId}
-                placeholder='Select an organization'
-                fullWidth
-              />
-            </AuthField>
+            {hasOrganizations && (
+              <AuthField htmlFor='aws-marketplace-organization' label='Organization'>
+                <AuthSelect
+                  id='aws-marketplace-organization'
+                  options={organizations.map((org) => ({ label: org.name, value: org.id }))}
+                  value={organizationId}
+                  onChange={setSelectedOrganizationId}
+                  placeholder='Select an organization'
+                  fullWidth
+                />
+              </AuthField>
+            )}
             {error && <AuthFormMessage type='error'>{error}</AuthFormMessage>}
           </div>
         }
         actions={[
-          {
-            label: 'Link subscription',
-            onClick: () => organizationId && onLink(organizationId),
-            disabled: !organizationId || linking,
-            loading: linking,
-          },
+          ...(hasOrganizations
+            ? [
+                {
+                  label: 'Link subscription',
+                  onClick: () => organizationId && onLink(organizationId),
+                  disabled: !organizationId || pending,
+                  loading: linking,
+                },
+              ]
+            : []),
+          registerAction,
           { label: 'Not now', onClick: onCancel },
         ]}
       />
 
@@ -4,6 +4,7 @@ import type { ContractBodyInput } from '@/lib/api/contracts'
 import {
   getAwsMarketplaceClaimContract,
   linkAwsMarketplaceLicenseContract,
+  registerAwsMarketplaceLicenseToAccountContract,
 } from '@/lib/api/contracts/aws-marketplace'
 
 const AWS_MARKETPLACE_CLAIM_STALE_TIME = 30 * 1000
@@ -35,3 +36,14 @@ export function useLinkAwsMarketplaceLicense() {
     },
   })
 }
+
+export function useRegisterAwsMarketplaceLicenseToAccount() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (body: ContractBodyInput<typeof registerAwsMarketplaceLicenseToAccountContract>) =>
+      requestJson(registerAwsMarketplaceLicenseToAccountContract, { body }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: awsMarketplaceKeys.claims() })
+    },
+  })
+}
@@ -58,3 +58,11 @@ export const linkAwsMarketplaceLicenseContract = defineRouteContract({
     schema: z.object({ success: z.literal(true), organizationId: z.string() }),
   },
 })
+
+/** Registers the claimed license to the signed-in account when no organization is chosen. */
+export const registerAwsMarketplaceLicenseToAccountContract = defineRouteContract({
+  method: 'POST',
+  path: '/api/marketplace/aws/claim/register-account',
+  body: z.object({ licenseId: z.string().min(1, 'License ID is required').max(255) }),
+  response: { mode: 'json', schema: z.object({ success: z.literal(true) }) },
+})
@@ -12,6 +12,12 @@ export const awsMarketplaceOperations = {
     principalKinds: ['session'],
     capability: 'none',
   }),
+  // permission-group-exempt: a buyer with no organization takes their own purchase; nothing a group governs is touched.
+  registerToAccount: defineOperation({
+    id: 'aws_marketplace.license.register_account',
+    principalKinds: ['session'],
+    capability: 'none',
+  }),
   // permission-group-exempt: linking a purchased license is organization administration, not a governed capability.
   linkLicense: defineOrganizationOperation({
     id: 'organization.aws_marketplace_license.link',