Identifiers and dedupe — at-least-once

// Dedupe store: durable (database/Redis) in production — an in-memory
// Set dies with the process. Expire the keys after 30 days (the delivery
// retention window) so the store does not grow forever.
async function isDuplicate(store, deliveryId, eventId) {
  // Layer 1: the same delivery retried -> same webhook-delivery-id.
  if (await store.has(`d:${deliveryId}`)) return true;
  // Layer 2: the same event replayed -> new delivery id, same event id.
  if (await store.has(`e:${eventId}`)) return true;
  await store.set(`d:${deliveryId}`, 1);
  await store.set(`e:${eventId}`, 1);
  return false;
}

// In your route, after signature verification passes:
// if (await isDuplicate(store, headers["webhook-delivery-id"], headers["webhook-event-id"])) {
//   return res.status(200).end(); // already processed: acknowledge, do nothing
// }