feat: complete commercial developer workflowspublish-commercial-control-plane

Add tenant-safe usage observability, prepaid billing controls, API key lifecycle management, Embeddings metering, configurable billing alerts, and resilient provider health propagation. Harden Stripe failure handling, migrations, readiness, and the authenticated control-plane UI with end-to-end verification evidence.

1 files changed, 5 insertions, 4 deletions

diff --git a/internal/controlplane/snapshot.go b/internal/controlplane/snapshot.go
index 75a3a80..48be436 100644
--- a/internal/controlplane/snapshot.go
+++ b/internal/controlplane/snapshot.go
@@ -246,7 +246,7 @@ func loadModels(ctx context.Context, tx pgx.Tx, providers map[string]domain.Prov
 func loadAPIKeys(ctx context.Context, tx pgx.Tx) ([]auth.HashedKeyRecord, error) {
 	rows, err := tx.Query(ctx, `
 		SELECT k.id::text, k.key_hash, k.tenant_id::text, k.project_id::text, k.scopes,
-		       k.monthly_spend_micros, k.expires_at,
+		       k.monthly_spend_micros, k.daily_spend_micros, k.requests_per_minute, k.tokens_per_minute, k.expires_at,
 		       COALESCE((
 		           SELECT jsonb_agg(m.public_id ORDER BY m.public_id)
 		           FROM api_key_model_restrictions r
@@ -265,10 +265,10 @@ func loadAPIKeys(ctx context.Context, tx pgx.Tx) ([]auth.HashedKeyRecord, error)
 	for rows.Next() {
 		var keyID, tenantID, projectID string
 		var hashBytes, scopesJSON, allowedModelsJSON []byte
-		var monthlySpendMicros int64
+		var monthlySpendMicros, dailySpendMicros, requestsPerMinute, tokensPerMinute int64
 		var expiresAt *time.Time
 		if err := rows.Scan(&keyID, &hashBytes, &tenantID, &projectID, &scopesJSON,
-			&monthlySpendMicros, &expiresAt, &allowedModelsJSON); err != nil {
+			&monthlySpendMicros, &dailySpendMicros, &requestsPerMinute, &tokensPerMinute, &expiresAt, &allowedModelsJSON); err != nil {
 			return nil, fmt.Errorf("scan API key: %w", err)
 		}
 		if len(hashBytes) != sha256.Size {
@@ -290,7 +290,8 @@ func loadAPIKeys(ctx context.Context, tx pgx.Tx) ([]auth.HashedKeyRecord, error)
 		}
 		records = append(records, auth.HashedKeyRecord{Hash: hash, Principal: domain.Principal{
 			KeyID: keyID, TenantID: tenantID, ProjectID: projectID, Scopes: scopes,
-			AllowedModels: allowedModels, MonthlySpendMicros: monthlySpendMicros, ExpiresAt: expiresAt,
+			AllowedModels: allowedModels, MonthlySpendMicros: monthlySpendMicros, DailySpendMicros: dailySpendMicros,
+			RequestsPerMinute: requestsPerMinute, TokensPerMinute: tokensPerMinute, ExpiresAt: expiresAt,
 		}})
 	}
 	if err := rows.Err(); err != nil {