feat: complete commercial developer workflowspublish-commercial-control-plane

Add tenant-safe usage observability, prepaid billing controls, API key lifecycle management, Embeddings metering, configurable billing alerts, and resilient provider health propagation. Harden Stripe failure handling, migrations, readiness, and the authenticated control-plane UI with end-to-end verification evidence.

1 files changed, 83 insertions, 0 deletions

diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index bb3e814..ff824ca 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -38,6 +38,73 @@ func TestLoadAppliesDefaultsAndResolvesSecrets(t *testing.T) {
 	}
 }
 
+func TestLoadResolvesActiveProviderProbeConfiguration(t *testing.T) {
+	t.Setenv("TEST_UPSTREAM_KEY", "secret")
+	t.Setenv("TEST_UPSTREAM_URL", "https://example.com/v1")
+	t.Setenv("TEST_ACTIVE_PROBES", "true")
+	path := writeConfig(t, `{
+  "provider_health":{"active_probes_enabled_env":"TEST_ACTIVE_PROBES","probe_interval_seconds":15,"probe_timeout_seconds":2},
+  "providers":[{"id":"primary","protocol":"openai","base_url_env":"TEST_UPSTREAM_URL","api_key_env":"TEST_UPSTREAM_KEY"}],
+  "models":[{"id":"example/model","routes":[{"provider":"primary","upstream_model":"model"}]}]
+}`)
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !cfg.ProviderHealth.ActiveProbesEnabled || cfg.ProviderHealth.ProbeIntervalSeconds != 15 || cfg.ProviderHealth.ProbeTimeoutSeconds != 2 {
+		t.Fatalf("unexpected provider health config: %+v", cfg.ProviderHealth)
+	}
+}
+
+func TestLoadResolvesSharedProviderHealthConfiguration(t *testing.T) {
+	t.Setenv("AIGW_DATABASE_URL", "postgres://aigw:aigw@postgres/aigw")
+	t.Setenv("AIGW_REDIS_URL", "redis://redis:6379/0")
+	t.Setenv("AIGW_CREDENTIAL_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
+	t.Setenv("TEST_SHARED_HEALTH", "true")
+	path := writeConfig(t, `{
+  "control_plane":{"enabled":true},
+  "provider_health":{"shared_history_enabled_env":"TEST_SHARED_HEALTH","shared_history_stream":"test:health","shared_history_ttl_seconds":120,"shared_history_max_events":500}
+}`)
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !cfg.ProviderHealth.SharedHistoryEnabled || cfg.ProviderHealth.SharedHistoryStream != "test:health" ||
+		cfg.ProviderHealth.SharedHistoryTTLSeconds != 120 || cfg.ProviderHealth.SharedHistoryMaxEvents != 500 {
+		t.Fatalf("unexpected shared provider health config: %+v", cfg.ProviderHealth)
+	}
+}
+
+func TestLoadAllowsSharedProviderHealthWithoutRedis(t *testing.T) {
+	t.Setenv("AIGW_DATABASE_URL", "postgres://aigw:aigw@postgres/aigw")
+	t.Setenv("AIGW_CREDENTIAL_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
+	t.Setenv("TEST_SHARED_HEALTH", "true")
+	path := writeConfig(t, `{
+  "control_plane":{"enabled":true},
+  "provider_health":{"shared_history_enabled_env":"TEST_SHARED_HEALTH"}
+}`)
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !cfg.ProviderHealth.SharedHistoryEnabled || cfg.ControlPlane.RedisURL != "" {
+		t.Fatalf("unexpected degraded shared provider health config: %+v", cfg.ProviderHealth)
+	}
+}
+
+func TestLoadRejectsInvalidActiveProviderProbeConfiguration(t *testing.T) {
+	t.Setenv("TEST_UPSTREAM_KEY", "secret")
+	t.Setenv("TEST_UPSTREAM_URL", "https://example.com/v1")
+	path := writeConfig(t, `{
+  "provider_health":{"probe_interval_seconds":5,"probe_timeout_seconds":5},
+  "providers":[{"id":"primary","protocol":"openai","base_url_env":"TEST_UPSTREAM_URL","api_key_env":"TEST_UPSTREAM_KEY"}],
+  "models":[{"id":"example/model","routes":[{"provider":"primary","upstream_model":"model"}]}]
+}`)
+	if _, err := Load(path); err == nil {
+		t.Fatal("expected invalid provider probe timeout to be rejected")
+	}
+}
+
 func TestLoadValidatesPublicProviderSlugs(t *testing.T) {
 	t.Setenv("TEST_UPSTREAM_KEY", "secret")
 	t.Setenv("TEST_UPSTREAM_URL", "https://example.com")
@@ -68,6 +135,22 @@ func TestLoadAcceptsOpenAIResponsesWireAPI(t *testing.T) {
 	}
 }
 
+func TestLoadAcceptsOpenAIEmbeddingsWireAPI(t *testing.T) {
+	t.Setenv("TEST_UPSTREAM_KEY", "secret")
+	t.Setenv("TEST_UPSTREAM_URL", "https://example.com/v1")
+	path := writeConfig(t, `{
+  "providers": [{"id":"embeddings","protocol":"openai","wire_api":"embeddings","base_url_env":"TEST_UPSTREAM_URL","api_key_env":"TEST_UPSTREAM_KEY"}],
+  "models": [{"id":"example/embedding","capabilities":["embeddings"],"routes":[{"provider":"embeddings","upstream_model":"embedding-model"}]}]
+}`)
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Providers[0].WireAPI != "embeddings" || len(cfg.Models[0].Capabilities) != 1 || cfg.Models[0].Capabilities[0] != "embeddings" {
+		t.Fatalf("unexpected embeddings config: provider=%+v model=%+v", cfg.Providers[0], cfg.Models[0])
+	}
+}
+
 func TestLoadRejectsIncompatibleWireAPI(t *testing.T) {
 	t.Setenv("TEST_UPSTREAM_KEY", "secret")
 	t.Setenv("TEST_UPSTREAM_URL", "https://example.com")