@oneuptime/common 12.0.34 → 13.0.1

package/build/dist/Server/Services/BillingPaymentMethodService.js

@@ -14,32 +14,43 @@ import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/BillingPaymentMethod";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService from "./PayAsYouGoBillingService";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
+        /*
+         * Every read of this model re-syncs it from the payment provider, and one
+         * billing page render issues two list requests at once (the table itself,
+         * and the unfiltered count beside it). That was 10 provider reads - four
+         * payment-method types plus the customer, twice - fired simultaneously for a
+         * single page, on top of a hard delete and re-insert of the same rows from
+         * both requests at once. Against a rate-limited account that is what makes a
+         * read fail; it also raced the two re-syncs against each other in Postgres.
+         *
+         * Collapse only requests that genuinely overlap in time: a caller arriving
+         * while a sync is in flight awaits that one instead of starting a second.
+         * Nothing is cached beyond the in-flight window, so a payment method added
+         * a moment ago is still read fresh by the next request.
+         */
+        this.syncsInFlight = {};
     }
-    async onBeforeFind(findBy) {
-        if (!findBy.props.tenantId) {
-            throw new BadDataException("ProjectID not found.");
+    syncPaymentMethodsFromProvider(data) {
+        const key = data.projectId.toString();
+        const inFlight = this.syncsInFlight[key];
+        if (inFlight) {
+            return inFlight;
         }
-        const project = await ProjectService.findOneById({
-            id: findBy.props.tenantId,
-            props: Object.assign(Object.assign({}, findBy.props), { isRoot: true, ignoreHooks: true }),
-            select: {
-                _id: true,
-                paymentProviderCustomerId: true,
-            },
+        const sync = this.runPaymentMethodSync(data).finally(() => {
+            delete this.syncsInFlight[key];
         });
-        if (!project) {
-            throw new BadDataException("Project not found");
-        }
-        if (!project.paymentProviderCustomerId) {
-            throw new BadDataException("Payment provider customer id not found.");
-        }
-        const paymentMethods = await BillingService.getPaymentMethods(project.paymentProviderCustomerId);
+        this.syncsInFlight[key] = sync;
+        return sync;
+    }
+    async runPaymentMethodSync(data) {
+        const paymentMethods = await BillingService.getPaymentMethods(data.customerId);
         await this.deleteBy({
             query: {
-                projectId: findBy.props.tenantId,
+                projectId: data.projectId,
             },
             limit: LIMIT_PER_PROJECT,
             skip: 0,
@@ -50,13 +61,12 @@ export class Service extends DatabaseService {
         });
         for (const paymentMethod of paymentMethods) {
             const billingPaymentMethod = new Model();
-            billingPaymentMethod.projectId = project.id;
+            billingPaymentMethod.projectId = data.projectId;
             billingPaymentMethod.paymentMethodType = paymentMethod.type;
             billingPaymentMethod.last4Digits = paymentMethod.last4Digits;
             billingPaymentMethod.isDefault = paymentMethod.isDefault;
             billingPaymentMethod.paymentProviderPaymentMethodId = paymentMethod.id;
-            billingPaymentMethod.paymentProviderCustomerId =
-                project.paymentProviderCustomerId;
+            billingPaymentMethod.paymentProviderCustomerId = data.customerId;
             await this.create({
                 data: billingPaymentMethod,
                 props: {
@@ -64,6 +74,39 @@ export class Service extends DatabaseService {
                 },
             });
         }
+        /*
+         * We have just read the authoritative list of payment methods for this
+         * project, so any cached authorization decision is now stale by
+         * definition. Clearing it here is what makes the admission path's denial
+         * cache safe: the billing page reads this table immediately after a card
+         * is added, so ingest stops being denied on the very next batch instead of
+         * at the end of the denial TTL.
+         */
+        PayAsYouGoBillingService.invalidate(data.projectId);
+        return paymentMethods;
+    }
+    async onBeforeFind(findBy) {
+        if (!findBy.props.tenantId) {
+            throw new BadDataException("ProjectID not found.");
+        }
+        const project = await ProjectService.findOneById({
+            id: findBy.props.tenantId,
+            props: Object.assign(Object.assign({}, findBy.props), { isRoot: true, ignoreHooks: true }),
+            select: {
+                _id: true,
+                paymentProviderCustomerId: true,
+            },
+        });
+        if (!project) {
+            throw new BadDataException("Project not found");
+        }
+        if (!project.paymentProviderCustomerId) {
+            throw new BadDataException("Payment provider customer id not found.");
+        }
+        const paymentMethods = await this.syncPaymentMethodsFromProvider({
+            projectId: project.id,
+            customerId: project.paymentProviderCustomerId,
+        });
         return { findBy, carryForward: paymentMethods };
     }
     async onBeforeDelete(deleteBy) {
@@ -87,6 +130,13 @@ export class Service extends DatabaseService {
                 await BillingService.deletePaymentMethod(item.paymentProviderCustomerId, item.paymentProviderPaymentMethodId);
             }
         }
+        /*
+         * No authorization invalidation here on purpose: BillingService
+         * .deletePaymentMethod refuses to detach the last remaining method, so a
+         * successful delete always leaves the project with at least one card and
+         * its authorization unchanged. Clearing the cache would only force a
+         * needless provider read.
+         */
         return { deleteBy, carryForward: null };
     }
 }

package/build/dist/Server/Services/BillingPaymentMethodService.js.map

@@ -1 +1 @@
-{"version":3,"file":"BillingPaymentMethodService.js","sourceRoot":"","sources":["../../../../Server/Services/BillingPaymentMethodService.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,cAAiC,MAAM,kBAAkB,CAAC;AACjE,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,MAAM,kDAAkD,CAAC;AAErE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,YAAY,CACnC,MAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,QAAS;YAC1B,KAAK,kCACA,MAAM,CAAC,KAAK,KACf,MAAM,EAAE,IAAI,EACZ,WAAW,EAAE,IAAI,GAClB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,yBAAyB,EAAE,IAAI;aAChC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,cAAc,GAClB,MAAM,cAAc,CAAC,iBAAiB,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,QAAQ,CAAC;YAClB,KAAK,EAAE;gBACL,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAS;aAClC;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,MAAM,oBAAoB,GAAU,IAAI,KAAK,EAAE,CAAC;YAEhD,oBAAoB,CAAC,SAAS,GAAG,OAAO,CAAC,EAAG,CAAC;YAE7C,oBAAoB,CAAC,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC;YAC5D,oBAAoB,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;YAC7D,oBAAoB,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;YACzD,oBAAoB,CAAC,8BAA8B,GAAG,aAAa,CAAC,EAAE,CAAC;YACvE,oBAAoB,CAAC,yBAAyB;gBAC5C,OAAO,CAAC,yBAAyB,CAAC;YAEpC,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,KAAK,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC5C,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,8BAA8B,EAAE,IAAI;gBACpC,yBAAyB,EAAE,IAAI;aAChC;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,IAAI,CAAC,8BAA8B;gBACnC,IAAI,CAAC,yBAAyB,EAC9B,CAAC;gBACD,MAAM,cAAc,CAAC,mBAAmB,CACtC,IAAI,CAAC,yBAAyB,EAC9B,IAAI,CAAC,8BAA8B,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnG0B;IADxB,WAAW,EAAE;;;;2CAiEb;AAGwB;IADxB,WAAW,EAAE;;;;6CAgCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"BillingPaymentMethodService.js","sourceRoot":"","sources":["../../../../Server/Services/BillingPaymentMethodService.ts"],"names":[],"mappings":";;;;;;;;;AAGA,OAAO,cAAiC,MAAM,kBAAkB,CAAC;AACjE,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,MAAM,kDAAkD,CAAC;AAErE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAIlE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QAGf;;;;;;;;;;;;;WAaG;QACK,kBAAa,GAA8C,EAAE,CAAC;IAhBtE,CAAC;IAkBO,8BAA8B,CAAC,IAGtC;QACC,MAAM,GAAG,GAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAE9C,MAAM,QAAQ,GACZ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAkC,IAAI,CAAC,oBAAoB,CACnE,IAAI,CACL,CAAC,OAAO,CAAC,GAAG,EAAE;YACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAE/B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAGlC;QACC,MAAM,cAAc,GAClB,MAAM,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,QAAQ,CAAC;YAClB,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,MAAM,oBAAoB,GAAU,IAAI,KAAK,EAAE,CAAC;YAEhD,oBAAoB,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAEhD,oBAAoB,CAAC,iBAAiB,GAAG,aAAa,CAAC,IAAI,CAAC;YAC5D,oBAAoB,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;YAC7D,oBAAoB,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;YACzD,oBAAoB,CAAC,8BAA8B,GAAG,aAAa,CAAC,EAAE,CAAC;YACvE,oBAAoB,CAAC,yBAAyB,GAAG,IAAI,CAAC,UAAU,CAAC;YAEjE,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;WAOG;QACH,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEpD,OAAO,cAAc,CAAC;IACxB,CAAC;IAGwB,AAAN,KAAK,CAAC,YAAY,CACnC,MAAqB;QAErB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,QAAS;YAC1B,KAAK,kCACA,MAAM,CAAC,KAAK,KACf,MAAM,EAAE,IAAI,EACZ,WAAW,EAAE,IAAI,GAClB;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,yBAAyB,EAAE,IAAI;aAChC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,cAAc,GAClB,MAAM,IAAI,CAAC,8BAA8B,CAAC;YACxC,SAAS,EAAE,OAAO,CAAC,EAAG;YACtB,UAAU,EAAE,OAAO,CAAC,yBAAyB;SAC9C,CAAC,CAAC;QAEL,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;IAClD,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,KAAK,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC5C,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,8BAA8B,EAAE,IAAI;gBACpC,yBAAyB,EAAE,IAAI;aAChC;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,IAAI,CAAC,8BAA8B;gBACnC,IAAI,CAAC,yBAAyB,EAC9B,CAAC;gBACD,MAAM,cAAc,CAAC,mBAAmB,CACtC,IAAI,CAAC,yBAAyB,EAC9B,IAAI,CAAC,8BAA8B,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED;;;;;;WAMG;QACH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AA7E0B;IADxB,WAAW,EAAE;;;;2CAoCb;AAGwB;IADxB,WAAW,EAAE;;;;6CAuCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/BillingService.js

@@ -20,17 +20,21 @@ import Email from "../../Types/Email";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import APIException from "../../Types/Exception/ApiException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
 import ProductType from "../../Types/MeteredPlan/ProductType";
 import ObjectID from "../../Types/ObjectID";
 import Sleep from "../../Types/Sleep";
 import Stripe from "stripe";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService from "./PayAsYouGoBillingService";
 /*
  * Stripe rejects a trial_end more than two years past the billing cycle
  * anchor. Enforce the same ceiling here so an admin gets a readable error
  * instead of a raw payment-provider failure.
  */
 export const MAX_TRIAL_LENGTH_IN_DAYS = 730;
+export const METERED_BILLING_START_METADATA_KEY = "oneuptime_pay_as_you_go_started_at";
 /*
  * How long to wait before trying a cancel again, per retry.
  *
@@ -40,11 +44,61 @@ export const MAX_TRIAL_LENGTH_IN_DAYS = 730;
  * Kept short and finite because this runs inside the plan change request.
  */
 const CANCEL_RETRY_DELAYS_IN_MS = [1000, 3000];
+const PAYMENT_METHOD_TYPES = [
+    "card",
+    "sepa_debit",
+    "us_bank_account",
+    "bacs_debit",
+];
+/*
+ * Four attempts spread over 1s+2s+4s was the whole budget, and CI showed it
+ * spent: every failing read took 9-10s and then 500'd, which is this ladder
+ * running out while Stripe was still rate-limiting. One more attempt roughly
+ * doubles the window without making a user-facing request pathological.
+ */
+const PAYMENT_READ_MAX_RETRIES = 4;
+// Ceiling for a single wait, so a large Retry-After cannot hang the request.
+const PAYMENT_READ_MAX_RETRY_DELAY_IN_MS = 8000;
+/*
+ * stripe-node defaults maxNetworkRetries to 0, so out of the box a dropped
+ * socket, a 409, a Stripe-side 5xx, or a 400 that Stripe itself marks retryable
+ * with `Stripe-Should-Retry: true` (lock_timeout is the common one) is not
+ * retried at all - it surfaces as a raw StripeError, which is not an
+ * OneUptime Exception, so the express handler answers an opaque
+ * 500 {"error":"Server Error"}. That is a user-visible failure of the billing
+ * page on a single upstream hiccup. The SDK's own retry generates an
+ * idempotency key per attempt, so it is safe for writes as well as reads.
+ *
+ * It does NOT cover a plain 429: stripe-node's _shouldRetry
+ * (node_modules/stripe/lib/StripeResource.js) retries connection-closed codes,
+ * 409 and >=500 only. Rate limits are handled by readPaymentProvider's own
+ * ladder and, more importantly, by not making the calls in the first place.
+ */
+const STRIPE_MAX_NETWORK_RETRIES = 2;
+/*
+ * The SDK default is 80s. A request holding a worker for 80s on a hung socket
+ * outlives every caller that waits on it, so fail fast enough to retry.
+ */
+const STRIPE_REQUEST_TIMEOUT_IN_MS = 20000;
+/*
+ * Node's socket-level failures, which reach us with no HTTP status. Mirrors
+ * stripe-node's own CONNECTION_CLOSED_ERROR_CODES plus the timeout cases.
+ */
+const RETRYABLE_CONNECTION_ERROR_CODES = [
+    "ECONNRESET",
+    "EPIPE",
+    "ETIMEDOUT",
+    "ECONNREFUSED",
+    "EAI_AGAIN",
+    "ENOTFOUND",
+];
 export class BillingService extends BaseService {
     constructor() {
         super();
         this.stripe = new Stripe(BillingPrivateKey, {
             apiVersion: "2022-08-01",
+            maxNetworkRetries: STRIPE_MAX_NETWORK_RETRIES,
+            timeout: STRIPE_REQUEST_TIMEOUT_IN_MS,
         });
     }
     // returns billing id of the customer.
@@ -369,7 +423,7 @@ export class BillingService extends BaseService {
             proration_behavior: "always_invoice",
         });
     }
-    async addOrUpdateMeteredPricingOnSubscription(subscriptionId, serverMeteredPlan, quantity) {
+    async addOrUpdateMeteredPricingOnSubscription(subscriptionId, serverMeteredPlan, quantity, options) {
         var _a;
         if (!this.isBillingEnabled()) {
             throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
@@ -389,6 +443,9 @@ export class BillingService extends BaseService {
             throw new BadDataException(Errors.BillingService.SUBSCRIPTION_NOT_FOUND);
         }
         // check if this pricing exists
+        if (quantity > 0) {
+            await PayAsYouGoBillingService.requireMeteredSubscriptionPayment(subscription, options);
+        }
         const pricingExists = subscription.items.data.some((item) => {
             var _a;
             return ((_a = item.price) === null || _a === void 0 ? void 0 : _a.id) === serverMeteredPlan.getPriceId();
@@ -880,11 +937,150 @@ export class BillingService extends BaseService {
         await this.stripe.paymentMethods.detach(paymentMethodId);
     }
     async hasPaymentMethods(customerId) {
-        if ((await this.getPaymentMethods(customerId)).length > 0) {
-            return true;
+        if (!this.isBillingEnabled()) {
+            throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
+        }
+        // Eligibility needs one attached method, without fetching or changing defaults.
+        for (const type of PAYMENT_METHOD_TYPES) {
+            const methods = await this.listPaymentMethods(customerId, type, 1);
+            if (methods.data.length > 0) {
+                return true;
+            }
         }
         return false;
     }
+    /**
+     * A read that could not be completed is not the same answer as "no payment
+     * method", so this never converts a failure into a value - it retries, and
+     * then reports the outage as one. Callers stay free to fail closed.
+     */
+    async readPaymentProvider(read) {
+        for (let attempt = 0;; attempt++) {
+            try {
+                return await read();
+            }
+            catch (err) {
+                if (!BillingService.isRetryablePaymentProviderRead(err)) {
+                    /*
+                     * A 400/401/404 is this request being wrong - a bad key, a customer
+                     * that is not there. Keep it exactly as it came: renaming it "could
+                     * not reach the provider" would send the reader somewhere else.
+                     */
+                    throw err;
+                }
+                if (attempt >= PAYMENT_READ_MAX_RETRIES) {
+                    throw BillingService.toPaymentProviderReadFailure(err);
+                }
+                /*
+                 * The SDK's own network retries are immediate and few; this is the
+                 * longer, jittered wait a sustained rate limit needs. An exhausted
+                 * read still denies paid usage - it never answers "no payment method".
+                 */
+                await Sleep.sleep(BillingService.getPaymentReadRetryDelay(err, attempt));
+            }
+        }
+    }
+    /**
+     * Honour Retry-After if it is there, rather than preferring our own doubling
+     * over a number the provider gave us.
+     *
+     * Be clear about what this does NOT buy: Stripe documents only a
+     * `Stripe-Rate-Limited-Reason` header on a rate-limited 429
+     * (https://docs.stripe.com/rate-limits) and does not document sending
+     * Retry-After, so on the failure that actually breaks us this falls through
+     * to the exponential backoff. It is kept because it is correct if Stripe
+     * ever does send one - not because it is mitigating today's rate limit.
+     * Do not count it as mitigation when sizing this.
+     */
+    static getPaymentReadRetryDelay(err, attempt) {
+        var _a;
+        const backoffInMs = Math.round(1000 * 2 ** attempt * (1 + Math.random() / 2));
+        const headers = (err !== null && err !== void 0 ? err : {})
+            .headers || {};
+        const retryAfterInSeconds = Number((_a = headers["retry-after"]) !== null && _a !== void 0 ? _a : headers["Retry-After"]);
+        if (!Number.isFinite(retryAfterInSeconds) || retryAfterInSeconds <= 0) {
+            return backoffInMs;
+        }
+        return Math.min(Math.max(backoffInMs, retryAfterInSeconds * 1000), PAYMENT_READ_MAX_RETRY_DELAY_IN_MS);
+    }
+    /**
+     * Rate limits are the documented case, but a read can also fail with no HTTP
+     * response at all - a reset or timed-out socket, which arrives with
+     * statusCode undefined - or with Stripe's own 5xx. The SDK retries those too
+     * now (STRIPE_MAX_NETWORK_RETRIES); this outer loop adds the longer,
+     * jittered backoff that a sustained rate limit needs.
+     */
+    static isRetryablePaymentProviderRead(err) {
+        const providerError = (err !== null && err !== void 0 ? err : {});
+        if (typeof providerError.statusCode === "number") {
+            return (providerError.statusCode === 429 || providerError.statusCode >= 500);
+        }
+        /*
+         * No HTTP response was read at all. Retry only the transport failures we
+         * can name - a programming error also lands here with no statusCode, and
+         * retrying one four times just delays the real report.
+         */
+        return (providerError.type === "StripeConnectionError" ||
+            providerError.type === "StripeAPIError" ||
+            RETRYABLE_CONNECTION_ERROR_CODES.includes(providerError.code || ""));
+    }
+    /**
+     * A raw StripeError is not an OneUptime Exception, so it reaches the express
+     * handler's fallback branch and becomes an opaque 500 {"error":"Server
+     * Error"} - indistinguishable from a bug in OneUptime, and carrying nothing
+     * an operator or an E2E diagnostic can act on. Name the real condition
+     * instead: the payment provider could not be reached.
+     */
+    static toPaymentProviderReadFailure(err) {
+        if (err instanceof Exception) {
+            return err;
+        }
+        const providerError = (err !== null && err !== void 0 ? err : {});
+        logger.error(err);
+        return new ServiceUnavailableException(`Could not reach the payment provider to read payment methods${providerError.code ? ` (${providerError.code})` : ""}. Please try again.`);
+    }
+    async listPaymentMethods(customerId, type, limit) {
+        const params = {
+            customer: customerId,
+            type,
+        };
+        if (limit !== undefined) {
+            params.limit = limit;
+        }
+        return this.readPaymentProvider(() => {
+            return this.stripe.paymentMethods.list(params);
+        });
+    }
+    /**
+     * Old usage must not become a debt when a customer adds their first card.
+     * Establish a durable boundary at the first authorized billing pass. For
+     * existing customers without the marker this deliberately forgives older
+     * unreported telemetry. Never derive consent from subscription creation:
+     * signup creates a subscription even when no payment method exists.
+     */
+    async getMeteredBillingStartDate(customerId) {
+        if (!this.isBillingEnabled()) {
+            throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
+        }
+        const customer = await this.stripe.customers.retrieve(customerId);
+        if (customer.deleted) {
+            throw new BadDataException(Errors.BillingService.CUSTOMER_NOT_FOUND);
+        }
+        const storedValue = customer.metadata[METERED_BILLING_START_METADATA_KEY];
+        const storedDate = storedValue
+            ? new Date(storedValue)
+            : undefined;
+        if (storedDate && Number.isFinite(storedDate.getTime())) {
+            return storedDate;
+        }
+        const startsAt = OneUptimeDate.getCurrentDate();
+        await this.stripe.customers.update(customerId, {
+            metadata: {
+                [METERED_BILLING_START_METADATA_KEY]: startsAt.toISOString(),
+            },
+        });
+        return startsAt;
+    }
     async setDefaultPaymentMethod(customerId, paymentMethodId) {
         await this.stripe.customers.update(customerId, {
             invoice_settings: {
@@ -898,22 +1094,10 @@ export class BillingService extends BaseService {
             throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
         }
         const paymentMethods = [];
-        const cardPaymentMethods = await this.stripe.paymentMethods.list({
-            customer: customerId,
-            type: "card",
-        });
-        const sepaPaymentMethods = await this.stripe.paymentMethods.list({
-            customer: customerId,
-            type: "sepa_debit",
-        });
-        const usBankPaymentMethods = await this.stripe.paymentMethods.list({
-            customer: customerId,
-            type: "us_bank_account",
-        });
-        const bacsPaymentMethods = await this.stripe.paymentMethods.list({
-            customer: customerId,
-            type: "bacs_debit",
-        });
+        const cardPaymentMethods = await this.listPaymentMethods(customerId, "card");
+        const sepaPaymentMethods = await this.listPaymentMethods(customerId, "sepa_debit");
+        const usBankPaymentMethods = await this.listPaymentMethods(customerId, "us_bank_account");
+        const bacsPaymentMethods = await this.listPaymentMethods(customerId, "bacs_debit");
         cardPaymentMethods.data.forEach((item) => {
             var _a, _b;
             paymentMethods.push({
@@ -951,7 +1135,9 @@ export class BillingService extends BaseService {
             });
         });
         // check if there's a default payment method.
-        const customer = await this.stripe.customers.retrieve(customerId);
+        const customer = await this.readPaymentProvider(() => {
+            return this.stripe.customers.retrieve(customerId);
+        });
         const defaultPaymentMethod = (_a = customer.invoice_settings) === null || _a === void 0 ? void 0 : _a.default_payment_method;
         const defaultPaymentMethodId = typeof defaultPaymentMethod === "string"
             ? defaultPaymentMethod
@@ -1082,7 +1268,9 @@ export class BillingService extends BaseService {
         if (!this.isBillingEnabled()) {
             throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
         }
-        const subscription = await this.stripe.subscriptions.retrieve(subscriptionId);
+        const subscription = await this.readPaymentProvider(() => {
+            return this.stripe.subscriptions.retrieve(subscriptionId);
+        });
         return subscription;
     }
     async getInvoice(customerId, invoiceId) {
@@ -1594,7 +1782,7 @@ __decorate([
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, ServerMeteredPlan, Number]),
+    __metadata("design:paramtypes", [String, ServerMeteredPlan, Number, Object]),
     __metadata("design:returntype", Promise)
 ], BillingService.prototype, "addOrUpdateMeteredPricingOnSubscription", null);
 __decorate([