@riocrypto/common-server 1.0.2881 → 1.0.2883

package/build/clients/kraken-client.d.ts

@@ -33,6 +33,13 @@ export interface KrakenWithdrawInfo {
     amount: string;
     fee: string;
 }
+export interface KrakenFundingQuery {
+    method?: string;
+    start?: number;
+    end?: number;
+    maxPages?: number;
+    stopWhen?: (row: KrakenFundingStatus) => boolean;
+}
 export interface KrakenLedgerEntry {
     refid: string;
     time: number;
@@ -62,16 +69,19 @@ declare class KrakenClient {
     getAllBalances(assets: string[]): Promise<Record<string, number>>;
     getDepositMethods(asset: string): Promise<KrakenDepositMethod[]>;
     getDepositAddresses(asset: string, method: string, isNew?: boolean): Promise<KrakenDepositAddress[]>;
-    getDepositStatus(asset: string, method?: string): Promise<KrakenFundingStatus[]>;
+    private listFunding;
+    getDepositStatus(asset: string, query?: KrakenFundingQuery): Promise<KrakenFundingStatus[]>;
     getWithdrawInfo(asset: string, key: string, amount: number): Promise<KrakenWithdrawInfo>;
     withdraw(asset: string, key: string, amount: number): Promise<string>;
-    getWithdrawStatus(asset: string, method?: string): Promise<KrakenFundingStatus[]>;
+    getWithdrawStatus(asset: string, query?: KrakenFundingQuery): Promise<KrakenFundingStatus[]>;
     getWithdrawStatusByRefid(asset: string, refid: string): Promise<KrakenFundingStatus | undefined>;
     getDepositByTxId(asset: string, txid: string): Promise<KrakenFundingStatus | undefined>;
     getLedgers(params?: {
         type?: string;
         asset?: string;
         start?: number;
+        end?: number;
+        maxPages?: number;
     }): Promise<Record<string, KrakenLedgerEntry>>;
 }
 export declare const buildKrakenClient: () => Promise<KrakenClient>;

package/build/clients/kraken-client.js

@@ -28,6 +28,42 @@ const getKrakenRestBaseUrl = (env) => env === common_1.RioEnv.Production
     : KRAKEN_UAT_REST_BASE_URL;
 // Kraken Balance keys. Fiat USD is `ZUSD`; the stablecoins use their ticker.
 exports.KRAKEN_ASSET_USD = "ZUSD";
+// Page size we ask the funding endpoints for. Their own defaults differ sharply
+// - DepositStatus returns 25 rows and WithdrawStatus 500 - so always send an
+// explicit limit rather than inheriting whichever default applies. Reading only
+// the first default-size page is what previously made older deposits invisible.
+const FUNDING_PAGE_LIMIT = 500;
+// Ledgers returns 50 rows per call and pages via a numeric `ofs` offset.
+const LEDGER_PAGE_SIZE = 50;
+// Ceiling on pages any single call will walk. The private-request queue
+// serializes these, so an unbounded walk would both stall the queue and burn
+// the per-account rate counter that liquidity-management and external-trading
+// share.
+const MAX_FUNDING_PAGES = 40;
+const MAX_LEDGER_PAGES = 40;
+// The funding endpoints answer either with a bare array (when `cursor` is
+// disabled) or with an object holding the rows plus `next_cursor`. That
+// object's row property is documented as `deposit` for DepositStatus and is not
+// documented at all for WithdrawStatus, so take the first array-valued property
+// instead of trusting a name: guessing the key wrong yields a silent zero rows
+// rather than an error.
+const normalizeFundingPage = (raw) => {
+    var _a;
+    if (Array.isArray(raw)) {
+        return { rows: raw };
+    }
+    if (!raw || typeof raw !== "object") {
+        return { rows: [] };
+    }
+    const record = raw;
+    const rows = (_a = Object.values(record).find((value) => Array.isArray(value))) !== null && _a !== void 0 ? _a : [];
+    const nextCursor = typeof record.next_cursor === "string" ? record.next_cursor : undefined;
+    return { rows, nextCursor };
+};
+// Cursor pages restart from the newest record, so the same row can appear on
+// more than one page. Identity is the funding reference plus its transaction
+// and timestamp.
+const fundingRowKey = (row) => `${row.refid}:${row.txid}:${row.time}`;
 class KrakenClient {
     constructor(apiKey, apiSecret, env) {
         this.apiKey = apiKey;
@@ -146,12 +182,51 @@ class KrakenClient {
             });
         });
     }
-    getDepositStatus(asset, method) {
+    // Walk a funding endpoint to exhaustion (or to `maxPages`). The first call
+    // deliberately omits `cursor` so it matches the documented unpaginated form;
+    // pagination is enabled from the second call onward, which restarts at the
+    // newest record and so overlaps the first page. Duplicates are dropped by
+    // reference id, making the overlap harmless.
+    listFunding(endpoint, asset, query) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            return this.privatePost("DepositStatus", {
-                asset,
-                method,
-            });
+            const maxPages = (_a = query.maxPages) !== null && _a !== void 0 ? _a : MAX_FUNDING_PAGES;
+            const rows = [];
+            const seen = new Set();
+            let cursor;
+            for (let page = 0; page < maxPages; page++) {
+                const raw = yield this.privatePost(endpoint, {
+                    asset,
+                    method: query.method,
+                    start: query.start,
+                    end: query.end,
+                    limit: FUNDING_PAGE_LIMIT,
+                    cursor: page === 0 ? undefined : cursor !== null && cursor !== void 0 ? cursor : true,
+                });
+                const { rows: batch, nextCursor } = normalizeFundingPage(raw);
+                for (const row of batch) {
+                    const key = fundingRowKey(row);
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        rows.push(row);
+                    }
+                }
+                if (query.stopWhen && batch.some(query.stopWhen)) {
+                    break;
+                }
+                // Page 0 carries no cursor, so allow one more call to obtain one; after
+                // that, no cursor means there is nothing further back.
+                if (batch.length === 0 || (page > 0 && !nextCursor)) {
+                    break;
+                }
+                cursor = nextCursor;
+            }
+            return rows;
+        });
+    }
+    getDepositStatus(asset, query = {}) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.listFunding("DepositStatus", asset, query);
         });
     }
     // ----- Withdrawals -----
@@ -181,41 +256,64 @@ class KrakenClient {
             return result.refid;
         });
     }
-    getWithdrawStatus(asset, method) {
+    getWithdrawStatus(asset, query = {}) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.privatePost("WithdrawStatus", {
-                asset,
-                method,
-            });
+            return this.listFunding("WithdrawStatus", asset, query);
         });
     }
     getWithdrawStatusByRefid(asset, refid) {
         return __awaiter(this, void 0, void 0, function* () {
-            const statuses = yield this.getWithdrawStatus(asset);
+            const statuses = yield this.getWithdrawStatus(asset, {
+                stopWhen: (row) => row.refid === refid,
+            });
             return statuses.find((s) => s.refid === refid);
         });
     }
     getDepositByTxId(asset, txid) {
         return __awaiter(this, void 0, void 0, function* () {
-            const statuses = yield this.getDepositStatus(asset);
+            const statuses = yield this.getDepositStatus(asset, {
+                stopWhen: (row) => row.txid === txid,
+            });
             return statuses.find((s) => s.txid === txid);
         });
     }
     // ----- Ledgers -----
-    // Returns the ledger entries (keyed by ledger id) for the given filters.
-    // This is the authoritative source for fiat deposits/withdrawals, which do
-    // not appear in DepositStatus/WithdrawStatus. `start` is a unix timestamp in
-    // seconds; Kraken returns the most recent entries (max 50 per page) at or
-    // after it.
+    // Returns the ledger entries (keyed by ledger id) for the given filters,
+    // walking every page rather than just the most recent 50. Kraken caps a
+    // response at 50 rows and reports the full match count, so pagination is via
+    // the numeric `ofs` offset until that count is covered. `start`/`end` are
+    // unix timestamps in seconds.
     getLedgers(params = {}) {
-        var _a;
+        var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
-            const result = yield this.privatePost("Ledgers", {
-                type: params.type,
-                asset: params.asset,
-                start: params.start,
-            });
-            return (_a = result === null || result === void 0 ? void 0 : result.ledger) !== null && _a !== void 0 ? _a : {};
+            const maxPages = (_a = params.maxPages) !== null && _a !== void 0 ? _a : MAX_LEDGER_PAGES;
+            const merged = {};
+            for (let page = 0; page < maxPages; page++) {
+                const result = yield this.privatePost("Ledgers", {
+                    type: params.type,
+                    asset: params.asset,
+                    start: params.start,
+                    end: params.end,
+                    ofs: page * LEDGER_PAGE_SIZE,
+                });
+                const rows = (_b = result === null || result === void 0 ? void 0 : result.ledger) !== null && _b !== void 0 ? _b : {};
+                const pageSize = Object.keys(rows).length;
+                if (pageSize === 0) {
+                    break;
+                }
+                Object.assign(merged, rows);
+                // A short page is the last one. `count` is Kraken's total for the filter;
+                // it is only trusted when present so a missing count cannot terminate the
+                // walk after a single page.
+                if (pageSize < LEDGER_PAGE_SIZE) {
+                    break;
+                }
+                const count = (_c = result === null || result === void 0 ? void 0 : result.count) !== null && _c !== void 0 ? _c : 0;
+                if (count > 0 && Object.keys(merged).length >= count) {
+                    break;
+                }
+            }
+            return merged;
         });
     }
 }

package/build/helpers/payin-destinations.d.ts

@@ -11,8 +11,18 @@ export interface PayinBankDetails {
     RFC?: string;
     bankAddress?: string;
     NIT?: string;
+    largeTransferCCI?: string;
 }
 export declare const PER_USER_PAYIN_PROCESSORS: Processor[];
+/**
+ * Per-operation ceiling of the CCE's immediate transfer service, set by the BCRP.
+ *
+ * A virtual CCI accepts nothing but immediate transfers, so a payment above this
+ * cannot be sent to one at all: the payer's bank has to use deferred CCE or LBTR,
+ * and both are refused by a CCIV. Those payments go to the principal account
+ * instead, which is why the ceiling decides which CCI a customer is shown.
+ */
+export declare const CCE_IMMEDIATE_CEILING_BY_FIAT: Partial<Record<Fiat, number>>;
 export declare const normalizeCci: (cci: string) => string;
 /**
  * Whether a CCI is one of Rio's own Peru accounts.
@@ -24,12 +34,14 @@ export declare const normalizeCci: (cci: string) => string;
  * order happened to be awaiting the same amount.
  */
 export declare const isRioOwnPeruAccountCci: (cci?: string) => boolean;
-export declare const getPayinBankDetails: ({ mongoose, processor, fiat, country, user, }: {
+export declare const getPayinBankDetails: ({ mongoose, processor, fiat, country, user, amount, requireSharedAlfinAccount, }: {
     mongoose: Mongoose;
     processor: Processor;
     fiat: Fiat;
     country: Country;
     user: User;
+    amount?: number | undefined;
+    requireSharedAlfinAccount?: boolean | undefined;
 }) => Promise<PayinBankDetails>;
 export interface PayinDestination {
     processor: Processor;

package/build/helpers/payin-destinations.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getPayinDestinations = exports.getPayinBankDetails = exports.isRioOwnPeruAccountCci = exports.normalizeCci = exports.PER_USER_PAYIN_PROCESSORS = void 0;
+exports.getPayinDestinations = exports.getPayinBankDetails = exports.isRioOwnPeruAccountCci = exports.normalizeCci = exports.CCE_IMMEDIATE_CEILING_BY_FIAT = exports.PER_USER_PAYIN_PROCESSORS = void 0;
 const common_1 = require("@riocrypto/common");
 const rio_bank_account_1 = require("../models/rio-bank-account");
 const STP_deposit_CLABE_1 = require("../models/STP-deposit-CLABE");
@@ -33,13 +33,32 @@ const PERU_COMPANY_ADDRESS = "Calle General de la Fuente, Edificio 393, dep. 102
 const PERU_RUC = "20610425713";
 // Rio's Alfin Cuenta Vista per currency. A CCIV is reachable only through the
 // interbank clearing house, so a customer who banks at Alfin cannot pay one from
-// inside Alfin and needs the underlying account number. Note that a payment sent
-// here carries no CCIV, so Alfin raises no payin notification for it: it is only
-// picked up by the treasury statement import and has to be matched by hand.
+// inside Alfin and needs the underlying account number. A payment sent here
+// carries no CCIV, so Alfin raises no payin notification for it: it is picked up
+// by the treasury statement import and attributed from there.
 const ALFIN_ACCOUNT_NUMBER_BY_FIAT = {
     [common_1.Fiat.PEN]: "01818233900001",
     [common_1.Fiat.USD]: "01818233900002",
 };
+// The same accounts as CCIs, for payers at another bank. An account number is
+// only addressable from inside Alfin, so this is what a customer needs when the
+// payment cannot go to their CCIV.
+const ALFIN_PRINCIPAL_CCI_BY_FIAT = {
+    [common_1.Fiat.PEN]: "05810001818233900196",
+    [common_1.Fiat.USD]: "05810001818233900294",
+};
+/**
+ * Per-operation ceiling of the CCE's immediate transfer service, set by the BCRP.
+ *
+ * A virtual CCI accepts nothing but immediate transfers, so a payment above this
+ * cannot be sent to one at all: the payer's bank has to use deferred CCE or LBTR,
+ * and both are refused by a CCIV. Those payments go to the principal account
+ * instead, which is why the ceiling decides which CCI a customer is shown.
+ */
+exports.CCE_IMMEDIATE_CEILING_BY_FIAT = {
+    [common_1.Fiat.PEN]: 30000,
+    [common_1.Fiat.USD]: 10000,
+};
 const INTERBANK_PERU_CCI_BY_FIAT = {
     [common_1.Fiat.PEN]: "003-200-003004741070-36",
     [common_1.Fiat.USD]: "003-200-003004741088-38",
@@ -144,8 +163,10 @@ const getStaticPayinBankDetails = (processor, fiat) => {
 // Looks up (and by default creates) the user's own destination on a per-user
 // rail. With `provision` false it reports what exists without calling out to the
 // provider, which is what the whitelisting list needs so that merely viewing the
-// page does not allocate account numbers at Fintoc or Alfin.
-const getPerUserPayinBankDetails = ({ mongoose, processor, fiat, userId, provision, }) => __awaiter(void 0, void 0, void 0, function* () {
+// page does not allocate account numbers at Fintoc or Alfin. `amount` is the sum
+// the customer will send in one transfer, which on Alfin decides whether their
+// virtual CCI can receive it at all.
+const getPerUserPayinBankDetails = ({ mongoose, processor, fiat, userId, provision, amount, requireSharedAlfinAccount, }) => __awaiter(void 0, void 0, void 0, function* () {
     if (processor === common_1.Processor.SPEI_STP) {
         const STPDepositCLABE = (0, STP_deposit_CLABE_1.buildSTPDepositCLABE)(mongoose);
         const existing = yield STPDepositCLABE.findOne({ userId });
@@ -191,22 +212,34 @@ const getPerUserPayinBankDetails = ({ mongoose, processor, fiat, userId, provisi
         };
     }
     if (processor === common_1.Processor.Alfin) {
-        const AlfinVirtualCci = (0, alfin_virtual_cci_1.buildAlfinVirtualCci)(mongoose);
-        const existing = yield AlfinVirtualCci.findOne({ userId, fiat });
-        let CCIV = existing === null || existing === void 0 ? void 0 : existing.CCIV;
-        if (!CCIV) {
-            if (!provision) {
-                return undefined;
+        // Above the immediate-transfer ceiling the customer is given the principal
+        // account's CCI rather than their own virtual one. Showing the CCIV there
+        // would be showing them the one destination their bank cannot pay: the
+        // transfer has to go out on a rail a CCIV refuses, so it would never arrive.
+        const ceiling = exports.CCE_IMMEDIATE_CEILING_BY_FIAT[fiat];
+        const exceedsCcivCeiling = amount !== undefined && ceiling !== undefined && amount > ceiling;
+        const usePrincipalAccount = Boolean(requireSharedAlfinAccount) || exceedsCcivCeiling;
+        let CCI = usePrincipalAccount
+            ? ALFIN_PRINCIPAL_CCI_BY_FIAT[fiat]
+            : undefined;
+        if (!usePrincipalAccount) {
+            const AlfinVirtualCci = (0, alfin_virtual_cci_1.buildAlfinVirtualCci)(mongoose);
+            const existing = yield AlfinVirtualCci.findOne({ userId, fiat });
+            CCI = existing === null || existing === void 0 ? void 0 : existing.CCIV;
+            if (!CCI) {
+                if (!provision) {
+                    return undefined;
+                }
+                const clusterClient = yield (0, cluster_client_1.buildClusterClient)();
+                CCI = (yield clusterClient.generateAlfinVirtualCci(userId, fiat)).CCIV;
             }
-            const clusterClient = yield (0, cluster_client_1.buildClusterClient)();
-            CCIV = (yield clusterClient.generateAlfinVirtualCci(userId, fiat)).CCIV;
         }
         return {
             bankName: "Alfin Banco",
             companyName: PERU_COMPANY_NAME,
             companyAddress: PERU_COMPANY_ADDRESS,
             accountNumber: ALFIN_ACCOUNT_NUMBER_BY_FIAT[fiat],
-            CCI: CCIV,
+            CCI,
             RUC: PERU_RUC,
         };
     }
@@ -215,7 +248,7 @@ const getPerUserPayinBankDetails = ({ mongoose, processor, fiat, userId, provisi
 // The account a customer must pay into to fund a buy order on a given rail.
 // A custom Rio bank account replaces the rail's own destination outright, which
 // is why routing has to know that account's processor - see resolveProcessor.
-const getPayinBankDetails = ({ mongoose, processor, fiat, country, user, }) => __awaiter(void 0, void 0, void 0, function* () {
+const getPayinBankDetails = ({ mongoose, processor, fiat, country, user, amount, requireSharedAlfinAccount, }) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b, _c;
     const rioBankAccountId = (_c = (_b = (_a = user.rioBankAccount) === null || _a === void 0 ? void 0 : _a[country]) === null || _b === void 0 ? void 0 : _b[fiat]) === null || _c === void 0 ? void 0 : _c.id;
     if (rioBankAccountId) {
@@ -243,6 +276,8 @@ const getPayinBankDetails = ({ mongoose, processor, fiat, country, user, }) => _
             fiat,
             userId: user.id,
             provision: true,
+            amount,
+            requireSharedAlfinAccount,
         });
         return details || {};
     }
@@ -280,6 +315,12 @@ const getPayinDestinations = ({ mongoose, user, country, fiat, processors, provi
                 userId: user.id,
                 provision,
             });
+            // A customer who may only send to accounts their bank has on file has to
+            // have both Alfin CCIs on it before they place an order, since which one
+            // they are given depends on how much that order is for.
+            if (processor === common_1.Processor.Alfin && bankDetails) {
+                bankDetails.largeTransferCCI = ALFIN_PRINCIPAL_CCI_BY_FIAT[fiat];
+            }
         }
         else {
             bankDetails = getStaticPayinBankDetails(processor, fiat);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2881",
+  "version": "1.0.2883",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",