[Akanimoh12]

Summary

This PR implements four issues in one branch:

• contract: implement gas-optimized batch payroll cancellation and unclaimed escrow reclamation #188 Payroll escrow with an expiration timestamp, plus sender reclamation of unclaimed funds
• backend: implement automated Webhook dead-letter alerting and PagerDuty / Slack incident bridge #189 Webhook incident alerting to Slack, PagerDuty, and email, with recovery notices
• frontend: build interactive subscription dunning workflow builder and email sequence manager #190 Dunning workflow builder, email template editor, and recovery funnel
• widget: implement multi-currency token selector and live DEX swap quote preview in checkout #191 Multi-asset "Pay With" in the checkout widget, with a live swap quote and an atomic swap-subscribe transaction

Each change is its own commit, so they can be reviewed separately.

#188 Payroll escrow reclamation (contracts/soroban)

• create_payroll_escrow pulls the deposit into the contract and records total_deposited, claimed_amount, expiration_timestamp, and a reclaimed flag.
• claim_payroll_escrow lets the recipient withdraw while now <= expiration_timestamp.
• reclaim_unclaimed_payroll(sender, payroll_id) requires sender auth and now > expiration_timestamp. It computes unclaimed = total_deposited - claimed_amount, asserts it is positive, marks the escrow reclaimed before transferring, and emits payroll_escrow_reclaimed.
• Claims and reclaims meet at the expiration with no gap or overlap. The existing batch payroll and multisig flows are unchanged.

#189 Webhook incident alerting (apps/backend)

• webhook-alerts.js tracks each endpoint over a 15-minute rolling window and reports the failure rate. An incident opens after 5 consecutive 5xx or connection errors. The next 2xx resolves it and sends a "Webhook Delivery Restored" notice. Other 4xx responses are neutral.
• Each alert carries the endpoint URL, the failed event type, the error code, and a link to the DLQ inspector.
• Channels: Slack Incoming Webhook, PagerDuty Events API v2 (trigger and resolve share a dedup_key), and email through a relay set by ALERT_EMAIL_RELAY_URL.
• Routes: GET/POST /webhook-alert-channels, DELETE /webhook-alert-channels/:id. Backed by the new webhook_alert_channels table.
• webhooks.js calls an optional observer after every dispatch and resend. It runs off the request path, so alert delivery never slows or fails a webhook.

#190 Dunning workflow builder (apps/backend + apps/frontend)

• Backend: GET/PUT /dunning/workflow store a merchant's steps (day, retry toggle, action, grace discount, markdown templates) in dunning_workflows. Validation requires increasing days, a final attempt as the last step, and known placeholders only.
• The scheduler honors a saved workflow for retry days and attempt count. Without one, the original Day 1 / 3 / 5 / 7 behavior is unchanged.
• dunning.attempt_failed webhooks include the rendered email subject and body for the step, so the merchant can send it.
• GET /dunning/analytics returns failed and recovered invoices, recovered volume, net churn prevented, and recovery rate.
• Frontend: a new page at /dashboard/dunning with a timeline editor, a markdown editor with placeholder chips and a live preview (escaped before rendering), validation before save, and funnel cards.

#191 Multi-asset checkout (packages/checkout-widget + contract)

• Pay With selector listing the connected wallet's USDC, EURC, XLM, and AQUA balances. Assets with no balance are hidden.
• Live quote from Horizon strict-receive paths: rate, price impact against the mid-market rate (flagged above 5%), and the maximum input after slippage (0.5%, 1%, 3%).
• Atomic swap and subscribe: a new contract entrypoint, create_vault_with_swap, creates the vault, stores the swap config, and approves the payment-token allowance in one invocation. Soroban allows one contract invocation per transaction, so this is what keeps the steps atomic. The whole call reverts if any step fails.
• Router allowlist: merchants approve routers on-chain with approve_swap_router / revoke_swap_router. The contract rejects any router the merchant has not approved.

Testing

Run and passing:

• Backend, Vitest: test/webhook-alerts.test.js, test/webhooks.test.js, test/dunning.test.js, 22 tests passing. This run was before the final dunning.js change, so the dunning suite should be re-run.

Written but not run:

• Contract: new tests in contracts/soroban/src/test.rs for escrow (test_payroll_*) and swap subscribe (test_create_vault_with_swap_*). I have not compiled or run them. Run cargo test in contracts/soroban before merging.
• Frontend: test/dunning-workflow.test.mjs (Node test runner) has not been run. The view has not been type-checked.
• Widget: not built. The widget's package-lock.json is out of sync with its package.json (npm ci fails on utf-8-validate) and that predates this PR. The JSX was not syntax-checked.

Known limitations and follow-ups

• backend: implement automated Webhook dead-letter alerting and PagerDuty / Slack incident bridge #189: incident state is held in memory, so each API instance tracks its own endpoints. The DLQ link uses ?view=developers&delivery=<id>. The developers view does not yet open that delivery automatically.
• frontend: build interactive subscription dunning workflow builder and email sequence manager #190: the backend does not send the emails itself. It delivers the rendered copy in the webhook payload, and the merchant's system sends it. The builder page is not linked from the dashboard navigation yet.
• widget: implement multi-currency token selector and live DEX swap quote preview in checkout #191: the USDC, EURC, and AQUA issuer addresses need checking before release. Plans need swap_router_address set, but no route exists to set it yet. The contract ABI in packages/contract-sdk was not regenerated for the new entrypoints.
• contract: implement gas-optimized batch payroll cancellation and unclaimed escrow reclamation #188: the new contract entrypoints are not in the generated contract SDK ABI either.

Closes #188
Closes #189
Closes #190
Closes #191

[vercel]

@Akanimoh12 is attempting to deploy a commit to the Abdqoharr Olayiwola's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Akanimoh12 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits