Skip to content
Sign up

flagon-io/g1t

public
0
730 linesCodeBlameRaw
1//! Keeps every price current with what g1t actually pays.
2//!
3//! g1t passes its own costs through, so a price is only right while the
4//! cost under it is. One job keeps them right, on the billing service's
5//! daily cron:
6//!
7//! - **Checking costs** (daily). What Cloudflare billed g1t's account, from
8//! its usage API, is measured against how much was used: Containers
9//! against the seconds containers ran, Workers for Platforms per request
10//! and per CPU millisecond. When a measured cost moves, the price book
11//! moves with it, since each price is its cost plus a set markup, and
12//! the change is recorded where anyone can see it. A measurement goes
13//! through `pricing` as a proposal: a small move is applied on its own (a
14//! rise only after customers have had notice), a large or suspect one
15//! waits for staff in sudo, so one odd day of data cannot reprice
16//! everything.
17
18use g1t_contracts::actions::{InstanceType, STANDARD_INSTANCE, runner_minutes};
19use g1t_contracts::billing::{MICROS_PER_DOLLAR, Price, PriceBook, PriceChange};
20
21use g1t_contracts::time::rfc3339;
22use g1t_kit::now_ms;
23use serde::Deserialize;
24use serde_json::{Value, json};
25use worker::{Env, Fetch, Headers, Method, Request, RequestInit, Result};
26
27use crate::Billing;
28
29/// The cron that also checks costs against Cloudflare's bill.
30pub(crate) const DAILY: &str = "17 4 * * *";
31/// The quarter-hourly tick: settling, and once an hour the platform watch.
32pub(crate) const QUARTER_HOURLY: &str = "*/15 * * * *";
33
34/// Where the keeper reads what g1t pays.
35pub(crate) struct Keeper {
36 /// `CLOUDFLARE_USAGE_TOKEN`: Billing and Account Analytics, read only.
37 token: Option<String>,
38 /// What reads the bill for `costs`: `CLOUDFLARE_BILLING_TOKEN`
39 /// (Account: Billing Read and Account Analytics Read), or the usage
40 /// token, which has both.
41 billing_token: Option<String>,
42 account: String,
43}
44
45impl Keeper {
46 pub(crate) fn from_env(env: &Env) -> Self {
47 let var = |name: &str| env.var(name).map(|v| v.to_string()).unwrap_or_default();
48 let secret = |name: &str| env.secret(name).ok().map(|v| v.to_string()).filter(|v| !v.is_empty());
49 let token = secret("CLOUDFLARE_USAGE_TOKEN");
50 Keeper {
51 billing_token: secret("CLOUDFLARE_BILLING_TOKEN").or_else(|| token.clone()),
52 token,
53 account: var("CLOUDFLARE_ACCOUNT_ID"),
54 }
55 }
56
57 async fn send(&self, method: Method, url: &str, body: Option<Value>) -> Result<Value> {
58 let Some(token) = &self.token else {
59 return Err(worker::Error::RustError("no CLOUDFLARE_USAGE_TOKEN".into()));
60 };
61 send_with(token, method, url, body).await
62 }
63
64 /// Whether Cloudflare's bill can be read.
65 pub(crate) fn can_read_bill(&self) -> bool {
66 self.billing_token.is_some() && !self.account.is_empty()
67 }
68
69 fn billing_token(&self) -> Result<&str> {
70 self.billing_token
71 .as_deref()
72 .ok_or_else(|| worker::Error::RustError("no CLOUDFLARE_BILLING_TOKEN or CLOUDFLARE_USAGE_TOKEN".into()))
73 }
74
75 /// Billable usage from `from` to `to` (dates), every page of it, as one
76 /// answer (`result` holds all the rows), and how many pages it took.
77 /// An answer that says it failed is returned as it is.
78 pub(crate) async fn billable_usage_pages(&self, from: &str, to: &str) -> Result<(Value, u32)> {
79 usage_pages(self.billing_token()?, &self.api(&format!("/billable-usage?from={from}&to={to}"))).await
80 }
81
82 /// The account's subscriptions (Workers Paid, add-ons), as Cloudflare
83 /// answers them. Needs Account: Billing Read.
84 pub(crate) async fn subscriptions_body(&self) -> Result<Value> {
85 send_with(self.billing_token()?, Method::Get, &self.api("/subscriptions"), None).await
86 }
87
88 /// A GraphQL Analytics query, as Cloudflare answers it, errors and all.
89 pub(crate) async fn graphql(&self, body: Value) -> Result<Value> {
90 send_with(self.billing_token()?, Method::Post, "https://api.cloudflare.com/client/v4/graphql", Some(body)).await
91 }
92
93 pub(crate) fn account(&self) -> &str {
94 &self.account
95 }
96
97 fn api(&self, path: &str) -> String {
98 format!("https://api.cloudflare.com/client/v4/accounts/{}{path}", self.account)
99 }
100
101 /// The account's billable usage, one row per service per day, as
102 /// Cloudflare reports it.
103 async fn billable_usage(&self, from: &str, to: &str) -> Result<Vec<UsageRow>> {
104 let Some(token) = &self.token else {
105 return Err(worker::Error::RustError("no CLOUDFLARE_USAGE_TOKEN".into()));
106 };
107 let (body, _) = usage_pages(token, &self.api(&format!("/billable-usage?from={from}&to={to}"))).await?;
108 let rows = body["result"].as_array().cloned().unwrap_or_default();
109 Ok(rows.iter().filter_map(UsageRow::from_value).collect())
110 }
111
112 /// What g1t's containers used from `since` to `until` (dates), as
113 /// Cloudflare bills it: memory in byte-seconds, and CPU seconds.
114 async fn container_usage(&self, since: &str, until: &str) -> Result<ContainerUsage> {
115 let query = "query ($account: String!, $since: Date!, $until: Date!) {
116 viewer { accounts(filter: { accountTag: $account }) {
117 containersUsageAdaptiveGroups(limit: 1000, filter: { date_geq: $since, date_leq: $until }) {
118 sum { cpuTimeSec allocatedMemory }
119 }
120 } }
121 }";
122 let body = self
123 .send(
124 Method::Post,
125 "https://api.cloudflare.com/client/v4/graphql",
126 Some(json!({ "query": query, "variables": { "account": self.account, "since": since, "until": until } })),
127 )
128 .await?;
129 let groups = body["data"]["viewer"]["accounts"][0]["containersUsageAdaptiveGroups"]
130 .as_array()
131 .cloned()
132 .unwrap_or_default();
133 Ok(groups.iter().fold(ContainerUsage::default(), |total, g| ContainerUsage {
134 cpu_seconds: total.cpu_seconds + g["sum"]["cpuTimeSec"].as_f64().unwrap_or(0.0),
135 memory_byte_seconds: total.memory_byte_seconds + g["sum"]["allocatedMemory"].as_f64().unwrap_or(0.0),
136 }))
137 }
138}
139
140/// A request to Cloudflare's API with a bearer token; anything but 200 is
141/// an error with what Cloudflare said.
142/// The most pages of billable usage read in one go: far more than a few
143/// months of g1t's meters.
144const MAX_USAGE_PAGES: u32 = 50;
145
146/// Every page of a billable-usage answer, its rows together. Before
147/// 2026-10-09 only the first page was read.
148async fn usage_pages(token: &str, url: &str) -> Result<(Value, u32)> {
149 let mut rows: Vec<Value> = Vec::new();
150 let mut pages = 0;
151 let mut next = url.to_owned();
152 loop {
153 let body = send_with(token, Method::Get, &next, None).await?;
154 if body["success"] == Value::Bool(false) {
155 return Ok((body, pages + 1));
156 }
157 pages += 1;
158 rows.extend(body["result"].as_array().cloned().unwrap_or_default());
159 match crate::costs::next_page(&body, pages).filter(|_| pages < MAX_USAGE_PAGES) {
160 Some(query) => next = format!("{url}&{query}"),
161 None => break,
162 }
163 }
164 Ok((json!({ "success": true, "result": rows }), pages))
165}
166
167async fn send_with(token: &str, method: Method, url: &str, body: Option<Value>) -> Result<Value> {
168 let headers = Headers::new();
169 headers.set("authorization", &format!("Bearer {token}"))?;
170 headers.set("content-type", "application/json")?;
171 let mut init = RequestInit::new();
172 init.with_method(method).with_headers(headers);
173 if let Some(body) = body {
174 init.with_body(Some(body.to_string().into()));
175 }
176 let mut response = Fetch::Request(Request::new_with_init(url, &init)?).send().await?;
177 let status = response.status_code();
178 let value: Value = response.json().await.unwrap_or(Value::Null);
179 if status != 200 {
180 return Err(worker::Error::RustError(format!("Cloudflare answered {status}: {value}")));
181 }
182 Ok(value)
183}
184
185#[derive(Debug, Default, Clone, Copy)]
186pub(crate) struct ContainerUsage {
187 cpu_seconds: f64,
188 memory_byte_seconds: f64,
189}
190
191/// g1t's standard sandbox (`STANDARD_INSTANCE` in the contracts):
192/// Containers' standard-3, 2 vCPU, 8 GiB and 16 GB of disk. Memory and disk
193/// are billed as provisioned for every second it runs, so they are in the
194/// base; CPU only as used.
195const SANDBOX_GIB: f64 = 8.0;
196const SANDBOX_DISK_GB: f64 = 16.0;
197const GIB: f64 = 1024.0 * 1024.0 * 1024.0;
198/// The Durable Object behind each container is billed for as long as the
199/// container runs, at 128 MB.
200const SANDBOX_DO_GB: f64 = 0.125;
201
202/// Cloudflare's published Containers rates, in dollars, used for any rate
203/// the bill does not show yet (while usage is inside the included amount).
204const LIST_MEMORY_GIB_SECOND: f64 = 0.000_002_5;
205const LIST_DISK_GB_SECOND: f64 = 0.000_000_07;
206const LIST_VCPU_SECOND: f64 = 0.000_02;
207/// Durable Objects duration: $12.50 per million GB-seconds.
208const LIST_DO_GB_SECOND: f64 = 0.000_012_5;
209
210/// What one second of a sandbox costs whatever it does, in millionths of a
211/// dollar: its memory and disk, and the Durable Object behind it, for the
212/// whole second. CPU is billed only while busy, on top.
213pub(crate) fn sandbox_base_micros(memory: f64, disk: f64, durable_object: f64) -> f64 {
214 (SANDBOX_GIB * memory + SANDBOX_DISK_GB * disk + SANDBOX_DO_GB * durable_object) * MICROS_PER_DOLLAR as f64
215}
216
217/// What one second of a sandbox costs on average, in millionths of a
218/// dollar: its base, and the CPU sandboxes actually use per second of
219/// running. Runs that report their own CPU are priced on it instead (see
220/// `run_cost`).
221pub(crate) fn sandbox_second_micros(usage: ContainerUsage, memory: f64, disk: f64, vcpu: f64, durable_object: f64) -> Option<f64> {
222 let instance_seconds = usage.memory_byte_seconds / (SANDBOX_GIB * GIB);
223 if instance_seconds < 3600.0 {
224 return None;
225 }
226 let cpu_share = usage.cpu_seconds / instance_seconds;
227 Some(sandbox_base_micros(memory, disk, durable_object) + cpu_share * vcpu * MICROS_PER_DOLLAR as f64)
228}
229
230/// How much more a second of a larger machine's memory and disk (and the
231/// Durable Object behind it) costs than the standard sandbox's, at
232/// Cloudflare's list rates: 1 for the standard machine.
233pub(crate) fn base_scale(memory_gib: f64, disk_gb: f64) -> f64 {
234 let base = |memory: f64, disk: f64| memory * LIST_MEMORY_GIB_SECOND + disk * LIST_DISK_GB_SECOND + SANDBOX_DO_GB * LIST_DO_GB_SECOND;
235 base(memory_gib, disk_gb) / base(SANDBOX_GIB, SANDBOX_DISK_GB)
236}
237
238/// How much more a second of a machine costs g1t than the standard
239/// sandbox's with every vCPU of each as busy, at Cloudflare's list rates: 1
240/// for the standard machine. What a run that did not report its CPU is
241/// costed at, against the measured `sandbox_second`.
242pub(crate) fn busy_scale(instance: &InstanceType) -> f64 {
243 let busy = |i: &InstanceType| {
244 i.memory_gib * LIST_MEMORY_GIB_SECOND + i.disk_gb * LIST_DISK_GB_SECOND + i.vcpu * LIST_VCPU_SECOND + SANDBOX_DO_GB * LIST_DO_GB_SECOND
245 };
246 busy(instance) / busy(&STANDARD_INSTANCE)
247}
248
249/// What a job on g1t's machines is charged before the account's terms:
250/// its minutes, rounded up (`runner_minutes`), at its machine's rate a
251/// minute. The rates cover a machine with every vCPU busy at Cloudflare's
252/// list prices; should what a job cost g1t plus the margin
253/// (`margin_percent`) ever come to more (a busier job, a dearer bill), it
254/// is charged that instead, so g1t never sells a minute below cost plus
255/// the margin. Returns the minutes and the price.
256pub(crate) fn runner_charge(seconds: i64, instance: &InstanceType, cost: i64, margin_percent: u32) -> (i64, i64) {
257 let minutes = runner_minutes(seconds);
258 (minutes, (minutes * instance.micros_per_minute).max(crate::credits::with_margin(cost.max(0), margin_percent)))
259}
260
261/// `1 minute`, `12 minutes`.
262pub(crate) fn minutes_text(minutes: i64) -> String {
263 format!("{minutes} minute{}", if minutes == 1 { "" } else { "s" })
264}
265
266/// What a run that reported its own CPU cost g1t: its base for every
267/// second, and its vCPU-seconds at the vCPU rate.
268pub(crate) fn run_cost(seconds: i64, cpu_seconds: f64, base_per_second: f64, per_vcpu_second: f64) -> f64 {
269 seconds.max(0) as f64 * base_per_second + cpu_seconds.max(0.0) * per_vcpu_second
270}
271
272/// A unit's rate from the bill: the median, over the days with a list
273/// cost, of list cost over quantity. Never what was billed: that is net of
274/// the included amounts (nothing while a cycle is inside them, part of a
275/// day's usage on the day it passes one), so over all of the quantity it
276/// reads as a lower price when nothing changed. None without a list cost;
277/// the published rates stand in.
278pub(crate) fn billed_rate(rows: &[&UsageRow]) -> Option<f64> {
279 let mut rates: Vec<f64> = rows
280 .iter()
281 .filter(|r| r.list_cost > 0.0 && r.quantity > 0.0)
282 .map(|r| r.list_cost / r.quantity)
283 .collect();
284 if rates.is_empty() {
285 return None;
286 }
287 rates.sort_by(f64::total_cmp);
288 Some(rates[rates.len() / 2])
289}
290
291/// One line of Cloudflare's billable usage.
292#[derive(Debug, Clone)]
293pub(crate) struct UsageRow {
294 period_start: String,
295 period_end: String,
296 service: String,
297 unit: String,
298 quantity: f64,
299 cost: f64,
300 /// The quantity at list price, before the included amounts.
301 list_cost: f64,
302}
303
304impl UsageRow {
305 /// Read leniently: the API is new, and its field names are FOCUS's.
306 fn from_value(row: &Value) -> Option<Self> {
307 let text = |keys: &[&str]| keys.iter().find_map(|k| row[*k].as_str()).unwrap_or_default().to_owned();
308 let number = |keys: &[&str]| {
309 keys.iter()
310 .find_map(|k| row[*k].as_f64().or_else(|| row[*k].as_str().and_then(|s| s.parse().ok())))
311 .unwrap_or(0.0)
312 };
313 let service = text(&["ServiceName", "service_name", "service"]);
314 if service.is_empty() {
315 return None;
316 }
317 let family = text(&["ServiceFamilyName", "service_family_name"]);
318 Some(UsageRow {
319 period_start: text(&["ChargePeriodStart", "charge_period_start"]),
320 period_end: text(&["ChargePeriodEnd", "charge_period_end"]),
321 service: if family.is_empty() { service } else { format!("{family} / {service}") },
322 unit: text(&["PricingUnit", "ConsumedUnit", "consumed_unit"]),
323 quantity: number(&["PricingQuantity", "ConsumedQuantity", "pricing_quantity"]),
324 // What g1t pays; list price if nothing was contracted.
325 cost: Some(number(&["ContractedCost", "BilledCost", "contracted_cost"]))
326 .filter(|cost| *cost > 0.0)
327 .unwrap_or_else(|| number(&["ListCost", "list_cost"])),
328 list_cost: number(&["ListCost", "list_cost"]),
329 })
330 }
331}
332
333#[derive(Deserialize)]
334struct PriceRow {
335 meter: String,
336 title: String,
337 unit: String,
338 cost_micros: f64,
339 markup_percent: u32,
340 source: String,
341 checked_at: Option<String>,
342 updated_at: String,
343}
344
345#[derive(Deserialize)]
346struct ChangeRow {
347 meter: String,
348 old_cost_micros: f64,
349 new_cost_micros: f64,
350 markup_percent: u32,
351 old_markup_percent: Option<u32>,
352 reason: String,
353 created_at: String,
354}
355
356impl Billing {
357 pub(crate) async fn prices(&self) -> Result<PriceBook> {
358 // Three reads at once; the plans are priced from the rows already
359 // read, not one query per meter (status.g1t.sh times this call).
360 let (prices, changes, coming) = futures_util::future::join3(
361 async { self.db.prepare("SELECT * FROM prices ORDER BY rowid").all().await?.results::<PriceRow>() },
362 async {
363 self.db
364 .prepare("SELECT * FROM price_changes ORDER BY created_at DESC LIMIT 20")
365 .all()
366 .await?
367 .results::<ChangeRow>()
368 },
369 // Changes still to come first, so a rise is seen before it is charged.
370 self.coming_changes(),
371 )
372 .await;
373 let (prices, changes, coming) = (prices?, changes?, coming?);
374 // Agents' and models' meters, from before g1t stopped running
375 // agents, stay in the table but are no longer prices.
376 let prices: Vec<PriceRow> = prices.into_iter().filter(|row| !crate::pricing::retired(&row.meter)).collect();
377 let changes: Vec<ChangeRow> = changes.into_iter().filter(|row| !crate::pricing::retired(&row.meter)).collect();
378 let coming: Vec<PriceChange> = coming.into_iter().filter(|change| !crate::pricing::retired(&change.meter)).collect();
379 let book: std::collections::BTreeMap<&str, f64> = prices
380 .iter()
381 .map(|row| (row.meter.as_str(), Price::price_for(row.cost_micros, row.markup_percent)))
382 .collect();
383 // Each monthly price is all of it, before tax: no card fee on top.
384 let plans: Vec<_> = g1t_contracts::billing::Feature::ALL
385 .iter()
386 .map(|feature| match feature {
387 g1t_contracts::billing::Feature::Security => crate::features::security_plan_at(&book),
388 _ => self.plan_at(&book),
389 })
390 .collect();
391 Ok(PriceBook {
392 prices: prices
393 .into_iter()
394 .map(|row| Price {
395 price_micros: Price::price_for(row.cost_micros, row.markup_percent),
396 meter: row.meter,
397 title: row.title,
398 unit: row.unit,
399 cost_micros: row.cost_micros,
400 markup_percent: row.markup_percent,
401 source: row.source,
402 checked_at: row.checked_at,
403 updated_at: row.updated_at,
404 })
405 .collect(),
406 changes: coming
407 .into_iter()
408 .chain(changes.into_iter().map(|row| PriceChange {
409 meter: row.meter,
410 old_cost_micros: row.old_cost_micros,
411 new_cost_micros: row.new_cost_micros,
412 markup_percent: row.markup_percent,
413 old_markup_percent: row.old_markup_percent,
414 reason: row.reason,
415 created_at: row.created_at,
416 effective_at: None,
417 }))
418 .collect(),
419 // Nothing is charged for models any more; kept for readers.
420 model_margin_percent: self.margin_percent,
421 plans,
422 free: Some(g1t_contracts::billing::FreeTier {
423 trial_workspace_micros: if self.trials_on { self.plans.trial_workspace_micros } else { 0 },
424 trial_monthly_pool_micros: if self.trials_on { self.plans.trial_monthly_pool_micros } else { 0 },
425 oss_pool_micros: self.plans.oss_pool_micros,
426 oss_repo_micros: self.plans.oss_repo_micros,
427 free_private_storage_bytes: self.plans.free_storage_bytes,
428 audit_retention_days: self.plans.free_audit_days,
429 plan_audit_retention_days: self.plans.audit_days,
430 min_charge_micros: self.plans.min_charge_micros,
431 git_operations_included: self.plans.git_included,
432 paid_start_ceiling_micros: self.plans.paid_start_micros,
433 overage_forgive_cost_micros: self.plans.forgive_cost_micros,
434 }),
435 })
436 }
437
438 /// Whether the costs have never been checked against Cloudflare's bill.
439 pub(crate) async fn never_checked(&self) -> Result<bool> {
440 Ok(self
441 .db
442 .prepare("SELECT meter FROM prices WHERE checked_at IS NOT NULL LIMIT 1")
443 .first::<Value>(None)
444 .await?
445 .is_none())
446 }
447
448 /// A meter's cost and price per unit, from the book.
449 pub(crate) async fn price(&self, meter: &str) -> Result<Option<(f64, f64)>> {
450 #[derive(Deserialize)]
451 struct Row {
452 cost_micros: f64,
453 markup_percent: u32,
454 }
455 Ok(self
456 .db
457 .prepare("SELECT cost_micros, markup_percent FROM prices WHERE meter = ?")
458 .bind(&[meter.into()])?
459 .first::<Row>(None)
460 .await?
461 .map(|row| (row.cost_micros, Price::price_for(row.cost_micros, row.markup_percent))))
462 }
463
464 pub(crate) async fn reconcile(&self, keeper: &Keeper) -> Result<()> {
465 if keeper.token.is_none() {
466 return Ok(());
467 }
468 let now = rfc3339(now_ms());
469 let today = &now[..10];
470 let since = rfc3339(now_ms() - 30 * 24 * 60 * 60 * 1000);
471 let rows = keeper.billable_usage(&since[..10], today).await?;
472 for row in &rows {
473 self.db
474 .prepare(
475 "INSERT INTO cloudflare_usage (period_start, period_end, service, unit, quantity, cost_usd, fetched_at)
476 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
477 ON CONFLICT (period_start, service, unit) DO UPDATE SET
478 period_end = ?2, quantity = ?5, cost_usd = ?6, fetched_at = ?7",
479 )
480 .bind(&[
481 row.period_start.as_str().into(),
482 row.period_end.as_str().into(),
483 row.service.as_str().into(),
484 row.unit.as_str().into(),
485 row.quantity.into(),
486 row.cost.into(),
487 now.as_str().into(),
488 ])?
489 .run()
490 .await?;
491 }
492
493 let named = |words: &[&str]| -> Vec<&UsageRow> {
494 rows.iter()
495 .filter(|r| {
496 let service = r.service.to_lowercase();
497 words.iter().all(|word| service.contains(word))
498 })
499 .collect()
500 };
501
502 // Containers: each resource at the list cost the bill shows for it
503 // (before the included amounts), or the published rate without one,
504 // over how much CPU g1t's sandboxes really use per second.
505 let memory = billed_rate(&named(&["container memory"]));
506 let disk = billed_rate(&named(&["container disk"]));
507 let vcpu = billed_rate(&named(&["container vcpu"]));
508 let durable_object = billed_rate(&named(&["durable objects", "duration"]));
509 let usage = keeper.container_usage(&since[..10], today).await?;
510 let rates = (
511 memory.unwrap_or(LIST_MEMORY_GIB_SECOND),
512 disk.unwrap_or(LIST_DISK_GB_SECOND),
513 vcpu.unwrap_or(LIST_VCPU_SECOND),
514 durable_object.unwrap_or(LIST_DO_GB_SECOND),
515 );
516 // The parts, for runs that report their own CPU.
517 let parts_reason = "Cloudflare's Containers and Durable Objects rates, as listed on the bill or published";
518 self.measure("sandbox_base_second", sandbox_base_micros(rates.0, rates.1, rates.3), parts_reason).await?;
519 self.measure("sandbox_cpu_second", rates.2 * MICROS_PER_DOLLAR as f64, parts_reason).await?;
520 if let Some(per_second) = sandbox_second_micros(usage, rates.0, rates.1, rates.2, rates.3) {
521 let instance_seconds = usage.memory_byte_seconds / (SANDBOX_GIB * GIB);
522 let billed = [("memory", memory), ("disk", disk), ("vCPU", vcpu), ("Durable Object duration", durable_object)]
523 .iter()
524 .filter(|(_, rate)| rate.is_some())
525 .map(|(name, _)| *name)
526 .collect::<Vec<_>>();
527 let reason = format!(
528 "Sandboxes used {:.2} vCPU per second over {:.0} hours of Cloudflare Containers in the last 30 days, with the Durable Object behind each; {}",
529 usage.cpu_seconds / instance_seconds,
530 instance_seconds / 3600.0,
531 if billed.is_empty() {
532 "rates are Cloudflare's published ones".to_owned()
533 } else {
534 format!("{} at the list cost on Cloudflare's bill", billed.join(", "))
535 },
536 );
537 for meter in ["sandbox_second", "build_second"] {
538 self.measure(meter, per_second, &reason).await?;
539 }
540 }
541 // Apps run as Workers: per million requests and CPU milliseconds,
542 // once the bill shows them charged.
543 // Security scans' CPU follows the same Workers CPU rate.
544 let app_meters: [(&str, &[&str], &str); 3] = [
545 ("app_requests", &["workers", "requests"], "requests"),
546 ("app_cpu", &["workers cpu"], "CPU ms"),
547 ("scan_cpu", &["workers cpu"], "CPU ms"),
548 ];
549 for (meter, words, unit) in app_meters {
550 if let Some(rate) = billed_rate(&named(words)) {
551 let reason = format!("Cloudflare's bill lists Workers {unit} at ${:.2} per million", rate * 1e6);
552 self.measure(meter, rate * 1e6 * MICROS_PER_DOLLAR as f64, &reason).await?;
553 }
554 }
555 self.db
556 .prepare("UPDATE prices SET checked_at = ?")
557 .bind(&[now.as_str().into()])?
558 .run()
559 .await?;
560 Ok(())
561 }
562
563 /// Proposes moving a meter's cost to a measurement (see `pricing`):
564 /// applied on its own when small, after notice when a rise; left for
565 /// staff when large or suspect.
566 async fn measure(&self, meter: &str, measured: f64, reason: &str) -> Result<()> {
567 if let Some(outcome) = self.propose(meter, measured, reason, "keeper").await? {
568 worker::console_log!("{meter}: {outcome}");
569 }
570 Ok(())
571 }
572}
573
574#[cfg(test)]
575mod tests {
576 use super::*;
577
578 #[test]
579 fn a_cost_plus_the_margin_rounds_up_to_a_whole_micro() {
580 assert_eq!(crate::margin_on(140_000_000, 20), 168_000_000);
581 // Exactly cost plus the margin, rounded up, in whole micros, never under it.
582 for cost in [0_i64, 1, 7, 999, 123_457, 99_999_999] {
583 let exact = (cost * 120 + 99) / 100;
584 assert_eq!(crate::margin_on(cost, 20), exact, "{cost}");
585 assert!(crate::margin_on(cost, 20) * 100 >= cost * 120, "{cost}");
586 }
587 }
588
589 #[test]
590 fn a_sandbox_second_is_its_memory_and_disk_and_the_cpu_it_uses() {
591 // An hour of sandboxes that kept a fifth of a vCPU busy.
592 let usage = ContainerUsage { cpu_seconds: 720.0, memory_byte_seconds: 3600.0 * 8.0 * GIB };
593 let micros =
594 sandbox_second_micros(usage, LIST_MEMORY_GIB_SECOND, LIST_DISK_GB_SECOND, LIST_VCPU_SECOND, LIST_DO_GB_SECOND).unwrap();
595 // 8 x 2.5 + 16 x 0.07 + 0.125 x 12.5 + 0.2 x 20 = 26.6825
596 assert!((micros - 26.6825).abs() < 1e-9, "{micros}");
597 // Memory, disk and the Durable Object, billed for every second.
598 let base = sandbox_base_micros(LIST_MEMORY_GIB_SECOND, LIST_DISK_GB_SECOND, LIST_DO_GB_SECOND);
599 assert!((base - 22.6825).abs() < 1e-9);
600 // An hour of sandboxes that used no CPU still costs their base.
601 let idle = ContainerUsage { cpu_seconds: 0.0, memory_byte_seconds: 3600.0 * 8.0 * GIB };
602 let idle = sandbox_second_micros(idle, LIST_MEMORY_GIB_SECOND, LIST_DISK_GB_SECOND, LIST_VCPU_SECOND, LIST_DO_GB_SECOND).unwrap();
603 assert!((idle - base).abs() < 1e-9);
604 // Too little use to say anything.
605 assert!(sandbox_second_micros(ContainerUsage { cpu_seconds: 1.0, memory_byte_seconds: GIB }, 1.0, 1.0, 1.0, 1.0).is_none());
606 }
607
608 #[test]
609 fn a_run_that_reports_its_cpu_is_priced_on_it() {
610 let base = sandbox_base_micros(LIST_MEMORY_GIB_SECOND, LIST_DISK_GB_SECOND, LIST_DO_GB_SECOND);
611 let vcpu = LIST_VCPU_SECOND * MICROS_PER_DOLLAR as f64;
612 // A 10-minute cargo build that kept half a vCPU busy throughout.
613 let heavy = run_cost(600, 300.0, base, vcpu);
614 assert!((heavy - (600.0 * 22.6825 + 300.0 * 20.0)).abs() < 1e-6);
615 // Ten idle minutes cost the memory, disk and Durable Object that
616 // Cloudflare bills for all of them, and are charged that plus the
617 // margin, never less.
618 let idle = run_cost(600, 0.0, base, vcpu);
619 let provisioned = 600.0 * (8.0 * 2.5 + 16.0 * 0.07 + 0.125 * 12.5);
620 assert!((idle - provisioned).abs() < 1e-6, "{idle}");
621 let charged = crate::credits::with_margin(idle.ceil() as i64, 20);
622 assert!(charged as f64 >= provisioned * 1.2, "{charged}");
623 // The same ten minutes, mostly idle, costs less.
624 let light = run_cost(600, 30.0, base, vcpu);
625 assert!(light < heavy);
626 // The average would have under-priced the heavy one.
627 let average = 600.0 * (base + 0.195 * vcpu);
628 assert!(average < heavy && average > light);
629 assert_eq!(run_cost(0, -1.0, base, vcpu), 0.0);
630 // A larger machine's base: its memory and disk, not its CPU.
631 assert!((base_scale(SANDBOX_GIB, SANDBOX_DISK_GB) - 1.0).abs() < 1e-12);
632 assert!((base_scale(12.0, 20.0) - 1.45).abs() < 0.01, "{}", base_scale(12.0, 20.0));
633 // Each machine in the contracts is costed from its own memory and
634 // disk, and with its CPU unknown, at its vCPUs as busy: at least its
635 // base's share, so an idle job's cost still has the memory and disk
636 // it held.
637 for instance in g1t_contracts::actions::INSTANCE_TYPES {
638 let scale = base_scale(instance.memory_gib, instance.disk_gb);
639 assert!(scale >= 1.0 - 1e-12 && scale <= busy_scale(&instance) + 1e-9, "{}: {scale}", instance.label);
640 }
641 assert!((busy_scale(&STANDARD_INSTANCE) - 1.0).abs() < 1e-12);
642 let four = g1t_contracts::actions::machine_named("4-core").unwrap();
643 assert!((busy_scale(&four) - 1.80).abs() < 0.01, "{}", busy_scale(&four));
644 assert_eq!((STANDARD_INSTANCE.memory_gib, STANDARD_INSTANCE.disk_gb), (SANDBOX_GIB, SANDBOX_DISK_GB));
645 }
646
647 #[test]
648 fn a_job_is_charged_its_minutes_rounded_up_at_its_machines_rate() {
649 let four = g1t_contracts::actions::machine_named("4-core").unwrap();
650 // 61 seconds is 2 minutes; a job that ran is at least 1.
651 assert_eq!(runner_charge(61, &STANDARD_INSTANCE, 2_000, 20), (2, 8_000));
652 assert_eq!(runner_charge(1, &STANDARD_INSTANCE, 30, 20), (1, 4_000));
653 assert_eq!(runner_charge(60, &four, 4_000, 20), (1, 7_000));
654 assert_eq!(runner_charge(0, &STANDARD_INSTANCE, 0, 20), (0, 0));
655 // A full hour at list prices, half the vCPUs busy (what the rates
656 // are set from): the rate, over cost plus the margin. Every vCPU
657 // busy: cost plus the margin, never less.
658 for machine in g1t_contracts::actions::machines() {
659 let second = |busy: f64| machine.memory_gib * 2.5 + machine.disk_gb * 0.07 + 0.125 * 12.5 + machine.vcpu * busy * 20.0;
660 let half = (3_600.0 * second(0.5)).ceil() as i64;
661 let (minutes, price) = runner_charge(3_600, &machine, half, 20);
662 assert_eq!((minutes, price), (60, 60 * machine.micros_per_minute), "{}", machine.machine);
663 assert!(price >= crate::credits::with_margin(half, 20), "{}: {price} {half}", machine.machine);
664 let busy = (3_600.0 * second(1.0)).ceil() as i64;
665 let (_, price) = runner_charge(3_600, &machine, busy, 20);
666 assert_eq!(price, (60 * machine.micros_per_minute).max(crate::credits::with_margin(busy, 20)), "{}", machine.machine);
667 assert!(price >= crate::credits::with_margin(busy, 20) && price > busy, "{}: {price} {busy}", machine.machine);
668 }
669 // Should a job ever cost more than its minutes at the rate (a dearer
670 // Cloudflare bill), it is charged that cost plus the margin, never
671 // the bare cost.
672 assert_eq!(runner_charge(60, &STANDARD_INSTANCE, 10_000, 20), (1, 12_000));
673 assert_eq!(runner_charge(60, &STANDARD_INSTANCE, 10_000, 0), (1, 10_000));
674 assert_eq!(minutes_text(1), "1 minute");
675 assert_eq!(minutes_text(12), "12 minutes");
676 }
677
678 #[test]
679 fn a_billed_rate_is_the_median_of_the_charged_days() {
680 let row = |quantity: f64, list_cost: f64| UsageRow {
681 period_start: String::new(),
682 period_end: String::new(),
683 service: "Containers / Container Memory".into(),
684 unit: "Count".into(),
685 quantity,
686 cost: list_cost,
687 list_cost,
688 };
689 let rows = [row(100.0, 0.0), row(100.0, 0.0002), row(100.0, 0.00025), row(100.0, 0.00025)];
690 assert_eq!(billed_rate(&rows.iter().collect::<Vec<_>>()), Some(0.000_002_5));
691 assert_eq!(billed_rate(&[&row(5.0, 0.0)]), None);
692 }
693
694 #[test]
695 fn a_rate_is_the_list_price_not_what_was_billed_past_the_included_amount() {
696 // 126,870 GiB-seconds, of which the 36,870 past the included 90,000
697 // were billed: $0.09 billed, $0.32 at list. The rate is the list's.
698 let row = UsageRow {
699 period_start: String::new(),
700 period_end: String::new(),
701 service: "Containers / Container Memory".into(),
702 unit: "GiB-seconds".into(),
703 quantity: 126_870.0,
704 cost: 0.092_175,
705 list_cost: 0.317_175,
706 };
707 assert!((billed_rate(&[&row]).unwrap() - 0.000_002_5).abs() < 1e-15);
708 // Billed with no list cost says nothing about the price.
709 assert_eq!(billed_rate(&[&UsageRow { list_cost: 0.0, ..row }]), None);
710 }
711
712 #[test]
713 fn usage_rows_are_read_by_their_focus_names() {
714 let row = UsageRow::from_value(&json!({
715 "ServiceFamilyName": "Containers",
716 "ServiceName": "Memory",
717 "PricingUnit": "GiB-seconds",
718 "PricingQuantity": "1200.5",
719 "ContractedCost": 0.003,
720 "ListCost": 0.0030,
721 "ChargePeriodStart": "2026-10-01",
722 }))
723 .unwrap();
724 assert_eq!(row.service, "Containers / Memory");
725 assert_eq!(row.quantity, 1200.5);
726 assert_eq!(row.cost, 0.003);
727 assert_eq!(row.list_cost, 0.003);
728 assert!(UsageRow::from_value(&json!({ "nothing": 1 })).is_none());
729 }
730}