Idempotent Payment Webhooks

Build an API that receives signed payment events and updates order state safely across retries.

Requirements

1. 01Verify each provider signature against the raw request body before parsing or mutating state.
2. 02Deduplicate by provider event ID so retries return a stable success response without repeating side effects.
3. 03Apply an explicit order-state transition table; late or out-of-order events must not regress a terminal state.
4. 04Persist the event record and order transition atomically under concurrent delivery.
5. 05Return observable, retry-safe responses for accepted, duplicate, invalid-signature, and temporarily failed events.

Constraints

• • Submit one compact engineering spec, not implementation code.
• • The generated artifact must use the declared Node.js API adapter.
• • Scoring rewards observable behavior and prompt efficiency, not runtime.