@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { isAwsMarketplaceEnabled } from '@/lib/billing/aws-marketplace/config'
 import { reconcileAwsMarketplaceLicenses } from '@/lib/billing/aws-marketplace/reconcile'
 import { acquireLock, releaseLock } from '@/lib/core/config/redis'
 import { runDetached } from '@/lib/core/utils/background'
@@ -20,15 +20,15 @@ export const dynamic = 'force-dynamic'
  * Applies AWS Marketplace agreement events from the SQS queue and re-verifies licenses no event
  * touched within a day. Acknowledges the cron call at once and works in the background; a Redis
  * lock keeps runs from overlapping, and every write is idempotent, so a replayed run is harmless.
- * A no-op on deployments without `AWS_MARKETPLACE_PRODUCT_CODE`.
+ * A no-op on deployments without `AWS_MARKETPLACE_PRODUCTS`.
  */
 export const GET = withRouteHandler(async (request: NextRequest) => {
   const authError = verifyCronAuth(request, 'AWS Marketplace reconcile')
   if (authError) {
     return authError
   }
 
-  if (!getAwsMarketplaceProductCode()) {
+  if (!isAwsMarketplaceEnabled()) {
     return NextResponse.json({
       success: true,
       message: 'AWS Marketplace is not configured – skipped',
 
@@ -3,7 +3,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { awsMarketplaceRegistrationFormSchema } from '@/lib/api/contracts/aws-marketplace'
 import { serializeClaimCookie } from '@/lib/billing/aws-marketplace/claim'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { isAwsMarketplaceEnabled } from '@/lib/billing/aws-marketplace/config'
 import {
   AWS_MARKETPLACE_ONBOARDING_PATH,
   type AwsMarketplaceOnboardingError,
@@ -59,8 +59,7 @@ async function readRegistrationToken(request: NextRequest): Promise<string | nul
  * the claim cookie unless the license lapsed. The token is never logged.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
-  const productCode = getAwsMarketplaceProductCode()
-  if (!productCode) return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!isAwsMarketplaceEnabled()) return NextResponse.json({ error: 'Not found' }, { status: 404 })
 
   try {
     const rateLimited = await enforceIpRateLimit(
@@ -76,7 +75,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return redirectToOnboarding('invalid')
     }
 
-    const outcome = await registerAwsMarketplaceBuyer(productCode, token)
+    const outcome = await registerAwsMarketplaceBuyer(token)
     if (outcome.kind !== 'claimed') return redirectToOnboarding(outcome.kind)
 
     const response = redirectToOnboarding()
@@ -91,7 +90,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
 /** A refresh, back button, or bookmark of the fulfillment URL lands on the onboarding page. */
 export const GET = withRouteHandler(async () => {
-  if (!getAwsMarketplaceProductCode())
-    return NextResponse.json({ error: 'Not found' }, { status: 404 })
+  if (!isAwsMarketplaceEnabled()) return NextResponse.json({ error: 'Not found' }, { status: 404 })
   return redirectToOnboarding()
 })
@@ -9,7 +9,7 @@ import {
   linkAwsMarketplaceLicenseAsAdmin,
   listUnlinkedAwsMarketplaceLicenses,
 } from '@/lib/billing/aws-marketplace/application/admin'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { isAwsMarketplaceEnabled } from '@/lib/billing/aws-marketplace/config'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getAdminAuditActor } from '@/app/api/v1/admin/dashboard/actor'
@@ -29,7 +29,7 @@ const logger = createLogger('AdminAwsMarketplaceLicensesAPI')
 /** The Marketplace licenses no organization holds yet. */
 export const GET = withRouteHandler(
   withAdminAuth(async (request) => {
-    if (!getAwsMarketplaceProductCode()) return adminNotFoundResponse('AWS Marketplace')
+    if (!isAwsMarketplaceEnabled()) return adminNotFoundResponse('AWS Marketplace')
     const parsed = await parseRequest(
       adminDashboardListAwsMarketplaceLicensesContract,
       request,
@@ -56,7 +56,7 @@ export const GET = withRouteHandler(
 /** Links a Marketplace license to an organization once the team has provisioned it. */
 export const POST = withRouteHandler(
   withAdminAuth(async (request) => {
-    if (!getAwsMarketplaceProductCode()) return adminNotFoundResponse('AWS Marketplace')
+    if (!isAwsMarketplaceEnabled()) return adminNotFoundResponse('AWS Marketplace')
     const parsed = await parseRequest(
       adminDashboardLinkAwsMarketplaceLicenseContract,
       request,
 
@@ -1,6 +1,6 @@
 import type { Metadata } from 'next'
 import { notFound } from 'next/navigation'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { isAwsMarketplaceEnabled } from '@/lib/billing/aws-marketplace/config'
 import { AWS_MARKETPLACE_ONBOARDING_ERRORS } from '@/lib/billing/aws-marketplace/onboarding'
 import { isRegistrationDisabled } from '@/lib/core/config/env-flags'
 import { AwsMarketplaceOnboarding } from '@/app/marketplace/aws/aws-marketplace-onboarding'
@@ -18,7 +18,7 @@ interface AwsMarketplacePageProps {
 
 /** Where AWS Marketplace buyers land after registration, to link their subscription. */
 export default async function AwsMarketplacePage({ searchParams }: AwsMarketplacePageProps) {
-  if (!getAwsMarketplaceProductCode()) notFound()
+  if (!isAwsMarketplaceEnabled()) notFound()
   const { error } = await searchParams
   const registrationError = AWS_MARKETPLACE_ONBOARDING_ERRORS.find((code) => code === error) ?? null
   return (
 
@@ -3,7 +3,7 @@ import { subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { APIError } from 'better-auth/api'
 import { and, eq, isNotNull } from 'drizzle-orm'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import { isAwsMarketplaceEnabled } from '@/lib/billing/aws-marketplace/config'
 import { holdsMarketplaceLicense } from '@/lib/billing/aws-marketplace/repository'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import {
@@ -64,7 +64,7 @@ async function assertNoBoundIncompleteSubscription(referenceId: string): Promise
  * license lookup fails.
  */
 async function assertNotBilledThroughMarketplace(referenceId: string): Promise<void> {
-  if (!getAwsMarketplaceProductCode()) return
+  if (!isAwsMarketplaceEnabled()) return
   if (!(await holdsMarketplaceLicense(referenceId))) return
 
   logger.warn('Blocking checkout - reference is billed through AWS Marketplace', { referenceId })
 
@@ -3,7 +3,10 @@ import { db } from '@sim/db'
 import type { AwsMarketplaceClaim } from '@/lib/api/contracts/aws-marketplace'
 import { awsMarketplaceOperations } from '@/lib/billing/aws-marketplace/application/operations'
 import { hashClaimToken } from '@/lib/billing/aws-marketplace/claim'
-import { getAwsMarketplaceProductCode } from '@/lib/billing/aws-marketplace/config'
+import {
+  findAwsMarketplaceProduct,
+  isAwsMarketplaceEnabled,
+} from '@/lib/billing/aws-marketplace/config'
 import { verifyLicense } from '@/lib/billing/aws-marketplace/entitlements'
 import {
   type AwsMarketplaceLicenseRecord,
@@ -27,10 +30,15 @@ import { requireOrganizationSubjectMembership } from '@/lib/core/application/org
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 /** The same answer as an unknown route, so a deployment that does not sell on AWS shows nothing. */
-function requireProductCode(): string {
-  const productCode = getAwsMarketplaceProductCode()
-  if (!productCode) throw new OrchestrationError('not_found', 'Not found')
-  return productCode
+function requireMarketplaceEnabled(): void {
+  if (!isAwsMarketplaceEnabled()) throw new OrchestrationError('not_found', 'Not found')
+}
+
+/** The listing a license was sold under; one this deployment no longer sells reads as unknown. */
+function requireLicenseProduct(license: AwsMarketplaceLicenseRecord) {
+  const product = findAwsMarketplaceProduct(license.productCode)
+  if (!product) throw new OrchestrationError('not_found', 'Not found')
+  return product
 }
 
 function isClaimOpen(license: AwsMarketplaceLicenseRecord, now: Date): boolean {
@@ -115,7 +123,7 @@ export const readAwsMarketplaceClaim: OperationUseCase<
   operation: awsMarketplaceOperations.readClaim,
   async execute({ principal, input }) {
     assertOperationPrincipal(principal, awsMarketplaceOperations.readClaim)
-    requireProductCode()
+    requireMarketplaceEnabled()
     if (!input.claimToken) return { status: 'missing' }
     const license = await findLicenseByClaimHash(hashClaimToken(input.claimToken))
     if (!license || !isClaimOpen(license, new Date())) return { status: 'missing' }
@@ -169,7 +177,7 @@ function contactOf(input: BuyerContact) {
  * rechecks the claim under the row lock, so two tabs racing one claim take it at most once.
  */
 async function verifyClaimedLicense(input: ClaimInput, organizationId: string | null) {
-  const productCode = requireProductCode()
+  requireMarketplaceEnabled()
   const claimHash = input.claimToken ? hashClaimToken(input.claimToken) : null
   const claimed = requireOpenClaim(
     claimHash ? await findLicenseByClaimHash(claimHash) : null,
@@ -179,12 +187,12 @@ async function verifyClaimedLicense(input: ClaimInput, organizationId: string |
   requireLinkableTo(claimed, organizationId)
 
   const verifiedAt = new Date()
-  const summary = await verifyLicense(productCode, claimed.licenseArn)
+  const summary = await verifyLicense(requireLicenseProduct(claimed), claimed.licenseArn)
   const verification = { summary, verifiedAt }
   if (!summary.active) {
     const outcome = await recordLicenseVerification({
       licenseArn: claimed.licenseArn,
-      productCode,
+      productCode: claimed.productCode,
       verification,
     })
     throw new OrchestrationError(
@@ -321,15 +329,15 @@ export const saveAwsMarketplaceClaimContact: OperationUseCase<
   operation: awsMarketplaceOperations.saveClaimContact,
   async execute({ principal, input }) {
     assertOperationPrincipal(principal, awsMarketplaceOperations.saveClaimContact)
-    const productCode = requireProductCode()
+    requireMarketplaceEnabled()
     const claimHash = input.claimToken ? hashClaimToken(input.claimToken) : null
     const claimed = requireOpenClaim(
       claimHash ? await findLicenseByClaimHash(claimHash) : null,
       input.licenseId,
       claimHash
     )
     const verifiedAt = new Date()
-    const summary = await verifyLicense(productCode, claimed.licenseArn)
+    const summary = await verifyLicense(requireLicenseProduct(claimed), claimed.licenseArn)
     return db.transaction(async (tx) => {
       const locked = requireOpenClaim(
         await lockLicense(tx, input.licenseId),
@@ -360,7 +368,7 @@ function toLicenseStatusList(rows: Awaited<ReturnType<typeof listOrganizationLic
 export const listOrganizationAwsMarketplaceLicenses = defineAuthorizedOrganizationUseCase({
   operation: awsMarketplaceOperations.listOrganizationLicenses,
   async execute({ context }: OrganizationUseCaseContext<{ organizationId: string }>) {
-    if (!getAwsMarketplaceProductCode()) return []
+    if (!isAwsMarketplaceEnabled()) return []
     return toLicenseStatusList(await listOrganizationLicenses(context.organizationId))
   },
 })
@@ -374,7 +382,7 @@ export const listAccountAwsMarketplaceLicenses: OperationUseCase<
   operation: awsMarketplaceOperations.listAccountLicenses,
   async execute({ principal }) {
     assertOperationPrincipal(principal, awsMarketplaceOperations.listAccountLicenses)
-    if (!getAwsMarketplaceProductCode()) return []
+    if (!isAwsMarketplaceEnabled()) return []
     return toLicenseStatusList(await listAccountLicenses(principal.userId))
   },
 }
@@ -11,7 +11,7 @@ const TEAM_PLAN = 'team_6000'
 const productCode = vi.hoisted(() => ({ current: 'product-placeholder' as string | null }))
 
 vi.mock('@/lib/billing/aws-marketplace/config', () => ({
-  getAwsMarketplaceProductCode: () => productCode.current,
+  isAwsMarketplaceEnabled: () => productCode.current !== null,
 }))
 
 import {
 
@@ -1,10 +1,40 @@
+import {
+  type AwsMarketplaceProduct,
+  parseAwsMarketplaceProducts,
+} from '@/lib/billing/aws-marketplace/products'
 import { env } from '@/lib/core/config/env'
 
+/** Parsed once per distinct setting; env validation already rejected a malformed one at boot. */
+let parsed: { raw: string | undefined; products: ReadonlyMap<string, AwsMarketplaceProduct> } = {
+  raw: undefined,
+  products: new Map(),
+}
+
 /**
- * The SaaS product code, or null when this deployment does not sell through AWS Marketplace:
- * self-hosted installs and every environment but production. Null turns the registration,
- * claim, and reconcile surfaces off.
+ * The products this deployment sells through AWS Marketplace, by product code. Empty on
+ * self-hosted installs and every environment but production, which turns the registration, claim,
+ * and reconcile surfaces off.
  */
-export function getAwsMarketplaceProductCode(): string | null {
-  return env.AWS_MARKETPLACE_PRODUCT_CODE ?? null
+export function getAwsMarketplaceProducts(): ReadonlyMap<string, AwsMarketplaceProduct> {
+  const raw = env.AWS_MARKETPLACE_PRODUCTS
+  if (parsed.raw !== raw) {
+    parsed = { raw, products: raw ? parseAwsMarketplaceProducts(raw) : new Map() }
+  }
+  return parsed.products
+}
+
+export function isAwsMarketplaceEnabled(): boolean {
+  return getAwsMarketplaceProducts().size > 0
+}
+
+/** The configured product for a code AWS returned or a license row stored; null for any other. */
+export function findAwsMarketplaceProduct(
+  productCode: string | null | undefined
+): AwsMarketplaceProduct | null {
+  return productCode ? (getAwsMarketplaceProducts().get(productCode) ?? null) : null
+}
+
+/** Every configured product code, for queries that span all of them. */
+export function getAwsMarketplaceProductCodes(): string[] {
+  return [...getAwsMarketplaceProducts().keys()]
 }
@@ -13,23 +13,40 @@ vi.mock('@aws-sdk/client-marketplace-entitlement-service', () => ({
 }))
 
 import { verifyLicense } from '@/lib/billing/aws-marketplace/entitlements'
-
-const PRODUCT = 'product-placeholder'
+import {
+  AWS_MARKETPLACE_PLANS,
+  type AwsMarketplaceProduct,
+} from '@/lib/billing/aws-marketplace/products'
+
+const CONTRACT: AwsMarketplaceProduct = {
+  productCode: 'product-placeholder',
+  planId: 'contract',
+  plan: AWS_MARKETPLACE_PLANS.contract,
+}
+const USAGE: AwsMarketplaceProduct = {
+  productCode: 'usage-product-placeholder',
+  planId: 'platform-with-usage',
+  plan: AWS_MARKETPLACE_PLANS['platform-with-usage'],
+}
 const LICENSE = 'license-placeholder'
 const NOW = new Date('2026-06-01T00:00:00.000Z')
 
 function entitlement(overrides: Partial<Entitlement> = {}): Entitlement {
   return {
-    ProductCode: PRODUCT,
+    ProductCode: CONTRACT.productCode,
     Dimension: 'enterprise',
     Value: { IntegerValue: 25 },
     ...overrides,
   }
 }
 
-function read(...entitlements: Entitlement[]) {
+function readAs(product: AwsMarketplaceProduct, ...entitlements: Entitlement[]) {
   mockSend.mockResolvedValueOnce({ Entitlements: entitlements })
-  return verifyLicense(PRODUCT, LICENSE)
+  return verifyLicense(product, LICENSE)
+}
+
+function read(...entitlements: Entitlement[]) {
+  return readAs(CONTRACT, ...entitlements)
 }
 
 describe('verifyLicense', () => {
@@ -85,6 +102,29 @@ describe('verifyLicense', () => {
     expect(summary).toMatchObject({ active: true, dimension: 'b-current', quantity: 50 })
   })
 
+  it('does not let a current usage entitlement stand in for a required platform one', async () => {
+    const summary = await readAs(USAGE, entitlement({ Dimension: 'llm_credits' }))
+    expect(summary).toMatchObject({ active: false, entitlementCount: 1, dimension: null })
+  })
+
+  it('reads a lapsed platform as inactive even while usage is current', async () => {
+    const summary = await readAs(
+      USAGE,
+      entitlement({ Dimension: 'llm_credits' }),
+      entitlement({ Dimension: 'platform', ExpirationDate: new Date('2026-01-01T00:00:00.000Z') })
+    )
+    expect(summary).toMatchObject({ active: false, entitlementCount: 2, dimension: 'platform' })
+  })
+
+  it('reads a current platform as active and describes it, not the usage dimension', async () => {
+    const summary = await readAs(
+      USAGE,
+      entitlement({ Dimension: 'llm_credits', Value: { IntegerValue: 7 } }),
+      entitlement({ Dimension: 'platform', Value: { IntegerValue: 1 } })
+    )
+    expect(summary).toMatchObject({ active: true, dimension: 'platform', quantity: 1 })
+  })
+
   it('reads quantity only from an integer value, never from another value kind', async () => {
     expect((await read(entitlement({ Value: { DoubleValue: 1200.5 } }))).quantity).toBeNull()
   })
@@ -95,7 +135,7 @@ describe('verifyLicense', () => {
       .mockResolvedValueOnce({ Entitlements: [], NextToken: 't2' })
       .mockResolvedValueOnce({ Entitlements: [entitlement({ Dimension: 'two' })] })
 
-    const summary = await verifyLicense(PRODUCT, LICENSE)
+    const summary = await verifyLicense(CONTRACT, LICENSE)
 
     expect(summary).toMatchObject({ entitlementCount: 2, dimension: 'one' })
     expect(mockSend.mock.calls.map(([command]) => command.input.NextToken)).toEqual([