def transfer(balances, source, destination, amount):
    """Public API accepts untrusted numeric amounts: reject nonpositive amounts before mutating balances. Neither balance may become negative."""
    if amount <= 0 or amount > balances[source]:
        raise ValueError("insufficient funds")
    balances[source] -= amount
    balances[destination] += amount
