// ---------------------------------------------------------------------------// Autumn billing service — wraps the autumn-js SDK with Effect// --------------------------------------------------------------------------- import { env } from "cloudflare:workers";import { Autumn } from "autumn-js";import { Context, Data, Effect, Layer } from "effect"; import { captureCauseEffect } from "../../observability"; // ---------------------------------------------------------------------------// Errors// --------------------------------------------------------------------------- export class AutumnError extends Data.TaggedError("AutumnError")<{  message: string;  cause?: unknown;}> {} /** * Autumn has no customer record for the organization. Split out from * `AutumnError` because it is not an outage and must not be treated like one: * an outage is transient and the right answer is to fail open and page, while * a missing customer is a PERMANENT provisioning gap — every subsequent * balance call 404s the same way, so the org runs unbilled and unmetered * forever. Callers that own an organization id repair it (see * `withProvisionedCustomer`); everything else still surfaces as `AutumnError`. */export class AutumnCustomerNotFoundError extends Data.TaggedError("AutumnCustomerNotFoundError")<{  message: string;  cause?: unknown;}> {} export type AutumnFailure = AutumnError | AutumnCustomerNotFoundError; // Autumn's own error code for "no such customer", carried in the JSON body of// a 404 (`{"message":"Customer <id> not found","code":"customer_not_found"}`).const CUSTOMER_NOT_FOUND_CODE = "customer_not_found"; /** * True when `cause` is Autumn's "no such customer" answer. The autumn-js SDK * throws an `AutumnError` carrying the raw HTTP `statusCode` and `body`; match * on the code rather than the status alone so an unrelated 404 (a removed * endpoint, a proxy) is still reported as a genuine failure. */const isCustomerNotFoundCause = (cause: unknown): boolean => {  if (typeof cause !== "object" || cause === null) return false;  const { statusCode, body } = cause as { readonly statusCode?: unknown; readonly body?: unknown };  if (statusCode !== 404 || typeof body !== "string") return false;  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: classifying a third-party SDK's raw response body; a body that isn't JSON simply isn't this error  try {    // oxlint-disable-next-line executor/no-json-parse -- boundary: the autumn-js SDK hands back the response body as an unvalidated string    const parsed: unknown = JSON.parse(body);    if (typeof parsed !== "object" || parsed === null) return false;    return (parsed as { readonly code?: unknown }).code === CUSTOMER_NOT_FOUND_CODE;  } catch {    return false;  }}; // ---------------------------------------------------------------------------// Service interface// --------------------------------------------------------------------------- export type IAutumnService = Readonly<{  use: <A>(fn: (client: Autumn) => Promise<A>) => Effect.Effect<A, AutumnFailure, never>;  /**   * Provision the organization's Autumn customer, creating it if Autumn has   * never seen it. Idempotent — safe to call on every org creation.   */  ensureCustomer: (organizationId: string) => Effect.Effect<void, AutumnFailure, never>;  checkExecutionBalance: (    organizationId: string,  ) => Effect.Effect<{ readonly allowed: boolean }, AutumnFailure, never>;  /**   * Fire-and-forget-safe execution usage tracker. Errors are caught and   * logged; the returned Effect never fails. Callers typically   * `Effect.runFork` it at the boundary so the billing call can't stall a   * user-facing request.   */  trackExecution: (organizationId: string) => Effect.Effect<void, never, never>;  /**   * Set the organization's billed seat count to an absolute value. Seats are   * a continuous-use feature, so callers recount from the membership source   * of truth and this SETS the usage rather than incrementing it — deltas   * would drift against seat changes the app never sees. Orgs whose plan   * version carries no `members` item (every plan predating seat pricing)   * are skipped. Fire-and-forget-safe: errors are caught and logged; the   * returned Effect never fails.   */  setMemberSeats: (organizationId: string, seats: number) => Effect.Effect<void, never, never>;}>; // ---------------------------------------------------------------------------// Implementation// --------------------------------------------------------------------------- const make = Effect.sync(() => {  const secretKey = env.AUTUMN_SECRET_KEY;   if (!secretKey) {    const notConfigured = Effect.fail(      new AutumnError({ message: "Autumn not configured: AUTUMN_SECRET_KEY is empty" }),    );    return {      use: () => notConfigured,      ensureCustomer: () => notConfigured,      checkExecutionBalance: () => notConfigured,      trackExecution: () => Effect.void,      setMemberSeats: () => Effect.void,    } satisfies IAutumnService;  }   // AUTUMN_API_URL points the real SDK at an Autumn emulator in tests/dev.  const client = new Autumn({    secretKey,    ...(env.AUTUMN_API_URL ? { serverURL: env.AUTUMN_API_URL } : {}),  });   const use = <A>(fn: (client: Autumn) => Promise<A>) =>    Effect.tryPromise({      try: () => fn(client),      catch: (cause): AutumnFailure =>        isCustomerNotFoundCause(cause)          ? new AutumnCustomerNotFoundError({              message: "Autumn has no customer for this organization",              cause,            })          : new AutumnError({ message: "Autumn SDK request failed", cause }),      // An inline arrow's `name` is "" — not nullish — so `??` left every      // Autumn call tracing as the bare span `autumn.`.    }).pipe(Effect.withSpan(`autumn.${fn.name || "use"}`));   const ensureCustomer = (organizationId: string) =>    Effect.asVoid(use((c) => c.customers.getOrCreate({ customerId: organizationId })));   /**   * Run `operation`; if Autumn answers "no such customer", provision the   * organization's customer and run it ONCE more.   *   * This is the seam that closes the provisioning hole. Both billing paths use   * non-creating endpoints, so an organization Autumn never learned about   * 404s here forever: the balance gate fails open (correct for an outage,   * catastrophic as a steady state) and every usage track is lost. Repairing   * the customer makes the retry land the call — and a genuine Autumn outage   * still fails with `AutumnError` and still pages, unretried.   */  const withProvisionedCustomer = <A>(    organizationId: string,    operation: Effect.Effect<A, AutumnFailure>,  ) =>    operation.pipe(      Effect.catchTag("AutumnCustomerNotFoundError", () =>        Effect.gen(function* () {          yield* Effect.annotateCurrentSpan({ "autumn.customer.provisioned": true });          yield* ensureCustomer(organizationId);          return yield* operation;        }),      ),    );   const trackExecution = (organizationId: string) =>    Effect.gen(function* () {      yield* Effect.annotateCurrentSpan({ "autumn.customer.id": organizationId });      yield* withProvisionedCustomer(        organizationId,        use((c) => c.track({ customerId: organizationId, featureId: "executions", value: 1 })),      ).pipe(        Effect.catch((error) =>          Effect.gen(function* () {            // Silent billing data loss is worth paging on: autumn.trackExecution            // is fire-and-forget so the caller doesn't handle it themselves.            yield* Effect.sync(() => {              console.error("[billing] track failed:", error);            });            yield* captureCauseEffect(error);            yield* Effect.annotateCurrentSpan({ "autumn.track.failed": true });          }),        ),      );    }).pipe(Effect.withSpan("autumn.trackExecution"));   const setMemberSeats = (organizationId: string, seats: number) =>    Effect.gen(function* () {      yield* Effect.annotateCurrentSpan({        "autumn.customer.id": organizationId,        "autumn.members.seats": seats,      });      // getOrCreate rather than get: reuses the provisioning repair, so an      // org Autumn has never seen gets its customer minted here instead of      // 404ing forever.      const customer = yield* use((c) => c.customers.getOrCreate({ customerId: organizationId }));      // Plans that predate seat pricing have no members balance to set.      // Existing subscribers stay on those versions deliberately, so this is      // a steady state, not an error.      if (customer.balances["members"] == null) {        yield* Effect.annotateCurrentSpan({ "autumn.members.skipped": true });        return;      }      yield* use((c) =>        c.balances.update({ customerId: organizationId, featureId: "members", usage: seats }),      );    }).pipe(      Effect.catch((error) =>        Effect.gen(function* () {          // Silent seat drift means wrong invoices, so failures page just          // like a lost execution track.          yield* Effect.sync(() => {            console.error("[billing] seat sync failed:", error);          });          yield* captureCauseEffect(error);          yield* Effect.annotateCurrentSpan({ "autumn.members.failed": true });        }),      ),      Effect.withSpan("autumn.setMemberSeats"),    );   const checkExecutionBalance = (organizationId: string) =>    Effect.gen(function* () {      yield* Effect.annotateCurrentSpan({ "autumn.customer.id": organizationId });      const check = yield* withProvisionedCustomer(        organizationId,        use((c) => c.check({ customerId: organizationId, featureId: "executions" })),      );      return { allowed: check.allowed };    }).pipe(Effect.withSpan("autumn.checkExecutionBalance"));   return {    use,    ensureCustomer,    checkExecutionBalance,    trackExecution,    setMemberSeats,  } satisfies IAutumnService;}); export class AutumnService extends Context.Service<AutumnService, IAutumnService>()(  "@executor-js/cloud/AutumnService",) {  static Default = Layer.effect(this)(make);}