fix(billing): make AWS Marketplace notices durable and carry licenses across agreement replacements

- Team notices and the buyer confirmation go through the outbox, enqueued in the transaction that
  changes the license, so a failed send is retried and reconcile never waits on email. Every writer
  decides under its row lock whether terms moved, dimension included, and a new registration tells
  the team at once.
- A license with no entitlements yet is pending, not lapsed: it holds a claim, the buyer can leave
  contact details, and taking it waits for a read that says it is current. The notice reports
  whether the License Updated event has arrived. A Deprovisioned event the read contradicts stays
  queued, and a verification recording inactive clears the claim.
- Agreement replacement keys on previousAgreementId, works in either arrival order, hands the
  owner on to the new license, refuses a late A to B over B to C, and uses the event time so a
  redelivered license event cannot roll the agreement back. A superseded license ending does not
  ask the team to cancel. Advisory events reach the team.
- Provisioning stays manual. The buyer is told the account is being set up, to wait, the
  turnaround, and the contact. The team notice says to provision with payment collection paused
  and never to invoice through Stripe, and names the cancel flow for a lapse. An admin route lists
  unlinked licenses and links one, with audit.
- Status for account-only buyers, and billing hides plan entry points while a license is active.
  The link card shows a masked account and the signed-in email with no preselected organization,
  and the claim lasts 4 hours.
- Clients use request timeouts and SDK default retries, signing through fromHttp from
  @aws-sdk/credential-providers. Each license of an ended agreement gets its own read bound. The
  fulfillment URL always answers with a redirect and takes only URL-encoded forms.

Author: waleedlatif1

apps/sim/app/_shell/providers/theme-provider.tsx

@@ -28,6 +28,7 @@ const NON_LANDING_LIGHT_SEGMENTS = [
   'unsubscribe',
   'cli',
   'credential-groups',
+  'marketplace',
 ] as const
 
 /**

apps/sim/app/api/marketplace/aws/claim/contact/route.ts

@@ -0,0 +1,25 @@
+import { saveAwsMarketplaceClaimContactContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { saveAwsMarketplaceClaimContact } from '@/lib/billing/aws-marketplace/application/use-cases'
+import { AWS_MARKETPLACE_CLAIM_COOKIE } from '@/lib/billing/aws-marketplace/claim'
+
+export const POST = defineInternalJsonRoute({
+  contract: saveAwsMarketplaceClaimContactContract,
+  operation: saveAwsMarketplaceClaimContact.operation,
+  useCase: saveAwsMarketplaceClaimContact,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-link' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: ({ body }, { request }) => ({
+    licenseId: body.licenseId,
+    contactEmail: body.contactEmail,
+    companyName: body.companyName || null,
+    claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
+  }),
+})

apps/sim/app/api/marketplace/aws/claim/link/route.ts

@@ -26,10 +26,7 @@ export const POST = defineInternalJsonRoute({
     companyName: body.companyName || null,
     claimToken: request.cookies.get(AWS_MARKETPLACE_CLAIM_COOKIE)?.value ?? null,
   }),
-  present: (_linked, { input }) => ({
-    success: true as const,
-    organizationId: input.organizationId,
-  }),
+  present: () => ({ success: true as const }),
   /** The claim is spent once the link commits; the cookie that carried it goes with it. */
   finalizeResponse: () => ({ headers: { 'set-cookie': serializeClaimCookie(null) } }),
 })

apps/sim/app/api/marketplace/aws/licenses/route.ts

@@ -0,0 +1,20 @@
+import { listAccountAwsMarketplaceLicensesContract } from '@/lib/api/contracts/aws-marketplace'
+import {
+  defineInternalJsonRoute,
+  internalOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { listAccountAwsMarketplaceLicenses } from '@/lib/billing/aws-marketplace/application/use-cases'
+
+export const GET = defineInternalJsonRoute({
+  contract: listAccountAwsMarketplaceLicensesContract,
+  operation: listAccountAwsMarketplaceLicenses.operation,
+  useCase: listAccountAwsMarketplaceLicenses,
+  auth: internalSessionAuth,
+  rateLimit: internalRateLimits.user({ bucketName: 'aws-marketplace-licenses' }),
+  errorPolicy: internalOrchestrationErrorPolicy,
+  staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
+  mapInput: () => ({}),
+  present: (licenses) => ({ licenses }),
+})

apps/sim/app/api/marketplace/aws/register/route.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { awsMarketplaceRegistrationFormSchema } from '@/lib/api/contracts/aws-marketplace'
 import { serializeClaimCookie } from '@/lib/billing/aws-marketplace/claim'
@@ -17,9 +18,6 @@ export const dynamic = 'force-dynamic'
 
 const logger = createLogger('AwsMarketplaceRegisterAPI')
 
-/** AWS posts a URL-encoded form; multipart is accepted too, under the same cap. */
-const FORM_MEDIA_TYPES = new Set(['application/x-www-form-urlencoded', 'multipart/form-data'])
-
 /** The form carries one opaque token; anything larger is not from AWS. */
 const MAX_FORM_BYTES = 16 * 1024
 
@@ -37,7 +35,7 @@ function redirectToOnboarding(error?: AwsMarketplaceOnboardingError): NextRespon
 
 async function readRegistrationToken(request: NextRequest): Promise<string | null> {
   const mediaType = request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase()
-  if (!mediaType || !FORM_MEDIA_TYPES.has(mediaType)) return null
+  if (mediaType !== 'application/x-www-form-urlencoded') return null
   let form: FormData
   try {
     form = await readFormDataWithLimit(request, {
@@ -58,32 +56,37 @@ async function readRegistrationToken(request: NextRequest): Promise<string | nul
  * The listing's fulfillment URL. AWS sends the buyer's browser here with a cross-site form POST,
  * so the request carries no Sim session and is authenticated only by the registration token,
  * which ResolveCustomer verifies. The response is always a 303 to the onboarding page, carrying
- * the claim cookie when the license is active. The token is never logged.
+ * the claim cookie unless the license lapsed. The token is never logged.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const productCode = getAwsMarketplaceProductCode()
   if (!productCode) return NextResponse.json({ error: 'Not found' }, { status: 404 })
 
-  const rateLimited = await enforceIpRateLimit(
-    'aws-marketplace-register',
-    request,
-    REGISTER_RATE_LIMIT
-  )
-  if (rateLimited) return rateLimited
+  try {
+    const rateLimited = await enforceIpRateLimit(
+      'aws-marketplace-register',
+      request,
+      REGISTER_RATE_LIMIT
+    )
+    if (rateLimited) return redirectToOnboarding('unavailable')
 
-  const token = await readRegistrationToken(request)
-  if (!token) {
-    logger.warn('AWS Marketplace registration arrived without a usable token')
-    return redirectToOnboarding('invalid')
-  }
+    const token = await readRegistrationToken(request)
+    if (!token) {
+      logger.warn('AWS Marketplace registration arrived without a usable token')
+      return redirectToOnboarding('invalid')
+    }
 
-  const outcome = await registerAwsMarketplaceBuyer(productCode, token)
-  if (outcome.kind !== 'claimed') return redirectToOnboarding(outcome.kind)
+    const outcome = await registerAwsMarketplaceBuyer(productCode, token)
+    if (outcome.kind !== 'claimed') return redirectToOnboarding(outcome.kind)
 
-  const response = redirectToOnboarding()
-  response.headers.append('set-cookie', serializeClaimCookie(outcome.claimToken))
-  response.headers.set('Cache-Control', 'no-store')
-  return response
+    const response = redirectToOnboarding()
+    response.headers.append('set-cookie', serializeClaimCookie(outcome.claimToken))
+    response.headers.set('Cache-Control', 'no-store')
+    return response
+  } catch (error) {
+    logger.error('AWS Marketplace registration failed', { error: getErrorMessage(error) })
+    return redirectToOnboarding('unavailable')
+  }
 })
 
 /** A refresh, back button, or bookmark of the fulfillment URL lands on the onboarding page. */

apps/sim/app/api/organizations/[id]/aws-marketplace-licenses/route.ts

@@ -16,11 +16,5 @@ export const GET = defineInternalJsonRoute({
   errorPolicy: internalOrchestrationErrorPolicy,
   staticResponseHeaders: { 'Cache-Control': 'private, no-store' },
   mapInput: ({ params }) => ({ organizationId: params.id }),
-  present: (licenses) => ({
-    licenses: licenses.map((license) => ({
-      ...license,
-      expiresAt: license.expiresAt?.toISOString() ?? null,
-      lastVerifiedAt: license.lastVerifiedAt.toISOString(),
-    })),
-  }),
+  present: (licenses) => ({ licenses }),
 })

apps/sim/app/api/v1/admin/dashboard/aws-marketplace-licenses/route.ts

@@ -0,0 +1,78 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import {
+  adminDashboardLinkAwsMarketplaceLicenseContract,
+  adminDashboardListAwsMarketplaceLicensesContract,
+} from '@/lib/api/contracts/v1/admin/dashboard'
+import { parseRequest } from '@/lib/api/server'
+import {
+  linkAwsMarketplaceLicenseAsAdmin,
+  listUnlinkedAwsMarketplaceLicenses,
+} from '@/lib/billing/aws-marketplace/application/admin'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getAdminAuditActor } from '@/app/api/v1/admin/dashboard/actor'
+import { withAdminAuth } from '@/app/api/v1/admin/middleware'
+import {
+  adminConflictResponse,
+  adminInternalErrorResponse,
+  adminInvalidJsonResponse,
+  adminNotFoundResponse,
+  adminValidationErrorResponse,
+  listResponse,
+  singleResponse,
+} from '@/app/api/v1/admin/responses'
+
+const logger = createLogger('AdminAwsMarketplaceLicensesAPI')
+
+/** The Marketplace licenses no organization holds yet. */
+export const GET = withRouteHandler(
+  withAdminAuth(async (request) => {
+    const parsed = await parseRequest(
+      adminDashboardListAwsMarketplaceLicensesContract,
+      request,
+      {},
+      { validationErrorResponse: adminValidationErrorResponse }
+    )
+    if (!parsed.success) return parsed.response
+    try {
+      const { limit, offset } = parsed.data.query
+      const { total, licenses } = await listUnlinkedAwsMarketplaceLicenses({ limit, offset })
+      return listResponse(licenses, {
+        total,
+        limit,
+        offset,
+        hasMore: offset + licenses.length < total,
+      })
+    } catch (error) {
+      logger.error('Failed to list AWS Marketplace licenses', { error })
+      return adminInternalErrorResponse(getErrorMessage(error, 'Failed to list licenses'))
+    }
+  })
+)
+
+/** Links a Marketplace license to an organization once the team has provisioned it. */
+export const POST = withRouteHandler(
+  withAdminAuth(async (request) => {
+    const parsed = await parseRequest(
+      adminDashboardLinkAwsMarketplaceLicenseContract,
+      request,
+      {},
+      {
+        validationErrorResponse: adminValidationErrorResponse,
+        invalidJsonResponse: adminInvalidJsonResponse,
+      }
+    )
+    if (!parsed.success) return parsed.response
+    try {
+      const actor = await getAdminAuditActor(request)
+      return singleResponse(await linkAwsMarketplaceLicenseAsAdmin(parsed.data.body, actor))
+    } catch (error) {
+      const refusal = asOrchestrationError(error)
+      if (refusal?.code === 'not_found') return adminNotFoundResponse(refusal.message)
+      if (refusal?.code === 'conflict') return adminConflictResponse(refusal.message)
+      logger.error('Failed to link an AWS Marketplace license', { error })
+      return adminInternalErrorResponse(getErrorMessage(error, 'Failed to link the license'))
+    }
+  })
+)