Function decide

apps/cloud/src/engine/execution-rate-limit.ts:232–280

(organizationId: string)

    });

  const decide = (organizationId: string): Effect.Effect<GateDecision> =>
    Effect.suspend(() => {
      const windowId = Math.floor(now() / windowMs);
      return increment(organizationId, windowId).pipe(
        Effect.timeoutOrElse({
          duration: `${timeoutMs} millis`,
          orElse: () => Effect.fail(new RateLimitCheckTimeoutError({ timeoutMs })),
        }),
        Effect.flatMap((count): Effect.Effect<GateDecision> => {
          // Under the cap: no exemption lookup, no extra I/O.
          if (count <= limit) return Effect.succeed({ blocked: false });
          return Effect.gen(function* () {
            if (yield* resolveExemption(organizationId)) {
              return { blocked: false } as const satisfies GateDecision;
            }
            // The only record that the backstop fired. A blocked execution is
            // never usage-tracked (the gate short-circuits before the tracker)
            // and deliberately not sent to Sentry — a backstop stopping
            // runaway automation is expected, not exceptional — so without
            // this line a blocked org is invisible outside a bug report, which
            // is how the 2026-08-18 block went unnoticed until a customer
            // sent a screenshot.
            yield* Effect.sync(() => {
              console.warn(
                `[rate-limit] blocked execution for ${organizationId}: ${count} > ${limit} in window ${windowId}`,
              );
            });
            return {
              blocked: true,
              error: new ExecutionRateLimitExceededError({
                organizationId,
                message: RATE_LIMIT_BLOCKED_MESSAGE,
              }),
            } as const satisfies GateDecision;
          });
        }),
        // FAIL OPEN: the backstop must never block executions because its
        // counter is unreachable or slow.
        Effect.catch((error: unknown) =>
          Effect.gen(function* () {
            yield* Effect.sync(() => {
              console.warn("[rate-limit] execution rate limit check failed open:", error);
            });
            yield* captureCauseEffect(error);
            return { blocked: false } as const satisfies GateDecision;
          }),
        ),
      );
    });

  return {
    decorate: (organizationId, engine) => withPreExecutionGate(engine, decide(organizationId)),