fix(usage): repair the run-count predicate, align the ledger and analytics scopes

Fourth review round. The first item is a break this branch introduced last round.

`getBillingPeriodWorkflowRunCount` was rewritten to exclude unbilled categories via
`<> ALL(${UNBILLED_USAGE_CATEGORIES})`. Interpolating a JavaScript array into a
`sql` template emits parenthesized scalar binds, so the statement rendered as
`ALL(($1))` and Postgres rejects it: "op ANY/ALL (array) requires array on right
side" — verified against a real database. Its only caller builds the enterprise
billing preview, so that preview would have thrown on every request. It now uses
`notInArray`. Unit tests could not have caught it; `@sim/db` is mocked, so no
statement is ever rendered.

The ledger listing filtered on `created_at` while the analytics scope matches a
stripe or default period on the stamps rows carry. The event list and the CSV
therefore covered a different set than the totals above them — rows created inside
the period but stamped to another, and the reverse. Both now derive their filter
from one `usageWindowLedgerFilter`, which mirrors `buildUsageAnalyticsScope` case
for case, with a test asserting the two branch on the same discriminant.

An invalid timezone reached `assertValidTimezone` and surfaced as a 500 for what is
an ordinary bad query param; it is now refused by the contract as a 400, with the
SQL-boundary assertion left in place as the backstop it is.

A bookmarked workspace id that no longer resolves opened a detail view with an
untitled header and empty sections, against this repo's own deep-link rule. It now
falls back to the list once the list has loaded.

Also: `Cache-Control: no-store` on the CSV, which is every member's spend behind
session auth and the one response a browser will cache; Export no longer gated on
an unrelated summary query; the bar chart keeps its measurement ref on the empty
branch; and the admin create-organization contract declares `attachedWorkspaceIds`
plus `workspaceAttachmentFailed`, so a caller can tell an owner with no workspaces
from provisioning that is genuinely incomplete.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/organizations/[id]/usage/export/route.ts

@@ -71,6 +71,10 @@ export const GET = withRouteHandler(async (request: NextRequest, context) => {
     return new NextResponse(csv, {
       headers: {
         'Content-Type': 'text/csv; charset=utf-8',
+        // Every member's spend for one organization, behind session auth. Without
+        // this a browser or shared intermediary may serve it again after the
+        // viewer's access to that organization has been revoked.
+        'Cache-Control': 'no-store',
         'Content-Disposition': `attachment; filename="organization-usage-${params.id}.csv"`,
         ...(result.truncated ? { 'X-Export-Truncated': '1' } : {}),
       },

apps/sim/app/api/v1/admin/organizations/route.ts

@@ -18,10 +18,11 @@
  *   - slug: string - Organization slug (optional, auto-generated from name if not provided)
  *   - ownerId: string - User ID of the organization owner (required)
  *
- * Response: AdminSingleResponse<AdminOrganization & { memberId: string; attachedWorkspaceIds: string[] }>
+ * Response: AdminSingleResponse<AdminOrganization & { memberId, attachedWorkspaceIds, workspaceAttachmentFailed }>
  *   `attachedWorkspaceIds` reports which of the owner's workspaces moved under the
- *   organization. Empty means none did — either the owner had none, or attachment
- *   failed after the organization was already committed.
+ *   organization, and `workspaceAttachmentFailed` distinguishes an owner who had
+ *   none from an attachment that threw after the organization was committed — the
+ *   latter leaves the organization unreachable and is worth retrying.
  */
 
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
@@ -178,11 +179,11 @@ export const POST = withRouteHandler(
        * blocked by the existing-membership check above, with no way to reach the
        * organization at all.
        *
-       * It must not be reported as an unqualified success either. The outcome is
-       * returned as `attachedWorkspaceIds` and recorded on the audit event, so a
-       * caller sees which workspaces moved — an empty array after a failure is the
-       * explicit incomplete state, and attaching afterwards is a normal repeatable
-       * operation rather than something only the logs know is outstanding.
+       * It must not be reported as an unqualified success either. Both the ids that
+       * moved and whether the attach threw are on the response contract and on the
+       * audit event, because an empty list alone cannot distinguish an owner who had
+       * no workspaces from provisioning that is genuinely incomplete — only the
+       * second is worth retrying, and only the caller can decide to.
        */
       let attachedWorkspaceIds: string[] = []
       let workspaceAttachmentFailed = false
@@ -238,6 +239,7 @@ export const POST = withRouteHandler(
         ...toAdminOrganization(createdOrg),
         memberId,
         attachedWorkspaceIds,
+        workspaceAttachmentFailed,
       })
     } catch (error) {
       if (error instanceof OrganizationSlugInvalidError) {

apps/sim/components/charts/bar-chart.tsx

@@ -133,7 +133,11 @@ function BarChartComponent({
 
   if (data.length === 0) {
     return (
+      // Keeps the measurement ref: dropping it here left the observer watching a
+      // detached node, so a resize while empty was never seen and the next non-empty
+      // render laid out at the stale width.
       <div
+        ref={containerRef}
         className={cn(
           'flex items-center justify-center',
           !hasExternalWrapper && 'rounded-lg border bg-card p-4'

apps/sim/ee/organization-usage/components/usage-monitoring.tsx

@@ -93,13 +93,15 @@ export function UsageMonitoring({ organizationId, workspaceId }: UsageMonitoring
   const [creditsTarget, setCreditsTarget] = useState<ManageCreditsTarget | null>(null)
 
   const isOverview = tab === USAGE_OVERVIEW_TAB
-  /** A selected workspace turns the Workspaces tab into that workspace's workflows. */
-  const isWorkspaceDetail = tab === 'workspace' && Boolean(workspace)
-  const dimension: UsageBreakdownDimension = isOverview
-    ? 'source'
-    : isWorkspaceDetail
-      ? 'workflow'
-      : (tab as UsageBreakdownDimension)
+  /**
+   * A selected workspace turns the Workspaces tab into that workspace's workflows —
+   * but only once the id resolves against the loaded list. A bookmarked id for a
+   * deleted workspace, or one belonging to another organization, would otherwise open
+   * a detail view with an untitled header and empty sections. Falling back to the
+   * list is the rule for every deep-linked entity id (`sim-url-state.md`); the
+   * lingering param is harmless.
+   */
+  const isWorkspaceSelected = tab === 'workspace' && Boolean(workspace)
 
   /**
    * Per-member caps are hosted-only: the usage-limit route 404s where Sim does not
@@ -111,18 +113,31 @@ export function UsageMonitoring({ organizationId, workspaceId }: UsageMonitoring
   const canManageCredits = tab === 'member' && isHosted
 
   const summary = useOrganizationUsageSummary(organizationId, window)
-  const breakdown = useOrganizationUsageBreakdown(organizationId, window, dimension, {
-    ...(isWorkspaceDetail && workspace ? { workspaceId: workspace } : {}),
-  })
   /**
    * Kept alive in the drill-down purely to name it. The rule is to store the id and
    * derive the entity from the loaded list; arriving by click serves this from cache,
    * and arriving by deep link fetches it once.
    */
   const workspaceList = useOrganizationUsageBreakdown(organizationId, window, 'workspace', {
-    enabled: isWorkspaceDetail,
+    enabled: isWorkspaceSelected,
   })
   const workspaceName = workspaceList.data?.rows.find((row) => row.id === workspace)?.label
+  /**
+   * Resolved, not merely present — and only once the list has actually loaded, so a
+   * deep link does not flash the Workspaces tab before its own detail view.
+   */
+  const isWorkspaceDetail =
+    isWorkspaceSelected && (workspaceList.isLoading || workspaceName !== undefined)
+
+  const dimension: UsageBreakdownDimension = isOverview
+    ? 'source'
+    : isWorkspaceDetail
+      ? 'workflow'
+      : (tab as UsageBreakdownDimension)
+
+  const breakdown = useOrganizationUsageBreakdown(organizationId, window, dimension, {
+    ...(isWorkspaceDetail && workspace ? { workspaceId: workspace } : {}),
+  })
   const workspaceSources = useOrganizationUsageBreakdown(organizationId, window, 'source', {
     enabled: isWorkspaceDetail,
     ...(workspace ? { workspaceId: workspace } : {}),
@@ -247,7 +262,6 @@ export function UsageMonitoring({ organizationId, workspaceId }: UsageMonitoring
           text: 'Export',
           icon: Download,
           onSelect: () => void handleExport(),
-          disabled: summary.isLoading || summary.isError,
         },
       ]}
     >

apps/sim/lib/api/contracts/organization-usage.ts

@@ -2,6 +2,7 @@ import { z } from 'zod'
 import { organizationIdSchema, workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { INTERNAL_USAGE_LOG_SOURCES } from '@/lib/billing/usage-sources'
+import { isValidTimezone } from '@/lib/core/utils/timezone'
 
 /**
  * Organization usage monitoring (enterprise).
@@ -55,8 +56,20 @@ const organizationUsageWindowQuerySchema = z.object({
   preset: usageWindowPresetSchema,
   startDate: isoDateSchema,
   endDate: isoDateSchema,
-  /** IANA name; bucket boundaries are the viewer's calendar days. */
-  timezone: z.string().min(1, 'timezone cannot be empty').default('UTC'),
+  /**
+   * IANA name; bucket boundaries are the viewer's calendar days.
+   *
+   * Validated here rather than only at the SQL boundary. `assertValidTimezone` is a
+   * hard gate — the value reaches `AT TIME ZONE`, which takes an identifier and not
+   * a bound parameter — but it throws a plain `Error`, which surfaced as a 500 for
+   * what is an ordinary bad query param. Rejecting it as a contract violation makes
+   * it a 400 with a usable message and leaves that gate as the backstop it is.
+   */
+  timezone: z
+    .string()
+    .min(1, 'timezone cannot be empty')
+    .refine(isValidTimezone, 'Expected an IANA timezone such as America/Los_Angeles')
+    .default('UTC'),
 })
 
 export const organizationUsageSummaryQuerySchema = organizationUsageWindowQuerySchema

apps/sim/lib/api/contracts/v1/admin/organizations.ts

@@ -209,13 +209,31 @@ export const adminV1ListOrganizationsContract = defineRouteContract({
   },
 })
 
+/**
+ * Creating an organization also attaches the owner's existing workspaces, so that
+ * the organization is reachable through the workspace-scoped settings it is
+ * administered from. That attachment runs in its own transaction and can fail after
+ * the organization is already committed, so the outcome is part of the response
+ * rather than something only the logs know.
+ *
+ * `attachedWorkspaceIds` alone is ambiguous — empty means both "the owner had none"
+ * and "the attach threw" — which is why the failure carries its own flag. A caller
+ * seeing `workspaceAttachmentFailed` can retry the attachment; a caller seeing an
+ * empty list without it has nothing outstanding.
+ */
+const adminV1CreatedOrganizationSchema = adminV1OrganizationSchema.extend({
+  memberId: z.string(),
+  attachedWorkspaceIds: z.array(z.string()),
+  workspaceAttachmentFailed: z.boolean(),
+})
+
 export const adminV1CreateOrganizationContract = defineRouteContract({
   method: 'POST',
   path: '/api/v1/admin/organizations',
   body: adminV1CreateOrganizationBodySchema,
   response: {
     mode: 'json',
-    schema: adminV1SingleResponseSchema(adminV1OrganizationSchema.extend({ memberId: z.string() })),
+    schema: adminV1SingleResponseSchema(adminV1CreatedOrganizationSchema),
   },
 })
 

apps/sim/lib/billing/application/organization-usage/export-organization-usage-events.ts

@@ -3,7 +3,7 @@ import { organizationUsageOperations } from '@/lib/billing/application/organizat
 import {
   resolveUsageAnalyticsWindow,
   type UsageWindowPreset,
-  usageWindowBounds,
+  usageWindowLedgerFilter,
 } from '@/lib/billing/core/usage-analytics'
 import { getBillingEntityUsageLogs } from '@/lib/billing/core/usage-log'
 import { dollarsToCredits } from '@/lib/billing/credits/conversion'
@@ -56,18 +56,17 @@ export const exportOrganizationUsageEvents = defineAuthorizedOrganizationUsageUs
       customEnd: input.endDate,
       timezone: input.timezone,
     })
-    const bounds = usageWindowBounds(window)
+    const ledgerFilter = usageWindowLedgerFilter(window)
 
     const rows: OrganizationUsageExportRow[] = []
     let cursor: string | undefined
     let truncated = false
 
     while (rows.length < USAGE_EXPORT_SAFETY_CAP) {
       const page = await getBillingEntityUsageLogs(context.billingEntity, {
-        startDate: bounds.start,
-        endDate: bounds.end,
-        // Half-open, matching the summary and breakdowns — see `endDateExclusive`.
-        endDateExclusive: true,
+        // One derivation for both predicates, so the CSV covers exactly the rows the
+        // summary and breakdowns aggregate over.
+        ...ledgerFilter,
         ...(input.source?.length ? { source: input.source } : {}),
         limit: EXPORT_PAGE_SIZE,
         ...(cursor ? { cursor } : {}),

apps/sim/lib/billing/application/organization-usage/list-organization-usage-events.ts

@@ -3,7 +3,7 @@ import { organizationUsageOperations } from '@/lib/billing/application/organizat
 import {
   resolveUsageAnalyticsWindow,
   type UsageWindowPreset,
-  usageWindowBounds,
+  usageWindowLedgerFilter,
 } from '@/lib/billing/core/usage-analytics'
 import { getBillingEntityUsageLogs } from '@/lib/billing/core/usage-log'
 import { dollarsToCredits } from '@/lib/billing/credits/conversion'
@@ -57,13 +57,10 @@ export const listOrganizationUsageEvents = defineAuthorizedOrganizationUsageUseC
       customEnd: input.endDate,
       timezone: input.timezone,
     })
-    const bounds = usageWindowBounds(window)
-
     const result = await getBillingEntityUsageLogs(context.billingEntity, {
-      startDate: bounds.start,
-      endDate: bounds.end,
-      // Half-open, matching the summary and breakdowns — see `endDateExclusive`.
-      endDateExclusive: true,
+      // One derivation for both predicates, so this list covers exactly the rows the
+      // summary and breakdowns aggregate over.
+      ...usageWindowLedgerFilter(window),
       ...(input.source?.length ? { source: input.source } : {}),
       limit: input.limit,
       ...(input.cursor ? { cursor: input.cursor } : {}),

apps/sim/lib/billing/core/usage-analytics.test.ts

@@ -14,6 +14,7 @@ import {
   resolveUsageBucket,
   UsageWindowRangeInvertedError,
   UsageWindowRangeTooLargeError,
+  usageWindowLedgerFilter,
 } from '@/lib/billing/core/usage-analytics'
 
 const ENTITY = { type: 'organization', id: 'org-1' } as const
@@ -69,6 +70,49 @@ describe('buildUsageAnalyticsScope', () => {
   })
 })
 
+describe('usageWindowLedgerFilter', () => {
+  it('matches a stripe period on the stamps, as the aggregate does', () => {
+    // Filtering this window on `created_at` instead selects a different set — rows
+    // created inside the period but stamped to another, and vice versa — so the event
+    // list and the CSV covered different rows than the totals above them.
+    const filter = usageWindowLedgerFilter({ kind: 'period', period: period({ source: 'stripe' }) })
+    expect(filter).toEqual({
+      billingPeriod: {
+        start: new Date('2026-08-01T00:00:00.000Z'),
+        end: new Date('2026-09-01T00:00:00.000Z'),
+      },
+    })
+  })
+
+  it('matches a reporting period on created_at, as the aggregate does', () => {
+    const filter = usageWindowLedgerFilter({
+      kind: 'period',
+      period: period({ source: 'reporting', anchorDate: '2026-08-01', interval: 'month' }),
+    })
+    expect(filter.billingPeriod).toBeUndefined()
+    expect(filter.endDateExclusive).toBe(true)
+  })
+
+  it('keeps a plain range half-open', () => {
+    const from = new Date('2026-08-01T00:00:00.000Z')
+    const to = new Date('2026-08-08T00:00:00.000Z')
+    expect(usageWindowLedgerFilter({ kind: 'range', from, to })).toEqual({
+      startDate: from,
+      endDate: to,
+      endDateExclusive: true,
+    })
+  })
+
+  it('branches on the same condition the scope builder does', () => {
+    // The two predicates are only in step because they read the same discriminant.
+    for (const source of ['reporting', 'stripe', 'default'] as const) {
+      const window = { kind: 'period' as const, period: period({ source }) }
+      const usesStamps = scopeShape(window).includes('usageLog.billingPeriodStart')
+      expect(usageWindowLedgerFilter(window).billingPeriod !== undefined).toBe(usesStamps)
+    }
+  })
+})
+
 describe('resolveUsageAnalyticsWindow', () => {
   const now = new Date('2026-08-20T12:00:00.000Z')
 

apps/sim/lib/billing/core/usage-analytics.ts

@@ -99,6 +99,36 @@ export function usageWindowBounds(window: UsageAnalyticsWindow): { start: Date;
     : { start: window.period.start, end: window.period.end }
 }
 
+export interface UsageWindowLedgerFilter {
+  startDate?: Date
+  endDate?: Date
+  endDateExclusive?: boolean
+  billingPeriod?: { start: Date; end: Date }
+}
+
+/**
+ * The same window, expressed for the ledger listing query.
+ *
+ * `getBillingEntityUsageLogs` filters rows while {@link buildUsageAnalyticsScope}
+ * aggregates them, and the two must select the same set or the event list and CSV
+ * describe different rows than the totals above them. That is not hypothetical for a
+ * stripe or default period: those are matched on the *stamps* rows carry, and
+ * filtering the same window on `created_at` picks up rows created inside it but
+ * stamped to another period, while missing the reverse.
+ *
+ * Deriving both from one function is what keeps the predicates in step — the branches
+ * below mirror `buildUsageAnalyticsScope` case for case.
+ */
+export function usageWindowLedgerFilter(window: UsageAnalyticsWindow): UsageWindowLedgerFilter {
+  if (window.kind === 'range' || window.period.source === 'reporting') {
+    const { start, end } = usageWindowBounds(window)
+    // Half-open, so a row on the boundary belongs to the next window — as it does
+    // for the aggregate, whose `lt` says the same thing.
+    return { startDate: start, endDate: end, endDateExclusive: true }
+  }
+  return { billingPeriod: { start: window.period.start, end: window.period.end } }
+}
+
 export class UsageWindowRangeTooLargeError extends Error {
   constructor(days: number) {
     super(`Custom range spans ${days} days; the maximum is ${MAX_CUSTOM_RANGE_DAYS}.`)