ابنِ تجربة تجارة مخصصة على برنتلت

Implement a production-ready server-to-server integration with Printlet API Integration v1.

AUTHORITATIVE PRINTLET RESOURCES
- Integration guide: https://printleteg.com/developers/api-integration
- OpenAPI 3.1 contract: https://printleteg.com/api/developer-docs/api-integration/openapi
- Interactive API reference: https://printleteg.com/developers/api-integration/reference
- Credential management: https://printleteg.com/dashboard/settings/integrations/api
- API base URL: https://printleteg.com/api/integrations/v1

Before writing code, fetch and read the integration guide and OpenAPI contract. Treat the OpenAPI document as the source of truth for request and response fields. If either URL cannot be fetched, stop and report the exact URL and HTTP error instead of guessing the contract.

SETUP
1. Ask me to create a test installation and obtain a one-time test key from the credential-management URL.
2. Expect PRINTLET_API_KEY in the server-side environment. Never request that I paste the secret into chat and never expose it to a browser, mobile app, repository, logs, error reports, or generated code.
3. Use this server-side configuration:
   PRINTLET_API_BASE_URL=https://printleteg.com/api/integrations/v1
   PRINTLET_API_KEY=<read from server environment>
   PRINTLET_WEBHOOK_SECRET=<read from server environment>
4. Send Authorization: Bearer $PRINTLET_API_KEY on every API request.
5. Start with prnt_test_ credentials. Do not use live credentials until all acceptance tests pass.

IMPLEMENTATION SEQUENCE
1. Build a typed API client from the OpenAPI contract with timeouts and redacted structured errors.
2. Discover countries, products, product details, variants, print areas, techniques, placement presets, prices, and shipping methods. Never hard-code or derive Printlet IDs; persist them as opaque strings.
3. Upload the untouched original artwork using a direct upload intent or remote HTTPS ingestion. Wait for asynchronous validation to complete.
4. Let the user select only catalog-provided placement presets. The artwork fills the chosen print area; do not submit arbitrary coordinates, layers, scaling, or rotation in v1.
5. Create and poll a preview before checkout so the customer can see Printlet's configurator-equivalent mockup.
6. Create a quote using the recipient address and selected items, then create the order from validated resources.
7. Send a new UUID Idempotency-Key on every POST. Persist the key with the local operation and reuse that same key when retrying the same operation after a timeout.
8. Persist Printlet resource IDs and statuses. Treat pending resources as asynchronous until a webhook or GET response reaches a terminal state.
9. Implement webhook receipt using the exact raw request bytes. Verify Printlet's HMAC signature in constant time, reject timestamps older than five minutes, deduplicate event IDs, persist before returning 2xx, and make processing idempotent.
10. Reconcile missed events through GET /events and process catalog-change events before relying on changed catalog entities.

BUSINESS RULES
- The merchant owns the end-customer relationship, charges any retail amount, and controls customer-facing tax and shipping rules.
- Do not collect Printlet's fulfillment payment during customer checkout. The merchant pays Printlet from wallet balance or manually by card in the Printlet dashboard.
- Card-paid and COD customer orders can have separate automatic-wallet-fulfillment settings. Do not commit an unverified COD order unless the merchant's configuration explicitly allows it.
- Test and live credentials and data are isolated. A test key must never create live fulfillment side effects.

DELIVERABLES AND ACCEPTANCE TESTS
- Typed Printlet client isolated behind a small service interface.
- Server-only environment validation with secret redaction.
- Catalog sync/discovery, artwork upload and validation, preview, quote, order creation, order-status reconciliation, and verified webhook handling.
- Integration tests for invalid and revoked authentication, pagination, catalog discovery, artwork rejection, async polling, preview completion, quoting, idempotent order retries, webhook signature validation, stale/replayed events, test/live isolation, rate limits, and documented error responses.
- A short README naming the Printlet documentation and OpenAPI URLs above, required environment variables, local test commands, and the exact steps to switch from test to live safely.

Do not invent missing fields or behavior. Cite the relevant OpenAPI operationId when explaining each implemented API call.