# Roberto Enterprise Payment Architecture

## Request path

Client → shared API gateway → Hyperswitch orchestration → Stripe / Midtrans / Xendit / PayPal / QRIS rail → normalized webhook → order service → refund and settlement ledger.

## Core guarantees

- One payment intent contract independent of provider.
- Idempotency for every mutating request.
- Provider selection by method, country, currency, health, and business policy.
- No fulfillment from browser redirects alone; use verified provider state.
- Full audit trail for webhook, refund, and settlement operations.
- PCI-appropriate tokenization or hosted collection in production.

## Cloudflare demo boundary

The included Worker simulates orchestration behavior. It does not charge real payment methods. Native Hyperswitch should run in its supported container or managed environment and be exposed through the shared API Platform.