Stripe payments to invoices

Stripe delivers payment events by webhook, sometimes more than once, and expects a quick answer. A webhook that acknowledges an event before storing it loses that event when the database is down. Processing the same event twice creates duplicate invoices and messages. And failures go unnoticed when nobody is alerted.

Intake checks the Stripe signature (HMAC-SHA256) and rejects timestamps older than 5 minutes. It answers only after the event is stored; if the insert fails it answers 500, so Stripe retries.

Every minute a Processor claims up to 10 events atomically (FOR UPDATE SKIP LOCKED). Each paid event gets exactly one invoice, enforced by UNIQUE constraints in PostgreSQL. The email, the PDF and the Telegram message are built from the stored invoice row only, so every retry produces the same document.

A Monitor workflow reports dead or stuck events by Telegram and email; a failed event can be replayed with a reason and an audit row. An outside heartbeat reports when the system has been silent for about 15 minutes.