Universal Webhook Idempotency Receipt Guard

Release: GCD-INT-001 v1.0.1

Authenticate first. Verify the provider signature against the exact raw body before using its event ID or digest. The guard is not a signature verifier.

Five-minute verification

  1. Install Node.js 20 or newer.
  2. Open a terminal in this extracted folder and run npm test.
  3. Run npm run example; the expected output is process.
  4. Read the atomic store contract in README.md.

Production integration

  1. Implement a shared durable store with an atomic claim operation.
  2. Verify the webhook signature, then SHA-256 hash the verified raw body.
  3. Call begin() before business side effects.
  4. Complete the receipt only after all intended effects succeed; release only safely retryable failures.
  5. Exercise new, duplicate, conflict, crash, and retry paths in staging.

The in-memory example is intentionally not production storage. Review retention, privacy, observability, provider retry behavior, and rollback before deployment.