[collins-uzu]

Summary

• Require a valid API key during the GraphQL WebSocket connection-init handshake.
• Meter each subscription activation at the shared $0.10 GraphQL price and enforce usage quota.
• Cap concurrent subscriptions per API key; configure the limit with GRAPHQL_MAX_SUBSCRIPTIONS_PER_KEY (default: 10).
• Document the connection credentials, pricing, and limit.

Tests

• npm test (62 files passed, 1 skipped; 643 tests passed, 1 skipped)
• npx tsc --noEmit

Closes #363

[drips-wave]

@collins-uzu Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Miracle656]

Needs a rebase — main moved six times this morning (#379, #380, #382, #392, #401, #310 all landed) and this now conflicts. Push a rebase and I will pick it up; nothing is queued ahead of it.

[Miracle656]

Needs a rebase — main has moved a lot today (#306, #309, #252, #256, #355, #381, #390, #402 all landed) and this now conflicts.

Worth knowing before you rebase: #402 replaced every console.* call with a pino logger, so if this PR adds logging, express it as logger.* on a component child rather than console.* — there is a test that fails the build on a stray console call in non-test source.

Push the rebase and I will pick it up; nothing is queued ahead of it.