tapimo 0.10.2 → 0.12.0

package/src/apps/data/routes/webhooks.test.ts

@@ -1,17 +1,11 @@
-import { type Db, Store, Webhooks as Core } from 'tapimo'
-import * as z from 'zod/mini'
+import { type Db, Webhooks as Core } from 'tapimo'
 
 import * as Cursor from '../../../internal/Cursor.js'
-import * as Viem from '../../../internal/Viem.js'
 import * as TestApp from '../../../../test/App.js'
 import * as Mppx from '../../../../test/Mppx.js'
-import * as Runtime from '../../../../test/runtime.js'
 import * as Tempo from '../../../../test/Tempo.js'
 import * as Webhooks from './webhooks.js'
 
-/** Humanized transaction payload delivered by transaction webhooks. */
-type TransactionEvent = z.output<typeof Webhooks.schema.TransactionEvent>
-
 /** API key with both webhook scopes, owned by `org_test`. */
 const writer = {
   id: 'key_writer',
@@ -115,6 +109,29 @@ describe('feature gate', () => {
     const body = (await response.json()) as { error?: { code?: string } }
     expect(body.error?.code).toMatchInlineSnapshot(`"webhooks_not_enabled"`)
   })
+
+  test('does not register funding events without a host producer', async () => {
+    const app = TestApp.client({
+      auth: { keys: [writer] },
+      webhook: { supportedChainIds: [4217, 42431] },
+    })
+    const catalog = await app.v1.webhooks['event-types'].$get({})
+    const catalogBody = await TestApp.json(catalog, Webhooks.schema.getWebhookEventTypes.Response)
+    const created = await app.v1.webhooks.$post(
+      {
+        json: {
+          destination: { type: 'url', url: 'https://example.com/funding' },
+          eventType: 'funding:deposit.updated',
+        },
+      },
+      as(writer),
+    )
+
+    expect(catalogBody.data.map((eventType) => eventType.type)).not.toContain(
+      'funding:deposit.updated',
+    )
+    expect(created.status).toBe(400)
+  })
 })
 
 describe('access matrix', () => {
@@ -191,6 +208,7 @@ describe('access matrix', () => {
     expect(body.data.map((entry) => entry.type)).toMatchInlineSnapshot(`
       [
         "block:created",
+        "funding:deposit.updated",
         "log:emitted",
         "token:transfer",
         "transaction:included",
@@ -220,6 +238,151 @@ describe('access matrix', () => {
 })
 
 describe('CRUD lifecycle', () => {
+  test('requires funding read access to create a funding deposit subscription', async () => {
+    const webhookWriter = {
+      id: 'key_funding_webhook_only',
+      orgId: 'org_funding_webhook_only',
+      scopes: ['webhooks:write'],
+      token: 'secret_funding_webhook_only',
+    } satisfies TestApp.kvStore.Key
+    const app = TestApp.client({ auth: { keys: [webhookWriter] } })
+    const response = await app.v1.webhooks.$post(
+      {
+        json: {
+          destination: { type: 'url', url: 'https://example.com/funding' },
+          eventType: 'funding:deposit.updated',
+        },
+      },
+      as(webhookWriter),
+    )
+    const body = (await response.json()) as { error?: { code?: string } }
+
+    expect(response.status).toBe(403)
+    expect(body.error?.code).toBe('api_key_forbidden')
+  })
+
+  test('captures funding deposit ownership scope without reading the RPC head', async () => {
+    const db = TestApp.database()
+    const projectWriter = {
+      id: 'key_funding_webhook_project',
+      orgId: 'org_funding_webhook',
+      projectId: 'prj_funding_webhook',
+      scopes: ['funding:read', 'webhooks:write'],
+      token: 'secret_funding_webhook_project',
+    } satisfies TestApp.kvStore.Key
+    const app = TestApp.client({ auth: { keys: [projectWriter] }, db })
+    const response = await app.v1.webhooks.$post(
+      {
+        json: {
+          destination: { type: 'url', url: 'https://example.com/funding' },
+          eventType: 'funding:deposit.updated',
+          filters: { status: 'completed' },
+        },
+      },
+      as(projectWriter),
+    )
+    const body = await TestApp.json(response, Webhooks.schema.createWebhook.Response)
+    const stored = await Core.getSubscription(
+      db,
+      { orgId: projectWriter.orgId, type: 'api_key' },
+      body.id,
+    )
+
+    expect(response.status).toBe(200)
+    expect(stored).toMatchObject({
+      environment: 'production',
+      projectId: projectWriter.projectId,
+    })
+    expect(await Core.getCursor(db, body.id)).toBeNull()
+  })
+
+  test('isolates funding subscriptions by API-key environment and project', async () => {
+    const db = TestApp.database()
+    const shared = {
+      orgId: 'org_funding_access',
+      scopes: ['funding:read', 'webhooks:read', 'webhooks:write'],
+    } as const
+    const projectA = {
+      ...shared,
+      id: 'key_funding_project_a',
+      projectId: 'prj_funding_a',
+      token: 'secret_funding_project_a',
+    } satisfies TestApp.kvStore.Key
+    const projectB = {
+      ...shared,
+      id: 'key_funding_project_b',
+      projectId: 'prj_funding_b',
+      token: 'secret_funding_project_b',
+    } satisfies TestApp.kvStore.Key
+    const sandboxProjectB = {
+      ...projectB,
+      environment: 'sandbox',
+      id: 'key_funding_project_b_sandbox',
+      token: 'secret_funding_project_b_sandbox',
+    } satisfies TestApp.kvStore.Key
+    const projectBWebhookReader = {
+      ...projectB,
+      id: 'key_funding_project_b_webhook_reader',
+      scopes: ['webhooks:read'],
+      token: 'secret_funding_project_b_webhook_reader',
+    } satisfies TestApp.kvStore.Key
+    const organization = {
+      ...shared,
+      id: 'key_funding_organization',
+      token: 'secret_funding_organization',
+    } satisfies TestApp.kvStore.Key
+    const app = TestApp.client({
+      auth: {
+        keys: [organization, projectA, projectB, projectBWebhookReader, sandboxProjectB],
+      },
+      db,
+    })
+    const subscription = await Core.createSubscription(db, {
+      chainId: 4217,
+      destination: { type: 'url', url: 'https://example.com/project-b' },
+      environment: 'production',
+      eventType: 'funding:deposit.updated',
+      owner: { orgId: shared.orgId, type: 'api_key' },
+      projectId: projectB.projectId,
+    })
+
+    const listed = await app.v1.webhooks.$get({ query: { include: 'totalCount' } }, as(projectA))
+    const listedBody = await TestApp.json(listed, Webhooks.schema.listWebhooks.Response)
+    const hidden = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: subscription.id } },
+      as(projectA),
+    )
+    const sandboxHidden = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: subscription.id } },
+      as(sandboxProjectB),
+    )
+    const scopeHidden = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: subscription.id } },
+      as(projectBWebhookReader),
+    )
+    const patchHidden = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$patch(
+      { json: { status: 'paused' }, param: { id: subscription.id } },
+      as(projectA),
+    )
+    const deleteHidden = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$delete(
+      { param: { id: subscription.id } },
+      as(projectA),
+    )
+    const organizationRead = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].$get(
+      { param: { id: subscription.id } },
+      as(organization),
+    )
+
+    expect(listed.status).toBe(200)
+    expect(listedBody).toMatchObject({ data: [], meta: { totalCount: 0 } })
+    expect(hidden.status).toBe(404)
+    expect(sandboxHidden.status).toBe(404)
+    expect(scopeHidden.status).toBe(404)
+    expect(patchHidden.status).toBe(404)
+    expect(deleteHidden.status).toBe(404)
+    expect(organizationRead.status).toBe(200)
+  })
+
   test('creates, reads, lists, updates, and deletes a subscription', async () => {
     const db = TestApp.database()
     const app = TestApp.client({
@@ -1152,6 +1315,7 @@ describe('OpenAPI visibility', () => {
         "Included transaction event",
         "Log event",
         "Block event",
+        "Funding deposit updated event",
         "Ping (test delivery)",
       ]
     `)
@@ -1250,6 +1414,14 @@ describe('OpenAPI visibility', () => {
           ],
           "title": "Block subscription",
         },
+        {
+          "filters": [
+            "depositAddressId",
+            "recipient",
+            "status",
+          ],
+          "title": "Funding deposit subscription",
+        },
       ]
     `)
   })
@@ -1351,1496 +1523,6 @@ describe('MPP access (disabled for now — API-key-only)', () => {
   })
 })
 
-// The poll tests pin a fixed immutable historical window on testnet chain 42431.
-// Under `localnet`, the test RPC client is redirected to the disposable local
-// chain, which lacks that history, so the whole block is testnet-only.
-describe.skipIf(Runtime.get().mode === 'localnet')('poll', () => {
-  /** Decodes an opaque creation checkpoint or `(block, index)` poller cursor. */
-  function decodeCursor(token: string | null): number[] | null {
-    if (!token) return null
-    const json = atob(token.replaceAll('-', '+').replaceAll('_', '/'))
-    return JSON.parse(json) as number[]
-  }
-
-  /** Encodes a `(block, index)` keyset cursor in the poller's opaque format. */
-  function encodeCursor(values: [number, number]): string {
-    return btoa(JSON.stringify(values)).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '')
-  }
-
-  /** End-of-block index sentinel (matches the poller's own cursor sentinel). */
-  const endOfBlockIndex = 2_147_483_647
-
-  // Every scanner reads this immutable window over real RPC (chain 42431 to
-  // `rpc.testnet.tempo.xyz`), so the results remain snapshot-stable.
-  const client = Viem.getClient({ chainId: 42431, rpc: TestApp.rpc })
-  // Confirmed scan window `[windowFrom, windowTo]`: anchor the cursor just below
-  // `windowFrom`, and pass `headBlockNumber = windowTo + confirmations` so the
-  // poller's `safeBlock` lands exactly on `windowTo`.
-  const windowFrom = 1_000_000
-  const windowTo = 1_000_002
-  const windowCursor = encodeCursor([windowFrom - 1, endOfBlockIndex])
-  const windowHead = windowTo + 1
-  // A sender whose only transfers in `[windowFrom, windowTo]` are exactly two
-  // rows, both in block 1,000,002 (`log_idx` 0 then 1): a TIP-20 transfer
-  // followed by its fee payment. Filtering on it makes the scan deterministic.
-  const windowRecipient = '0x9e39034aae71fb89f66061a2602eb6efec271754'
-  const windowSender = '0xe7687128b0a808c2831ff94d4f7b2fb35c65af38'
-  // This token has 226 transfers across blocks 1,000,000 through 1,000,003.
-  const volumeHead = 1_000_005
-  const volumeToken = '0x20c0000000000000000000000000000000000001'
-
-  async function createTransferSubscription(db: Db.Db) {
-    return Core.createSubscription(db, {
-      chainId: 42431,
-      eventType: 'token:transfer',
-      filters: { sender: windowSender },
-      owner: { orgId: 'org_test', type: 'api_key' },
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-    })
-  }
-
-  async function createVolumeSubscription(db: Db.Db, ownerId = 'org_test') {
-    return Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: `https://hooks.example.com/${ownerId}` },
-      eventType: 'token:transfer',
-      filters: { token: volumeToken },
-      owner: { orgId: ownerId, type: 'api_key' },
-    })
-  }
-
-  test('dispatches a signed envelope per row and advances the cursor', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    // Anchor the subscription just below the pinned window so the poller scans
-    // it this tick (a brand-new subscription anchors at head and skips its first
-    // tick).
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const scanCheckpoints: Webhooks.poll.ScanCheckpoint[] = []
-    const stages: Webhooks.poll.Stage[] = []
-    let cursorLagBlocks: number | undefined
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer', 'token:transfer'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-      onCursorLag(blocks) {
-        cursorLagBlocks = blocks
-      },
-      onScanCheckpoint(checkpoint) {
-        scanCheckpoints.push(checkpoint)
-      },
-      onStage(stage) {
-        stages.push(stage)
-      },
-    })
-
-    expect(result).toMatchInlineSnapshot(`
-      {
-        "chainId": 42431,
-        "dispatched": 2,
-        "failed": 0,
-        "safeBlock": 1000002,
-        "scanned": 2,
-        "subscriptions": 1,
-      }
-    `)
-    expect(cursorLagBlocks).toBe(3)
-    expect(scanCheckpoints.map(({ durationMs: _, ...checkpoint }) => checkpoint))
-      .toMatchInlineSnapshot(`
-      [
-        {
-          "concurrency": 8,
-          "eventType": "token:transfer",
-          "maxWindowBlocks": 3,
-          "phase": "start",
-          "rpcMethod": "eth_getLogs",
-          "subscriptionCount": 1,
-          "subscriptionLimit": 256,
-          "totalWindowBlocks": 3,
-        },
-        {
-          "concurrency": 8,
-          "eventType": "token:transfer",
-          "failedSubscriptions": 0,
-          "matchedItems": 2,
-          "maxWindowBlocks": 3,
-          "outcome": "ok",
-          "phase": "complete",
-          "rpcMethod": "eth_getLogs",
-          "subscriptionCount": 1,
-          "subscriptionLimit": 256,
-          "totalWindowBlocks": 3,
-        },
-      ]
-    `)
-    expect(stages.map(({ eventType, outcome, stage }) => ({ eventType, outcome, stage })))
-      .toMatchInlineSnapshot(`
-      [
-        {
-          "eventType": undefined,
-          "outcome": "ok",
-          "stage": "rpc_head",
-        },
-        {
-          "eventType": undefined,
-          "outcome": "ok",
-          "stage": "subscription_read",
-        },
-        {
-          "eventType": "token:transfer",
-          "outcome": "ok",
-          "stage": "scan",
-        },
-        {
-          "eventType": "token:transfer",
-          "outcome": "ok",
-          "stage": "enrich",
-        },
-        {
-          "eventType": "token:transfer",
-          "outcome": "ok",
-          "stage": "cursor_write",
-        },
-      ]
-    `)
-    expect(dispatched).toHaveLength(2)
-    // The envelope carries the decoded RPC transfer row, here the first of the
-    // two pinned-window transfers from `windowSender`.
-    expect(dispatched[0]?.envelope.data).toMatchInlineSnapshot(`
-      {
-        "address": "0x20c00000000000000000000071de0cd31ab0d105",
-        "amount": "10000",
-        "blockNumber": 1000002,
-        "logIndex": 0,
-        "recipient": "0x9e39034aae71fb89f66061a2602eb6efec271754",
-        "sender": "0xe7687128b0a808c2831ff94d4f7b2fb35c65af38",
-        "timestamp": "2026-01-14T18:38:03.685Z",
-        "token": {
-          "decimals": 6,
-          "symbol": "QKSUSD",
-        },
-        "transactionHash": "0x3d24a706cc2f6f4c96620bef1f61ddb23040ff77c22c8db42918c7c424bbf9d3",
-      }
-    `)
-
-    // Cursor advanced to the last dispatched row `(1000002, 1)`.
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        1000002,
-        1,
-      ]
-    `)
-  })
-
-  test('delivers collision-shaped token metadata from a cache hit', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-    const cache = Store.memory()
-    const address = '0x20c00000000000000000000071de0cd31ab0d105'
-    await Store.memoize(
-      async () => ({
-        currency: 'USD',
-        decimals: 6,
-        name: 'Collision token',
-        symbol: '123#__bigint',
-      }),
-      {
-        key: `webhook:token-meta:v2:42431:${address}`,
-        store: cache,
-        ttl: 60_000,
-      },
-    )
-    const bodies: string[] = []
-    const fetch = (async (_input, init) => {
-      bodies.push(typeof init?.body === 'string' ? init.body : '')
-      return new Response(null, { status: 200 })
-    }) satisfies typeof globalThis.fetch
-
-    const result = await Webhooks.poll({
-      cache,
-      chainId: 42431,
-      client,
-      db,
-      dispatch: ({ envelope, subscription }) =>
-        Core.deliverAndRecord(db, subscription, envelope, { fetch }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-    })
-
-    const payloads = bodies.map((body) => Webhooks.schema.Envelope.parse(JSON.parse(body)))
-    const delivered = payloads.find(
-      (payload) => payload.type === 'token:transfer' && payload.data.address === address,
-    )
-    expect(result.dispatched).toBe(2)
-    expect(delivered?.type === 'token:transfer' ? delivered.data.token?.symbol : undefined).toBe(
-      '123#__bigint',
-    )
-  })
-
-  test('scans event types concurrently without increasing scan bounds', async () => {
-    const db = TestApp.database()
-    const transfer = await createTransferSubscription(db)
-    const block = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/block' },
-      eventType: 'block:created',
-      filters: {},
-      owner: { orgId: 'org_block', type: 'api_key' },
-    })
-    await Promise.all([
-      Core.setCursor(db, transfer.id, windowCursor),
-      Core.setCursor(db, block.id, windowCursor),
-    ])
-
-    const active = new Map<
-      Webhooks.EventType,
-      Pick<Webhooks.poll.ScanCheckpoint, 'concurrency' | 'subscriptionLimit'>
-    >()
-    let maxConcurrency = 0
-    let maxEventTypes = 0
-    let maxSubscriptionLimit = 0
-    await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatch: async () => ({ ok: true }),
-      eventTypes: ['token:transfer', 'block:created'],
-      headBlockNumber: windowHead,
-      onScanCheckpoint(checkpoint) {
-        expect(checkpoint.subscriptionCount).toBeLessThanOrEqual(checkpoint.subscriptionLimit)
-        if (checkpoint.phase === 'start')
-          active.set(checkpoint.eventType, {
-            concurrency: checkpoint.concurrency,
-            subscriptionLimit: checkpoint.subscriptionLimit,
-          })
-        else active.delete(checkpoint.eventType)
-        maxConcurrency = Math.max(
-          maxConcurrency,
-          ...[...active.values()].map((value) => value.concurrency),
-        )
-        maxEventTypes = Math.max(maxEventTypes, active.size)
-        maxSubscriptionLimit = Math.max(
-          maxSubscriptionLimit,
-          [...active.values()].reduce((total, value) => total + value.subscriptionLimit, 0),
-        )
-      },
-    })
-
-    expect(active.size).toBe(0)
-    expect(maxConcurrency).toBe(8)
-    expect(maxEventTypes).toBe(2)
-    expect(maxSubscriptionLimit).toBe(256)
-  })
-
-  test('dispatches a page as one batch and advances the cursor', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const batches: Webhooks.poll.Dispatchable[][] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatchBatch: async (dispatchables, context) => {
-        expect(context.db).toBe(db)
-        batches.push([...dispatchables])
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.dispatched).toBe(2)
-    expect(batches.map((batch) => batch.length)).toEqual([2])
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 1])
-  })
-
-  test('keeps the cursor unchanged when a batch dispatch fails', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatchBatch: async () => ({ error: 'unreachable', ok: false }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.dispatched).toBe(0)
-    expect(result.failed).toBe(2)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([
-      windowFrom - 1,
-      endOfBlockIndex,
-    ])
-  })
-
-  test('matches the either-side address filter through Viem log filters', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/address' },
-      eventType: 'token:transfer',
-      filters: { address: windowSender },
-      owner: { orgId: 'org_address', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const positions: string[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatch: async ({ envelope }) => {
-        const data = envelope.data as { blockNumber: number; logIndex: number }
-        positions.push(`${data.blockNumber}:${data.logIndex}`)
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.dispatched).toBe(2)
-    expect(positions).toEqual(['1000002:0', '1000002:1'])
-  })
-
-  test('keeps distinct transfer pushdowns isolated', async () => {
-    const db = TestApp.database()
-    const recipient = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/recipient' },
-      eventType: 'token:transfer',
-      filters: { recipient: windowRecipient },
-      owner: { orgId: 'org_recipient', type: 'api_key' },
-    })
-    const sender = await createTransferSubscription(db)
-    await Promise.all([
-      Core.setCursor(db, recipient.id, windowCursor),
-      Core.setCursor(db, sender.id, windowCursor),
-    ])
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.dispatched).toBe(3)
-    expect(
-      Object.fromEntries(
-        [...Map.groupBy(dispatched, ({ subscription }) => subscription.id)].map(([id, items]) => [
-          id,
-          items.length,
-        ]),
-      ),
-    ).toEqual({ [recipient.id]: 1, [sender.id]: 2 })
-  })
-
-  test('pauses the cursor at the last success when dispatch fails', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    let calls = 0
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      // Succeed on the first row, fail on the second.
-      dispatch: async () => (++calls === 1 ? { ok: true } : { error: 'boom', ok: false }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(result.dispatched).toMatchInlineSnapshot(`1`)
-    expect(result.failed).toMatchInlineSnapshot(`1`)
-
-    // Cursor stops at the first (successful) row `(1000002, 0)`, so the failed
-    // one re-runs on the next tick (at-least-once).
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        1000002,
-        0,
-      ]
-    `)
-  })
-
-  test('does not advance the cursor when the first row fails', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async () => ({ error: 'unreachable', ok: false }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(result.dispatched).toMatchInlineSnapshot(`0`)
-    expect(result.failed).toMatchInlineSnapshot(`1`)
-    // Nothing accepted → cursor untouched at the window anchor, so the row
-    // retries next tick.
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        999999,
-        2147483647,
-      ]
-    `)
-  })
-
-  test('stops dispatching when the poll signal is aborted', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const abort = new AbortController()
-    let calls = 0
-    await expect(
-      Webhooks.poll({
-        chainId: 42431,
-        client,
-        db,
-        dispatch: async () => {
-          calls++
-          abort.abort(new Error('lease lost'))
-          return { ok: true }
-        },
-        eventTypes: ['token:transfer'],
-        headBlockNumber: windowHead,
-        signal: abort.signal,
-      }),
-    ).rejects.toThrow('lease lost')
-    expect(calls).toBe(1)
-  })
-
-  test('drains two bounded transfer pages per tick without gaps', async () => {
-    const db = TestApp.database()
-    const subscription = await createVolumeSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const positions: string[] = []
-    const tick = () =>
-      Webhooks.poll({
-        chainId: 42431,
-        client,
-        confirmations: 2,
-        db,
-        dispatch: async ({ envelope }) => {
-          const data = envelope.data as { blockNumber: number; logIndex: number }
-          positions.push(`${data.blockNumber}:${data.logIndex}`)
-          return { ok: true }
-        },
-        eventTypes: ['token:transfer'],
-        headBlockNumber: volumeHead,
-      })
-
-    expect((await tick()).dispatched).toBe(200)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([1_000_003, 144])
-    expect((await tick()).dispatched).toBe(26)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([1_000_003, 223])
-    expect(positions).toHaveLength(226)
-    expect(new Set(positions).size).toBe(226)
-    expect(positions[99]).toBe('1000002:9')
-    expect(positions[100]).toBe('1000002:10')
-  })
-
-  test('commits the first page before a continuation delivery fails', async () => {
-    const db = TestApp.database()
-    const subscription = await createVolumeSubscription(db)
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    let calls = 0
-    const first = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      confirmations: 2,
-      db,
-      dispatch: async () => (++calls === 101 ? { error: 'unreachable', ok: false } : { ok: true }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: volumeHead,
-    })
-
-    expect(first.dispatched).toBe(100)
-    expect(first.failed).toBe(1)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([1_000_002, 9])
-
-    let resumed: readonly [number, number] | undefined
-    await Webhooks.poll({
-      batchSize: 1,
-      chainId: 42431,
-      client,
-      confirmations: 2,
-      db,
-      dispatch: async ({ envelope }) => {
-        const data = envelope.data as { blockNumber: number; logIndex: number }
-        resumed = [data.blockNumber, data.logIndex]
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: volumeHead,
-    })
-    expect(resumed).toEqual([1_000_002, 10])
-  })
-
-  test('round-robins continuation pages across subscriptions', async () => {
-    const db = TestApp.database()
-    const a = await createVolumeSubscription(db, 'org_a')
-    const b = await createVolumeSubscription(db, 'org_b')
-    await Core.setCursor(db, a.id, windowCursor)
-    await Core.setCursor(db, b.id, windowCursor)
-    const [first, second] = [a.id, b.id].sort()
-
-    const order: string[] = []
-    await Webhooks.poll({
-      chainId: 42431,
-      client,
-      confirmations: 2,
-      db,
-      dispatch: async ({ subscription }) => {
-        order.push(subscription.id)
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: volumeHead,
-    })
-
-    expect(order).toHaveLength(400)
-    expect(new Set(order.slice(0, 100))).toEqual(new Set([first]))
-    expect(new Set(order.slice(100, 200))).toEqual(new Set([second]))
-    expect(new Set(order.slice(200, 300))).toEqual(new Set([first]))
-    expect(new Set(order.slice(300, 400))).toEqual(new Set([second]))
-  })
-
-  test('anchors a first-seen subscription at the confirmed head without backfilling', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-      // Rows exist in history, but a brand-new subscription must not replay them.
-    })
-
-    // Nothing scanned or dispatched on the first tick; the cursor is anchored at
-    // the head of the confirmed window (`windowHead - confirmations` = 1000002).
-    expect(result.scanned).toMatchInlineSnapshot(`0`)
-    expect(dispatched).toHaveLength(0)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        1000002,
-        2147483647,
-      ]
-    `)
-  })
-
-  test('dispatches creation-head replacements once confirmed', async () => {
-    const db = TestApp.database()
-    const creationHead = windowTo
-    const subscription = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        destination: { type: 'url', url: 'https://hooks.example.com/x' },
-        eventType: 'token:transfer',
-        filters: { sender: windowSender },
-        owner: { orgId: 'org_test', type: 'api_key' },
-      },
-      { startBlockNumber: creationHead },
-    )
-
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      confirmations: 3,
-      dispatch: async () => ({ ok: true }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: creationHead + 3,
-      client,
-      db,
-    })
-
-    expect(result.dispatched).toBe(2)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 1])
-  })
-
-  test('keeps confirmed creation anchors while sources catch up', async () => {
-    const db = TestApp.database()
-    const startBlockNumber = windowTo + 100
-    const transfer = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        destination: { type: 'url', url: 'https://hooks.example.com/transfer' },
-        eventType: 'token:transfer',
-        filters: { sender: windowSender },
-        owner: { orgId: 'org_transfer', type: 'api_key' },
-      },
-      { startBlockNumber },
-    )
-    const block = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        destination: { type: 'url', url: 'https://hooks.example.com/block' },
-        eventType: 'block:created',
-        filters: {},
-        owner: { orgId: 'org_block', type: 'api_key' },
-      },
-      { startBlockNumber },
-    )
-
-    await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async () => ({ ok: true }),
-      eventTypes: ['token:transfer', 'block:created'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(decodeCursor(await Core.getCursor(db, transfer.id))).toEqual([
-      startBlockNumber - 1,
-      endOfBlockIndex,
-    ])
-    expect(decodeCursor(await Core.getCursor(db, block.id))).toEqual([
-      startBlockNumber - 1,
-      endOfBlockIndex,
-    ])
-  })
-
-  test('advances to the end of the confirmed window on an empty scan', async () => {
-    const db = TestApp.database()
-    const subscription = await createTransferSubscription(db)
-    // Anchor just past the window's only matching block (1000002) and confirm up
-    // to block 1000004 — a range `windowSender` has no transfers in, so the scan
-    // is genuinely empty.
-    await Core.setCursor(db, subscription.id, encodeCursor([windowTo, endOfBlockIndex]))
-
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async () => ({ ok: true }),
-      eventTypes: ['token:transfer'],
-      headBlockNumber: windowTo + 3,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`0`)
-
-    // No rows, clean scan: cursor jumps past the end of the confirmed window
-    // (`headBlockNumber - confirmations` = block 1000004) so it is not rescanned.
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        1000004,
-        2147483647,
-      ]
-    `)
-  })
-
-  // The two pinned-window rows are `Transfer(from, to, value)` logs. Their raw
-  // topic0 (the `Transfer` selector) and the `from` address padded to a bytes32
-  // topic let the raw-log path be filtered as deterministically as the decoded
-  // path.
-  const transferSignature =
-    'event Transfer(address indexed from, address indexed to, uint256 value)'
-  const transferSelector = '0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef'
-  const windowToken = '0x20c00000000000000000000071de0cd31ab0d105'
-  const windowSenderTopic = `0x${'0'.repeat(24)}${windowSender.slice(2)}`
-
-  test('log:emitted decodes args from a signature-matched event view', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      eventType: 'log:emitted',
-      filters: { signature: transferSignature, args: { from: windowSender } },
-      owner: { orgId: 'org_test', type: 'api_key' },
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['log:emitted'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`2`)
-    expect(dispatched[0]?.envelope.data).toMatchInlineSnapshot(`
-      {
-        "address": "0x20c00000000000000000000071de0cd31ab0d105",
-        "args": {
-          "from": "0xE7687128b0A808C2831ff94d4F7B2fb35C65aF38",
-          "to": "0x9E39034aAE71fb89f66061a2602eb6eFeC271754",
-          "value": "10000",
-        },
-        "blockNumber": 1000002,
-        "data": "0x0000000000000000000000000000000000000000000000000000000000002710",
-        "event": {
-          "name": "Transfer",
-          "signature": "event Transfer(address indexed from, address indexed to, uint256 value)",
-          "topic0": "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef",
-        },
-        "logIndex": 0,
-        "timestamp": "2026-01-14T18:38:03.685Z",
-        "topics": [
-          "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef",
-          "0x000000000000000000000000e7687128b0a808c2831ff94d4f7b2fb35c65af38",
-          "0x0000000000000000000000009e39034aae71fb89f66061a2602eb6efec271754",
-        ],
-        "transactionHash": "0x3d24a706cc2f6f4c96620bef1f61ddb23040ff77c22c8db42918c7c424bbf9d3",
-        "transactionIndex": 0,
-      }
-    `)
-  })
-
-  test('log:emitted scans raw logs by topic when no signature is given', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      eventType: 'log:emitted',
-      filters: { topic0: transferSelector, topic1: windowSenderTopic },
-      owner: { orgId: 'org_test', type: 'api_key' },
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['log:emitted'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`2`)
-    expect(dispatched[0]?.envelope.data).toMatchInlineSnapshot(`
-      {
-        "address": "0x20c00000000000000000000071de0cd31ab0d105",
-        "blockNumber": 1000002,
-        "data": "0x0000000000000000000000000000000000000000000000000000000000002710",
-        "logIndex": 0,
-        "timestamp": "2026-01-14T18:38:03.685Z",
-        "topics": [
-          "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef",
-          "0x000000000000000000000000e7687128b0a808c2831ff94d4f7b2fb35c65af38",
-          "0x0000000000000000000000009e39034aae71fb89f66061a2602eb6efec271754",
-        ],
-        "transactionHash": "0x3d24a706cc2f6f4c96620bef1f61ddb23040ff77c22c8db42918c7c424bbf9d3",
-        "transactionIndex": 0,
-      }
-    `)
-  })
-
-  test('log:emitted scans an address-only filter', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/address-only' },
-      eventType: 'log:emitted',
-      filters: { address: '0xffffffffffffffffffffffffffffffffffffffff' },
-      owner: { orgId: 'org_address_only', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      eventTypes: ['log:emitted'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.scanned).toBe(0)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([
-      windowTo,
-      endOfBlockIndex,
-    ])
-  })
-
-  test('log:emitted keeps distinct address and topic pushdowns isolated', async () => {
-    const db = TestApp.database()
-    const address = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/address' },
-      eventType: 'log:emitted',
-      filters: {
-        address: windowToken,
-        args: { from: windowSender },
-        signature: transferSignature,
-      },
-      owner: { orgId: 'org_address', type: 'api_key' },
-    })
-    const topic = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/topic' },
-      eventType: 'log:emitted',
-      filters: { topic0: transferSelector, topic1: windowSenderTopic },
-      owner: { orgId: 'org_topic', type: 'api_key' },
-    })
-    await Promise.all([
-      Core.setCursor(db, address.id, windowCursor),
-      Core.setCursor(db, topic.id, windowCursor),
-    ])
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['log:emitted'],
-      headBlockNumber: windowHead,
-    })
-
-    expect(result.dispatched).toBe(3)
-    expect(
-      Object.fromEntries(
-        [...Map.groupBy(dispatched, ({ subscription }) => subscription.id)].map(([id, items]) => [
-          id,
-          items.length,
-        ]),
-      ),
-    ).toEqual({ [address.id]: 1, [topic.id]: 2 })
-    expect(
-      await Promise.all([Core.getCursor(db, address.id), Core.getCursor(db, topic.id)]),
-    ).toEqual([
-      encodeCursor([windowTo, endOfBlockIndex]),
-      encodeCursor([windowTo, endOfBlockIndex]),
-    ])
-  })
-
-  test('log:emitted limits a tick and resumes within the block', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      eventType: 'log:emitted',
-      filters: { args: { from: windowSender }, signature: transferSignature },
-      owner: { orgId: 'org_test', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const tick = () =>
-      Webhooks.poll({
-        batchSize: 1,
-        chainId: 42431,
-        client,
-        db,
-        dispatch: async (input) => {
-          dispatched.push(input)
-          return { ok: true }
-        },
-        eventTypes: ['log:emitted'],
-        headBlockNumber: windowHead,
-      })
-
-    const first = await tick()
-    expect(first.dispatched).toBe(1)
-    expect(first.hasMore).toBe(true)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 0])
-    const second = await tick()
-    expect(second.dispatched).toBe(1)
-    expect(second.hasMore).toBe(true)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 1])
-    const third = await tick()
-    expect(third.dispatched).toBe(0)
-    expect(third.hasMore).toBeUndefined()
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([
-      windowTo,
-      endOfBlockIndex,
-    ])
-    expect(
-      dispatched.map(({ envelope }) => (envelope.data as { logIndex: number }).logIndex),
-    ).toEqual([0, 1])
-  })
-
-  test('block:created scans new blocks and resolves transaction counts', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        eventType: 'block:created',
-        // Pin to the creation-head height, which may be replaced before confirmation.
-        filters: { number: { eq: `0x${windowTo.toString(16)}` } },
-        owner: { orgId: 'org_test', type: 'api_key' },
-        destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      },
-      { startBlockNumber: windowTo },
-    )
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      confirmations: 3,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['block:created'],
-      headBlockNumber: windowTo + 3,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`1`)
-    expect(dispatched[0]?.envelope.data).toMatchInlineSnapshot(`
-      {
-        "gasLimit": 500000000,
-        "gasUsed": 4340281,
-        "hash": "0x3fe7d9e595f3d8215ec840c6ef55ac0bead58933e96fc2ead0f2aaf79715f45d",
-        "miner": "0x0000000000000000000000000000000000000000",
-        "number": 1000002,
-        "parentHash": "0xa406dff9c51cc2abbef3a811f0499e99a568bf781019f129ab45dca1df0e43e5",
-        "timestamp": "2026-01-14T18:38:03.685Z",
-        "transactionCount": 52,
-      }
-    `)
-    // The window scanner advances to the end of the fully-scanned block so the
-    // next tick resumes at the following block.
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toMatchInlineSnapshot(`
-      [
-        1000002,
-        2147483647,
-      ]
-    `)
-  })
-
-  test('block:created limits a tick and resumes at the next block', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      eventType: 'block:created',
-      filters: {},
-      owner: { orgId: 'org_test', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const tick = () =>
-      Webhooks.poll({
-        batchSize: 1,
-        chainId: 42431,
-        client,
-        db,
-        dispatch: async (input) => {
-          dispatched.push(input)
-          return { ok: true }
-        },
-        eventTypes: ['block:created'],
-        headBlockNumber: windowHead,
-      })
-
-    expect((await tick()).dispatched).toBe(1)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowFrom, 0])
-    expect((await tick()).dispatched).toBe(1)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowFrom + 1, 0])
-    expect(dispatched.map(({ envelope }) => (envelope.data as { number: number }).number)).toEqual([
-      windowFrom,
-      windowFrom + 1,
-    ])
-  })
-
-  test('block:created continues other subscriptions when a block header cannot be read', async () => {
-    const db = TestApp.database()
-    const missingBlock = 4_000_000_000
-    const cursor = encodeCursor([missingBlock - 1, endOfBlockIndex])
-    const unavailable = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        destination: { type: 'url', url: 'https://hooks.example.com/unavailable' },
-        eventType: 'block:created',
-        filters: { number: { eq: `0x${missingBlock.toString(16)}` } },
-        owner: { orgId: 'org_test', type: 'api_key' },
-      },
-      { now: () => new Date('2026-01-01T00:00:00.000Z') },
-    )
-    const healthy = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        destination: { type: 'url', url: 'https://hooks.example.com/healthy' },
-        eventType: 'block:created',
-        filters: { number: { eq: `0x${windowTo.toString(16)}` } },
-        owner: { orgId: 'org_test', type: 'api_key' },
-      },
-      { now: () => new Date('2026-01-01T00:00:01.000Z') },
-    )
-    await Core.setCursor(db, unavailable.id, cursor)
-    await Core.setCursor(db, healthy.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const subscriptions: number[] = []
-
-    await expect(
-      Webhooks.poll({
-        chainId: 42431,
-        dispatch: async (input) => {
-          dispatched.push(input)
-          return { ok: true }
-        },
-        eventTypes: ['block:created'],
-        headBlockNumber: missingBlock + 2,
-        client,
-        db,
-        maxBlocks: 3,
-        onSubscriptions(count) {
-          subscriptions.push(count)
-        },
-      }),
-    ).rejects.toThrow()
-
-    expect(await Core.getCursor(db, unavailable.id)).toBe(cursor)
-    expect(subscriptions).toEqual([2])
-    expect(decodeCursor(await Core.getCursor(db, healthy.id))).toMatchInlineSnapshot(`
-      [
-        1000002,
-        2147483647,
-      ]
-    `)
-    expect(dispatched.map(({ subscription }) => subscription.id)).toEqual([healthy.id])
-  })
-
-  test('transaction:included filters on txs columns and inner calls', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(
-      db,
-      {
-        chainId: 42431,
-        eventType: 'transaction:included',
-        // `from` + an `input` selector (ERC20 `transfer` = 0xa9059cbb) pins the
-        // scan to the deterministic creation-head transaction.
-        filters: { from: windowSender, input: { selector: '0xa9059cbb' } },
-        owner: { orgId: 'org_test', type: 'api_key' },
-        destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      },
-      { startBlockNumber: windowTo },
-    )
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      confirmations: 3,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['transaction:included'],
-      headBlockNumber: windowTo + 3,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`1`)
-    const tx = dispatched[0]?.envelope.data as TransactionEvent | undefined
-    expect(tx?.hash).toMatchInlineSnapshot(
-      `"0x3d24a706cc2f6f4c96620bef1f61ddb23040ff77c22c8db42918c7c424bbf9d3"`,
-    )
-    expect(tx?.sender).toBe(windowSender)
-    if (tx?.meta.rpc.feeToken) {
-      expect(tx.feeToken?.address).toBe(tx.meta.rpc.feeToken)
-      expect(typeof tx.feeToken?.currency).toBe('string')
-      expect(typeof tx.feeToken?.decimals).toBe('number')
-      expect(typeof tx.feeToken?.name).toBe('string')
-      expect(typeof tx.feeToken?.symbol).toBe('string')
-    } else expect(tx?.feeToken).toBeUndefined()
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([
-      windowTo,
-      endOfBlockIndex,
-    ])
-  })
-
-  test('disables stored subscriptions with removed receipt filters', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/legacy' },
-      eventType: 'transaction:included',
-      filters: { includeReceipt: true },
-      owner: { orgId: 'org_legacy', type: 'api_key' },
-    })
-
-    await Webhooks.poll({
-      chainId: 42431,
-      client,
-      db,
-      eventTypes: ['transaction:included'],
-      headBlockNumber: windowHead,
-    })
-
-    const disabled = await Core.getSubscription(db, subscription.owner, subscription.id)
-    expect(disabled?.status).toBe('disabled')
-  })
-
-  test('transaction:included limits a tick and resumes within the block', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      eventType: 'transaction:included',
-      filters: {},
-      owner: { orgId: 'org_test', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, encodeCursor([windowTo - 1, endOfBlockIndex]))
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const tick = () =>
-      Webhooks.poll({
-        batchSize: 1,
-        chainId: 42431,
-        client,
-        db,
-        dispatch: async (input) => {
-          dispatched.push(input)
-          return { ok: true }
-        },
-        eventTypes: ['transaction:included'],
-        headBlockNumber: windowHead,
-      })
-
-    expect((await tick()).dispatched).toBe(1)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 0])
-    expect((await tick()).dispatched).toBe(1)
-    expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 1])
-    expect(
-      new Set(dispatched.map(({ envelope }) => (envelope.data as { hash: string }).hash)).size,
-    ).toBe(2)
-  })
-
-  test('transaction:included preserves the cursor when a confirmed block is unavailable', async () => {
-    const db = TestApp.database()
-    const missingBlock = 4_000_000_000
-    const cursor = encodeCursor([missingBlock - 1, endOfBlockIndex])
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-      eventType: 'transaction:included',
-      filters: { blockNumber: { eq: `0x${missingBlock.toString(16)}` } },
-      owner: { orgId: 'org_test', type: 'api_key' },
-    })
-    await Core.setCursor(db, subscription.id, cursor)
-
-    await expect(
-      Webhooks.poll({
-        chainId: 42431,
-        eventTypes: ['transaction:included'],
-        headBlockNumber: missingBlock + 2,
-        client,
-        db,
-      }),
-    ).rejects.toThrowErrorMatchingInlineSnapshot(`
-      [Webhooks.BlockUnavailableError: Block 4000000000 is unavailable.]
-    `)
-
-    expect(await Core.getCursor(db, subscription.id)).toBe(cursor)
-  })
-
-  test('transaction:included matches exact empty calldata through the poller', async () => {
-    const db = TestApp.database()
-    const subscription = await Core.createSubscription(db, {
-      chainId: 42431,
-      eventType: 'transaction:included',
-      filters: { input: { eq: '0x' } },
-      owner: { orgId: 'org_test', type: 'api_key' },
-      destination: { type: 'url', url: 'https://hooks.example.com/x' },
-    })
-    await Core.setCursor(db, subscription.id, windowCursor)
-
-    const dispatched: Webhooks.poll.Dispatchable[] = []
-    const result = await Webhooks.poll({
-      chainId: 42431,
-      dispatch: async (input) => {
-        dispatched.push(input)
-        return { ok: true }
-      },
-      eventTypes: ['transaction:included'],
-      headBlockNumber: windowHead,
-      client,
-      db,
-    })
-
-    expect(result.scanned).toMatchInlineSnapshot(`1`)
-    expect(dispatched[0]?.envelope.data).toMatchObject({
-      hash: '0x359a47d5a7a582ae412e8ba8bb729b326464f2e97d00bcabf28694e919327f33',
-      input: '0x',
-    })
-  })
-
-  // End-to-end through the *default* transport: `poll` with no injected
-  // `dispatch` falls back to `deliverAndRecord`, which signs and POSTs via
-  // `globalThis.fetch` and records the outcome. These intercept the delivery
-  // request while real RPC reads pass through.
-  describe('default transport (deliverAndRecord)', () => {
-    afterEach(() => {
-      vi.restoreAllMocks()
-    })
-
-    test('delivers a verifiable signed envelope and records success', async () => {
-      const db = TestApp.database()
-      const subscription = await createTransferSubscription(db)
-      await Core.setCursor(db, subscription.id, windowCursor)
-
-      // RPC queries also go through `globalThis.fetch`, so the interceptor passes
-      // non-webhook requests through and captures only the delivery POST.
-      const realFetch = globalThis.fetch.bind(globalThis)
-      const calls: { body: string; headers: Headers; url: string }[] = []
-      vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
-        const url =
-          typeof input === 'string' ? input : input instanceof Request ? input.url : input.href
-        if (!url.startsWith(subscription.destination.url)) return realFetch(input, init)
-        calls.push({
-          body: typeof init?.body === 'string' ? init.body : '',
-          headers: new Headers(init?.headers),
-          url,
-        })
-        return new Response(null, { status: 200 })
-      })
-
-      const result = await Webhooks.poll({
-        // One row per tick keeps the delivery assertions focused on a single
-        // signed envelope.
-        batchSize: 1,
-        chainId: 42431,
-        eventTypes: ['token:transfer'],
-        headBlockNumber: windowHead,
-        client,
-        db,
-      })
-
-      expect(result.dispatched).toBe(1)
-      expect(calls).toHaveLength(1)
-      expect(calls[0]?.url).toBe(subscription.destination.url)
-
-      // The captured body verifies against the subscription's signing secret.
-      expect(
-        Core.verify({
-          body: calls[0]?.body ?? '',
-          secret: subscription.secret,
-          signature: calls[0]?.headers.get('tempo-signature') ?? '',
-        }),
-      ).toBe(true)
-
-      // The delivered envelope carries the matched transfer row and its type.
-      const envelope = JSON.parse(calls[0]?.body ?? '{}') as Core.Envelope
-      expect(envelope.type).toBe('token:transfer')
-      expect(calls[0]?.headers.get('tempo-event-type')).toBe('token:transfer')
-      expect((envelope.data as { blockNumber: number }).blockNumber).toBe(windowTo)
-
-      // Success resets the failure counter, stamps lastDeliveryAt, stays active.
-      const after = await Core.getSubscription(db, subscription.owner, subscription.id)
-      expect(after?.status).toBe('active')
-      expect(after?.failureCount).toBe(0)
-      expect(after?.lastDeliveryAt).toBeDefined()
-    })
-
-    test('pauses on a failed delivery and re-delivers on the next tick', async () => {
-      const db = TestApp.database()
-      const subscription = await createTransferSubscription(db)
-      await Core.setCursor(db, subscription.id, windowCursor)
-
-      const realFetch = globalThis.fetch.bind(globalThis)
-      let attempts = 0
-      vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
-        const url =
-          typeof input === 'string' ? input : input instanceof Request ? input.url : input.href
-        if (!url.startsWith(subscription.destination.url)) return realFetch(input, init)
-        attempts++
-        return new Response(null, { status: attempts === 1 ? 500 : 200 })
-      })
-
-      const tick = () =>
-        Webhooks.poll({
-          batchSize: 1,
-          chainId: 42431,
-          eventTypes: ['token:transfer'],
-          headBlockNumber: windowHead,
-          client,
-          db,
-        })
-
-      const first = await tick()
-      expect(first.failed).toBe(1)
-      expect(first.dispatched).toBe(0)
-      // Cursor paused at the prior position so the row re-delivers next tick.
-      expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([
-        windowFrom - 1,
-        endOfBlockIndex,
-      ])
-
-      const second = await tick()
-      expect(second.dispatched).toBe(1)
-      expect(attempts).toBe(2)
-      // Now advanced past the redelivered row (the first row in block 1000002).
-      expect(decodeCursor(await Core.getCursor(db, subscription.id))).toEqual([windowTo, 0])
-    })
-
-    test('auto-disables a subscription after sustained failures', async () => {
-      const db = TestApp.database()
-      const subscription = await createTransferSubscription(db)
-      await Core.setCursor(db, subscription.id, windowCursor)
-
-      // Real RPC queries pass through; only the webhook delivery fails (500).
-      const realFetch = globalThis.fetch.bind(globalThis)
-      vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
-        const url =
-          typeof input === 'string' ? input : input instanceof Request ? input.url : input.href
-        if (!url.startsWith(subscription.destination.url)) return realFetch(input, init)
-        return new Response(null, { status: 500 })
-      })
-
-      const tick = () =>
-        Webhooks.poll({
-          batchSize: 1,
-          chainId: 42431,
-          eventTypes: ['token:transfer'],
-          headBlockNumber: windowHead,
-          client,
-          db,
-        })
-
-      // Each tick delivers once and fails; after `maxFailures` ticks the
-      // subscription auto-disables and drops out of the poller's active index.
-      for (let i = 0; i < Core.maxFailures; i++) await tick()
-
-      const disabled = await Core.getSubscription(db, subscription.owner, subscription.id)
-      expect(disabled?.status).toBe('disabled')
-      expect(disabled?.failureCount).toBe(Core.maxFailures)
-
-      // A subsequent tick visits no active subscriptions.
-      const after = await tick()
-      expect(after.subscriptions).toBe(0)
-    })
-  })
-
-  // Full loop through the public HTTP surface: create over the route, let the
-  // poller detect an RPC transfer log and deliver via the default transport, then
-  // read the recorded outcome back through the deliveries route. Unlike the
-  // `poll` tests above (which seed subscriptions via the core helper), this
-  // proves the route-issued secret and id line up with what is delivered/logged.
-  describe('end-to-end (routes + poller)', () => {
-    test('create → poll → signed delivery → deliveries route records success', async () => {
-      const db = TestApp.database()
-      const app = TestApp.client({
-        auth: { keys: [writer] },
-        db,
-      })
-
-      // 1. Create through the route; capture the one-time signing secret + id.
-      // The `windowSender` filter pins the scan to the deterministic window rows.
-      const created = await app.v1.webhooks.$post(
-        { json: { ...validBody, chainId: 42431, filters: { sender: windowSender } } },
-        as(writer),
-      )
-      expect(created.status).toBe(200)
-      const { id, secret } = await TestApp.json(created, Webhooks.schema.createWebhook.Response)
-
-      // Anchor the cursor just below the window so the poller scans this tick (a
-      // brand-new subscription anchors at the confirmed head and skips its first
-      // tick).
-      await Core.setCursor(db, id, windowCursor)
-
-      // 2. A local delivery sink that captures the request and acks 200, injected
-      // via `deliverAndRecord`'s `fetch` option (the SSRF guard blocks loopback,
-      // so a real local server can't be a subscriber URL) — no global mock.
-      const calls: { body: string; headers: Headers; url: string }[] = []
-      const fetch = (async (input, init) => {
-        calls.push({
-          body: typeof init?.body === 'string' ? init.body : '',
-          headers: new Headers(init?.headers),
-          url: typeof input === 'string' ? input : '',
-        })
-        return new Response(null, { status: 200 })
-      }) satisfies typeof globalThis.fetch
-
-      // 3. Poll a real RPC transfer log; dispatch through the real
-      // sign+deliver+record core with the injected transport. `batchSize: 1`
-      // delivers exactly one envelope from the window.
-      const result = await Webhooks.poll({
-        batchSize: 1,
-        chainId: 42431,
-        dispatch: ({ envelope, subscription }) =>
-          Core.deliverAndRecord(db, subscription, envelope, { fetch }),
-        eventTypes: ['token:transfer'],
-        headBlockNumber: windowHead,
-        client,
-        db,
-      })
-      expect(result.dispatched).toBe(1)
-
-      // The subscriber received exactly one POST to its URL, signed verifiably
-      // with the secret the route returned.
-      expect(calls).toHaveLength(1)
-      expect(calls[0]?.url).toBe(validBody.destination.url)
-      expect(
-        Core.verify({
-          body: calls[0]?.body ?? '',
-          secret,
-          signature: calls[0]?.headers.get('tempo-signature') ?? '',
-        }),
-      ).toBe(true)
-      const envelope = JSON.parse(calls[0]?.body ?? '{}') as Core.Envelope
-      expect(envelope.type).toBe('token:transfer')
-
-      // 4. The deliveries route shows the recorded success for this event.
-      const deliveries = await app.v1.webhooks[':id{wh_[A-Za-z0-9_-]+}'].deliveries.$get(
-        { param: { id }, query: {} },
-        as(writer),
-      )
-      const log = await TestApp.json(deliveries, Webhooks.schema.listWebhookDeliveries.Response)
-      expect(log.data).toHaveLength(1)
-      expect(log.data[0]?.status).toBe('succeeded')
-      expect(log.data[0]?.eventId).toBe(envelope.id)
-    })
-  })
-})
-
 describe('matchesOperator', () => {
   const addr = '0x20c0000000000000000000008f5425160ebe5525'
   const addr2 = '0x1111111111111111111111111111111111111111'