@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/lib/api-lane/webhook-crypto.js

@@ -0,0 +1,103 @@
+/**
+ * Webhook secrets and signatures (Go Prod §4.5, §6.1; the wire contract is
+ * src/contracts/webhooks.ts). Pure Web Crypto, no I/O.
+ *
+ * Signing: `Oracle-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>`, one
+ * `v1=` per live secret while a rotation overlaps. The key is the secret string as sent to the
+ * receiver (`whsec_…`, prefix included) — what a receiver holds is exactly what it verifies with.
+ *
+ * At rest (`webhook_endpoints.secretCiphertext`): AES-256-GCM under a key derived from
+ * `WEBHOOK_ENCRYPTION_KEY` (SHA-256 of it), stored `v1:<base64url(iv ‖ ciphertext)>`. `v1:` names
+ * the FORMAT; there is one key, so rotating `WEBHOOK_ENCRYPTION_KEY` (§14) means re-encrypting every
+ * row under the new key in the same change — a second, previous-key slot is the follow-up if a
+ * zero-downtime rotation is ever needed.
+ * A secret must be recoverable to sign with, which is why it is encrypted and not hashed.
+ *
+ * The same sealing (`sealText` / `openText`, same key, same `v1:` format) keeps every other bearer
+ * credential the oracle must be able to use again: a verified `PAYMENT-SIGNATURE` (it embeds the
+ * payer's reusable payment delegation, payments/header-seal.ts) and a source's stored review-billing
+ * delegation (payments/review-billing.ts). One key, one format, one rotation.
+ */
+import { ORACLE_SIGNATURE_FORMAT } from "../../contracts/index.js";
+const encoder = new TextEncoder();
+const VERSION = "v1";
+const hex = (bytes) => [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+// Byte by byte, never `String.fromCharCode(...bytes)`: a sealed payment delegation is tens of KB,
+// past what a spread may pass as arguments.
+const b64url = (bytes) => {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+};
+const fromB64url = (text) => Uint8Array.from(atob(text.replaceAll("-", "+").replaceAll("_", "/")), (c) => c.charCodeAt(0));
+/**
+ * A fresh `whsec_` secret in the contract's alphabet (`[0-9A-Za-z]{32,}`): 40 base62 chars, about
+ * 238 bits — the modulo bias of 256 over 62 costs a fraction of a bit at this length.
+ */
+export function newWebhookSecret() {
+    const alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+    const bytes = crypto.getRandomValues(new Uint8Array(40));
+    return `whsec_${[...bytes].map((b) => alphabet[b % 62]).join("")}`;
+}
+async function hmacHex(secret, message) {
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return hex(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+}
+/** The `Oracle-Signature` value for one POST body, signed by every live secret. */
+export async function signatureHeader(secrets, body, t) {
+    const macs = await Promise.all(secrets.map((s) => hmacHex(s, `${t}.${body}`)));
+    return [`t=${t}`, ...macs.map((m) => `v1=${m}`)].join(",");
+}
+/**
+ * The receiver's check (§4.5), exactly as S7's SDK implements it: the header parses, `t` is within
+ * `toleranceSec` of `now`, and some `v1` equals the MAC under `secret` (constant-time compare).
+ * Here for the tests and the "send test event" route; the oracle never receives its own webhooks.
+ */
+export async function verifySignature(header, body, secret, nowSec, toleranceSec = 300) {
+    if (!ORACLE_SIGNATURE_FORMAT.test(header))
+        return false;
+    const parts = header.split(",");
+    const t = Number(parts[0]?.slice(2));
+    if (Math.abs(nowSec - t) > toleranceSec)
+        return false;
+    const expected = await hmacHex(secret, `${t}.${body}`);
+    return parts.slice(1).some((p) => timingSafeEqual(p.slice(3), expected));
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+async function aesKey(encryptionKey) {
+    const raw = await crypto.subtle.digest("SHA-256", encoder.encode(encryptionKey));
+    return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+/** Any text → `v1:<base64url(iv ‖ ciphertext)>`, AES-256-GCM under `WEBHOOK_ENCRYPTION_KEY`. */
+export async function sealText(plain, encryptionKey) {
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const sealed = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await aesKey(encryptionKey), encoder.encode(plain)));
+    const out = new Uint8Array(iv.length + sealed.length);
+    out.set(iv);
+    out.set(sealed, iv.length);
+    return `${VERSION}:${b64url(out)}`;
+}
+/** The inverse; throws on a wrong key, a tampered row or an unknown format. */
+export async function openText(stored, encryptionKey) {
+    const [version, payload] = stored.split(":", 2);
+    if (version !== VERSION || !payload)
+        throw new Error(`Unknown sealed format ${version}`);
+    const bytes = fromB64url(payload);
+    const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bytes.slice(0, 12) }, await aesKey(encryptionKey), bytes.slice(12));
+    return new TextDecoder().decode(plain);
+}
+/** Whether `stored` is sealed (`v1:…`) — a base64 header or CAR never contains a `:`. */
+export const isSealed = (stored) => stored.startsWith(`${VERSION}:`);
+/** `whsec_…` → `v1:<base64url(iv ‖ ciphertext)>` for `webhook_endpoints.secretCiphertext`. */
+export const encryptWebhookSecret = sealText;
+/** The inverse; throws on a wrong key, a tampered row or an unknown key version. */
+export const decryptWebhookSecret = openText;
+//# sourceMappingURL=webhook-crypto.js.map

package/dist/lib/api-lane/webhook-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-crypto.js","sourceRoot":"","sources":["../../../src/lib/api-lane/webhook-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,MAAM,GAAG,GAAG,CAAC,KAAkB,EAAE,EAAE,CACjC,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAElF,kGAAkG;AAClG,4CAA4C;AAC5C,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAE,EAAE;IACnC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAClC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,gEAAgE,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0B,EAC1B,IAAY,EACZ,CAAS;IAET,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,IAAY,EACZ,MAAc,EACd,MAAc,EACd,YAAY,GAAG,GAAG;IAElB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,YAAY;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,aAAqB;IACzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,aAAqB;IACjE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,MAAM,MAAM,CAAC,aAAa,CAAC,EAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CACtB,CACF,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,aAAqB;IAClE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACvC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAC3C,MAAM,MAAM,CAAC,aAAa,CAAC,EAC3B,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAChB,CAAC;IACF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;AAEtF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,oFAAoF;AACpF,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC"}

package/dist/lib/api-lane/webhooks.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Webhook delivery (Go Prod §4.5, App. B; the wire is src/contracts/webhooks.ts). At-least-once: an
+ * event is ENQUEUED first — one `matrix_deliveries` row per target (`kind: webhook`,
+ * `wh:<eventId>:<endpointId|claim>`), the signed envelope frozen on it — and only then attempted,
+ * so a crash between the two leaves a row the retry cron finds (`nextAttemptAt = now`). Every
+ * attempt posts the row's own payload, so every retry carries the bytes `Oracle-Event-Id` promised.
+ *
+ * Targets: every active endpoint of the source subscribed to the type (`events` empty = all), and
+ * for `claim.*` the claim's own `webhookUrl` or else the source's default — whether or not any
+ * endpoint subscribes, and skipped only when it is exactly a subscribed endpoint's URL (one post,
+ * the endpoint's). The two without an endpoint are signed with the SOURCE's own signing secret (contracts v1.1 —
+ * plus the rotated-out one for its 24 h overlap); a source created before v1.1 has none until an
+ * owner rotates, so such a delivery is `dead` at once rather than posted unsigned.
+ *
+ * Schedule: 8 attempts over 24 h — at once, then 1 min, 5 min, 30 min, 2 h, 6 h, 12 h and 24 h
+ * after the first — then `dead` (the dead-letter the portal shows; `redeliver` re-queues). A
+ * receiver answering anything but 2xx within 10 s is a failed attempt; up to 3 redirects are
+ * followed, every hop held to https, a public host and the endpoint's own origin, the POST re-sent
+ * as a POST (§14) — a hop elsewhere is refused and the delivery `dead`. An endpoint's URL edit retargets its
+ * queued rows (the PATCH, in one batch); a redeliver re-reads its target — the endpoint's URL, the
+ * claim's `webhookUrl` or the source's CURRENT default — so a signed event never goes on posting to
+ * a URL its owner moved away from; a sent row's log keeps where it went. A disabled or deleted
+ * endpoint gets nothing more: its queued rows go `dead`, and a redeliver of one is refused.
+ */
+import type { Config } from "../../config.js";
+import { type WebhookEventType } from "../../contracts/index.js";
+import type { Database } from "../../db/client.js";
+import { type MatrixDelivery } from "../../db/schema.js";
+import type { Logger } from "../logger.js";
+import type { Metrics } from "../metrics.js";
+import type { ChargeTerms } from "../payments/terms.js";
+import { type AlertDeps } from "../sentry.js";
+export interface WebhookDeps extends AlertDeps {
+    db: Database;
+    config: Pick<Config, "WEBHOOK_ENCRYPTION_KEY"> & AlertDeps["config"];
+    logger: Logger;
+    metrics: Metrics;
+}
+/** Due deliveries per retry tick — bounded like the scan, so one tick never runs long. */
+export declare const WEBHOOK_BATCH = 50;
+export interface WebhookEvent {
+    eventId: string;
+    type: WebhookEventType;
+    createdAt: Date;
+    sourceId: string;
+    /** Null for `source.*`, `balance.low`. */
+    claimId: string | null;
+    data: unknown;
+    /** `claim.*` only: the claim's own `webhookUrl`. */
+    claimWebhookUrl?: string | null;
+    /** Deliver to this one endpoint and nowhere else (the "send test event" button). */
+    onlyEndpointId?: string;
+}
+/**
+ * Freeze the envelope onto one row per target (`onConflictDoNothing`: an event enqueued twice
+ * lands once); the keys of every row the event has, new or not.
+ */
+export declare function enqueueWebhook(db: Database, event: WebhookEvent): Promise<string[]>;
+type Outcome = "sent" | "failed" | "dead" | "skipped";
+/**
+ * One attempt of one row, if it is owed one now. The row is LEASED first — one conditional UPDATE
+ * that pushes `nextAttemptAt` past the attempt's own worst case — so an overlapping tick, the notify
+ * step's inline attempt and a redeliver can never post the same row at once; whoever lost the
+ * UPDATE skips. The attempt's outcome is then written only over that lease (`attempts` unchanged).
+ * Never throws: whatever goes wrong is this row's failed attempt, not the caller's.
+ */
+export declare function deliverWebhook(deps: WebhookDeps, dedupeKey: string): Promise<Outcome>;
+/**
+ * The retry cron (every minute): the due rows, oldest due first, attempted a few at a time — each
+ * behind its own lease, so a tick that overlaps the last one only takes what nobody holds.
+ */
+export declare function deliverDueWebhooks(deps: WebhookDeps, now?: Date): Promise<number>;
+/** Attempt rows `PARALLEL` at a time — bounded, so one tick or one notify step stays short. */
+export declare function deliverAll(deps: WebhookDeps, keys: readonly string[]): Promise<void>;
+/** Why a redeliver is refused before anything is reset (the route answers 409 with it as
+ *  `details.reason`): the endpoint the row was for is gone or switched off — its owner stopped
+ *  receiving there — or a default-URL row's source has no default URL any more. */
+export type RedeliverRefusal = "endpoint-deleted" | "endpoint-disabled" | "no-webhook-url";
+/**
+ * `POST …/deliveries/:id/redeliver`: the same row back to the start of the ladder, attempted now,
+ * to where its target points NOW — an endpoint's row to the endpoint's current URL, a claim-URL row
+ * to the claim's `webhookUrl`, a default-URL row to the source's current default (both signed with
+ * the source's secret at attempt, as the original was). Null when the delivery is not this
+ * source's (the route answers 404); a `RedeliverRefusal` leaves the row as it was.
+ */
+export declare function redeliverWebhook(deps: WebhookDeps, sourceId: string, deliveryId: string): Promise<MatrixDelivery | RedeliverRefusal | null>;
+/**
+ * `POST /v1/api/webhooks/:endpointId/test` (§4.5): one signed `claim.decided` with sample data to
+ * that endpoint alone, attempted now and logged like any delivery. `not_found` when the endpoint
+ * is not this source's (404); `disabled` when it is switched off (409 — enable it first).
+ */
+export declare function sendTestEvent(deps: WebhookDeps, sourceId: string, endpointId: string): Promise<MatrixDelivery | "not_found" | "disabled">;
+/**
+ * `payment.settled` (App. B) for S4's settle on the receipt: on the claim's timeline (`paid`) and to
+ * the source's subscribed endpoints. Called once per claim — on the settle that moved its charge
+ * off `reserved` (lib/payments/settle.ts); a replay announces nothing new.
+ */
+export declare function emitPaymentSettled(db: Database, charge: {
+    claimId: string;
+    sourceId: string;
+    settlementId: string;
+    /** What it was paid in (lib/payments/terms.ts): PAY or card. */
+    terms: ChargeTerms;
+    settledAt: Date;
+}): Promise<void>;
+/**
+ * `balance.low` (App. B, §12.4) for S4's balance watch: one per crossing — `crossedAt` is the
+ * `api_sources.balanceLowAt` it stamped, so a watch tick that repeats the same crossing lands once.
+ */
+export declare function emitBalanceLow(db: Database, low: {
+    sourceId: string;
+    balanceCents: number;
+    floorCents: number;
+    crossedAt: Date;
+}): Promise<void>;
+export {};
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/lib/api-lane/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../src/lib/api-lane/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAOL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAGL,KAAK,cAAc,EAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,KAAK,SAAS,EAA4B,MAAM,WAAW,CAAC;AAKrE,MAAM,WAAW,WAAY,SAAQ,SAAS;IAC5C,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAWD,0FAA0F;AAC1F,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqDzF;AAED,KAAK,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA2B3F;AAmED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,OAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB7F;AAED,+FAA+F;AAC/F,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI1F;AAED;;mFAEmF;AACnF,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,gBAAgB,GAAG,IAAI,CAAC,CA+BnD;AAiND;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,WAAW,GAAG,UAAU,CAAC,CA0BpD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,KAAK,EAAE,WAAW,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB,GACA,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GACnF,OAAO,CAAC,IAAI,CAAC,CASf"}