Preconditions: options.onResolveAmount is provided.
maxCallbacksPerWindow (if set) is a positive integer.
rateLimitWindowMs (if set) is a positive integer ≥ 1000.
Side effect: emits a console.warn when both onCheckDuplicate
and onMarkProcessed are absent (in-memory fallback) and
suppressMultiInstanceWarning is not set.
SatimMissingDataError when onResolveAmount is missing.
SatimInvalidArgumentError when rate-limiter parameters are out of range or non-integer.
Verify a webhook callback by re-fetching authoritative state.
Flow (each step short-circuits with null on failure):
source via extractOrderId.onCheckDuplicate(orderId).onResolveAmount(orderId). Unknown order → null (no gateway call).satim.confirm(orderId, expectedAmount) — verifyAmount runs automatically on success.onMarkProcessed(orderId) if the response is not pending.finally.Postcondition: returns a WebhookResult on success (including
duplicate detection), or null when input is invalid, rate
limited, or the order is unknown.
Complexity: dominated by the gateway round trip in step 6
(O(network)). All other steps are O(1) or O(log n) (rate
limiter).
Anything satim.confirm() can throw — primarily
SatimUnexpectedResponseError on transport failures
or amount mismatch. Callers should wrap the call and
respond with HTTP 500 on unexpected throws.
Zero-trust webhook handler.
Construct via
satim.createWebhookHandler(options); do not instantiate directly (thesatimreference is required).The per-orderId in-flight lock serialises concurrent invocations for the same orderId; different orderIds run in parallel.