AMC OS separates product quotas from generation-compute safeguards. A generation or regeneration must satisfy role permissions, brand access, subscription entitlements, weekly action limits, monthly compute allowance, storage allowance, and concurrency limits.
| Plan | Monthly | Annual equivalent | Brands | Seats | Generations/week | Regenerations/week | Managed storage |
|---|---|---|---|---|---|---|---|
| Launch Trial | Free | — | 1 | 1 | 1 total | 0 | 1 GB |
| Independent | $119 | $109/month | 3 | 1 | 3 | 1 | 5 GB |
| Premium | $299 | $269/month | 7 | 3 | 7 | 5 | 15 GB |
| Pro | $699 + optional overages | $629/month | 20 | 10 | 30 | 25 | 50 GB |
| Enterprise | Custom, starting at $1,500 + usage | Custom | Unlimited/custom | Custom | Contracted throughput | Contracted throughput | Custom |
Existing installations default to Enterprise/manual mode so an upgrade never removes functionality. New customer deployments should explicitly set AMC_DEFAULT_PLAN_ID=trial or the contracted paid plan during concierge provisioning. The dashboard manual-plan endpoint is disabled by default; operators may temporarily set AMC_ALLOW_MANUAL_PLAN_ASSIGNMENT=true during controlled provisioning, but it must remain false on customer-facing deployments.
The central subscription store owns plan definitions, feature gates, limits, and usage accounting. It persists:
billing/subscription.jsonbilling/usage_ledger.jsonThe append-only usage ledger reserves quota before a generation job is queued. Successful jobs finalize usage; cancelled, failed, orphaned, or dead-lettered jobs refund it. Idempotency keys prevent a duplicated request from consuming quota twice.
Independent and Premium use curated model strategies and do not receive provider-cost fields through API responses. Pro and Enterprise may select exact models and view generation costs. Owner status never bypasses commercial entitlements.
Set AMC_BILLING_MODE=stripe, configure the Stripe secret and webhook secret, then map each public paid plan to monthly and annual Stripe Price IDs. The dashboard creates hosted Checkout Sessions and Customer Portal Sessions. Webhook signatures are verified before subscription state is changed, and processed event IDs are retained for idempotency.
For the Pro plan, create a Stripe Billing Meter whose event name matches AMC_STRIPE_OVERAGE_METER_EVENT_NAME, then create a recurring metered Price attached to that meter and set its ID as AMC_STRIPE_PRICE_PRO_OVERAGE. Pro Checkout adds that metered Price as a second subscription line item. AMC OS reports only completed usage above the included compute allowance, multiplied by the configured launch margin. Meter events are delta-based and carry stable identifiers, so retries do not intentionally rebill the same local usage. The Billing page also provides a manual reconciliation control after temporary Stripe outages.
Recommended webhook events include:
checkout.session.completedcustomer.subscription.createdcustomer.subscription.updatedcustomer.subscription.deletedinvoice.paidinvoice.payment_failedFailed payments enter the configured grace period before new paid generation is paused. Existing content remains accessible. Normal subscription management should use the Stripe Customer Portal. Executing organization deletion requires Stripe subscription cancellation to be confirmed before local data removal, preventing an account from losing access while billing remains active.
The resumable first-publication checklist covers:
Progress is inferred from durable AMC OS state and can also be manually completed, reopened, dismissed, or reset. Example prompts are available directly in Create.
The plan storage allowance is measured from tracked files beneath the configured output directory, excluding reliability backups. New uploads, imports, and generation requests are blocked when the plan allowance is exhausted. The generation queue combines the deployment-level maximum with the active plan concurrency cap.
Owners can create a privacy-safe account export. The export includes JSON, YAML, text, CSV, SQLite, and other control-plane records but excludes OAuth credentials, tokens, secrets, passwords, and large media binaries. Excluded media is listed in the export manifest.
Organization deletion requires the exact phrase DELETE ORGANIZATION, observes the configured grace period, can be cancelled during that period, and is constrained to the configured output directory plus known AMC OS credential locations. The privacy tombstone and export directory are retained so the execution can be audited.
The first public release should be invite-only and concierge-provisioned. Each customer receives a dashboard/worker deployment, an Owner account, a selected plan, and guided onboarding. This avoids coupling the launch sprint to automatic infrastructure provisioning while real usage and support costs are measured.