flagon-io/g1t

public

Compare changes

Choose two branches to see what one has that the other does not, then open a pull request for it.

1 commit

Two limits, real invoices, trust that grows by itself, sales signalsChase Pierce54755e13d ago

15 files+1688−2990/15 viewed

+66−43View BlameViewed

143	143
144	144		## Usage limits
145	145
146		−	Everything a workspace uses costs g1t money at Cloudflare or a model
147		−	provider before the workspace pays for it. So, as Fly and Cloudflare do
148		−	with new accounts, every workspace has a limit on usage not yet paid for.
149		−	When it is reached, the workspace's work stops until it pays, or the
150		−	month turns:
	146	+	Every workspace has two limits. One protects you from a surprise bill;
	147	+	the other protects g1t from usage that is never paid for. Both are on
	148	+	Settings → Billing → Limits.
151	149
152		−	- No new sandboxes. Assigning an agent, planning, asking for a
153		−	review and workflow jobs are refused with `402 payment_required` and the
154		−	reason; acceptance checks and the merge queue wait. Runs already under
155		−	way finish.
156		−	- No new builds, and deployed apps pause: they answer with a page
157		−	saying so (`402`) and run nothing. Once the workspace is under its limit
158		−	again, g1t rebuilds each one from the commit it was serving, by itself.
	150	+	### Your monthly spend limit
159	151
160		−	What counts is this month's usage (UTC), each item at what it cost g1t or
161		−	what it is charged, whichever is more, less what was paid this month, plus
162		−	any charges left unpaid from earlier months: a new month is not a fresh
163		−	allowance. Even
164		−	usage that is free to you, such as the free minutes, counts at its cost:
165		−	the limit is about what g1t has spent on a workspace's behalf.
	152	+	What the workspace may spend in a month (UTC). At it, work stops until the
	153	+	month turns or an owner raises it. Owners choose one of:
166	154
167		−	\| Workspace \| Limit \|
	155	+	- Automatic (the default): $200, or twice last month's spend,
	156	+	whichever is more. It keeps up as you grow: a workspace that spent $900
	157	+	last month can spend $1,800 this month without anyone changing a thing.
	158	+	- Fixed: an amount you set.
	159	+	- None: work never stops for spend.
	160	+
	161	+	You are emailed at 50%, 80% and 100% of it.
	162	+
	163	+	### What g1t lets go unpaid
	164	+
	165	+	Usage is charged after it runs, so at any moment some of it is not yet
	166	+	paid for. g1t lets that reach a ceiling that grows with your history, the
	167	+	way Cloudflare and Fly do:
	168	+
	169	+	\| \| Ceiling on what is unpaid \|
168	170		\| --- \| --- \|
169	171		\| New: has not paid g1t yet \| $3: the free allowances and a little more \|
170		−	\| Paid: has paid g1t \| twice what it has paid, from $25 up to $1,000 \|
171		−	\| Reviewed \| what g1t set for it, after talking with you \|
172		−	\| Comped \| none: g1t covers it \|
	172	+	\| Paid \| twice what you have paid, from $25 up to $1,000 \|
	173	+	\| Established: three steady months \| three times your monthly spend, up to $10,000, by itself \|
	174	+	\| Reviewed \| what g1t set with you; contact us \|
173	175
174		−	The limit is there to stop accounts that will never pay, not to slow down
175		−	ones that do. So:
	176	+	With a card on file, g1t charges it as you near the ceiling (80%):
	177	+	an invoice for what you owe, paid at once, after which the ceiling is
	178	+	yours again. So a workspace that pays keeps going, however much it uses;
	179	+	the ceiling only stops one that does not.
176	180
177		−	- With a card on file, work does not stop. As a workspace nears its
178		−	limit (80%), g1t charges its card for what it owes. That payment lowers
179		−	what is owed and raises the limit, since the limit grows with what a
180		−	workspace has paid. A workspace that pays as it goes keeps going.
181		−	- A declined card stops work until it is paid, with a message saying
182		−	so, and the pull requests that were waiting say Needs you. Paying
183		−	under Billing with another card clears it at once.
184		−	- Your own spend limit means stop. An owner can set a lower monthly
185		−	limit under Settings → Billing → Usage limit. At that one, g1t stops
186		−	work and does not charge the card past it.
	181	+	How the ceiling grows:
	182	+
	183	+	- A payment counts once it has cleared for 7 days, the time in which
	184	+	most bad cards are caught. Payments with prepaid cards pay, but do not
	185	+	raise the ceiling, nor do credits g1t gives or payments in test mode.
	186	+	- Established comes by itself after three months in a row of real spend
	187	+	($20 or more each), every monthly invoice paid, nothing declined in 90
	188	+	days and nothing ever disputed. From then the ceiling follows your
	189	+	spend.
	190	+	- Past $10,000, or for terms of your own, contact us: we set it with
	191	+	you, often with an enterprise account and invoices.
	192	+
	193	+	What counts as unpaid is each item at what it cost g1t or what it is
	194	+	charged, whichever is more, less what was paid this month, plus anything
	195	+	left unpaid from earlier months: a new month is not a fresh allowance.
	196	+
	197	+	A declined card stops work until it is paid, as does a payment
	198	+	disputed with the card's bank. Paying under Billing with another card
	199	+	clears it at once.
	200	+
	201	+	## Invoices
	202	+
	203	+	Every charge is a real invoice from g1t, kept on Stripe's billing page
	204	+	with its PDF and emailed as a receipt:
	205	+
	206	+	- When each month closes, an invoice for what the workspace owes,
	207	+	itemised: agents on g1t's models, runs on your own model provider,
	208	+	sandbox time, and deployments past the plan. Credit you paid in advance
	209	+	is taken off as Paid in advance; anything left unpaid from before is
	210	+	added.
	211	+	- When the workspace nears its ceiling mid-month, the same, sooner.
187	212
188		−	Payments in test mode are not money: they neither lower what is owed nor
189		−	raise the limit, and automatic charges only happen with live payments.
190		−	Credits g1t gives, such as refunds, lower what is owed but do not raise
191		−	the limit. To go past $1,000, write to support.
	213	+	Each is charged to the card on file. The Billing page lists them, with
	214	+	links to view each on Stripe and download its PDF.
192	215
193	216		## Enterprises and custom terms
194	217
⋯
223	246
224	247		With a card on file:
225	248
226		−	- Near the usage limit (80%), g1t charges it for what the workspace
227		−	owes, at least $5, so work does not stop.
228		−	- When each month closes, g1t charges it for what the workspace owed
229		−	at the end of the month, and the statement shows the payment as *Usage
230		−	for 2026-10, charged to the card on file when the month closed*.
	249	+	- Near the ceiling on what is unpaid (80%), g1t sends an
	250	+	[invoice](#invoices) for what the workspace owes and charges it, so work
	251	+	does not stop.
	252	+	- When each month closes, the month's [invoice](#invoices) is charged
	253	+	to it.
231	254		- If it is declined, work stops until the workspace pays, and the
232	255		Billing page and the API say why. Replace the card or add credit to pay.
233	256

+2−2View BlameViewed

394	394		className="scroll-mt-28 rounded-xl border border-line"
395	395		>
396	396		<header
397		−	className={`sticky top-14 z-20 flex items-center gap-2.5 border-line bg-surface/95 px-3 py-2 backdrop-blur ${
	397	+	className={`sticky top-16 z-20 flex items-center gap-2.5 border-line bg-surface/95 px-3 py-2 backdrop-blur ${
398	398		collapsed ? "rounded-xl" : "rounded-t-xl border-b"
399	399		}`}
400	400		>
⋯
707	707		const allCollapsed = files.every((file) => collapsed.has(file.path));
708	708		return (
709	709		<div>
710		−	<div className="sticky top-14 z-30 -mx-1 mb-3 flex flex-wrap items-center gap-x-4 gap-y-2 bg-bg/90 px-1 py-2 backdrop-blur">
	710	+	<div className="sticky top-16 z-30 -mx-1 mb-3 flex flex-wrap items-center gap-x-4 gap-y-2 bg-bg/90 px-1 py-2 backdrop-blur">
711	711		<span className="text-sm text-muted">
712	712		<span className="font-medium text-fg">{files.length}</span> {files.length === 1 ? "file" : "files"}
713	713		</span>

+7−7View BlameViewed

598	598		return (
599	599		<div className="flex h-full flex-col">
600	600		{/* The same height and rule as the top bar, so the two read as one line. */}
601		−	<div className="flex h-14 shrink-0 items-center gap-1.5 border-b border-line px-3">
602		−	<Link to="/" aria-label="g1t home" className="shrink-0 rounded-md p-1.5 hover:bg-raised">
603		−	<Mark className="size-5" />
	601	+	<div className="flex h-16 shrink-0 items-center gap-2 border-b border-line px-3">
	602	+	<Link to="/" aria-label="g1t home" className="shrink-0 rounded-md p-2 hover:bg-raised">
	603	+	<Mark className="size-6" />
604	604		</Link>
605	605		<span className="shrink-0 text-line-strong" aria-hidden="true">
606	606		/
⋯
611	611		<button
612	612		type="button"
613	613		onClick={onFind}
614		−	className="flex h-8 w-full items-center gap-2 rounded-md bg-surface px-2.5 text-[0.8125rem] text-faint ring-1 ring-line transition-colors hover:text-muted hover:ring-line-strong"
	614	+	className="flex h-9 w-full items-center gap-2 rounded-md bg-surface px-2.5 text-[0.8125rem] text-faint ring-1 ring-line transition-colors hover:text-muted hover:ring-line-strong"
615	615		>
616	616		<Search size={14} />
617	617		<span className="grow text-left">Find…</span>
⋯
1046	1046		)}
1047	1047
1048	1048		<div className="flex min-h-screen min-w-0 flex-col lg:pl-64">
1049		−	<header className="sticky top-0 z-30 flex h-14 items-center gap-3 border-b border-line bg-bg/85 px-4 backdrop-blur sm:px-6">
	1049	+	<header className="sticky top-0 z-30 flex h-16 items-center gap-3 border-b border-line bg-bg/85 px-4 backdrop-blur sm:px-6">
1050	1050		<button
1051	1051		type="button"
1052	1052		aria-label="Open menu"
⋯
1059	1059		<div className="ml-auto flex items-center gap-1.5">
1060	1060		<a
1061	1061		href="https://docs.g1t.sh/"
1062		−	className="hidden rounded-md px-2 py-1 text-[0.8125rem] text-muted transition-colors hover:bg-raised hover:text-fg sm:block"
	1062	+	className="hidden rounded-md px-2.5 py-1.5 text-sm text-muted transition-colors hover:bg-raised hover:text-fg sm:block"
1063	1063		>
1064	1064		Docs
1065	1065		</a>
1066	1066		<DropdownMenu>
1067	1067		<DropdownMenuTrigger
1068	1068		aria-label="Create"
1069		−	className="flex h-8 items-center gap-1.5 rounded-md bg-fg px-2.5 text-[0.8125rem] font-medium text-bg outline-none transition-colors hover:bg-white"
	1069	+	className="flex h-9 items-center gap-1.5 rounded-md bg-fg px-3 text-sm font-medium text-bg outline-none transition-colors hover:bg-white"
1070	1070		>
1071	1071		<Plus size={14} />
1072	1072		New

+182−60View BlameViewed

8	8		type Feature,
9	9		type FeatureState,
10	10		type Limit,
	11	+	type WorkspaceInvoice,
11	12		} from "@g1t/contracts";
12	13
13	14		import type { Route } from "./+types/billing";
⋯
47	48		await billing.confirm(slug, viewer, session);
48	49		throw redirect(`/${slug}/-/billing?added=1`);
49	50		}
50		−	const [account, ledger, features, deployUsage, limit] = await Promise.all([
	51	+	const [account, ledger, features, deployUsage, limit, invoices] = await Promise.all([
51	52		billing.account(slug, viewer),
52	53		billing.ledger(slug, viewer),
53	54		billing.features(slug, viewer),
54	55		deployments.usage(slug, viewer),
55	56		billing.limit(slug, viewer),
	57	+	billing.invoices(slug, viewer).catch(() => null),
56	58		]);
57	59		return {
58	60		slug,
⋯
62	64		features: unwrap(features),
63	65		deployUsage: deployUsage.ok ? deployUsage.value : null,
64	66		limit: limit.ok ? limit.value : null,
	67	+	invoices: invoices?.ok ? invoices.value : [],
65	68		added: url.searchParams.has("added"),
66	69		subscribed: url.searchParams.has("subscribed"),
67	70		};
⋯
79	82		if (!started.ok) return { error: started.error.message };
80	83		throw redirect(started.value.url);
81	84		}
82		−	if (intent === "spend-limit" \|\| intent === "no-spend-limit") {
	85	+	if (intent === "spend-limit") {
	86	+	// automatic, fixed (with an amount), or none.
	87	+	const mode = String(form.get("mode") ?? "automatic");
83	88		const amount = Number(form.get("limit"));
84		−	if (intent === "spend-limit" && !(Number.isFinite(amount) && amount >= 0)) {
85		−	return { error: "A spend limit is a dollar amount." };
	89	+	if (mode === "fixed" && !(Number.isFinite(amount) && amount >= 1)) {
	90	+	return { error: "A spend limit is a dollar amount, $1 or more." };
86	91		}
87	92		const set = await billing.setSpendLimit(
88	93		user,
89	94		params.owner,
90		−	intent === "spend-limit" ? Math.round(amount * MICROS_PER_DOLLAR) : null,
	95	+	mode === "fixed" ? Math.round(amount * MICROS_PER_DOLLAR) : null,
	96	+	mode === "none",
91	97		);
92	98		return set.ok ? null : { error: set.error.message };
93	99		}
⋯
120	126		}
121	127
122	128		export default function WorkspaceBilling({ loaderData, actionData }: Route.ComponentProps) {
123		−	const { slug, role, account, ledger, features, deployUsage, limit, added, subscribed } = loaderData;
	129	+	const { slug, role, account, ledger, features, deployUsage, limit, invoices, added, subscribed } = loaderData;
124	130		const { status } = account;
125	131		const paying = useNavigation().state === "submitting";
126	132		const empty = account.balanceMicros <= 0;
⋯
191	197		</section>
192	198		)}
193	199
	200	+	{invoices.length > 0 && <InvoiceList invoices={invoices} />}
	201	+
194	202		<h2 className="font-medium">Plans</h2>
195	203		<p className="mt-1 max-w-2xl text-sm text-muted">
196	204		Paid features are turned on per workspace with a monthly plan. They are never free, including while the rest of
⋯
491	499		}
492	500
493	501		const TRUST: Record<Limit["trust"], { label: string; detail: string }> = {
494		−	new: {
495		−	label: "New",
496		−	detail: "No payment to g1t yet, so the limit is small: the free allowances and a little more. It grows once the workspace pays.",
497		−	},
498		−	paid: { label: "Paid", detail: "Twice what the workspace has paid g1t, from $25 up to $1,000." },
	502	+	new: { label: "New", detail: "No payment to g1t yet." },
	503	+	paid: { label: "Paid", detail: "Grows with every payment." },
	504	+	established: { label: "Established", detail: "Follows your monthly spend." },
499	505		reviewed: { label: "Reviewed", detail: "Set by g1t for this workspace." },
500	506		internal: { label: "Comped", detail: "g1t covers this workspace's usage: nothing is charged, and there is no limit." },
501	507		};
502	508
	509	+	/** One meter: how much of a limit is used. */
	510	+	function Meter({ used, of, state }: { used: number; of: number \| null; state: "ok" \| "warning" \| "stopped" }) {
	511	+	const share = of ? Math.min(1, used / Math.max(of, 1)) : 0;
	512	+	const bar = state === "stopped" ? "bg-danger" : state === "warning" ? "bg-warn" : "bg-accent";
	513	+	return (
	514	+	<div className="mt-2 h-1.5 overflow-hidden rounded-full bg-line" role="presentation">
	515	+	<div className={`h-full ${bar}`} style={{ width: `${Math.max(share * 100, share > 0 ? 2 : 0)}%` }} />
	516	+	</div>
	517	+	);
	518	+	}
	519	+
	520	+	function meterState(used: number, of: number \| null): "ok" \| "warning" \| "stopped" {
	521	+	if (of == null) return "ok";
	522	+	if (used >= of) return "stopped";
	523	+	return used * 5 >= of * 4 ? "warning" : "ok";
	524	+	}
	525	+
503	526		/**
504		−	* How far this month's unpaid usage has gone, and where work stops: g1t's
505		−	* ceiling for the workspace, or the owners' own spend limit if lower.
	527	+	* The workspace's two limits, side by side: the owners' monthly spend
	528	+	* limit, which protects them from a surprise; and what g1t lets go unpaid,
	529	+	* which grows with what they pay and is charged to the card as it nears.
506	530		*/
507	531		function LimitCard({ limit, owner, busy, error }: { limit: Limit; owner: boolean; busy: boolean; error?: string }) {
508		−	const ceiling = limit.ceilingMicros;
509		−	const share = ceiling ? Math.min(1, limit.exposureMicros / Math.max(ceiling, 1)) : 0;
510	532		const tone =
511	533		limit.state === "stopped" ? "border-danger/40 bg-danger/5" : limit.state === "warning" ? "border-warn/40 bg-warn/5" : "border-line bg-surface";
512		−	const bar = limit.state === "stopped" ? "bg-danger" : limit.state === "warning" ? "bg-warn" : "bg-accent";
513	534		const trust = TRUST[limit.trust];
	535	+	const spent = limit.spentMicros ?? 0;
	536	+	const spendLimit = limit.spendLimitMicros;
	537	+	const available = limit.availableMicros ?? limit.ceilingMicros;
	538	+	const mode = limit.defaultSpendLimit ? "automatic" : spendLimit == null ? "none" : "fixed";
	539	+	if (limit.trust === "internal") {
	540	+	return (
	541	+	<section className="mb-10 rounded-xl border border-line bg-surface p-5">
	542	+	<div className="flex flex-wrap items-baseline justify-between gap-2">
	543	+	<h2 className="font-medium">Limits</h2>
	544	+	<span className="rounded-full border border-accent/40 px-2 py-0.5 text-xs text-accent">Comped</span>
	545	+	</div>
	546	+	<p className="mt-1 text-sm text-muted">{trust.detail}</p>
	547	+	</section>
	548	+	);
	549	+	}
514	550		return (
515	551		<section className={`mb-10 rounded-xl border p-5 ${tone}`}>
516	552		<div className="flex flex-wrap items-baseline justify-between gap-2">
517		−	<h2 className="font-medium">Usage limit</h2>
	553	+	<h2 className="font-medium">Limits</h2>
518	554		<span className="rounded-full border border-line px-2 py-0.5 text-xs text-muted">{trust.label}</span>
519	555		</div>
520		−	<p className="mt-1 max-w-2xl text-sm text-muted">
521		−	What this month's usage cost g1t, or is charged, whichever is more, less what was paid this month. With a card on
522		−	file, g1t charges it as the workspace nears the limit, so its work does not stop. Without one, at the limit new
523		−	sandboxes and builds stop and apps pause until it pays or the month turns. Work already running finishes.
524		−	</p>
525		−	<p className="mt-4 text-2xl font-semibold tabular-nums tracking-tight">
526		−	{dollars(limit.exposureMicros)}
527		−	<span className="text-base font-normal text-muted"> {ceiling == null ? "· no limit" : `of ${dollars(ceiling)}`}</span>
528		−	</p>
529		−	{ceiling != null && (
530		−	<div className="mt-3 h-1.5 overflow-hidden rounded-full bg-line" role="presentation">
531		−	<div className={`h-full ${bar}`} style={{ width: `${Math.max(share * 100, share > 0 ? 2 : 0)}%` }} />
532		−	</div>
533		−	)}
534	556		{limit.account.startsWith("ent_") && (
535		−	<p className="mt-3 text-sm text-muted">
	557	+	<p className="mt-1 text-sm text-muted">
536	558		Paid for by the <span className="font-medium text-fg">{limit.accountName}</span> enterprise: these figures are
537	559		for all of its workspaces together.
538	560		</p>
539	561		)}
540		−	{limit.message && <p className="mt-3 text-sm">{limit.message}</p>}
541		−	<p className="mt-3 text-xs text-faint">
542		−	{trust.detail}
543		−	{limit.trustCeilingMicros != null && limit.spendLimitMicros != null && ` g1t's limit is ${dollars(limit.trustCeilingMicros)}.`}
544		−	</p>
545		−	{owner && limit.trust !== "internal" && (
546		−	<Form method="post" className="mt-4 flex flex-wrap items-end gap-2">
547		−	<label className="text-sm">
548		−	<span className="block text-xs text-muted">Your own monthly spend limit</span>
549		−	<span className="mt-1 flex items-center rounded-md border border-line bg-bg px-2 focus-within:border-accent">
550		−	<span className="text-muted">$</span>
551		−	<input
552		−	name="limit"
553		−	type="number"
554		−	min={0}
555		−	step={1}
556		−	defaultValue={limit.spendLimitMicros != null ? limit.spendLimitMicros / MICROS_PER_DOLLAR : ""}
557		−	placeholder="None"
558		−	className="w-24 bg-transparent px-1 py-1.5 tabular-nums outline-none"
559		−	/>
	562	+
	563	+	<div className="mt-5 grid gap-6 sm:grid-cols-2">
	564	+	<div>
	565	+	<p className="text-xs text-muted">Spent this month</p>
	566	+	<p className="mt-1 text-2xl font-semibold tabular-nums tracking-tight">
	567	+	{dollars(spent)}
	568	+	<span className="text-base font-normal text-muted">
	569	+	{spendLimit == null ? " · no spend limit" : ` of ${dollars(spendLimit)}`}
	570	+	</span>
	571	+	</p>
	572	+	{spendLimit != null && <Meter used={spent} of={spendLimit} state={meterState(spent, spendLimit)} />}
	573	+	<p className="mt-2 text-xs text-faint">
	574	+	{mode === "automatic"
	575	+	? "Your spend limit is automatic: $200, or twice last month's spend, so it keeps up as you grow."
	576	+	: mode === "fixed"
	577	+	? "A spend limit you set. At it, work stops until the month turns."
	578	+	: "No spend limit: work never stops for spend, only for what g1t lets go unpaid."}
	579	+	</p>
	580	+	</div>
	581	+	<div>
	582	+	<p className="text-xs text-muted">Not yet paid</p>
	583	+	<p className="mt-1 text-2xl font-semibold tabular-nums tracking-tight">
	584	+	{dollars(limit.exposureMicros)}
	585	+	<span className="text-base font-normal text-muted">
	586	+	{available == null ? "" : ` of ${dollars(available)} available`}
560	587		</span>
561		−	</label>
562		−	<Button variant="quiet" type="submit" name="intent" value="spend-limit" disabled={busy}>
563		−	Set
564		−	</Button>
565		−	{limit.spendLimitMicros != null && (
566		−	<Button variant="quiet" type="submit" name="intent" value="no-spend-limit" disabled={busy}>
567		−	Remove
568		−	</Button>
	588	+	</p>
	589	+	{available != null && (
	590	+	<Meter used={limit.exposureMicros} of={available} state={meterState(limit.exposureMicros, available)} />
569	591		)}
	592	+	<p className="mt-2 text-xs text-faint">
	593	+	With a card on file, g1t charges it as this nears what is available, so work keeps going.
	594	+	{limit.growth ? ` ${limit.growth}` : ""}
	595	+	</p>
	596	+	</div>
	597	+	</div>
	598	+
	599	+	{limit.message && <p className="mt-4 text-sm">{limit.message}</p>}
	600	+
	601	+	{owner && (
	602	+	<Form method="post" className="mt-5 border-t border-line pt-4">
	603	+	<fieldset>
	604	+	<legend className="text-xs text-muted">Your monthly spend limit</legend>
	605	+	<div className="mt-2 flex flex-wrap items-center gap-x-5 gap-y-2 text-sm">
	606	+	<label className="flex items-center gap-2">
	607	+	<input type="radio" name="mode" value="automatic" defaultChecked={mode === "automatic"} className="accent-accent" />
	608	+	Automatic
	609	+	</label>
	610	+	<label className="flex items-center gap-2">
	611	+	<input type="radio" name="mode" value="fixed" defaultChecked={mode === "fixed"} className="accent-accent" />
	612	+	Fixed at
	613	+	<span className="flex items-center rounded-md border border-line bg-bg px-2 focus-within:border-accent">
	614	+	<span className="text-muted">$</span>
	615	+	<input
	616	+	name="limit"
	617	+	type="number"
	618	+	min={1}
	619	+	step={1}
	620	+	defaultValue={mode === "fixed" && spendLimit != null ? spendLimit / MICROS_PER_DOLLAR : ""}
	621	+	placeholder="500"
	622	+	className="w-24 bg-transparent px-1 py-1 tabular-nums outline-none"
	623	+	/>
	624	+	</span>
	625	+	</label>
	626	+	<label className="flex items-center gap-2">
	627	+	<input type="radio" name="mode" value="none" defaultChecked={mode === "none"} className="accent-accent" />
	628	+	None
	629	+	</label>
	630	+	<Button variant="quiet" type="submit" name="intent" value="spend-limit" disabled={busy}>
	631	+	Save
	632	+	</Button>
	633	+	</div>
	634	+	</fieldset>
570	635		<ErrorText>{error}</ErrorText>
	636	+	<p className="mt-3 text-xs text-faint">
	637	+	Need more than {available != null ? dollars(available) : "this"} available?{" "}
	638	+	<a href="mailto:billing@g1t.sh" className="text-fg hover:underline">
	639	+	Contact us
	640	+	</a>{" "}
	641	+	and we will set terms that fit.
	642	+	</p>
571	643		</Form>
572	644		)}
573	645		</section>
574	646		);
575	647		}
	648	+
	649	+	/** The workspace's invoices from g1t, each kept on Stripe with its PDF. */
	650	+	function InvoiceList({ invoices }: { invoices: WorkspaceInvoice[] }) {
	651	+	return (
	652	+	<section className="mb-10">
	653	+	<h2 className="font-medium">Invoices</h2>
	654	+	<p className="mt-1 text-sm text-muted">
	655	+	One when each month closes, and one each time g1t charges the card near your limit. Receipts and PDFs are also
	656	+	on Stripe's billing page.
	657	+	</p>
	658	+	<ul className="mt-4 divide-y divide-line overflow-hidden rounded-xl border border-line">
	659	+	{invoices.map((invoice) => (
	660	+	<li key={invoice.invoiceId} className="px-4 py-3 text-sm">
	661	+	<div className="flex flex-wrap items-center gap-3">
	662	+	<span className="font-medium">
	663	+	{invoice.reason === "month" ? `Usage for ${invoice.period}` : `Charged near the limit, ${invoice.period}`}
	664	+	</span>
	665	+	<span
	666	+	className={`rounded-full border px-2 py-0.5 text-xs ${
	667	+	invoice.status === "paid" ? "border-accent/40 text-accent" : "border-danger/40 text-danger"
	668	+	}`}
	669	+	>
	670	+	{invoice.status === "paid" ? "Paid" : invoice.status === "failed" ? "Payment failed" : invoice.status}
	671	+	</span>
	672	+	<span className="ml-auto font-mono tabular-nums">{dollars(invoice.amountMicros)}</span>
	673	+	{invoice.hostedUrl && (
	674	+	<a href={invoice.hostedUrl} className="text-xs text-muted hover:text-fg">
	675	+	View
	676	+	</a>
	677	+	)}
	678	+	{invoice.pdfUrl && (
	679	+	<a href={invoice.pdfUrl} className="text-xs text-muted hover:text-fg">
	680	+	PDF
	681	+	</a>
	682	+	)}
	683	+	</div>
	684	+	<ul className="mt-1.5 space-y-0.5 text-xs text-faint">
	685	+	{invoice.lines.map((line) => (
	686	+	<li key={line.description} className="flex justify-between gap-4">
	687	+	<span>{line.description}</span>
	688	+	<span className="font-mono tabular-nums">{dollars(line.amountMicros)}</span>
	689	+	</li>
	690	+	))}
	691	+	</ul>
	692	+	</li>
	693	+	))}
	694	+	</ul>
	695	+	</section>
	696	+	);
	697	+	}

+207−0View BlameViewed

402	402		New,
403	403		/// Has paid g1t real money: the ceiling grows with what it has paid.
404	404		Paid,
	405	+	/// Has paid steadily for months, with nothing disputed or declined:
	406	+	/// the ceiling follows its monthly spend, up to $10,000, by itself.
	407	+	Established,
405	408		/// A ceiling g1t set by hand, after talking to the workspace.
406	409		Reviewed,
407	410		/// g1t's own workspaces: no ceiling.
⋯
446	449		pub state: LimitState,
447	450		/// What to tell people when work is stopped or close to it.
448	451		pub message: Option<String>,
	452	+	/// Charged this month, which the spend limit is measured against.
	453	+	#[serde(default)]
	454	+	pub spent_micros: i64,
	455	+	/// True while the owners have not chosen a spend limit of their own, so
	456	+	/// the automatic one applies: $200, or twice last month's spend.
	457	+	#[serde(default)]
	458	+	pub default_spend_limit: bool,
	459	+	/// The most the owners may set their own limit to: g1t's ceiling. To
	460	+	/// go past it, they contact g1t.
	461	+	#[serde(default)]
	462	+	pub available_micros: Option<i64>,
	463	+	/// How the ceiling grows from here, in a sentence.
	464	+	#[serde(default)]
	465	+	pub growth: Option<String>,
449	466		}
450	467
451	468		/// `limit`: a workspace's limit, for its members. Returns `Outcome<Limit>`.
⋯
483	500		pub struct SetSpendLimitArgs {
484	501		pub actor: User,
485	502		pub workspace: String,
	503	+	/// A monthly limit, at most what is available; None goes back to the
	504	+	/// default.
486	505		pub spend_limit_micros: Option<i64>,
	506	+	/// Use everything available, with no limit of their own.
	507	+	#[serde(default)]
	508	+	pub use_full_limit: bool,
487	509		}
488	510
489	511		/// One metered unit: what it costs g1t, and what it is sold at. The price
⋯
717	739		pub amount_micros: i64,
718	740		}
719	741
	742	+	/// A workspace's invoice from g1t: one per month, and one each time it is
	743	+	/// charged near its limit. Itemised, charged to the card on file, and kept
	744	+	/// in Stripe's billing page with its PDF.
	745	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	746	+	#[serde(rename_all = "camelCase")]
	747	+	pub struct WorkspaceInvoice {
	748	+	pub invoice_id: String,
	749	+	pub workspace: String,
	750	+	/// `month` (2026-10) or `threshold`.
	751	+	pub reason: String,
	752	+	pub period: String,
	753	+	pub amount_micros: i64,
	754	+	/// `paid`, `open`, `failed` or `void`.
	755	+	pub status: String,
	756	+	pub hosted_url: Option<String>,
	757	+	pub pdf_url: Option<String>,
	758	+	pub lines: Vec<InvoiceItem>,
	759	+	pub created_at: String,
	760	+	}
	761	+
	762	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	763	+	#[serde(rename_all = "camelCase")]
	764	+	pub struct InvoiceItem {
	765	+	pub description: String,
	766	+	pub amount_micros: i64,
	767	+	}
	768	+
	769	+	/// `invoices`: a workspace's invoices from g1t, newest first. Members
	770	+	/// only. Returns `Outcome<Vec<WorkspaceInvoice>>`.
	771	+	#[derive(Debug, Serialize, Deserialize)]
	772	+	pub struct InvoicesArgs {
	773	+	pub workspace: String,
	774	+	pub viewer: Viewer,
	775	+	}
	776	+
	777	+	/// `admin_workspace_invoices`: the same, for staff. Returns
	778	+	/// `Vec<WorkspaceInvoice>`.
	779	+	#[derive(Debug, Serialize, Deserialize)]
	780	+	pub struct AdminWorkspaceInvoicesArgs {
	781	+	pub workspace: String,
	782	+	}
	783	+
	784	+	// --- Sales (sudo.g1t.sh) ------------------------------------------------------
	785	+	//
	786	+	// What staff need to know to reach out: who is growing, who is close to
	787	+	// their limit, who was declined, who has become a steady customer. And what
	788	+	// was done about it: a stage, an owner on g1t's side, a next step, notes.
	789	+
	790	+	/// Why a workspace is worth a look.
	791	+	#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
	792	+	#[serde(rename_all = "snake_case")]
	793	+	pub enum SignalKind {
	794	+	/// At its limit, or its own spend limit: work is stopped.
	795	+	AtLimit,
	796	+	/// Past 80% of what is available to it: about to need more.
	797	+	NearCeiling,
	798	+	/// Its card was declined or a payment disputed.
	799	+	Declined,
	800	+	/// This month is well ahead of last month.
	801	+	Growing,
	802	+	/// Became Established: the ceiling now follows its spend.
	803	+	Established,
	804	+	/// Paid g1t for the first time.
	805	+	FirstPayment,
	806	+	/// Spending enough that custom terms or an enterprise may suit it.
	807	+	HighSpend,
	808	+	}
	809	+
	810	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	811	+	#[serde(rename_all = "camelCase")]
	812	+	pub struct Signal {
	813	+	pub workspace: String,
	814	+	pub kind: SignalKind,
	815	+	/// One sentence, with the figures.
	816	+	pub detail: String,
	817	+	/// The figure that matters, such as this month's spend.
	818	+	pub value_micros: i64,
	819	+	/// Its sales stage, if staff gave it one.
	820	+	pub stage: Option<String>,
	821	+	pub owner: Option<String>,
	822	+	}
	823	+
	824	+	/// `admin_signals`: every workspace worth reaching out to, most urgent
	825	+	/// first. Returns `Vec<Signal>`.
	826	+	#[derive(Debug, Default, Serialize, Deserialize)]
	827	+	pub struct AdminSignalsArgs {}
	828	+
	829	+	/// What staff are doing about a workspace.
	830	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	831	+	#[serde(rename_all = "camelCase")]
	832	+	pub struct SalesRecord {
	833	+	pub workspace: String,
	834	+	/// `none`, `lead`, `contacted`, `negotiating`, `won`, `lost` or `churn_risk`.
	835	+	pub stage: String,
	836	+	/// The staff member looking after it.
	837	+	pub owner: Option<String>,
	838	+	pub next_step: Option<String>,
	839	+	/// RFC 3339 date.
	840	+	pub next_at: Option<String>,
	841	+	pub notes: Vec<SalesNote>,
	842	+	pub updated_at: Option<String>,
	843	+	}
	844	+
	845	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	846	+	#[serde(rename_all = "camelCase")]
	847	+	pub struct SalesNote {
	848	+	pub id: String,
	849	+	pub text: String,
	850	+	pub by: String,
	851	+	pub created_at: String,
	852	+	}
	853	+
	854	+	/// `admin_sales`: a workspace's sales record. Returns `SalesRecord`.
	855	+	#[derive(Debug, Serialize, Deserialize)]
	856	+	pub struct AdminSalesArgs {
	857	+	pub workspace: String,
	858	+	}
	859	+
	860	+	/// `admin_set_sales`: its stage, owner and next step. Returns `Outcome<SalesRecord>`.
	861	+	#[derive(Debug, Serialize, Deserialize)]
	862	+	pub struct AdminSetSalesArgs {
	863	+	pub workspace: String,
	864	+	pub stage: String,
	865	+	#[serde(default)]
	866	+	pub owner: Option<String>,
	867	+	#[serde(default)]
	868	+	pub next_step: Option<String>,
	869	+	#[serde(default)]
	870	+	pub next_at: Option<String>,
	871	+	pub by: String,
	872	+	}
	873	+
	874	+	/// `admin_add_note`. Returns `Outcome<SalesRecord>`.
	875	+	#[derive(Debug, Serialize, Deserialize)]
	876	+	pub struct AdminAddNoteArgs {
	877	+	pub workspace: String,
	878	+	pub text: String,
	879	+	pub by: String,
	880	+	}
	881	+
	882	+	/// `admin_overview`: the business at a glance. Returns `Overview`.
	883	+	#[derive(Debug, Default, Serialize, Deserialize)]
	884	+	pub struct AdminOverviewArgs {}
	885	+
	886	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	887	+	#[serde(rename_all = "camelCase")]
	888	+	pub struct Overview {
	889	+	/// YYYY-MM.
	890	+	pub month: String,
	891	+	/// The last six months, oldest first, all workspaces together.
	892	+	pub months: Vec<MonthFigures>,
	893	+	/// This month by kind of usage: models, sandbox, deployments, plans.
	894	+	pub by_kind: Vec<KindFigures>,
	895	+	pub paying_workspaces: u32,
	896	+	pub stopped: u32,
	897	+	pub near_ceiling: u32,
	898	+	pub declined: u32,
	899	+	/// Sent and not yet paid, workspaces and enterprises.
	900	+	pub open_invoices_micros: i64,
	901	+	/// Follow-ups due today or earlier.
	902	+	pub follow_ups_due: u32,
	903	+	}
	904	+
	905	+	#[derive(Clone, Debug, Serialize, Deserialize)]
	906	+	#[serde(rename_all = "camelCase")]
	907	+	pub struct KindFigures {
	908	+	pub kind: String,
	909	+	pub charged_micros: i64,
	910	+	pub cost_micros: i64,
	911	+	}
	912	+
720	913		// --- Staff (sudo.g1t.sh) ------------------------------------------------------
721	914		//
722	915		// Called only by the sudo app, which only g1t staff can reach (behind
⋯
750	943		/// any, so staff can see what one member of an enterprise used.
751	944		#[serde(default)]
752	945		pub by_workspace: Vec<WorkspaceFigures>,
	946	+	/// The last six months, oldest first, for trends.
	947	+	#[serde(default)]
	948	+	pub months: Vec<MonthFigures>,
	949	+	}
	950	+
	951	+	/// One month of an account's billing.
	952	+	#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
	953	+	#[serde(rename_all = "camelCase")]
	954	+	pub struct MonthFigures {
	955	+	/// YYYY-MM.
	956	+	pub month: String,
	957	+	pub charged_micros: i64,
	958	+	pub cost_micros: i64,
	959	+	pub paid_micros: i64,
753	960		}
754	961
755	962		/// One workspace's share of an [`AccountSummary`].

+80−3View BlameViewed

112	112		paidMicros: number;
113	113		/** The same figures for each of the account's workspaces that has any. */
114	114		byWorkspace: WorkspaceFigures[];
	115	+	/** The last six months, oldest first. */
	116	+	months?: MonthFigures[];
115	117		};
116	118
117	119		/** One workspace's share of an `AccountSummary`. */
⋯
136	138		createdAt: string;
137	139		};
138	140
	141	+	/** A workspace's invoice: monthly, or when charged near its limit. Itemised, in Stripe's billing page. */
	142	+	export type WorkspaceInvoice = {
	143	+	invoiceId: string;
	144	+	workspace: string;
	145	+	reason: "month" \| "threshold" \| string;
	146	+	period: string;
	147	+	amountMicros: number;
	148	+	status: "paid" \| "open" \| "failed" \| "void" \| string;
	149	+	hostedUrl: string \| null;
	150	+	pdfUrl: string \| null;
	151	+	lines: { description: string; amountMicros: number }[];
	152	+	createdAt: string;
	153	+	};
	154	+
	155	+	export type MonthFigures = { month: string; chargedMicros: number; costMicros: number; paidMicros: number };
	156	+
	157	+	export type SignalKind = "at_limit" \| "near_ceiling" \| "declined" \| "growing" \| "established" \| "first_payment" \| "high_spend";
	158	+
	159	+	/** Why a workspace is worth reaching out to. */
	160	+	export type Signal = {
	161	+	workspace: string;
	162	+	kind: SignalKind;
	163	+	detail: string;
	164	+	valueMicros: number;
	165	+	stage: string \| null;
	166	+	owner: string \| null;
	167	+	};
	168	+
	169	+	export type SalesStage = "none" \| "lead" \| "contacted" \| "negotiating" \| "won" \| "lost" \| "churn_risk";
	170	+
	171	+	export type SalesRecord = {
	172	+	workspace: string;
	173	+	stage: SalesStage \| string;
	174	+	owner: string \| null;
	175	+	nextStep: string \| null;
	176	+	nextAt: string \| null;
	177	+	notes: { id: string; text: string; by: string; createdAt: string }[];
	178	+	updatedAt: string \| null;
	179	+	};
	180	+
	181	+	export type Overview = {
	182	+	month: string;
	183	+	months: MonthFigures[];
	184	+	byKind: { kind: string; chargedMicros: number; costMicros: number }[];
	185	+	payingWorkspaces: number;
	186	+	stopped: number;
	187	+	nearCeiling: number;
	188	+	declined: number;
	189	+	openInvoicesMicros: number;
	190	+	followUpsDue: number;
	191	+	};
	192	+
139	193		/** A customer's Stripe billing page, for staff to send them. */
140	194		export type BillingLink = {
141	195		/** One-time and short-lived, signed in already. */
⋯
173	227		invoiceEnterprise(id: string, by: string): Promise<Result<EnterpriseInvoice>>;
174	228		/** Exactly these workspaces' accounts, such as one page of the list. */
175	229		accountsFor(workspaces: string[]): Promise<AccountSummary[]>;
	230	+	/** Every workspace worth reaching out to, most urgent first. */
	231	+	signals(): Promise<Signal[]>;
	232	+	/** The business at a glance. */
	233	+	overview(): Promise<Overview>;
	234	+	/** A workspace's sales record. */
	235	+	sales(workspace: string): Promise<SalesRecord>;
	236	+	setSales(workspace: string, record: { stage: string; owner?: string \| null; nextStep?: string \| null; nextAt?: string \| null }, by: string): Promise<Result<SalesRecord>>;
	237	+	addNote(workspace: string, text: string, by: string): Promise<Result<SalesRecord>>;
	238	+	/** A workspace's invoices from g1t, for staff. */
	239	+	workspaceInvoices(workspace: string): Promise<WorkspaceInvoice[]>;
176	240		}
177	241
178	242		/** How much a workspace has earned g1t's trust with money. */
179		−	export type Trust = "new" \| "paid" \| "reviewed" \| "internal";
	243	+	export type Trust = "new" \| "paid" \| "established" \| "reviewed" \| "internal";
180	244
181	245		/**
182	246		* How far a workspace's unpaid usage has gone this month, and where its
⋯
197	261		spendLimitMicros: number \| null;
198	262		state: "ok" \| "warning" \| "stopped";
199	263		message: string \| null;
	264	+	/** Charged this month: what the spend limit is measured against. */
	265	+	spentMicros?: number;
	266	+	/** True while the owners have not chosen a limit, so the automatic one applies: $200, or twice last month's spend. */
	267	+	defaultSpendLimit?: boolean;
	268	+	/** The most owners may set their own limit to; past it, they contact g1t. */
	269	+	availableMicros?: number \| null;
	270	+	/** How the ceiling grows from here, in a sentence. */
	271	+	growth?: string \| null;
200	272		};
201	273
202	274		/** One metered unit: what it costs g1t and what it is sold at; the price follows the cost. */
⋯
352	424		limit(workspace: string, viewer: Viewer): Promise<Result<Limit>>;
353	425		/** The same, for the services that enforce it. */
354	426		checkLimit(workspace: string): Promise<Result<Limit>>;
355		−	/** The owner's own monthly ceiling, under g1t's; null removes it. Owners only. */
356		−	setSpendLimit(actor: User, workspace: string, spendLimitMicros: number \| null): Promise<Result<Limit>>;
357	427		/**
	428	+	* The owners' own monthly limit, up to what is available; null goes back
	429	+	* to the default, and `useFullLimit` uses everything available. Owners only.
	430	+	*/
	431	+	setSpendLimit(actor: User, workspace: string, spendLimitMicros: number \| null, useFullLimit?: boolean): Promise<Result<Limit>>;
	432	+	/** The workspace's invoices from g1t, newest first. Members only. */
	433	+	invoices(workspace: string, viewer: Viewer): Promise<Result<WorkspaceInvoice[]>>;
	434	+	/**
358	435		* How long a sandbox ran for a workspace, reported when it stops. Its
359	436		* cost is always recorded; seconds past the month's free minutes are
360	437		* charged. False if `reference` was recorded before.

+17−2View BlameViewed

214	214		checkLimit: (workspace) => call("check_limit", { workspace }),
215	215		prices: () => call("prices", {}),
216	216		notePending: (workspace, source, costMicros) => call("note_pending", { workspace, source, costMicros }),
217		−	setSpendLimit: (actor, workspace, spendLimitMicros) =>
218		−	call("set_spend_limit", { actor, workspace, spendLimitMicros }),
	217	+	setSpendLimit: (actor, workspace, spendLimitMicros, useFullLimit = false) =>
	218	+	call("set_spend_limit", { actor, workspace, spendLimitMicros, use_full_limit: useFullLimit }),
	219	+	invoices: (workspace, viewer) => call("invoices", { workspace, viewer }),
219	220		};
220	221		}
221	222
⋯
233	234		enterpriseBilling: (id, email, by) => call("admin_enterprise_billing", { id, email, by }),
234	235		invoiceEnterprise: (id, by) => call("admin_invoice_enterprise", { id, by }),
235	236		accountsFor: (workspaces) => call("admin_accounts", { query: null, workspaces }),
	237	+	signals: () => call("admin_signals", {}),
	238	+	overview: () => call("admin_overview", {}),
	239	+	sales: (workspace) => call("admin_sales", { workspace }),
	240	+	setSales: (workspace, record, by) =>
	241	+	call("admin_set_sales", {
	242	+	workspace,
	243	+	stage: record.stage,
	244	+	owner: record.owner ?? null,
	245	+	next_step: record.nextStep ?? null,
	246	+	next_at: record.nextAt ?? null,
	247	+	by,
	248	+	}),
	249	+	addNote: (workspace, text, by) => call("admin_add_note", { workspace, text, by }),
	250	+	workspaceInvoices: (workspace) => call("admin_workspace_invoices", { workspace }),
236	251		};
237	252		}
238	253

+60−0View BlameViewed

1	+	-- Real invoices, trust that is hard to game, and sales records.
2	+
3	+	-- Payments: which kind of card paid (prepaid cards never raise the
4	+	-- limit), and whether the payment was disputed (never counts again).
5	+	ALTER TABLE ledger ADD COLUMN funding TEXT;
6	+	ALTER TABLE ledger ADD COLUMN disputed INTEGER NOT NULL DEFAULT 0;
7	+
8	+	-- The owners chose to use everything available, with no limit of their
9	+	-- own. Without it and without spend_limit_micros, the default applies.
10	+	ALTER TABLE limits ADD COLUMN spend_limit_full INTEGER NOT NULL DEFAULT 0;
11	+
12	+	-- A workspace's invoices from g1t: one when each month closes, and one
13	+	-- each time it is charged near its limit. Itemised at Stripe, charged to
14	+	-- the card on file, and kept in Stripe's billing page with a PDF.
15	+	CREATE TABLE workspace_invoices (
16	+	invoice_id TEXT PRIMARY KEY,
17	+	workspace TEXT NOT NULL,
18	+	-- month or threshold.
19	+	reason TEXT NOT NULL,
20	+	-- YYYY-MM for a month, the date for a threshold.
21	+	period TEXT NOT NULL,
22	+	amount_micros INTEGER NOT NULL,
23	+	-- paid, open, failed or void.
24	+	status TEXT NOT NULL,
25	+	hosted_url TEXT,
26	+	pdf_url TEXT,
27	+	-- Usage up to here is on this invoice.
28	+	through_at TEXT NOT NULL,
29	+	created_at TEXT NOT NULL,
30	+	paid_at TEXT
31	+	);
32	+	CREATE INDEX workspace_invoices_by_workspace ON workspace_invoices (workspace, created_at);
33	+
34	+	CREATE TABLE workspace_invoice_lines (
35	+	invoice_id TEXT NOT NULL,
36	+	position INTEGER NOT NULL,
37	+	description TEXT NOT NULL,
38	+	amount_micros INTEGER NOT NULL,
39	+	PRIMARY KEY (invoice_id, position)
40	+	);
41	+
42	+	-- What staff are doing about a workspace.
43	+	CREATE TABLE sales_records (
44	+	workspace TEXT PRIMARY KEY,
45	+	stage TEXT NOT NULL DEFAULT 'none',
46	+	owner TEXT,
47	+	next_step TEXT,
48	+	next_at TEXT,
49	+	updated_by TEXT NOT NULL,
50	+	updated_at TEXT NOT NULL
51	+	);
52	+
53	+	CREATE TABLE sales_notes (
54	+	id TEXT PRIMARY KEY,
55	+	workspace TEXT NOT NULL,
56	+	text TEXT NOT NULL,
57	+	by TEXT NOT NULL,
58	+	created_at TEXT NOT NULL
59	+	);
60	+	CREATE INDEX sales_notes_by_workspace ON sales_notes (workspace, created_at);

+2−0View BlameViewed

292	292		for p in &paid {
293	293		figures_for(&mut by_workspace, &p.workspace).paid_micros += p.paid.unwrap_or(0);
294	294		}
	295	+	let months = self.months_for(&account.workspaces, 6).await?;
295	296		Ok(AccountSummary {
	297	+	months,
296	298		charged_micros: by_workspace.iter().map(\|f\| f.charged_micros).sum(),
297	299		cost_micros: by_workspace.iter().map(\|f\| f.cost_micros).sum(),
298	300		paid_micros: by_workspace.iter().map(\|f\| f.paid_micros).sum(),

+351−0View BlameViewed

1	+	//! A workspace's invoices from g1t.
2	+	//!
3	+	//! Every time g1t charges a workspace's card, it is a real Stripe invoice:
4	+	//! when each month closes, and when the workspace nears its limit mid-month
5	+	//! (a threshold invoice, as Cloudflare and Fly do). Each is itemised by
6	+	//! what was used since the last one, with any credit paid in advance taken
7	+	//! off and anything left unpaid from before added, so its total is exactly
8	+	//! what is owed. Stripe charges the card, emails the receipt, and keeps
9	+	//! the invoice and its PDF in the workspace's billing page.
10	+
11	+	use g1t_contracts::billing::{EntryKind, InvoiceItem, InvoicesArgs, WorkspaceInvoice};
12	+	use g1t_contracts::time::rfc3339;
13	+	use g1t_contracts::{FailureCode, Outcome};
14	+	use g1t_kit::now_ms;
15	+	use serde::Deserialize;
16	+	use serde_json::Value;
17	+	use worker::Result;
18	+
19	+	use crate::Billing;
20	+
21	+	/// Stripe will not charge a card less than this.
22	+	const MIN_INVOICE_MICROS: i64 = 500_000;
23	+
24	+	/// The invoice's lines: what was used since the last one, by kind, then
25	+	/// whatever makes the total what is owed.
26	+	pub(crate) fn invoice_lines(used: &[(String, i64)], owed: i64) -> Vec<InvoiceItem> {
27	+	let mut lines: Vec<InvoiceItem> = used
28	+	.iter()
29	+	.filter(\|(_, amount)\| *amount > 0)
30	+	.map(\|(kind, amount)\| InvoiceItem { description: kind.clone(), amount_micros: *amount })
31	+	.collect();
32	+	let difference = owed - lines.iter().map(\|l\| l.amount_micros).sum::<i64>();
33	+	if difference < 0 {
34	+	lines.push(InvoiceItem { description: "Paid in advance".to_owned(), amount_micros: difference });
35	+	} else if difference > 0 {
36	+	lines.push(InvoiceItem { description: "Unpaid from earlier".to_owned(), amount_micros: difference });
37	+	}
38	+	lines
39	+	}
40	+
41	+	#[derive(Deserialize)]
42	+	struct InvoiceRow {
43	+	invoice_id: String,
44	+	workspace: String,
45	+	reason: String,
46	+	period: String,
47	+	amount_micros: i64,
48	+	status: String,
49	+	hosted_url: Option<String>,
50	+	pdf_url: Option<String>,
51	+	created_at: String,
52	+	}
53	+
54	+	#[derive(Deserialize)]
55	+	struct LineRow {
56	+	description: String,
57	+	amount_micros: i64,
58	+	}
59	+
60	+	/// A Stripe invoice, as far as billing reads it.
61	+	#[derive(Deserialize)]
62	+	struct StripeInvoice {
63	+	id: String,
64	+	#[serde(default)]
65	+	status: Option<String>,
66	+	#[serde(default)]
67	+	hosted_invoice_url: Option<String>,
68	+	#[serde(default)]
69	+	invoice_pdf: Option<String>,
70	+	#[serde(default)]
71	+	amount_paid: i64,
72	+	#[serde(default)]
73	+	charge: Option<String>,
74	+	}
75	+
76	+	impl Billing {
77	+	/// Invoices the workspace for what it owes, charging its card. `Ok(Err)`
78	+	/// says why not, when there was nothing to do or no card.
79	+	pub(crate) async fn invoice_workspace(
80	+	&self,
81	+	workspace: &str,
82	+	reason: &str,
83	+	period: &str,
84	+	) -> Result<std::result::Result<WorkspaceInvoice, String>> {
85	+	let Some(stripe) = &self.stripe else { return Ok(Err("Payments are not set up.".into())) };
86	+	let Some(account) = self.row(workspace).await? else { return Ok(Err("Nothing billed yet.".into())) };
87	+	let Some(customer) = account.customer_id else { return Ok(Err("No card on file.".into())) };
88	+	let owed = (-account.balance_micros).max(0);
89	+	if owed < MIN_INVOICE_MICROS {
90	+	return Ok(Err("Less is owed than Stripe will charge.".into()));
91	+	}
92	+	// What was used since the last invoice, by kind.
93	+	#[derive(Deserialize)]
94	+	struct Last {
95	+	through_at: Option<String>,
96	+	}
97	+	let since = self
98	+	.db
99	+	.prepare("SELECT MAX(through_at) AS through_at FROM workspace_invoices WHERE workspace = ? AND status <> 'void'")
100	+	.bind(&[workspace.into()])?
101	+	.first::<Last>(None)
102	+	.await?
103	+	.and_then(\|l\| l.through_at)
104	+	.unwrap_or_default();
105	+	#[derive(Deserialize)]
106	+	struct Used {
107	+	kind: String,
108	+	charged: Option<i64>,
109	+	}
110	+	let now = rfc3339(now_ms());
111	+	let used: Vec<(String, i64)> = self
112	+	.db
113	+	.prepare(
114	+	"SELECT CASE
115	+	WHEN task = 'sandbox' THEN 'Sandbox time'
116	+	WHEN task = 'deployments' THEN 'Deployments: builds and usage past the plan'
117	+	WHEN billed_to = 'workspace' THEN 'Runs on your own model provider'
118	+	ELSE 'Agents on g1t''s models' END AS kind,
119	+	-SUM(amount_micros) AS charged
120	+	FROM ledger WHERE workspace = ? AND kind = 'usage' AND created_at > ? AND created_at <= ?
121	+	GROUP BY 1 ORDER BY charged DESC",
122	+	)
123	+	.bind(&[workspace.into(), since.as_str().into(), now.as_str().into()])?
124	+	.all()
125	+	.await?
126	+	.results::<Used>()?
127	+	.into_iter()
128	+	.map(\|u\| (u.kind, u.charged.unwrap_or(0)))
129	+	.collect();
130	+	let lines = invoice_lines(&used, owed);
131	+	let key = format!("ws-invoice/{workspace}/{reason}/{period}/{}", owed / 10_000);
132	+	for (position, line) in lines.iter().enumerate() {
133	+	let fields = [
134	+	("customer", customer.clone()),
135	+	("amount", (line.amount_micros / 10_000).to_string()),
136	+	("currency", "usd".to_owned()),
137	+	("description", line.description.clone()),
138	+	("metadata[workspace]", workspace.to_owned()),
139	+	];
140	+	let _: Value = stripe.post_idempotent("/invoiceitems", &fields, &format!("{key}/item/{position}")).await?;
141	+	}
142	+	let description = match reason {
143	+	"month" => format!("g1t usage for {workspace}, {period}"),
144	+	_ => format!("g1t usage for {workspace}, charged as it neared its limit"),
145	+	};
146	+	let fields = [
147	+	("customer", customer.clone()),
148	+	("collection_method", "charge_automatically".to_owned()),
149	+	("auto_advance", "false".to_owned()),
150	+	("pending_invoice_items_behavior", "include".to_owned()),
151	+	("description", description),
152	+	("metadata[g1t_workspace]", workspace.to_owned()),
153	+	("metadata[reason]", reason.to_owned()),
154	+	("metadata[period]", period.to_owned()),
155	+	];
156	+	let draft: StripeInvoice = stripe.post_idempotent("/invoices", &fields, &key).await?;
157	+	// A retry finds it finalized already; that is fine.
158	+	let _ = stripe.post::<Value>(&format!("/invoices/{}/finalize", draft.id), &[]).await;
159	+	// Charge the card now; a decline comes back as an error.
160	+	let paid = stripe.post::<StripeInvoice>(&format!("/invoices/{}/pay", draft.id), &[("off_session", "true".to_owned())]).await;
161	+	let invoice: StripeInvoice = stripe.get(&format!("/invoices/{}", draft.id)).await?;
162	+	let total = lines.iter().map(\|l\| l.amount_micros).sum::<i64>();
163	+	let status = if invoice.status.as_deref() == Some("paid") { "paid" } else { "failed" };
164	+	let mut writes = vec![self
165	+	.db
166	+	.prepare(
167	+	"INSERT OR REPLACE INTO workspace_invoices
168	+	(invoice_id, workspace, reason, period, amount_micros, status, hosted_url, pdf_url, through_at, created_at, paid_at)
169	+	VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
170	+	)
171	+	.bind(&[
172	+	invoice.id.as_str().into(),
173	+	workspace.into(),
174	+	reason.into(),
175	+	period.into(),
176	+	(total as f64).into(),
177	+	status.into(),
178	+	crate::optional(invoice.hosted_invoice_url.as_deref()),
179	+	crate::optional(invoice.invoice_pdf.as_deref()),
180	+	now.as_str().into(),
181	+	now.as_str().into(),
182	+	crate::optional((status == "paid").then_some(now.as_str())),
183	+	])?];
184	+	for (position, line) in lines.iter().enumerate() {
185	+	writes.push(
186	+	self.db
187	+	.prepare("INSERT OR REPLACE INTO workspace_invoice_lines (invoice_id, position, description, amount_micros) VALUES (?, ?, ?, ?)")
188	+	.bind(&[invoice.id.as_str().into(), (position as u32).into(), line.description.as_str().into(), (line.amount_micros as f64).into()])?,
189	+	);
190	+	}
191	+	self.db.batch(writes).await?;
192	+	if status == "paid" {
193	+	self.credit_invoice(workspace, &invoice).await?;
194	+	} else {
195	+	let error = paid.err().map_or_else(\|\| "the card was declined".to_owned(), \|e\| e.to_string().chars().take(200).collect());
196	+	self.mark_declined(workspace, &error).await?;
197	+	}
198	+	Ok(Ok(WorkspaceInvoice {
199	+	invoice_id: invoice.id,
200	+	workspace: workspace.to_owned(),
201	+	reason: reason.to_owned(),
202	+	period: period.to_owned(),
203	+	amount_micros: total,
204	+	status: status.to_owned(),
205	+	hosted_url: invoice.hosted_invoice_url,
206	+	pdf_url: invoice.invoice_pdf,
207	+	lines,
208	+	created_at: now,
209	+	}))
210	+	}
211	+
212	+	/// Enters an invoice's payment once, with the kind of card that paid.
213	+	async fn credit_invoice(&self, workspace: &str, invoice: &StripeInvoice) -> Result<bool> {
214	+	let seen = self
215	+	.db
216	+	.prepare("SELECT id FROM ledger WHERE reference = ?")
217	+	.bind(&[invoice.id.as_str().into()])?
218	+	.first::<Value>(None)
219	+	.await?;
220	+	if seen.is_some() {
221	+	return Ok(false);
222	+	}
223	+	let amount = invoice.amount_paid * 10_000;
224	+	if amount <= 0 {
225	+	return Ok(false);
226	+	}
227	+	self.enter(workspace, EntryKind::TopUp, amount, &format!("Paid invoice {}", invoice.id), &invoice.id, None, None, None, None)
228	+	.await?;
229	+	// Prepaid cards pay, but never raise the limit.
230	+	if let (Some(stripe), Some(charge)) = (&self.stripe, &invoice.charge) {
231	+	if let Ok(charge) = stripe.get::<Value>(&format!("/charges/{charge}")).await {
232	+	if let Some(funding) = charge["payment_method_details"]["card"]["funding"].as_str() {
233	+	self.db
234	+	.prepare("UPDATE ledger SET funding = ? WHERE reference = ?")
235	+	.bind(&[funding.into(), invoice.id.as_str().into()])?
236	+	.run()
237	+	.await?;
238	+	}
239	+	}
240	+	}
241	+	Ok(true)
242	+	}
243	+
244	+	pub(crate) async fn mark_declined(&self, workspace: &str, error: &str) -> Result<()> {
245	+	let now = rfc3339(now_ms());
246	+	self.db
247	+	.prepare(
248	+	"INSERT INTO limits (workspace, autopay_failed_at, autopay_error, updated_at) VALUES (?1, ?2, ?3, ?2)
249	+	ON CONFLICT (workspace) DO UPDATE SET autopay_failed_at = ?2, autopay_error = ?3, updated_at = ?2",
250	+	)
251	+	.bind(&[workspace.into(), now.as_str().into(), error.into()])?
252	+	.run()
253	+	.await?;
254	+	Ok(())
255	+	}
256	+
257	+	/// A workspace invoice paid later, on Stripe's page or by a retry.
258	+	pub(crate) async fn workspace_invoice_paid(&self, invoice_id: &str) -> Result<Option<String>> {
259	+	#[derive(Deserialize)]
260	+	struct Row {
261	+	workspace: String,
262	+	}
263	+	let Some(row) = self
264	+	.db
265	+	.prepare("SELECT workspace FROM workspace_invoices WHERE invoice_id = ?")
266	+	.bind(&[invoice_id.into()])?
267	+	.first::<Row>(None)
268	+	.await?
269	+	else {
270	+	return Ok(None);
271	+	};
272	+	let Some(stripe) = &self.stripe else { return Ok(None) };
273	+	let invoice: StripeInvoice = stripe.get(&format!("/invoices/{invoice_id}")).await?;
274	+	self.db
275	+	.prepare("UPDATE workspace_invoices SET status = 'paid', paid_at = ? WHERE invoice_id = ?")
276	+	.bind(&[rfc3339(now_ms()).into(), invoice_id.into()])?
277	+	.run()
278	+	.await?;
279	+	let credited = self.credit_invoice(&row.workspace, &invoice).await?;
280	+	Ok(Some(format!(
281	+	"invoice {invoice_id} for {} paid{}",
282	+	row.workspace,
283	+	if credited { "" } else { " (already credited)" }
284	+	)))
285	+	}
286	+
287	+	pub(crate) async fn workspace_invoices(&self, workspace: &str) -> Result<Vec<WorkspaceInvoice>> {
288	+	let rows = self
289	+	.db
290	+	.prepare("SELECT * FROM workspace_invoices WHERE workspace = ? ORDER BY created_at DESC LIMIT 36")
291	+	.bind(&[workspace.into()])?
292	+	.all()
293	+	.await?
294	+	.results::<InvoiceRow>()?;
295	+	let mut invoices = vec![];
296	+	for row in rows {
297	+	let lines = self
298	+	.db
299	+	.prepare("SELECT description, amount_micros FROM workspace_invoice_lines WHERE invoice_id = ? ORDER BY position")
300	+	.bind(&[row.invoice_id.as_str().into()])?
301	+	.all()
302	+	.await?
303	+	.results::<LineRow>()?
304	+	.into_iter()
305	+	.map(\|l\| InvoiceItem { description: l.description, amount_micros: l.amount_micros })
306	+	.collect();
307	+	invoices.push(WorkspaceInvoice {
308	+	invoice_id: row.invoice_id,
309	+	workspace: row.workspace,
310	+	reason: row.reason,
311	+	period: row.period,
312	+	amount_micros: row.amount_micros,
313	+	status: row.status,
314	+	hosted_url: row.hosted_url,
315	+	pdf_url: row.pdf_url,
316	+	lines,
317	+	created_at: row.created_at,
318	+	});
319	+	}
320	+	Ok(invoices)
321	+	}
322	+
323	+	/// `invoices`: for the workspace's members.
324	+	pub(crate) async fn invoices(&self, a: InvoicesArgs) -> Result<Outcome<Vec<WorkspaceInvoice>>> {
325	+	let workspace = a.workspace.to_lowercase();
326	+	if !a.viewer.is_some_and(\|viewer\| viewer.is_member(&workspace)) {
327	+	return Ok(Outcome::fail(FailureCode::Forbidden, "Only members can see a workspace's invoices."));
328	+	}
329	+	Ok(Outcome::Ok(self.workspace_invoices(&workspace).await?))
330	+	}
331	+	}
332	+
333	+	#[cfg(test)]
334	+	mod tests {
335	+	use super::*;
336	+
337	+	#[test]
338	+	fn an_invoice_adds_up_to_what_is_owed() {
339	+	let used = vec![("Agents on g1t's models".to_owned(), 40_000_000), ("Sandbox time".to_owned(), 10_000_000)];
340	+	// $10 of credit was paid in advance.
341	+	let lines = invoice_lines(&used, 40_000_000);
342	+	assert_eq!(lines.last().unwrap().description, "Paid in advance");
343	+	assert_eq!(lines.iter().map(\|l\| l.amount_micros).sum::<i64>(), 40_000_000);
344	+	// $5 was left unpaid from before.
345	+	let lines = invoice_lines(&used, 55_000_000);
346	+	assert_eq!(lines.last().unwrap().description, "Unpaid from earlier");
347	+	assert_eq!(lines.iter().map(\|l\| l.amount_micros).sum::<i64>(), 55_000_000);
348	+	// Exactly what was used.
349	+	assert_eq!(invoice_lines(&used, 50_000_000).len(), 2);
350	+	}
351	+	}

+12−0View BlameViewed

17	17		//! the methods and their arguments.
18	18
19	19		mod accounts;
	20	+	mod invoices;
	21	+	mod sales;
20	22		mod webhooks;
21	23		mod features;
22	24		mod keeper;
⋯
1016	1018		"admin_enterprise_billing" => reply(&billing.admin_enterprise_billing(args(body)?).await?),
1017	1019		"admin_invoice_enterprise" => reply(&billing.admin_invoice_enterprise(args(body)?).await?),
1018	1020		"stripe_webhook" => reply(&billing.stripe_webhook(args(body)?).await?),
	1021	+	"invoices" => reply(&billing.invoices(args(body)?).await?),
	1022	+	"admin_workspace_invoices" => {
	1023	+	let a: AdminWorkspaceInvoicesArgs = args(body)?;
	1024	+	reply(&billing.workspace_invoices(&a.workspace.to_lowercase()).await?)
	1025	+	}
	1026	+	"admin_signals" => reply(&billing.admin_signals(args(body)?).await?),
	1027	+	"admin_overview" => reply(&billing.admin_overview(args(body)?).await?),
	1028	+	"admin_sales" => reply(&billing.admin_sales(args(body)?).await?),
	1029	+	"admin_set_sales" => reply(&billing.admin_set_sales(args(body)?).await?),
	1030	+	"admin_add_note" => reply(&billing.admin_add_note(args(body)?).await?),
1019	1031		"note_pending" => reply(&billing.note_pending(args(body)?).await?),
1020	1032		"admin_accounts" => reply(&billing.admin_accounts(args(body)?).await?),
1021	1033		"admin_account" => reply(&billing.admin_account(args(body)?).await?),

+223−134View BlameViewed

68	68		}
69	69		}
70	70
71		−	/// Never charged automatically for less.
72		−	const AUTOPAY_MIN_CENTS: i64 = 500;
	71	+	/// The automatic monthly spend limit's floor: $200.
	72	+	pub(crate) const DEFAULT_SPEND_MICROS: i64 = 200_000_000;
	73	+	/// Established workspaces' ceiling: three times their steady monthly
	74	+	/// spend, up to $10,000.
	75	+	const ESTABLISHED_FACTOR: i64 = 3;
	76	+	const ESTABLISHED_MAX_MICROS: i64 = 10_000_000_000;
	77	+	/// A month counts toward Established at this much spend or more.
	78	+	const ESTABLISHED_MONTH_MICROS: i64 = 20_000_000;
	79	+	/// Payments raise trust once this old: past the time most bad cards are
	80	+	/// caught.
	81	+	const SETTLE_DAYS: u64 = 7;
	82	+
	83	+	/// The automatic spend limit: $200, or twice last month's spend.
	84	+	pub(crate) fn automatic_spend_limit(last_month_charged: i64) -> i64 {
	85	+	DEFAULT_SPEND_MICROS.max(last_month_charged * 2)
	86	+	}
73	87
	88	+	/// An Established workspace's ceiling, from its last three months'
	89	+	/// charges, if each was steady enough.
	90	+	pub(crate) fn established_ceiling(months: &[i64]) -> Option<i64> {
	91	+	if months.len() < 3 \|\| months.iter().any(\|m\| *m < ESTABLISHED_MONTH_MICROS) {
	92	+	return None;
	93	+	}
	94	+	let average = months.iter().sum::<i64>() / months.len() as i64;
	95	+	Some((average * ESTABLISHED_FACTOR).min(ESTABLISHED_MAX_MICROS))
	96	+	}
	97	+
74	98		#[derive(Deserialize)]
75	99		struct LimitRow {
76	100		spend_limit_micros: Option<i64>,
	101	+	#[serde(default)]
	102	+	spend_limit_full: Option<i64>,
77	103		autopay_failed_at: Option<String>,
78	104		autopay_error: Option<String>,
79	105		}
⋯
98	124		let account = self.account_of(&workspace).await?;
99	125		let row = self
100	126		.db
101		−	.prepare("SELECT spend_limit_micros, autopay_failed_at, autopay_error FROM limits WHERE workspace = ?")
	127	+	.prepare("SELECT spend_limit_micros, spend_limit_full, autopay_failed_at, autopay_error FROM limits WHERE workspace = ?")
102	128		.bind(&[workspace.as_str().into()])?
103	129		.first::<LimitRow>(None)
104	130		.await?;
⋯
171	197		_ if account.terms.ceiling_micros.is_some() => (Trust::Reviewed, account.terms.ceiling_micros),
172	198		_ => {
173	199		let paid = self.live_paid(&members).await?;
174		−	if paid > 0 {
175		−	(Trust::Paid, Some(self.ceilings.for_paid(paid)))
176		−	} else {
177		−	(Trust::New, Some(self.ceilings.new))
	200	+	let established = if paid > 0 { self.established(&members).await? } else { None };
	201	+	match established {
	202	+	Some(ceiling) => (Trust::Established, Some(ceiling.max(self.ceilings.for_paid(paid)))),
	203	+	None if paid > 0 => (Trust::Paid, Some(self.ceilings.for_paid(paid))),
	204	+	None => (Trust::New, Some(self.ceilings.new)),
178	205		}
179	206		}
180	207		};
181		−	let spend_limit = row.as_ref().and_then(\|row\| row.spend_limit_micros);
	208	+	// This month's charges, and last month's, for the spend limit.
	209	+	let (spent, last_month) = self.charged_months(&members, &month_start).await?;
	210	+	let spent = spent + pending;
	211	+	// The owners' own monthly limit: theirs, none, or the automatic one
	212	+	// ($200, or twice last month), which self-serve workspaces start on.
	213	+	let chosen = row.as_ref().and_then(\|row\| row.spend_limit_micros);
	214	+	let full = row.as_ref().and_then(\|row\| row.spend_limit_full).unwrap_or(0) == 1;
	215	+	let self_serve = matches!(trust, Trust::New \| Trust::Paid \| Trust::Established);
	216	+	let default_spend_limit = chosen.is_none() && !full && self_serve;
	217	+	let spend_limit = match (chosen, full) {
	218	+	(Some(own), _) => Some(own),
	219	+	(None, true) => None,
	220	+	(None, false) if self_serve => Some(automatic_spend_limit(last_month)),
	221	+	_ => None,
	222	+	};
182	223		// A card declined when g1t charged it at the limit stops work until
183	224		// it is paid; any payment clears it.
184	225		let declined = row.as_ref().and_then(\|row\| row.autopay_failed_at.clone().map(\|at\| (at, row.autopay_error.clone())));
185		−	let ceiling = match (trust_ceiling, spend_limit) {
186		−	(Some(ceiling), Some(own)) => Some(ceiling.min(own)),
187		−	(None, Some(own)) => Some(own),
188		−	(ceiling, None) => ceiling,
	226	+	// Two limits: g1t's on what is unpaid, the owners' on what is spent.
	227	+	let ceiling = trust_ceiling;
	228	+	let risk = state(exposure, ceiling);
	229	+	let budget = state(spent, spend_limit);
	230	+	let over_budget = budget == LimitState::Stopped;
	231	+	let state = if declined.is_some() && exposure > 0 {
	232	+	LimitState::Stopped
	233	+	} else if risk == LimitState::Stopped \|\| over_budget {
	234	+	LimitState::Stopped
	235	+	} else if risk == LimitState::Warning \|\| budget == LimitState::Warning {
	236	+	LimitState::Warning
	237	+	} else {
	238	+	LimitState::Ok
189	239		};
190		−	let state = if declined.is_some() && exposure > 0 { LimitState::Stopped } else { state(exposure, ceiling) };
191	240		let who = if account.kind == g1t_contracts::billing::AccountKind::Enterprise {
192	241		format!("The {} enterprise, which pays for {workspace},", account.name)
193	242		} else {
⋯
195	244		};
196	245		let message = match state {
197	246		LimitState::Ok => None,
	247	+	LimitState::Warning if budget == LimitState::Warning => Some(format!(
	248	+	"{who} has spent {} of its {} monthly spend limit. At the limit, its sandboxes, builds and apps stop until the month turns or an owner raises it under Billing.",
	249	+	dollars_plain(spent),
	250	+	dollars_plain(spend_limit.unwrap_or_default()),
	251	+	)),
198	252		LimitState::Warning => Some(format!(
199		−	"{who} has used {} of its {} limit this month. At the limit, its sandboxes, builds and apps stop until it pays or the month turns.",
	253	+	"{who} has {} of usage not yet paid for, of the {} g1t allows. With a card on file g1t charges it now; without one, at the limit its sandboxes, builds and apps stop until it pays.",
200	254		dollars_plain(exposure),
201	255		dollars_plain(ceiling.unwrap_or_default()),
202	256		)),
⋯
204	258		"{who} could not be charged for its usage ({}), so its sandboxes, builds and apps are stopped. An owner can pay under Billing with another card.",
205	259		declined.as_ref().and_then(\|(_, error)\| error.clone()).unwrap_or_else(\|\| "the card was declined".to_owned()),
206	260		)),
207		−	LimitState::Stopped => Some(if spend_limit.is_some() && ceiling == spend_limit {
	261	+	LimitState::Stopped => Some(if over_budget {
208	262		format!(
209		−	"The {workspace} workspace reached the {} spend limit its owners set for this month, so its sandboxes, builds and apps are stopped. An owner can raise it under Billing.",
210		−	dollars_plain(ceiling.unwrap_or_default()),
	263	+	"{who} reached its {} monthly spend limit, so its sandboxes, builds and apps are stopped until the month turns. An owner can raise it under Billing.",
	264	+	dollars_plain(spend_limit.unwrap_or_default()),
211	265		)
212	266		} else {
213	267		format!(
⋯
216	270		)
217	271		}),
218	272		};
	273	+	let growth = match trust {
	274	+	Trust::New => Some("Pay g1t once, by card or credit, and this grows to $25; after that it grows with every payment.".to_owned()),
	275	+	Trust::Paid => Some(format!(
	276	+	"Grows to twice what you have paid, as payments clear (after {SETTLE_DAYS} days), up to $1,000. After three steady months it follows your monthly spend, up to $10,000, by itself."
	277	+	)),
	278	+	Trust::Established => Some("Follows your monthly spend, up to $10,000, by itself. For more, contact us.".to_owned()),
	279	+	Trust::Reviewed \| Trust::Internal => None,
	280	+	};
219	281		Ok(Limit {
220	282		workspace,
221	283		account: account.id,
222	284		account_name: account.name,
	285	+	spent_micros: spent,
	286	+	default_spend_limit,
	287	+	available_micros: trust_ceiling,
	288	+	growth,
223	289		trust,
224	290		exposure_micros: exposure,
225	291		ceiling_micros: ceiling,
⋯
241	307		.db
242	308		.prepare(format!(
243	309		"SELECT SUM(amount_micros) AS paid FROM ledger
244		−	WHERE workspace IN ({marks}) AND kind = 'top_up' AND reference NOT LIKE 'crd%'"
	310	+	WHERE workspace IN ({marks}) AND kind = 'top_up' AND reference NOT LIKE 'crd%'
	311	+	AND (amount_micros < 0
	312	+	OR (disputed = 0 AND COALESCE(funding, '') <> 'prepaid'
	313	+	AND created_at <= '{settled}'))",
	314	+	settled = rfc3339(now_ms() - SETTLE_DAYS * 24 * 60 * 60 * 1000)
245	315		))
246	316		.bind(members)?
247	317		.first::<Paid>(None)
⋯
250	320		.unwrap_or(0))
251	321		}
252	322
	323	+	/// This month's charges and last month's, across the workspaces.
	324	+	async fn charged_months(&self, members: &[JsValue], month_start: &str) -> Result<(i64, i64)> {
	325	+	#[derive(Deserialize)]
	326	+	struct Charged {
	327	+	this_month: Option<i64>,
	328	+	last_month: Option<i64>,
	329	+	}
	330	+	let last_start = format!("{}-01", previous_month(&month_start[..7]));
	331	+	let marks = vec!["?"; members.len().max(1)].join(", ");
	332	+	let row = self
	333	+	.db
	334	+	.prepare(format!(
	335	+	"SELECT
	336	+	-SUM(CASE WHEN created_at >= '{month_start}' THEN amount_micros END) AS this_month,
	337	+	-SUM(CASE WHEN created_at >= '{last_start}' AND created_at < '{month_start}' THEN amount_micros END) AS last_month
	338	+	FROM ledger WHERE kind = 'usage' AND workspace IN ({marks}) AND created_at >= '{last_start}'"
	339	+	))
	340	+	.bind(members)?
	341	+	.first::<Charged>(None)
	342	+	.await?;
	343	+	Ok(row.map_or((0, 0), \|r\| (r.this_month.unwrap_or(0).max(0), r.last_month.unwrap_or(0).max(0))))
	344	+	}
	345	+
	346	+	/// An Established ceiling, if the workspaces have paid steadily: three
	347	+	/// full months of real spend, each invoiced and paid, nothing declined
	348	+	/// in 90 days and nothing ever disputed.
	349	+	async fn established(&self, members: &[JsValue]) -> Result<Option<i64>> {
	350	+	let marks = vec!["?"; members.len().max(1)].join(", ");
	351	+	let now = rfc3339(now_ms());
	352	+	let mut months = vec![];
	353	+	let mut month = previous_month(&now[..7]);
	354	+	for _ in 0..3 {
	355	+	months.push(month.clone());
	356	+	month = previous_month(&month);
	357	+	}
	358	+	#[derive(Deserialize)]
	359	+	struct Count {
	360	+	n: Option<i64>,
	361	+	}
	362	+	let troubled = self
	363	+	.db
	364	+	.prepare(format!(
	365	+	"SELECT (SELECT COUNT(*) FROM ledger WHERE workspace IN ({marks}) AND disputed = 1)
	366	+	+ (SELECT COUNT(*) FROM limits WHERE workspace IN ({marks}) AND autopay_failed_at >= '{since}') AS n",
	367	+	since = rfc3339(now_ms() - 90 * 24 * 60 * 60 * 1000)
	368	+	))
	369	+	.bind(&[members, members].concat())?
	370	+	.first::<Count>(None)
	371	+	.await?
	372	+	.and_then(\|c\| c.n)
	373	+	.unwrap_or(0);
	374	+	if troubled > 0 {
	375	+	return Ok(None);
	376	+	}
	377	+	let mut charged = vec![];
	378	+	for month in &months {
	379	+	#[derive(Deserialize)]
	380	+	struct Month {
	381	+	charged: Option<i64>,
	382	+	unpaid: Option<i64>,
	383	+	}
	384	+	let next = {
	385	+	let year: i32 = month[..4].parse().unwrap_or(1970);
	386	+	let number: u32 = month[5..7].parse().unwrap_or(1);
	387	+	if number == 12 { format!("{}-01", year + 1) } else { format!("{year}-{:02}", number + 1) }
	388	+	};
	389	+	let row = self
	390	+	.db
	391	+	.prepare(format!(
	392	+	"SELECT
	393	+	(SELECT -SUM(amount_micros) FROM ledger WHERE kind = 'usage' AND workspace IN ({marks})
	394	+	AND created_at >= '{month}-01' AND created_at < '{next}-01') AS charged,
	395	+	(SELECT COUNT(*) FROM workspace_invoices WHERE workspace IN ({marks}) AND reason = 'month'
	396	+	AND period = '{month}' AND status <> 'paid') AS unpaid"
	397	+	))
	398	+	.bind(&[members, members].concat())?
	399	+	.first::<Month>(None)
	400	+	.await?;
	401	+	let Some(row) = row else { return Ok(None) };
	402	+	if row.unpaid.unwrap_or(0) > 0 {
	403	+	return Ok(None);
	404	+	}
	405	+	charged.push(row.charged.unwrap_or(0));
	406	+	}
	407	+	Ok(established_ceiling(&charged))
	408	+	}
	409	+
253	410		/// A refusal, with the reason, when the workspace's work is stopped.
254	411		/// None while billing is off: a g1t without payments has no limits.
255	412		pub(crate) async fn stopped<T>(&self, workspace: &str) -> Result<Option<Outcome<T>>> {
⋯
299	456		/// nothing. Not for a workspace's own spend limit, which means stop, nor
300	457		/// for enterprises, which are invoiced.
301	458		pub(crate) async fn autopay(&self) -> Result<()> {
302		−	let Some(stripe) = self.stripe.as_ref().filter(\|stripe\| stripe.live()) else {
	459	+	if !self.stripe.as_ref().is_some_and(crate::stripe::Stripe::live) {
303	460		return Ok(());
304		−	};
	461	+	}
305	462		#[derive(Deserialize)]
306	463		struct Candidate {
307	464		workspace: String,
308		−	customer_id: Option<String>,
309	465		}
310	466		let month_start = format!("{}-01", &rfc3339(now_ms())[..7]);
	467	+	// With a card, and not already declined: a declined card waits for
	468	+	// the owners, rather than being tried again every few minutes.
311	469		let candidates = self
312	470		.db
313	471		.prepare(
314		−	"SELECT DISTINCT ledger.workspace AS workspace, accounts.customer_id AS customer_id
	472	+	"SELECT DISTINCT ledger.workspace AS workspace
315	473		FROM ledger JOIN accounts ON accounts.workspace = ledger.workspace
316		−	WHERE ledger.kind = 'usage' AND ledger.created_at >= ? AND accounts.customer_id IS NOT NULL",
	474	+	LEFT JOIN limits ON limits.workspace = ledger.workspace
	475	+	WHERE ledger.kind = 'usage' AND ledger.created_at >= ? AND accounts.customer_id IS NOT NULL
	476	+	AND limits.autopay_failed_at IS NULL",
317	477		)
318	478		.bind(&[month_start.as_str().into()])?
319	479		.all()
320	480		.await?
321	481		.results::<Candidate>()?;
322	482		for candidate in candidates {
323		−	let Some(customer) = candidate.customer_id else { continue };
324	483		let limit = self.limit_of(&candidate.workspace).await?;
325		−	let own_limit = limit.spend_limit_micros.is_some() && limit.ceiling_micros == limit.spend_limit_micros;
326		−	if limit.state == LimitState::Ok
327		−	\|\| own_limit
328		−	\|\| limit.trust == Trust::Internal
329		−	\|\| limit.account.starts_with("ent_")
330		−	{
331		−	continue;
332		−	}
333		−	// What it owes: its charges less what it has paid, never the cost
334		−	// of what was free to it. At least the minimum, which is credit
335		−	// toward what comes next.
336		−	let balance = self.row(&candidate.workspace).await?.map_or(0, \|row\| row.balance_micros);
337		−	let owed = (-balance).max(0);
338		−	if owed == 0 {
	484	+	// Near g1t's ceiling on what is unpaid; the spend limit is the
	485	+	// owners' and stops work by itself, but what is owed is still owed.
	486	+	let near = limit.ceiling_micros.is_some_and(\|ceiling\| limit.exposure_micros * 5 >= ceiling * 4);
	487	+	if !near \|\| limit.trust == Trust::Internal \|\| limit.account.starts_with("ent_") {
339	488		continue;
340	489		}
341		−	let cents = ((owed + 9_999) / 10_000).max(AUTOPAY_MIN_CENTS);
342		−	let key = format!("autopay/{}/{}/{}", candidate.workspace, &month_start[..7], owed / 1_000_000);
343		−	let description = format!("g1t usage for {}, paid automatically near its limit", candidate.workspace);
344		−	let now = rfc3339(now_ms());
345		−	match stripe.charge_saved_card(&customer, cents, &description, &key).await {
346		−	Ok(payment) if payment.status == "succeeded" => {
347		−	// A retried charge is the same payment: credited once.
348		−	let seen = self
349		−	.db
350		−	.prepare("SELECT id FROM ledger WHERE reference = ?")
351		−	.bind(&[payment.id.as_str().into()])?
352		−	.first::<serde_json::Value>(None)
353		−	.await?;
354		−	if seen.is_some() {
355		−	continue;
356		−	}
357		−	self.enter(
358		−	&candidate.workspace,
359		−	g1t_contracts::billing::EntryKind::TopUp,
360		−	payment.amount_received.max(cents) * 10_000,
361		−	&format!("Paid automatically by card, near the {} limit", dollars_plain(limit.ceiling_micros.unwrap_or_default())),
362		−	&payment.id,
363		−	None,
364		−	None,
365		−	None,
366		−	Some(&customer),
367		−	)
368		−	.await?;
369		−	self.db
370		−	.prepare("UPDATE limits SET autopay_failed_at = NULL, autopay_error = NULL WHERE workspace = ?")
371		−	.bind(&[candidate.workspace.as_str().into()])?
372		−	.run()
373		−	.await?;
374		−	}
375		−	outcome => {
376		−	let error = match outcome {
377		−	Ok(payment) => format!("the payment is {}", payment.status.replace('_', " ")),
378		−	Err(error) => error.to_string().chars().take(200).collect(),
379		−	};
380		−	self.db
381		−	.prepare(
382		−	"INSERT INTO limits (workspace, autopay_failed_at, autopay_error, updated_at) VALUES (?1, ?2, ?3, ?2)
383		−	ON CONFLICT (workspace) DO UPDATE SET autopay_failed_at = ?2, autopay_error = ?3, updated_at = ?2",
384		−	)
385		−	.bind(&[candidate.workspace.as_str().into(), now.as_str().into(), error.as_str().into()])?
386		−	.run()
387		−	.await?;
388		−	}
	490	+	// An invoice for what it owes, charged to its card now: never
	491	+	// the cost of what was free to it.
	492	+	let today = rfc3339(now_ms())[..10].to_owned();
	493	+	match self.invoice_workspace(&candidate.workspace, "threshold", &today).await? {
	494	+	Ok(_) => {}
	495	+	Err(why) => worker::console_log!("{}: no threshold invoice: {why}", candidate.workspace),
389	496		}
390	497		}
391	498		Ok(())
⋯
396	503		/// workspace and month; a declined card stops work until it is paid.
397	504		/// Comped workspaces owe nothing, and enterprises are invoiced.
398	505		pub(crate) async fn close_months(&self) -> Result<()> {
399		−	let Some(stripe) = self.stripe.as_ref().filter(\|stripe\| stripe.live()) else {
	506	+	if !self.stripe.as_ref().is_some_and(crate::stripe::Stripe::live) {
400	507		return Ok(());
401		−	};
	508	+	}
402	509		let now = rfc3339(now_ms());
403	510		let month_start = format!("{}-01", &now[..7]);
404	511		let closing = previous_month(&now[..7]);
405	512		#[derive(Deserialize)]
406	513		struct Open {
407	514		workspace: String,
408		−	customer_id: String,
409	515		balance: Option<i64>,
410	516		}
411	517		let open = self
412	518		.db
413	519		.prepare(
414		−	"SELECT accounts.workspace AS workspace, accounts.customer_id AS customer_id,
	520	+	"SELECT accounts.workspace AS workspace,
415	521		(SELECT SUM(amount_micros) FROM ledger
416	522		WHERE ledger.workspace = accounts.workspace AND ledger.created_at < ?1) AS balance
417	523		FROM accounts
⋯
452	558		record("nothing", 0, None, None)?.run().await?;
453	559		continue;
454	560		}
455		−	let cents = (owed + 9_999) / 10_000;
456		−	let key = format!("close/{}/{closing}", account.workspace);
457		−	let description = format!("g1t usage for {} in {closing}", account.workspace);
458		−	match stripe.charge_saved_card(&account.customer_id, cents, &description, &key).await {
459		−	Ok(payment) if payment.status == "succeeded" => {
460		−	let seen = self
461		−	.db
462		−	.prepare("SELECT id FROM ledger WHERE reference = ?")
463		−	.bind(&[payment.id.as_str().into()])?
464		−	.first::<serde_json::Value>(None)
465		−	.await?;
466		−	if seen.is_none() {
467		−	self.enter(
468		−	&account.workspace,
469		−	g1t_contracts::billing::EntryKind::TopUp,
470		−	payment.amount_received.max(cents) * 10_000,
471		−	&format!("Usage for {closing}, charged to the card on file when the month closed"),
472		−	&payment.id,
473		−	None,
474		−	None,
475		−	None,
476		−	Some(&account.customer_id),
477		−	)
478		−	.await?;
479		−	}
480		−	record("paid", cents * 10_000, Some(&payment.id), None)?.run().await?;
	561	+	match self.invoice_workspace(&account.workspace, "month", &closing).await? {
	562	+	Ok(invoice) if invoice.status == "paid" => {
	563	+	record("paid", invoice.amount_micros, Some(&invoice.invoice_id), None)?.run().await?;
481	564		}
482		−	outcome => {
483		−	let error = match outcome {
484		−	Ok(payment) => format!("the payment is {}", payment.status.replace('_', " ")),
485		−	Err(error) => error.to_string().chars().take(200).collect(),
486		−	};
487		−	self.db
488		−	.prepare(
489		−	"INSERT INTO limits (workspace, autopay_failed_at, autopay_error, updated_at) VALUES (?1, ?2, ?3, ?2)
490		−	ON CONFLICT (workspace) DO UPDATE SET autopay_failed_at = ?2, autopay_error = ?3, updated_at = ?2",
491		−	)
492		−	.bind(&[account.workspace.as_str().into(), now.as_str().into(), error.as_str().into()])?
493		−	.run()
494		−	.await?;
495		−	record("failed", cents * 10_000, None, Some(&error))?.run().await?;
	565	+	Ok(invoice) => {
	566	+	record("failed", invoice.amount_micros, Some(&invoice.invoice_id), Some("the card was declined"))?.run().await?;
	567	+	}
	568	+	Err(why) => {
	569	+	record("nothing", 0, None, Some(&why))?.run().await?;
496	570		}
497	571		}
498	572		}
⋯
614	688		if a.spend_limit_micros.is_some_and(\|limit\| limit < 0) {
615	689		return Ok(Outcome::fail(FailureCode::Invalid, "A spend limit cannot be negative."));
616	690		}
617		−	let limit = a.spend_limit_micros.map_or(JsValue::NULL, \|limit\| (limit as f64).into());
	691	+	let limit = if a.use_full_limit { JsValue::NULL } else { a.spend_limit_micros.map_or(JsValue::NULL, \|limit\| (limit as f64).into()) };
618	692		self.db
619	693		.prepare(
620		−	"INSERT INTO limits (workspace, spend_limit_micros, updated_at) VALUES (?1, ?2, ?3)
621		−	ON CONFLICT (workspace) DO UPDATE SET spend_limit_micros = ?2, updated_at = ?3",
	694	+	"INSERT INTO limits (workspace, spend_limit_micros, spend_limit_full, updated_at) VALUES (?1, ?2, ?3, ?4)
	695	+	ON CONFLICT (workspace) DO UPDATE SET spend_limit_micros = ?2, spend_limit_full = ?3, updated_at = ?4",
622	696		)
623		−	.bind(&[workspace.as_str().into(), limit, rfc3339(now_ms()).into()])?
	697	+	.bind(&[workspace.as_str().into(), limit, (if a.use_full_limit { 1 } else { 0 }).into(), rfc3339(now_ms()).into()])?
624	698		.run()
625	699		.await?;
626	700		Ok(Outcome::Ok(self.limit_of(&workspace).await?))
⋯
675	749		use super::*;
676	750
677	751		#[test]
	752	+	fn the_automatic_spend_limit_follows_last_month() {
	753	+	assert_eq!(automatic_spend_limit(0), 200_000_000);
	754	+	assert_eq!(automatic_spend_limit(50_000_000), 200_000_000);
	755	+	assert_eq!(automatic_spend_limit(900_000_000), 1_800_000_000);
	756	+	}
	757	+
	758	+	#[test]
	759	+	fn three_steady_months_make_a_workspace_established() {
	760	+	assert_eq!(established_ceiling(&[900_000_000, 850_000_000, 950_000_000]), Some(2_700_000_000));
	761	+	assert_eq!(established_ceiling(&[5_000_000_000, 5_000_000_000, 5_000_000_000]), Some(10_000_000_000));
	762	+	assert_eq!(established_ceiling(&[900_000_000, 10_000_000, 950_000_000]), None);
	763	+	assert_eq!(established_ceiling(&[900_000_000, 900_000_000]), None);
	764	+	}
	765	+
	766	+	#[test]
678	767		fn warnings_come_at_half_four_fifths_and_the_limit() {
679	768		assert_eq!(warning_level(0, 300), 0);
680	769		assert_eq!(warning_level(149, 300), 0);

+451−0View BlameViewed

1	+	//! What g1t's team needs to sell and support: month-by-month figures, the
2	+	//! signals that say a workspace is worth a call, and what was done about
3	+	//! it. Staff only, through sudo.g1t.sh.
4	+
5	+	use g1t_contracts::billing::{
6	+	AdminAddNoteArgs, AdminOverviewArgs, AdminSalesArgs, AdminSetSalesArgs, AdminSignalsArgs, KindFigures,
7	+	LimitState, MonthFigures, Overview, SalesNote, SalesRecord, Signal, SignalKind, TermsKind, Trust,
8	+	};
9	+	use g1t_contracts::time::rfc3339;
10	+	use g1t_contracts::{FailureCode, Outcome, new_id};
11	+	use g1t_kit::now_ms;
12	+	use serde::Deserialize;
13	+	use worker::Result;
14	+	use worker::wasm_bindgen::JsValue;
15	+
16	+	use crate::Billing;
17	+	use crate::features::dollars;
18	+	use crate::limits::previous_month;
19	+
20	+	pub(crate) const STAGES: &[&str] = &["none", "lead", "contacted", "negotiating", "won", "lost", "churn_risk"];
21	+
22	+	/// A workspace this much ahead of last month's pace is growing.
23	+	const GROWING_FACTOR: f64 = 1.5;
24	+	/// Below this last month, growth is noise.
25	+	const GROWING_FROM_MICROS: i64 = 10_000_000;
26	+	/// Spending this much a month may suit custom terms or an enterprise.
27	+	const HIGH_SPEND_MICROS: i64 = 500_000_000;
28	+
29	+	/// The six months ending with `month`, oldest first.
30	+	pub(crate) fn last_months(month: &str, count: usize) -> Vec<String> {
31	+	let mut months = vec![month.to_owned()];
32	+	while months.len() < count {
33	+	let earlier = previous_month(months.last().unwrap());
34	+	months.push(earlier);
35	+	}
36	+	months.reverse();
37	+	months
38	+	}
39	+
40	+	/// How urgent a kind of signal is: lower first.
41	+	fn urgency(kind: SignalKind) -> u8 {
42	+	match kind {
43	+	SignalKind::AtLimit => 0,
44	+	SignalKind::Declined => 1,
45	+	SignalKind::NearCeiling => 2,
46	+	SignalKind::HighSpend => 3,
47	+	SignalKind::Growing => 4,
48	+	SignalKind::Established => 5,
49	+	SignalKind::FirstPayment => 6,
50	+	}
51	+	}
52	+
53	+	/// Whether this month, at its pace so far, is well ahead of last month.
54	+	pub(crate) fn growing(this_month: i64, last_month: i64, day: u32, days_in_month: u32) -> bool {
55	+	if last_month < GROWING_FROM_MICROS \|\| day == 0 {
56	+	return false;
57	+	}
58	+	let pace = this_month as f64 * f64::from(days_in_month) / f64::from(day);
59	+	pace >= last_month as f64 * GROWING_FACTOR
60	+	}
61	+
62	+	fn days_in(month: &str) -> u32 {
63	+	let year: i32 = month[..4].parse().unwrap_or(1970);
64	+	match month[5..7].parse::<u32>().unwrap_or(1) {
65	+	2 if (year % 4 == 0 && year % 100 != 0) \|\| year % 400 == 0 => 29,
66	+	2 => 28,
67	+	4 \| 6 \| 9 \| 11 => 30,
68	+	_ => 31,
69	+	}
70	+	}
71	+
72	+	#[derive(Deserialize)]
73	+	struct MonthRow {
74	+	month: String,
75	+	charged: Option<i64>,
76	+	cost: Option<i64>,
77	+	paid: Option<i64>,
78	+	}
79	+
80	+	#[derive(Deserialize)]
81	+	struct RecordRow {
82	+	stage: String,
83	+	owner: Option<String>,
84	+	next_step: Option<String>,
85	+	next_at: Option<String>,
86	+	updated_at: String,
87	+	}
88	+
89	+	#[derive(Deserialize)]
90	+	struct NoteRow {
91	+	id: String,
92	+	text: String,
93	+	by: String,
94	+	created_at: String,
95	+	}
96	+
97	+	impl Billing {
98	+	/// Month-by-month figures for some workspaces (all, when empty).
99	+	pub(crate) async fn months_for(&self, workspaces: &[String], count: usize) -> Result<Vec<MonthFigures>> {
100	+	let months = last_months(&rfc3339(now_ms())[..7], count);
101	+	let since = format!("{}-01", months[0]);
102	+	let (filter, values): (String, Vec<JsValue>) = if workspaces.is_empty() {
103	+	(String::new(), vec![])
104	+	} else {
105	+	let marks = vec!["?"; workspaces.len()].join(", ");
106	+	(format!("AND workspace IN ({marks})"), workspaces.iter().map(\|w\| JsValue::from(w.as_str())).collect())
107	+	};
108	+	let rows = self
109	+	.db
110	+	.prepare(format!(
111	+	"SELECT substr(created_at, 1, 7) AS month,
112	+	-SUM(CASE WHEN kind = 'usage' THEN amount_micros END) AS charged,
113	+	SUM(CASE WHEN kind = 'usage' THEN cost_micros END) AS cost,
114	+	SUM(CASE WHEN kind = 'top_up' AND reference NOT LIKE 'crd%' THEN amount_micros END) AS paid
115	+	FROM ledger WHERE created_at >= '{since}' {filter} GROUP BY 1"
116	+	))
117	+	.bind(&values)?
118	+	.all()
119	+	.await?
120	+	.results::<MonthRow>()?;
121	+	Ok(months
122	+	.into_iter()
123	+	.map(\|month\| {
124	+	let row = rows.iter().find(\|r\| r.month == month);
125	+	MonthFigures {
126	+	charged_micros: row.and_then(\|r\| r.charged).unwrap_or(0),
127	+	cost_micros: row.and_then(\|r\| r.cost).unwrap_or(0),
128	+	paid_micros: row.and_then(\|r\| r.paid).unwrap_or(0),
129	+	month,
130	+	}
131	+	})
132	+	.collect())
133	+	}
134	+
135	+	async fn record_row(&self, workspace: &str) -> Result<Option<RecordRow>> {
136	+	self.db
137	+	.prepare("SELECT * FROM sales_records WHERE workspace = ?")
138	+	.bind(&[workspace.into()])?
139	+	.first::<RecordRow>(None)
140	+	.await
141	+	}
142	+
143	+	pub(crate) async fn admin_sales(&self, a: AdminSalesArgs) -> Result<SalesRecord> {
144	+	let workspace = a.workspace.trim().to_lowercase();
145	+	let row = self.record_row(&workspace).await?;
146	+	let notes = self
147	+	.db
148	+	.prepare("SELECT id, text, by, created_at FROM sales_notes WHERE workspace = ? ORDER BY created_at DESC LIMIT 100")
149	+	.bind(&[workspace.as_str().into()])?
150	+	.all()
151	+	.await?
152	+	.results::<NoteRow>()?
153	+	.into_iter()
154	+	.map(\|n\| SalesNote { id: n.id, text: n.text, by: n.by, created_at: n.created_at })
155	+	.collect();
156	+	Ok(match row {
157	+	Some(row) => SalesRecord {
158	+	workspace,
159	+	stage: row.stage,
160	+	owner: row.owner,
161	+	next_step: row.next_step,
162	+	next_at: row.next_at,
163	+	notes,
164	+	updated_at: Some(row.updated_at),
165	+	},
166	+	None => SalesRecord {
167	+	workspace,
168	+	stage: "none".to_owned(),
169	+	owner: None,
170	+	next_step: None,
171	+	next_at: None,
172	+	notes,
173	+	updated_at: None,
174	+	},
175	+	})
176	+	}
177	+
178	+	pub(crate) async fn admin_set_sales(&self, a: AdminSetSalesArgs) -> Result<Outcome<SalesRecord>> {
179	+	let workspace = a.workspace.trim().to_lowercase();
180	+	if workspace.is_empty() \|\| a.by.trim().is_empty() {
181	+	return Ok(Outcome::fail(FailureCode::Invalid, "Name the workspace, and who is making the change."));
182	+	}
183	+	if !STAGES.contains(&a.stage.as_str()) {
184	+	return Ok(Outcome::fail(FailureCode::Invalid, format!("A stage is one of: {}.", STAGES.join(", "))));
185	+	}
186	+	let clean = \|value: &Option<String>\| value.as_deref().map(str::trim).filter(\|v\| !v.is_empty()).map(str::to_owned);
187	+	let (owner, next_step, next_at) = (clean(&a.owner), clean(&a.next_step), clean(&a.next_at));
188	+	let before = self.record_row(&workspace).await?;
189	+	self.db
190	+	.prepare(
191	+	"INSERT INTO sales_records (workspace, stage, owner, next_step, next_at, updated_by, updated_at)
192	+	VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)
193	+	ON CONFLICT (workspace) DO UPDATE SET stage = ?2, owner = ?3, next_step = ?4, next_at = ?5,
194	+	updated_by = ?6, updated_at = ?7",
195	+	)
196	+	.bind(&[
197	+	workspace.as_str().into(),
198	+	a.stage.as_str().into(),
199	+	crate::optional(owner.as_deref()),
200	+	crate::optional(next_step.as_deref()),
201	+	crate::optional(next_at.as_deref()),
202	+	a.by.as_str().into(),
203	+	rfc3339(now_ms()).into(),
204	+	])?
205	+	.run()
206	+	.await?;
207	+	let account = self.account_of(&workspace).await?;
208	+	let was = before.map_or_else(\|\| "none".to_owned(), \|b\| b.stage);
209	+	let detail = format!(
210	+	"{workspace}: stage {was} → {}{}{}",
211	+	a.stage,
212	+	owner.as_deref().map(\|o\| format!(", owner {o}")).unwrap_or_default(),
213	+	next_step.as_deref().map(\|s\| format!(", next: {s}")).unwrap_or_default(),
214	+	);
215	+	self.audit(&account.id, "sales", &detail, &a.by).await?;
216	+	Ok(Outcome::Ok(self.admin_sales(AdminSalesArgs { workspace }).await?))
217	+	}
218	+
219	+	pub(crate) async fn admin_add_note(&self, a: AdminAddNoteArgs) -> Result<Outcome<SalesRecord>> {
220	+	let workspace = a.workspace.trim().to_lowercase();
221	+	let text = a.text.trim();
222	+	if workspace.is_empty() \|\| text.is_empty() \|\| a.by.trim().is_empty() {
223	+	return Ok(Outcome::fail(FailureCode::Invalid, "A note needs a workspace, some words, and who wrote it."));
224	+	}
225	+	if text.chars().count() > 4000 {
226	+	return Ok(Outcome::fail(FailureCode::Invalid, "Keep a note under 4,000 characters."));
227	+	}
228	+	let now = now_ms();
229	+	self.db
230	+	.prepare("INSERT INTO sales_notes (id, workspace, text, by, created_at) VALUES (?, ?, ?, ?, ?)")
231	+	.bind(&[new_id("note", now).into(), workspace.as_str().into(), text.into(), a.by.as_str().into(), rfc3339(now).into()])?
232	+	.run()
233	+	.await?;
234	+	Ok(Outcome::Ok(self.admin_sales(AdminSalesArgs { workspace }).await?))
235	+	}
236	+
237	+	/// Every workspace worth reaching out to, most urgent first.
238	+	pub(crate) async fn admin_signals(&self, _: AdminSignalsArgs) -> Result<Vec<Signal>> {
239	+	let now = rfc3339(now_ms());
240	+	let month = &now[..7];
241	+	let last = previous_month(month);
242	+	#[derive(Deserialize)]
243	+	struct Active {
244	+	workspace: String,
245	+	this_month: Option<i64>,
246	+	last_month: Option<i64>,
247	+	first_paid: Option<String>,
248	+	}
249	+	let active = self
250	+	.db
251	+	.prepare(
252	+	"SELECT workspace,
253	+	-SUM(CASE WHEN kind = 'usage' AND created_at >= ?1 THEN amount_micros END) AS this_month,
254	+	-SUM(CASE WHEN kind = 'usage' AND created_at >= ?2 AND created_at < ?1 THEN amount_micros END) AS last_month,
255	+	MIN(CASE WHEN kind = 'top_up' AND amount_micros > 0 AND reference NOT LIKE 'crd%' THEN created_at END) AS first_paid
256	+	FROM ledger GROUP BY workspace
257	+	HAVING MAX(created_at) >= ?2
258	+	LIMIT 500",
259	+	)
260	+	.bind(&[format!("{month}-01").into(), format!("{last}-01").into()])?
261	+	.all()
262	+	.await?
263	+	.results::<Active>()?;
264	+	let day: u32 = now[8..10].parse().unwrap_or(1);
265	+	let fortnight_ago = rfc3339(now_ms() - 14 * 24 * 60 * 60 * 1000);
266	+	let mut signals = vec![];
267	+	for row in active {
268	+	let limit = self.limit_of(&row.workspace).await?;
269	+	if limit.trust == Trust::Internal {
270	+	continue;
271	+	}
272	+	let this_month = row.this_month.unwrap_or(0).max(0);
273	+	let last_month = row.last_month.unwrap_or(0).max(0);
274	+	let record = self.record_row(&row.workspace).await?;
275	+	let (stage, owner) = record.map_or((None, None), \|r\| (Some(r.stage), r.owner));
276	+	let mut push = \|kind: SignalKind, detail: String, value: i64\| {
277	+	signals.push(Signal {
278	+	workspace: row.workspace.clone(),
279	+	kind,
280	+	detail,
281	+	value_micros: value,
282	+	stage: stage.clone(),
283	+	owner: owner.clone(),
284	+	});
285	+	};
286	+	let declined = limit.message.as_deref().is_some_and(\|m\| m.contains("could not be charged"));
287	+	if declined {
288	+	push(SignalKind::Declined, limit.message.clone().unwrap_or_default(), limit.exposure_micros);
289	+	} else if limit.state == LimitState::Stopped {
290	+	push(SignalKind::AtLimit, limit.message.clone().unwrap_or_default(), limit.exposure_micros.max(limit.spent_micros));
291	+	} else if let Some(available) = limit.available_micros.filter(\|a\| *a > 0) {
292	+	if limit.exposure_micros * 5 >= available * 4 {
293	+	push(
294	+	SignalKind::NearCeiling,
295	+	format!(
296	+	"{} unpaid of the {} g1t allows it ({:?}); a call could raise it before it stops.",
297	+	dollars(limit.exposure_micros),
298	+	dollars(available),
299	+	limit.trust
300	+	),
301	+	limit.exposure_micros,
302	+	);
303	+	}
304	+	}
305	+	if last_month >= HIGH_SPEND_MICROS {
306	+	let terms = self.terms_of(&row.workspace).await?;
307	+	if terms.kind == TermsKind::Standard && !limit.account.starts_with("ent_") {
308	+	push(
309	+	SignalKind::HighSpend,
310	+	format!("Spent {} last month on standard terms: worth offering custom terms or an enterprise.", dollars(last_month)),
311	+	last_month,
312	+	);
313	+	}
314	+	}
315	+	if growing(this_month, last_month, day, days_in(month)) {
316	+	push(
317	+	SignalKind::Growing,
318	+	format!(
319	+	"{} so far this month, on pace for about {}, against {} last month.",
320	+	dollars(this_month),
321	+	dollars((this_month as f64 * f64::from(days_in(month)) / f64::from(day.max(1))) as i64),
322	+	dollars(last_month)
323	+	),
324	+	this_month,
325	+	);
326	+	}
327	+	if limit.trust == Trust::Established {
328	+	push(
329	+	SignalKind::Established,
330	+	format!(
331	+	"A steady customer: its limit now follows its spend ({} available).",
332	+	limit.available_micros.map(dollars).unwrap_or_default()
333	+	),
334	+	last_month,
335	+	);
336	+	}
337	+	if row.first_paid.as_deref().is_some_and(\|at\| at >= fortnight_ago.as_str()) {
338	+	push(SignalKind::FirstPayment, "Paid g1t for the first time in the last two weeks: say hello.".to_owned(), this_month);
339	+	}
340	+	}
341	+	signals.sort_by(\|a, b\| urgency(a.kind).cmp(&urgency(b.kind)).then(b.value_micros.cmp(&a.value_micros)));
342	+	Ok(signals)
343	+	}
344	+
345	+	/// The business at a glance.
346	+	pub(crate) async fn admin_overview(&self, _: AdminOverviewArgs) -> Result<Overview> {
347	+	let now = rfc3339(now_ms());
348	+	let month = now[..7].to_owned();
349	+	let months = self.months_for(&[], 6).await?;
350	+	#[derive(Deserialize)]
351	+	struct KindRow {
352	+	kind: Option<String>,
353	+	charged: Option<i64>,
354	+	cost: Option<i64>,
355	+	}
356	+	let by_kind = self
357	+	.db
358	+	.prepare(
359	+	"SELECT CASE
360	+	WHEN task = 'sandbox' THEN 'Sandbox time'
361	+	WHEN task = 'deployments' THEN 'Deployments'
362	+	WHEN billed_to = 'workspace' THEN 'Own-provider runs'
363	+	ELSE 'Models' END AS kind,
364	+	-SUM(amount_micros) AS charged, SUM(cost_micros) AS cost
365	+	FROM ledger WHERE kind = 'usage' AND created_at >= ? GROUP BY 1 ORDER BY charged DESC",
366	+	)
367	+	.bind(&[format!("{month}-01").into()])?
368	+	.all()
369	+	.await?
370	+	.results::<KindRow>()?
371	+	.into_iter()
372	+	.map(\|r\| KindFigures {
373	+	kind: r.kind.unwrap_or_else(\|\| "Other".to_owned()),
374	+	charged_micros: r.charged.unwrap_or(0),
375	+	cost_micros: r.cost.unwrap_or(0),
376	+	})
377	+	.collect();
378	+	#[derive(Deserialize)]
379	+	struct Count {
380	+	n: Option<i64>,
381	+	}
382	+	let count = \|sql: &'static str, args: Vec<JsValue>\| {
383	+	let db = &self.db;
384	+	async move {
385	+	Ok::<i64, worker::Error>(db.prepare(sql).bind(&args)?.first::<Count>(None).await?.and_then(\|c\| c.n).unwrap_or(0))
386	+	}
387	+	};
388	+	let paying = count(
389	+	"SELECT COUNT(DISTINCT workspace) AS n FROM ledger
390	+	WHERE kind = 'top_up' AND amount_micros > 0 AND reference NOT LIKE 'crd%' AND created_at >= ?",
391	+	vec![rfc3339(now_ms() - 60 * 24 * 60 * 60 * 1000).into()],
392	+	)
393	+	.await?;
394	+	let open_invoices = count(
395	+	"SELECT (SELECT COALESCE(SUM(amount_micros), 0) FROM workspace_invoices WHERE status IN ('open', 'failed'))
396	+	+ (SELECT COALESCE(SUM(amount_micros), 0) FROM enterprise_invoices WHERE status IN ('open', 'overdue')) AS n",
397	+	vec![],
398	+	)
399	+	.await?;
400	+	let follow_ups = count(
401	+	"SELECT COUNT(*) AS n FROM sales_records WHERE next_at IS NOT NULL AND next_at <= ? AND stage NOT IN ('won', 'lost')",
402	+	vec![now[..10].into()],
403	+	)
404	+	.await?;
405	+	let signals = self.admin_signals(AdminSignalsArgs {}).await?;
406	+	let tally = \|kind: SignalKind\| signals.iter().filter(\|s\| s.kind == kind).count() as u32;
407	+	Ok(Overview {
408	+	month,
409	+	months,
410	+	by_kind,
411	+	paying_workspaces: paying as u32,
412	+	stopped: tally(SignalKind::AtLimit),
413	+	near_ceiling: tally(SignalKind::NearCeiling),
414	+	declined: tally(SignalKind::Declined),
415	+	open_invoices_micros: open_invoices,
416	+	follow_ups_due: follow_ups as u32,
417	+	})
418	+	}
419	+	}
420	+
421	+	#[cfg(test)]
422	+	mod tests {
423	+	use super::*;
424	+
425	+	#[test]
426	+	fn six_months_end_with_this_one() {
427	+	assert_eq!(last_months("2026-02", 3), vec!["2025-12", "2026-01", "2026-02"]);
428	+	}
429	+
430	+	#[test]
431	+	fn growth_is_judged_on_pace_not_on_the_month_so_far() {
432	+	// Ten days in, $20 on a 30-day month is a $60 pace against $30.
433	+	assert!(growing(20_000_000, 30_000_000, 10, 30));
434	+	assert!(!growing(10_000_000, 30_000_000, 10, 30));
435	+	// Too small last month to say.
436	+	assert!(!growing(9_000_000, 1_000_000, 10, 30));
437	+	}
438	+
439	+	#[test]
440	+	fn the_most_urgent_comes_first() {
441	+	assert!(urgency(SignalKind::AtLimit) < urgency(SignalKind::NearCeiling));
442	+	assert!(urgency(SignalKind::Declined) < urgency(SignalKind::Growing));
443	+	}
444	+
445	+	#[test]
446	+	fn february_knows_its_leap_years() {
447	+	assert_eq!(days_in("2028-02"), 29);
448	+	assert_eq!(days_in("2026-02"), 28);
449	+	assert_eq!(days_in("2026-10"), 31);
450	+	}
451	+	}

+11−45View BlameViewed

104	104		}
105	105
106	106		/// `name=value` pairs as a form body.
107		−	/// A payment made with no one there.
108		−	#[derive(Debug, Deserialize)]
109		−	pub struct PaymentIntent {
110		−	pub id: String,
111		−	/// `succeeded`, or anything else when it did not go through.
112		−	pub status: String,
113		−	#[serde(default)]
114		−	pub amount_received: i64,
115		−	}
116		−
117	107		pub(crate) fn form(fields: &[(&str, String)]) -> String {
118	108		fields
119	109		.iter()
⋯
142	132		self.call(Method::Post, path, Some(form(fields))).await
143	133		}
144	134
	135	+	/// A form POST that Stripe does at most once for `key`, however often
	136	+	/// it is sent.
	137	+	pub(crate) async fn post_idempotent<T: for<'a> Deserialize<'a>>(
	138	+	&self,
	139	+	path: &str,
	140	+	fields: &[(&str, String)],
	141	+	key: &str,
	142	+	) -> Result<T> {
	143	+	self.send(Method::Post, path, Some(form(fields)), Some(key)).await
	144	+	}
	145	+
145	146		pub(crate) async fn delete<T: for<'a> Deserialize<'a>>(&self, path: &str) -> Result<T> {
146	147		self.call(Method::Delete, path, None).await
147	148		}
⋯
185	186		)));
186	187		}
187	188		response.json().await
188		−	}
189		−
190		−	/// Charges the customer's saved card, with no one there: the automatic
191		−	/// payment at a workspace's limit. `key` makes a retry the same charge.
192		−	pub async fn charge_saved_card(
193		−	&self,
194		−	customer: &str,
195		−	amount_cents: i64,
196		−	description: &str,
197		−	key: &str,
198		−	) -> Result<PaymentIntent> {
199		−	#[derive(Deserialize)]
200		−	struct Methods {
201		−	data: Vec<Method_>,
202		−	}
203		−	#[derive(Deserialize)]
204		−	struct Method_ {
205		−	id: String,
206		−	}
207		−	let methods: Methods = self
208		−	.call(Method::Get, &format!("/payment_methods?customer={}&type=card&limit=1", encode(customer)), None)
209		−	.await?;
210		−	let Some(card) = methods.data.first() else {
211		−	return Err(Error::RustError("no card on file".into()));
212		−	};
213		−	let fields = [
214		−	("amount", amount_cents.to_string()),
215		−	("currency", "usd".to_owned()),
216		−	("customer", customer.to_owned()),
217		−	("payment_method", card.id.clone()),
218		−	("off_session", "true".to_owned()),
219		−	("confirm", "true".to_owned()),
220		−	("description", description.to_owned()),
221		−	];
222		−	self.send(Method::Post, "/payment_intents", Some(form(&fields)), Some(key)).await
223	189		}
224	190
225	191		/// A customer for a workspace that has none yet.

+17−3View BlameViewed

273	273		"invoice.paid" => {
274	274		if let Some(subscription) = object["subscription"].as_str() {
275	275		self.settle_subscription(subscription).await?
	276	+	} else if let Some(done) = self.workspace_invoice_paid(&text("id")).await? {
	277	+	done
276	278		} else {
277	279		self.enterprise_invoice_paid(&text("id")).await?
278	280		}
279	281		}
280		−	"invoice.payment_failed" => match object["subscription"].as_str() {
281		−	Some(subscription) => self.settle_subscription(subscription).await?,
282		−	None => "ignored: not a plan".to_owned(),
	282	+	"invoice.payment_failed" => match (object["subscription"].as_str(), object["metadata"]["g1t_workspace"].as_str()) {
	283	+	(Some(subscription), _) => self.settle_subscription(subscription).await?,
	284	+	(None, Some(workspace)) => {
	285	+	self.mark_declined(workspace, "the card was declined for an invoice").await?;
	286	+	format!("{workspace}: invoice payment failed; work stopped")
	287	+	}
	288	+	_ => "ignored: not g1t's".to_owned(),
283	289		},
284	290		"invoice.overdue" => self.enterprise_invoice_status(&text("id"), "overdue").await?,
285	291		"invoice.voided" => self.enterprise_invoice_status(&text("id"), "void").await?,
⋯
455	461		return Ok("ignored: not a workspace's customer".to_owned());
456	462		};
457	463		let now = rfc3339(now_ms());
	464	+	// The disputed payment never counts toward trust again.
	465	+	for reference in [charge["payment_intent"].as_str(), charge["invoice"].as_str()].into_iter().flatten() {
	466	+	self.db
	467	+	.prepare("UPDATE ledger SET disputed = ? WHERE workspace = ? AND reference = ?")
	468	+	.bind(&[(if stop { 1 } else { 0 }).into(), workspace.as_str().into(), reference.into()])?
	469	+	.run()
	470	+	.await?;
	471	+	}
458	472		if stop {
459	473		self.db
460	474		.prepare(