@blamejs/blamejs-shop 0.4.87 → 0.4.89

package/lib/store-credit.js

@@ -89,6 +89,12 @@ var PRINTABLE_RE = /^[^\x00-\x1f\x7f]*$/;
 var MAX_BULK_IDS = 500;
 var MS_PER_DAY   = C.TIME.days(1);
 
+var SHA3_512_HEX_LEN = 128;
+// Genesis anchor for a customer's first ledger row. Each customer wallet
+// is its own independent chain — the first row links to ZERO, every
+// subsequent row links to the prior row's row_hash for the SAME customer.
+var ZERO_HASH = "0".repeat(SHA3_512_HEX_LEN);
+
 // ---- validators ---------------------------------------------------------
 
 function _uuid(s, label) {
@@ -137,6 +143,39 @@ function _epochMs(ts, label) {
 
 function _now() { return Date.now(); }
 
+// ---- chain hashing ------------------------------------------------------
+//
+// row_hash = SHA3-512(prev_hash || canonical-json(row-fields)), mirroring
+// shop.giftCardLedger / operator-audit-log. `b.auditChain.canonicalize`
+// (RFC 8785 walker, sorted keys, hash columns excluded) makes the preimage
+// byte-identical across deployments + node versions. Every persisted column
+// except the two hash columns participates, normalized so the write side
+// and `verifyChain` produce identical preimages for the same logical row.
+
+function _rowFieldsForHash(row) {
+  return {
+    id:                  row.id,
+    customer_id:         row.customer_id,
+    kind:                row.kind,
+    amount_minor:        Number(row.amount_minor),
+    source:              row.source == null ? null : row.source,
+    source_ref:          row.source_ref == null ? null : row.source_ref,
+    order_id:            row.order_id == null ? null : row.order_id,
+    balance_after_minor: Number(row.balance_after_minor),
+    expires_at:          row.expires_at == null ? null : Number(row.expires_at),
+    occurred_at:         Number(row.occurred_at),
+  };
+}
+
+function _computeRowHash(prevHash, rowFields) {
+  var canonical = b.auditChain.canonicalize(rowFields, ["prev_hash", "row_hash"]);
+  var preimage  = Buffer.concat([
+    Buffer.from(prevHash, "hex"),
+    Buffer.from(canonical, "utf8"),
+  ]);
+  return b.crypto.sha3Hash(preimage);
+}
+
 // ---- factory ------------------------------------------------------------
 
 function create(opts) {
@@ -151,16 +190,24 @@ function create(opts) {
   // aggregation at read time. Falls through to 0 when no rows exist
   // (a customer that has never had a ledger row has zero credit). The id
   // tie-break keeps any legacy same-millisecond rows deterministic; new
-  // writes can't tie — _writeRowAtomic computes a strictly-monotonic
-  // per-customer occurred_at inside the INSERT itself.
+  // writes can't tie — _resolveOccurredAt bumps a colliding timestamp to
+  // prior+1 app-side before the fenced INSERT. Also returns the tip's
+  // row_hash so the write path can chain off it (see _attemptChainedWrite).
   async function _readLatest(customerId) {
     var r = await query(
-      "SELECT balance_after_minor, occurred_at FROM store_credit_ledger " +
+      "SELECT balance_after_minor, occurred_at, row_hash FROM store_credit_ledger " +
       "WHERE customer_id = ?1 ORDER BY occurred_at DESC, id DESC LIMIT 1",
       [customerId],
     );
-    if (!r.rows.length) return { balance: 0, occurred_at: null };
-    return { balance: r.rows[0].balance_after_minor, occurred_at: r.rows[0].occurred_at };
+    if (!r.rows.length) return { balance: 0, occurred_at: null, row_hash: ZERO_HASH };
+    return {
+      balance:     r.rows[0].balance_after_minor,
+      occurred_at: r.rows[0].occurred_at,
+      // A legacy pre-chain row carries NULL row_hash — chain forward from
+      // ZERO so the first hashed row anchors the chain; verifyChain treats
+      // the unhashed legacy prefix as unverifiable rather than trusting it.
+      row_hash:    r.rows[0].row_hash == null ? ZERO_HASH : r.rows[0].row_hash,
+    };
   }
 
   async function _currentBalance(customerId) {
@@ -168,84 +215,101 @@ function create(opts) {
     return latest.balance;
   }
 
-  // Single-statement guarded write — the concurrency spine of the wallet.
-  // The live balance AND the strictly-monotonic per-customer occurred_at
-  // are computed by correlated subqueries INSIDE the INSERT, so two
-  // concurrent writes can never base off the same stale snapshot: the
-  // statements serialize at the database and the second sees the first's
-  // row. (A JS-side read-then-write here double-fulfilled concurrent
-  // debits and silently dropped one of two same-millisecond credits.)
-  // `kind` selects the guard + arithmetic:
-  //   credit — balance_after = live + amount, no balance gate (the in-SQL
-  //            occurred_at is what closes the same-millisecond tie);
-  //   debit  — balance_after = live - amount, gated on live >= amount
-  //            (zero rows = insufficient, or lost the race — same refusal);
-  //   expire — burns MIN(amount, live), gated on live > 0 (zero rows =
-  //            wallet already empty; callers degrade gracefully — by
-  //            design, never a throw).
-  //   sweep  — the scheduled expiry burn. `amount` carries the
-  //            customer's expired-credit total; the still-unburned
-  //            remainder (total minus the live SUM of prior
-  //            SWEEP_SOURCE_REF expire rows) is recomputed INSIDE the
-  //            insert and capped at the live balance, so two concurrent
-  //            sweeps can't both burn the same expired pool. The second
-  //            sweep serializes behind the first's committed row, sees
-  //            zero pending, and matches no rows — never burning the
-  //            still-valid (non-expired) credit left in the wallet.
-  //            Stored as an `expire` row stamped SWEEP_SOURCE_REF.
-  // Returns the written row's resolved values, or null when the guard
-  // refused the write.
-  async function _writeRowAtomic(kind, customerId, amount, source, sourceRef, orderId, expiresAt, requestedTs) {
+  // Strictly-monotonic per-customer occurred_at: a write at or before the
+  // prior row's timestamp is bumped to prior+1, so the denormalized
+  // balance_after snapshot is unambiguous on read. A backdated operator
+  // write still lands at the requested time when there's no collision.
+  function _resolveOccurredAt(requestedTs, latestTs) {
+    if (latestTs == null) return requestedTs;
+    if (requestedTs > latestTs) return requestedTs;
+    return latestTs + 1;
+  }
+
+  // How many times a writer re-derives the chain tip when the parent fence
+  // refuses its INSERT (another write landed first). Each fence round lets
+  // exactly ONE racing writer win, so a burst of N concurrent writes to the
+  // SAME customer needs up to N rounds — the cap is sized well beyond any
+  // realistic same-wallet fan-in (an admin grant + the scheduled expiry
+  // sweep + a checkout debit racing at once) so a legitimate burst is never
+  // dropped with STORE_CREDIT_CONTENTION. A genuine non-collision insert
+  // error re-throws on the first attempt (see _attemptChainedWrite), so a
+  // high cap never spins on a real failure.
+  var CHAIN_WRITE_ATTEMPTS = 64;
+
+  // One fenced write against the tip the caller just read. The live balance
+  // AND the strictly-monotonic occurred_at are computed APP-SIDE and bound
+  // explicitly, together with prev_hash + row_hash so every row participates
+  // in the per-customer hash chain. What makes the app-computed values safe
+  // is the chain-parent fence UNIQUE(customer_id, prev_hash) (migration
+  // 0236): a write derived from a STALE tip collides at the constraint
+  // instead of forking the chain or persisting a balance computed off a
+  // stale snapshot — the caller re-reads and retries. The debit overdraft
+  // gate stays INSIDE the statement (the correlated subquery, never a
+  // JS-side check): with the fence it is defense-in-depth, and it is what
+  // turns a genuine overdraft into a zero-row refusal rather than a retry
+  // loop.
+  //
+  // Collision detection is STATE-AGNOSTIC, never error-message matching:
+  // the production D1 service-binding redacts the SQLite "UNIQUE constraint
+  // failed" text to a generic "HTTP 500", so on ANY insert error we re-read
+  // the tip — if it advanced past the parent we tried to chain off, a
+  // competing write claimed our slot (a genuine fence collision) and we
+  // retry; if the tip is unchanged the insert failed for another reason, so
+  // we re-throw. Returns one of { written }, { refused } (the guard said no
+  // against the live tip), or { collided } (tip moved — retry).
+  async function _attemptChainedWrite(customerId, kind, latest, d) {
     var id = b.uuid.v7();
     var storedKind = kind === "sweep" ? "expire" : kind;
+    var rowHash = _computeRowHash(latest.row_hash, _rowFieldsForHash({
+      id:                  id,
+      customer_id:         customerId,
+      kind:                storedKind,
+      amount_minor:        d.amount,
+      source:              d.source,
+      source_ref:          d.sourceRef,
+      order_id:            d.orderId,
+      balance_after_minor: d.after,
+      expires_at:          d.expiresAt,
+      occurred_at:         d.ts,
+    }));
     var balSub = "COALESCE((SELECT balance_after_minor FROM store_credit_ledger " +
                  "WHERE customer_id = ?2 ORDER BY occurred_at DESC, id DESC LIMIT 1), 0)";
-    var tsSub  = "COALESCE((SELECT occurred_at FROM store_credit_ledger " +
-                 "WHERE customer_id = ?2 ORDER BY occurred_at DESC, id DESC LIMIT 1), 0)";
-    var tsExpr = "CASE WHEN ?8 > " + tsSub + " THEN ?8 ELSE " + tsSub + " + 1 END";
-    var amountExpr, afterExpr, guard;
-    if (kind === "credit") {
-      amountExpr = "?3";
-      afterExpr  = balSub + " + ?3";
-      guard      = "1";
-    } else if (kind === "debit") {
-      amountExpr = "?3";
-      afterExpr  = balSub + " - ?3";
-      guard      = balSub + " >= ?3";
-    } else if (kind === "sweep") {
-      // `?3` is this customer's expired-credit total. Subtract the live
-      // sum of prior sweep-stamped expire rows to get the still-pending
-      // burn, then cap at the live balance — both recomputed at INSERT
-      // time so a racing second sweep sees the first's committed row.
-      var sweptSub = "COALESCE((SELECT SUM(amount_minor) FROM store_credit_ledger " +
-                     "WHERE customer_id = ?2 AND kind = 'expire' AND source_ref = ?5), 0)";
-      var pending  = "(?3 - " + sweptSub + ")";
-      amountExpr   = "CASE WHEN " + balSub + " < " + pending + " THEN " + balSub + " ELSE " + pending + " END";
-      afterExpr    = "CASE WHEN " + balSub + " < " + pending + " THEN 0 ELSE " + balSub + " - " + pending + " END";
-      guard        = pending + " > 0 AND " + balSub + " > 0";
-    } else {            // expire — burn MIN(amount, live balance)
-      amountExpr = "CASE WHEN " + balSub + " < ?3 THEN " + balSub + " ELSE ?3 END";
-      afterExpr  = "CASE WHEN " + balSub + " < ?3 THEN 0 ELSE " + balSub + " - ?3 END";
-      guard      = balSub + " > 0";
+    try {
+      var res = await query(
+        "INSERT INTO store_credit_ledger " +
+        "(id, customer_id, kind, amount_minor, source, source_ref, order_id, balance_after_minor, expires_at, occurred_at, prev_hash, row_hash) " +
+        "SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12 " +
+        "WHERE " + (d.guarded ? balSub + " >= ?4" : "1"),
+        [id, customerId, storedKind, d.amount, d.source, d.sourceRef, d.orderId, d.after, d.expiresAt, d.ts, latest.row_hash, rowHash],
+      );
+      if (Number(res.rowCount || 0) === 0) return { refused: true };
+      return { written: { id: id, amount_minor: d.amount, balance_after_minor: d.after, occurred_at: d.ts } };
+    } catch (e) {
+      var after = await _readLatest(customerId);
+      if (after.row_hash !== latest.row_hash) return { collided: true };
+      throw e;
     }
-    var res = await query(
-      "INSERT INTO store_credit_ledger " +
-      "(id, customer_id, kind, amount_minor, source, source_ref, order_id, balance_after_minor, expires_at, occurred_at) " +
-      "SELECT ?1, ?2, ?9, " + amountExpr + ", ?4, ?5, ?6, " + afterExpr + ", ?7, " + tsExpr + " " +
-      "WHERE " + guard,
-      [id, customerId, amount, source, sourceRef, orderId, expiresAt, requestedTs, storedKind],
-    );
-    if (Number(res.rowCount || 0) === 0) return null;
-    var row = (await query(
-      "SELECT amount_minor, balance_after_minor, occurred_at FROM store_credit_ledger WHERE id = ?1",
-      [id],
-    )).rows[0];
-    return {
-      id:                  id,
-      amount_minor:        row.amount_minor,
-      balance_after_minor: row.balance_after_minor,
-      occurred_at:         row.occurred_at,
-    };
+  }
+
+  // Run a chained write with bounded tip-contention retries. `derive` maps
+  // the freshly-read tip to the attempt's concrete fields (it may be async —
+  // the sweep reads its prior-burn sum inside), or returns { noop: true }
+  // for a write that degrades gracefully on an empty / already-settled
+  // wallet. Each fence collision re-reads the tip and re-derives, so the
+  // values that land are always consistent with the parent they chain off.
+  async function _writeChained(customerId, kind, derive) {
+    for (var attempt = 0; attempt < CHAIN_WRITE_ATTEMPTS; attempt += 1) {
+      var latest = await _readLatest(customerId);
+      var d = await derive(latest);
+      if (d.noop) return { noop: true, balance: latest.balance };
+      var r = await _attemptChainedWrite(customerId, kind, latest, d);
+      if (r.collided) continue;
+      if (r.refused) return { refused: true };
+      return r.written;
+    }
+    var contention = new Error("storeCredit." + kind + ": persistent chain-tip contention — retry the write");
+    contention.code = "STORE_CREDIT_CONTENTION";
+    throw contention;
   }
 
   return {
@@ -264,7 +328,18 @@ function create(opts) {
       var requested  = _epochMs(input.occurred_at, "occurred_at");
       if (requested == null) requested = _now();
 
-      var w = await _writeRowAtomic("credit", customerId, amount, source, sourceRef, null, expiresAt, requested);
+      var w = await _writeChained(customerId, "credit", function (latest) {
+        return {
+          amount:    amount,
+          source:    source,
+          sourceRef: sourceRef,
+          orderId:   null,
+          expiresAt: expiresAt,
+          after:     latest.balance + amount,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   false,
+        };
+      });
 
       return {
         id:                  w.id,
@@ -289,11 +364,23 @@ function create(opts) {
       var requested  = _epochMs(input.occurred_at, "occurred_at");
       if (requested == null) requested = _now();
 
-      // The balance gate lives INSIDE the insert — a refused write covers
-      // both "always insufficient" and "a concurrent debit drained it
-      // first", with no window between check and write.
-      var w = await _writeRowAtomic("debit", customerId, amount, null, null, orderId, null, requested);
-      if (!w) {
+      // The balance gate lives INSIDE the insert (defense-in-depth behind
+      // the chain-parent fence) — a refused write covers both "always
+      // insufficient" and "a concurrent debit drained it first", with no
+      // window between check and write.
+      var w = await _writeChained(customerId, "debit", function (latest) {
+        return {
+          amount:    amount,
+          source:    null,
+          sourceRef: null,
+          orderId:   orderId,
+          expiresAt: null,
+          after:     latest.balance - amount,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   true,
+        };
+      });
+      if (w.refused) {
         var insufficient = new Error("storeCredit.debit: amount exceeds available balance");
         insufficient.code = "STORE_CREDIT_INSUFFICIENT_BALANCE";
         throw insufficient;
@@ -334,8 +421,24 @@ function create(opts) {
       // already at zero) is the structured no-op below, never a throw —
       // by design: a no-op expire is a valid outcome of a bulk sweep,
       // and a zero-amount row would violate CHECK(amount_minor > 0).
-      var w = await _writeRowAtomic("expire", customerId, amount, null, reason, null, null, requested);
-      if (!w) {
+      var w = await _writeChained(customerId, "expire", function (latest) {
+        var burn = amount > latest.balance ? latest.balance : amount;
+        // An empty wallet is the structured no-op below, never a throw —
+        // a zero-amount row would violate CHECK(amount_minor > 0), and a
+        // no-op expire is a valid outcome of a bulk sweep.
+        if (burn === 0) return { noop: true };
+        return {
+          amount:    burn,
+          source:    null,
+          sourceRef: reason,
+          orderId:   null,
+          expiresAt: null,
+          after:     latest.balance - burn,
+          ts:        _resolveOccurredAt(requested, latest.occurred_at),
+          guarded:   false,
+        };
+      });
+      if (w.noop) {
         return {
           id:                  null,
           customer_id:         customerId,
@@ -343,7 +446,7 @@ function create(opts) {
           amount_minor:        0,
           requested_minor:     amount,
           reason:              reason,
-          balance_after_minor: await _currentBalance(customerId),
+          balance_after_minor: w.balance,
           occurred_at:         requested,
           noop:                true,
         };
@@ -368,6 +471,124 @@ function create(opts) {
       return { customer_id: customerId, balance_minor: bal };
     },
 
+    // Recompute one customer's hash chain and flag the first divergence —
+    // the tamper-evidence READ side of the chain the writers maintain.
+    // Walks the wallet's rows in (occurred_at, id) order; rows from before
+    // the chain columns existed (NULL row_hash) are tolerated as an
+    // unverifiable legacy PREFIX, but once a hashed row anchors, every
+    // later row must link — an unhashed row after the anchor, a prev_hash
+    // that doesn't name its parent, or a row_hash that doesn't recompute is
+    // a break. A populated ledger that never anchors (every row NULL-hashed
+    // — the shape a full-ledger rewrite leaves behind) fails as unanchored;
+    // an empty ledger is the only no-anchor case that passes. O(n) per
+    // customer; operator-audit use, not hot-path.
+    //
+    // Optional trusted anchor (opts.anchor = { count, head }) — the ONLY
+    // way to detect a TAIL TRUNCATION (deleting the most-recent rows) or a
+    // whole-chain replacement, since an append-only chain stays internally
+    // consistent after its tail is removed (a deleted latest debit makes
+    // balance() revert while the remaining prefix still links). The caller
+    // supplies a count + head captured from a trusted prior snapshot of this
+    // same result (count = total_rows, head = last_hash) — a periodic
+    // operator checkpoint or an out-of-band monitor. The chain row at index
+    // count-1 must still carry that head hash, so a truncation BELOW the
+    // snapshot is caught even after later valid appends. Without an anchor
+    // this verifies INTERNAL consistency only and reports
+    // anchor_checked:false so the caller knows truncation was not ruled out
+    // (operator-audit-log closes the same gap with signed checkpoints).
+    verifyChain: async function (customerId, opts) {
+      _uuid(customerId, "customer_id");
+      opts = opts || {};
+      var anchor = null;
+      if (opts.anchor != null) {
+        if (typeof opts.anchor !== "object"
+            || typeof opts.anchor.count !== "number" || !Number.isInteger(opts.anchor.count) || opts.anchor.count < 1
+            || typeof opts.anchor.head !== "string" || opts.anchor.head.length !== SHA3_512_HEX_LEN) {
+          throw new TypeError("storeCredit.verifyChain: anchor must be { count: positive integer, head: " + SHA3_512_HEX_LEN + "-hex-char string }");
+        }
+        anchor = opts.anchor;
+      }
+      var r = await query(
+        "SELECT * FROM store_credit_ledger WHERE customer_id = ?1 " +
+        "ORDER BY occurred_at ASC, id ASC",
+        [customerId],
+      );
+      var rows = r.rows;
+      var legacyPrefix = 0;
+      var anchored = false;
+      var prevHash = ZERO_HASH;
+      for (var i = 0; i < rows.length; i += 1) {
+        var row = rows[i];
+        if (!anchored && row.row_hash == null) { legacyPrefix += 1; continue; }
+        anchored = true;
+        var breakBase = {
+          ok:            false,
+          rows_verified: i - legacyPrefix,
+          legacy_prefix: legacyPrefix,
+          break_at:      i,
+          break_row_id:  row.id,
+        };
+        if (row.row_hash == null) {
+          return Object.assign(breakBase, { reason: "unhashed row after chain anchor" });
+        }
+        if (row.prev_hash !== prevHash) {
+          return Object.assign(breakBase, { reason: "prev_hash mismatch", expected: prevHash, actual: row.prev_hash });
+        }
+        var computed = _computeRowHash(prevHash, _rowFieldsForHash(row));
+        if (computed !== row.row_hash) {
+          return Object.assign(breakBase, { reason: "row_hash mismatch", expected: computed, actual: row.row_hash });
+        }
+        prevHash = row.row_hash;
+      }
+      if (!anchored && rows.length > 0) {
+        return {
+          ok:            false,
+          rows_verified: 0,
+          legacy_prefix: legacyPrefix,
+          break_at:      0,
+          break_row_id:  rows[0].id,
+          reason:        "unanchored chain (no hashed row in a populated ledger)",
+        };
+      }
+      // Internal walk is clean. With a trusted anchor, also rule out a tail
+      // truncation below the snapshot: the row at the snapshot's position
+      // must still carry the snapshot's head hash (it survives later valid
+      // appends), and the chain must not be shorter than the snapshot.
+      if (anchor) {
+        if (rows.length < anchor.count) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "row count below anchor (possible tail truncation)",
+            expected_count: anchor.count,
+            actual_count:   rows.length,
+          };
+        }
+        var anchorRow = rows[anchor.count - 1];
+        if (!anchorRow || anchorRow.row_hash !== anchor.head) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "anchor row hash mismatch (possible tail truncation or divergence)",
+            expected:       anchor.head,
+            actual:         anchorRow ? anchorRow.row_hash : null,
+          };
+        }
+      }
+      return {
+        ok:             true,
+        rows_verified:  rows.length - legacyPrefix,
+        legacy_prefix:  legacyPrefix,
+        total_rows:     rows.length,
+        last_hash:      prevHash,
+        anchor_checked: anchor != null,
+      };
+    },
+
     history: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("storeCredit.history: input object required");
@@ -639,8 +860,38 @@ function create(opts) {
         // expired credits are "first-out" from the operator's POV — the
         // schema doesn't track FIFO at row level, so the audit trail
         // reflects what was actually burned.
-        var w = await _writeRowAtomic("sweep", customerId, expiredTotal, null, SWEEP_SOURCE_REF, null, null, now);
-        if (!w) continue;
+        var w = await _writeChained(customerId, "sweep", async function (latest) {
+          // Pending burn = this customer's expired-credit total minus the
+          // sweep's OWN prior output (expire rows stamped SWEEP_SOURCE_REF),
+          // capped at the live balance. The prior-burn sum is read INSIDE
+          // the derive so a fence retry recomputes it against the committed
+          // tip: a racing second sweep collides, re-reads a now-nonzero
+          // swept sum, sees zero pending, and no-ops — never burning the
+          // still-valid (non-expired) credit the first sweep left behind.
+          // Operator expires + debits already reduced the balance; the
+          // balance cap is what keeps the sweep from over-burning a partly
+          // drained wallet, so they must not also be netted out of the
+          // expired pool (only this sweep's own output is).
+          var sweptRow = (await query(
+            "SELECT COALESCE(SUM(amount_minor), 0) AS swept FROM store_credit_ledger " +
+            "WHERE customer_id = ?1 AND kind = 'expire' AND source_ref = ?2",
+            [customerId, SWEEP_SOURCE_REF],
+          )).rows[0];
+          var pending = expiredTotal - Number(sweptRow.swept || 0);
+          if (pending <= 0 || latest.balance <= 0) return { noop: true };
+          var burn = pending > latest.balance ? latest.balance : pending;
+          return {
+            amount:    burn,
+            source:    null,
+            sourceRef: SWEEP_SOURCE_REF,
+            orderId:   null,
+            expiresAt: null,
+            after:     latest.balance - burn,
+            ts:        _resolveOccurredAt(now, latest.occurred_at),
+            guarded:   false,
+          };
+        });
+        if (!w || w.noop || w.refused) continue;
         processed.push({
           id:                  w.id,
           customer_id:         customerId,