Upload folder using huggingface_hub

app/main.py

@@ -285,8 +285,8 @@ async def lifespan(app: FastAPI):
             # the health endpoint answers, the deploy succeeds, and API
             # requests get a clean 503 from enforce_quota until the database
             # is reachable -- at which point they recover with no redeploy.
-            postgres_ready = tracker.warm_up()
-            if not postgres_ready:
+            postgres_ready = tracker.warm_up() if tracker else False
+            if tracker and not postgres_ready:
                 logger.error(
                     "Usage tracker started WITHOUT a Postgres connection: api_keys "
                     "is unreachable, so API-key validation and quota enforcement "
@@ -302,7 +302,7 @@ async def lifespan(app: FastAPI):
             # kills the process -- reintroducing the crash loop the warm-up
             # above exists to prevent.
             api_keys_json = os.getenv("ARF_API_KEYS", "{}")
-            if not postgres_ready and api_keys_json not in ("", "{}"):
+            if tracker and not postgres_ready and api_keys_json not in ("", "{}"):
                 logger.warning(
                     "Skipping ARF_API_KEYS seeding: Postgres is unreachable. "
                     "Seeded keys will not exist until the database recovers "
@@ -311,38 +311,41 @@ async def lifespan(app: FastAPI):
                 api_keys_json = "{}"
             try:
                 api_keys = json.loads(api_keys_json)
-                for key, tier_str in api_keys.items():
-                    try:
-                        tier = Tier(tier_str.lower())
-                        # Previously called get_or_create_api_key(key, tier)
-                        # -- tier was silently accepted as tenant_id, so
-                        # every seeded key of the same tier collided onto
-                        # one bogus tenant_id. These are demo/env-seeded
-                        # keys with no real TenantDB row, but each still
-                        # needs its own tenant_id to avoid cross-key
-                        # contamination in tenant-scoped state elsewhere
-                        # (BetaStateDB, IntentDB, decision audit log). A
-                        # fixed-length key prefix isn't safe here: keys
-                        # generated elsewhere in this codebase share an
-                        # 8-char prefix ("sk_live_"/"sk_free_"), so a
-                        # prefix-based id would collide the same way the
-                        # original bug did. Hash the whole key instead.
-                        tenant_id = "env-seed-" + hashlib.sha256(key.encode()).hexdigest()[:16]
-                        tracker.get_or_create_api_key(key, tenant_id=tenant_id, tier=tier)
-                        logger.info(f"Seeded API key for tier {tier.value}")
-                    except ValueError:
-                        logger.warning(
-                            f"Invalid tier '{tier_str}' for key {key}, skipping"
-                        )
+                if tracker:
+                    for key, tier_str in api_keys.items():
+                        try:
+                            tier = Tier(tier_str.lower())
+                            # Previously called get_or_create_api_key(key, tier)
+                            # -- tier was silently accepted as tenant_id, so
+                            # every seeded key of the same tier collided onto
+                            # one bogus tenant_id. These are demo/env-seeded
+                            # keys with no real TenantDB row, but each still
+                            # needs its own tenant_id to avoid cross-key
+                            # contamination in tenant-scoped state elsewhere
+                            # (BetaStateDB, IntentDB, decision audit log). A
+                            # fixed-length key prefix isn't safe here: keys
+                            # generated elsewhere in this codebase share an
+                            # 8-char prefix ("sk_live_"/"sk_free_"), so a
+                            # prefix-based id would collide the same way the
+                            # original bug did. Hash the whole key instead.
+                            tenant_id = "env-seed-" + hashlib.sha256(key.encode()).hexdigest()[:16]
+                            tracker.get_or_create_api_key(key, tenant_id=tenant_id, tier=tier)
+                            logger.info(f"Seeded API key for tier {tier.value}")
+                        except ValueError:
+                            logger.warning(
+                                f"Invalid tier '{tier_str}' for key {key}, skipping"
+                            )
             except json.JSONDecodeError:
                 logger.warning(
                     "ARF_API_KEYS environment variable is not valid JSON; skipping seeding."
                 )
             app.state.usage_tracker = tracker
-            if postgres_ready:
+            if tracker and postgres_ready:
                 logger.info("✅ Usage tracker ready.")
-            else:
+            elif tracker:
                 logger.warning("⚠️  Usage tracker started in degraded mode (no Postgres).")
+            else:
+                logger.error("❌ Usage tracker is None; API-key validation and quota enforcement will not work.")
         except Exception as e:
             # Still fail closed on genuine configuration errors -- a missing
             # or too-short ARF_KEY_PEPPER, an unset DATABASE_URL. Those never