Add live money readiness controls

api/incident.js

@@ -0,0 +1,48 @@
+import { recordAuditEvent } from "./_db.js";
+
+async function notifyIncidentWebhook(payload) {
+  const url = process.env.INCIDENT_WEBHOOK_URL || process.env.SENTRY_WEBHOOK_URL;
+  if (!url) return { sent: false, reason: "No incident webhook is configured" };
+
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+  });
+
+  return { sent: response.ok, status: response.status };
+}
+
+export default async function handler(req, res) {
+  res.setHeader("Cache-Control", "no-store");
+
+  if (req.method !== "POST") {
+    res.setHeader("Allow", "POST");
+    return res.status(405).json({ ok: false, error: "Method not allowed" });
+  }
+
+  try {
+    const adminToken = process.env.RISK_ADMIN_TOKEN || "";
+    if (adminToken && req.headers["x-admin-token"] !== adminToken) {
+      return res.status(401).json({ ok: false, error: "Invalid admin token" });
+    }
+    if (!adminToken) {
+      return res.status(503).json({ ok: false, error: "Incident endpoint is locked until RISK_ADMIN_TOKEN is configured" });
+    }
+
+    const body = typeof req.body === "string" ? JSON.parse(req.body || "{}") : (req.body || {});
+    const payload = {
+      at: new Date().toISOString(),
+      severity: String(body.severity || "warning"),
+      title: String(body.title || "Polymarket Arena incident"),
+      detail: String(body.detail || ""),
+      live_trading_enabled: process.env.LIVE_TRADING_ENABLED === "true",
+    };
+
+    await recordAuditEvent("INCIDENT_REPORTED", payload);
+    const notification = await notifyIncidentWebhook(payload);
+    return res.status(200).json({ ok: true, notification, payload });
+  } catch (err) {
+    return res.status(500).json({ ok: false, error: err?.message || "Incident report failed" });
+  }
+}