fix(byok): keep an abandoned entitlement producer from writing the cache

coalesceLocally does not cancel a producer it timed out — its docstring says so
explicitly — so writing the cache from inside the producer let a late billing
result overwrite a fresher answer a retry had already cached, and hold it for a
full TTL.

Move the write onto the value the caller actually received. A caller that timed
out throws before reaching it, so an abandoned producer now resolves into
nothing. The test reproduces the overwrite and fails against the previous shape.

Reported by Cursor Bugbot.

Author: icecrasher321

apps/sim/lib/api-key/byok-entitlement.test.ts

@@ -128,6 +128,33 @@ describe('organization BYOK entitlement', () => {
     expect(mockResolveOrganizationPlan).toHaveBeenCalledTimes(2)
   })
 
+  /**
+   * `coalesceLocally` does not cancel a producer it timed out, so a write from
+   * inside the producer could land after a retry cached a fresher answer and
+   * overwrite it for a full TTL. Keeping the write on the value the caller
+   * received means an abandoned producer resolves into nothing.
+   */
+  it('ignores a producer that settles after its caller gave up', async () => {
+    let releaseAbandoned: (value: boolean) => void = () => {}
+    mockResolveOrganizationPlan.mockReturnValueOnce(
+      new Promise<boolean>((resolve) => {
+        releaseAbandoned = resolve
+      })
+    )
+
+    const abandoned = isOrganizationBYOKEntitledCached(ORGANIZATION_ID)
+    abandoned.catch(() => {})
+    __resetCoalesceLocallyForTests()
+
+    mockResolveOrganizationPlan.mockResolvedValue(false)
+    await expect(isOrganizationBYOKEntitledCached(ORGANIZATION_ID)).resolves.toBe(false)
+
+    releaseAbandoned(true)
+    await Promise.resolve()
+
+    await expect(isOrganizationBYOKEntitledCached(ORGANIZATION_ID)).resolves.toBe(false)
+  })
+
   it('never consults billing off hosted, on either path', async () => {
     mockIsHosted.value = false
 

apps/sim/lib/api-key/byok-entitlement.ts

@@ -54,29 +54,34 @@ export async function isOrganizationBYOKEntitled(organizationId: string): Promis
  * plan change to appear, which is true of a workflow run and false of the
  * settings page.
  */
-export function isOrganizationBYOKEntitledCached(organizationId: string): Promise<boolean> {
-  if (!isHosted) return Promise.resolve(false)
+export async function isOrganizationBYOKEntitledCached(organizationId: string): Promise<boolean> {
+  if (!isHosted) return false
 
   const cached = entitlementCache.get(organizationId)
-  if (cached !== undefined) return Promise.resolve(cached)
+  if (cached !== undefined) return cached
 
   /**
-   * `coalesceLocally` around a read-through cache is the shape
-   * `oauth/credential-service.ts` uses. It collapses a parallel or loop block's
-   * N simultaneous misses onto one resolution, and — unlike caching the promise
-   * directly — bounds a *hung* billing read at its settle deadline instead of
-   * wedging every caller for the whole TTL.
+   * `coalesceLocally` collapses a parallel or loop block's N simultaneous
+   * misses onto one resolution, and bounds a *hung* billing read at its settle
+   * deadline rather than wedging every caller for the whole TTL.
    *
-   * Writing the cache only on the success path is what keeps a momentary
-   * outage from being recorded as a plan lapse; `onError: 'throw'` is what
-   * makes that outage distinguishable, since the resolver otherwise maps a
-   * failed read to `false` exactly like a real lapse.
+   * The cache write stays out here, on the value this caller actually received,
+   * rather than inside the producer. `coalesceLocally` does not cancel a
+   * producer it timed out — it keeps running detached — so a write from inside
+   * could land after a retry already cached a fresher answer and overwrite it
+   * for a full TTL. A caller that timed out throws instead of reaching this
+   * line, and the abandoned producer resolves into nothing.
+   *
+   * Only reaching the write on success is also what keeps a momentary outage
+   * from being recorded as a plan lapse; `onError: 'throw'` is what makes that
+   * outage distinguishable, since the resolver otherwise maps a failed read to
+   * `false` exactly like a real lapse.
    */
-  return coalesceLocally(`byok-entitlement:${organizationId}`, async () => {
-    const entitled = await resolveOrganizationPlan(organizationId, { onError: 'throw' })
-    entitlementCache.set(organizationId, entitled)
-    return entitled
-  })
+  const entitled = await coalesceLocally(`byok-entitlement:${organizationId}`, () =>
+    resolveOrganizationPlan(organizationId, { onError: 'throw' })
+  )
+  entitlementCache.set(organizationId, entitled)
+  return entitled
 }
 
 /**