Add account-wide payment callback watching

[tehwave]

Summary

• allow callbacks:watch to monitor every payment when no selector is provided
• scan changed payments through bounded, validated updated_at pagination and fetch complete payment resources
• add readiness boundaries, overlap-safe deduplication, retry behavior, and deterministic clock coverage
• preserve scoped watching and the exact-one-selector requirement for replay
• update command help, README, security guidance, and the Quickpay agent skill

Why

Developers need a foreground callback watcher that can receive new payment-operation callbacks account-wide without identifying a payment or order in advance.

Safety and compatibility

• existing operations before watcher readiness are ignored
• malformed responses, unsafe pagination, cycles, and page overflow fail the scan
• failed retriable scans do not advance the watermark
• callback bodies, HMAC signing, redaction, destination validation, and local delivery retries remain unchanged
• subscription callbacks remain out of scope

Verification

• focused callback, locator, and command tests: 92 tests, 279 assertions
• composer check: 400 tests, 1216 assertions, PHPStan and Pint passed
• composer verify: 400 tests, 1216 assertions, 93.0% coverage, validation and dependency audit passed
• composer build
• builds/quickpay --version
• builds/quickpay list --raw
• builds/quickpay help callbacks:watch
• composer validate --strict
• git diff --check

The requested php scripts/verify-phar-source.php builds/quickpay dev check could not run because that verifier script is not present in the current repository.

[Copilot]

Pull request overview

This PR extends the Quickpay CLI’s callbacks:watch workflow to support account-wide payment callback watching when no payment selector is provided, while preserving the existing selector-scoped behavior and replay constraints. It fits into the callbacks subsystem by enhancing the foreground watcher to safely scan for changed payments using bounded, validated pagination and to forward only post-readiness operations.

Changes:

• Allow selector-free callbacks:watch to watch all payments, introducing a UTC readiness boundary and overlap-safe deduplication.
• Add PaymentLocator::changedBetween() to scan changed payments via updated_at pagination and fetch full payment resources.
• Update command/docs/security/skill guidance and expand feature coverage for new watcher behaviors (readiness, retries, pagination safety, malformed responses).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/Feature/Commands/Callbacks/WatchCallbacksCommandTest.php	Adds CLI-level coverage for selector-free watch and updated help/argument descriptions.
tests/Feature/Callbacks/Watching/CallbackWatchRunnerTest.php	Adds extensive runner coverage for readiness, scanning windows, dedup, retry behavior, and malformed responses.
tests/Feature/Callbacks/Resolution/PaymentLocatorTest.php	Adds coverage for changed-payment scanning, pagination safety (origin/cycles/max pages), and deduped full fetches.
skills/quickpay/SKILL.md	Updates agent guidance for selector-free account-wide watching and safety notes.
SECURITY.md	Documents account-wide forwarding implications and guidance to scope with a selector when appropriate.
README.md	Updates user-facing docs/examples for account-wide watch mode and readiness semantics.
app/Commands/Callbacks/WatchCallbacksCommand.php	Switches to CallbackRequest::forWatch() and adds account-wide watch event rendering.
app/Callbacks/Watching/CallbackWatchRunner.php	Implements account-wide watch flow with readiness timestamp, bounded scanning windows, and operation timestamp validation.
app/Callbacks/Resolution/PaymentLocator.php	Introduces changedBetween() with validated pagination and full-resource fetching for changed payments.
app/Callbacks/Input/CallbackRequest.php	Adds forWatch() to allow selector-free watch while retaining selector requirements for other flows.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.