### Phase 1: GPT-Architect (System Architecture & Data Schema) **Database Schema (PostgreSQL):** - invoices: id (UUID, PK), user_id (UUID), stripe_invoice_id (TEXT), amount_due (INT), status (TEXT), due_date (TIMESTAMP), created_at (TIMESTAMP) - reminders: id (UUID, PK), invoice_id (UUID, FK), reminder_type (TEXT), sent_at (TIMESTAMP), idempotency_key (TEXT UNIQUE) **API Endpoints:** - POST /api/webhooks/stripe: Handles invoice.payment_failed events. - GET /api/reminders/pending: Returns list of overdue invoices needing follow-up. --- ### Phase 2: Claude-Engineer (Core Implementation Code) ```javascript import Stripe from 'stripe'; import { Pool } from 'pg'; import twilio from 'twilio'; const stripe = new Stripe(process.env.STRIPE_SECRET_KEY); const pool = new Pool({ connectionString: process.env.DATABASE_URL }); const twilioClient = twilio(process.env.TWILIO_SID, process.env.TWILIO_AUTH_TOKEN); export async function handleStripeWebhook(req, res) { const sig = req.headers['stripe-signature']; let event; try { event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET); } catch (err) { return res.status(400).send(`Webhook Error: ${err.message}`); } if (event.type === 'invoice.payment_failed') { const invoice = event.data.object; const idempotencyKey = `${invoice.id}_failed_${invoice.attempt_count}`; const client = await pool.connect(); try { await client.query('BEGIN'); const insertQuery = ` INSERT INTO reminders (invoice_id, reminder_type, idempotency_key) VALUES ($1, 'sms', $2) ON CONFLICT (idempotency_key) DO NOTHING RETURNING id; `; const result = await client.query(insertQuery, [invoice.id, idempotencyKey]); if (result.rowCount > 0 && invoice.customer_phone) { await twilioClient.messages.create({ body: `Payment failed for invoice #${invoice.number}. Update payment method: ${invoice.hosted_invoice_url}`, from: process.env.TWILIO_PHONE, to: invoice.customer_phone }); } await client.query('COMMIT'); } catch (dbErr) { await client.query('ROLLBACK'); return res.status(500).json({ error: 'DB processing failed' }); } finally { client.release(); } } res.json({ received: true }); } Phase 3: Gemini-Synthesizer (Integration & Context Pipelines) Architecture Data Flow: [Stripe Webhook] -> [Fastify/Express Endpoint] -> [PostgreSQL Idempotency Check] -> [Twilio Worker] Environment Configuration: Bash STRIPE_SECRET_KEY=sk_test_123 STRIPE_WEBHOOK_SECRET=whsec_123 DATABASE_URL=postgresql://postgres:password@localhost:5432/app TWILIO_SID=AC123 TWILIO_AUTH_TOKEN=secret_token TWILIO_PHONE=+1234567890 Phase 4: Grok-Auditor (Stress Testing, Security & Edge Cases) SMS Flooding Risk: If Stripe sends rapid consecutive webhook retries, ensure an explicit time-window guard prevents users from receiving duplicate SMS alerts within 24 hours. Connection Starvation: Unauthenticated webhook endpoint traffic could overwhelm the Postgres pool. Add an Express rate-limiting middleware or an IP check before opening database transactions. TCPA Regulation: Automated SMS alerts without explicit recipient opt-in violate carrier guidelines. Ensure opt-in flags are saved before scheduling notifications.