@flopay/js 1.3.1 → 1.3.3

package/dist/index.d.cts

@@ -432,6 +432,9 @@ declare class PaymentAPI {
         };
         avsCheck?: boolean;
         avsConfig?: Record<string, unknown>;
+    }, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
     }): Promise<void>;
     /**
      * Create a PaymentIntent on the backend.
@@ -692,6 +695,13 @@ declare function createCheckoutSession(options: CreateSessionParams): Promise<Ch
  * Creates a checkout session with automatic retry on timeout/abort errors.
  *
  * Uses exponential backoff: 100ms, 200ms, 400ms, etc.
+ *
+ * The idempotency key (supplied or generated) is resolved **once**, before the
+ * retry loop, and reused for every attempt — so a timeout, a lost response, or
+ * a documented in-progress reply all replay the *same* key and cannot mint a
+ * second checkout session (TeamFloPay/backend#972). A later independent call
+ * resolves its own fresh key. A payload-conflict (`409`) is surfaced without
+ * retrying, since only the exact same request may safely replay a key.
  */
 declare function createCheckoutSessionWithRetries(options: CreateSessionParams & {
     maxRetries?: number;

package/dist/index.d.ts

@@ -432,6 +432,9 @@ declare class PaymentAPI {
         };
         avsCheck?: boolean;
         avsConfig?: Record<string, unknown>;
+    }, options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
     }): Promise<void>;
     /**
      * Create a PaymentIntent on the backend.
@@ -692,6 +695,13 @@ declare function createCheckoutSession(options: CreateSessionParams): Promise<Ch
  * Creates a checkout session with automatic retry on timeout/abort errors.
  *
  * Uses exponential backoff: 100ms, 200ms, 400ms, etc.
+ *
+ * The idempotency key (supplied or generated) is resolved **once**, before the
+ * retry loop, and reused for every attempt — so a timeout, a lost response, or
+ * a documented in-progress reply all replay the *same* key and cannot mint a
+ * second checkout session (TeamFloPay/backend#972). A later independent call
+ * resolves its own fresh key. A payload-conflict (`409`) is surfaced without
+ * retrying, since only the exact same request may safely replay a key.
  */
 declare function createCheckoutSessionWithRetries(options: CreateSessionParams & {
     maxRetries?: number;

package/dist/index.mjs

@@ -517,8 +517,11 @@ import {
   FloPayError as FloPayError3,
   SDK_VERSION,
   FLO_SDK_VERSION_HEADER,
+  IDEMPOTENCY_KEY_HEADER,
+  IDEMPOTENCY_IN_PROGRESS_CODE,
   buildProductPayload,
   foldIntoProducts,
+  resolveIdempotencyKey,
   resolveSessionCurrency
 } from "@flopay/shared";
 
@@ -593,6 +596,7 @@ var DEFAULT_PROCESSING_RETRY_AFTER_MS = 1e3;
 var MIN_PROCESSING_RETRY_AFTER_MS = 500;
 var DEFAULT_PROCESSING_TIMEOUT_MS = 15e3;
 var MAX_PROCESSING_RETRY_AFTER_MS = 3e3;
+var DEFAULT_ACCOUNT_SNAPSHOT_TIMEOUT_MS = 1e4;
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
@@ -634,6 +638,7 @@ async function buildApiErrorFromResponse(response, fallbackMessage) {
   });
 }
 var NETWORK_RETRY_ATTEMPTS = 2;
+var IDEMPOTENCY_IN_PROGRESS_RETRY_ATTEMPTS = 2;
 async function fetchWithNetworkRetry(input, init, attempts = NETWORK_RETRY_ATTEMPTS) {
   let lastErr;
   for (let attempt = 0; ; attempt++) {
@@ -815,18 +820,33 @@ var PaymentAPI = class {
    * pre-pay PATCH would silently leave AVS unsent and cause an
    * AVS-protected charge to decline downstream.
    */
-  async patchAccountSnapshot(sessionId, nonce, body) {
-    const response = await fetchWithNetworkRetry(
-      `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(sessionId)}/account`,
-      {
-        method: "PATCH",
-        headers: {
-          "Content-Type": "application/json",
-          "x-checkout-session-token": nonce
-        },
-        body: JSON.stringify(body)
-      }
-    );
+  async patchAccountSnapshot(sessionId, nonce, body, options) {
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_ACCOUNT_SNAPSHOT_TIMEOUT_MS;
+    const controller = new AbortController();
+    const onCallerAbort = () => controller.abort();
+    if (options?.signal) {
+      if (options.signal.aborted) controller.abort();
+      else options.signal.addEventListener("abort", onCallerAbort, { once: true });
+    }
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetchWithNetworkRetry(
+        `${this.baseUrl}/v1/checkouts/sessions/${encodeURIComponent(sessionId)}/account`,
+        {
+          method: "PATCH",
+          headers: {
+            "Content-Type": "application/json",
+            "x-checkout-session-token": nonce
+          },
+          body: JSON.stringify(body),
+          signal: controller.signal
+        }
+      );
+    } finally {
+      clearTimeout(timer);
+      options?.signal?.removeEventListener("abort", onCallerAbort);
+    }
     if (!response.ok) {
       throw await buildApiErrorFromResponse(response, "Failed to persist account snapshot");
     }
@@ -965,29 +985,41 @@ var PaymentAPI = class {
     if (params.checkoutType) payload["checkoutType"] = params.checkoutType;
     if (params.checkoutLayout) payload["checkoutLayout"] = params.checkoutLayout;
     if (params.avsConfig) payload["avsConfig"] = params.avsConfig;
-    const response = await fetchWithNetworkRetry(
-      `${this.baseUrl}/v1/checkouts/sessions?expand=true`,
-      {
-        method: "POST",
-        // Declare the SDK version so backends at TeamFloPay/backend#823 embed
-        // the hosted vault capture block (`body.vault`) in the response for
-        // SDKs ≥ 1.3.0. Older backends ignore the header.
-        headers: {
-          "Content-Type": "application/json",
-          [FLO_SDK_VERSION_HEADER]: SDK_VERSION
-        },
-        body: JSON.stringify(payload)
-      }
-    );
-    if (response.status === 204) {
-      throw new FloPayError3(
-        "Session auto-completed \u2014 payment method already on file",
-        "api_error",
-        { code: "session_auto_completed" }
+    const headers = {
+      "Content-Type": "application/json",
+      // Declare the SDK version so backends at TeamFloPay/backend#823 embed
+      // the hosted vault capture block (`body.vault`) in the response for
+      // SDKs ≥ 1.3.0. Older backends ignore the header.
+      [FLO_SDK_VERSION_HEADER]: SDK_VERSION
+    };
+    const idempotencyKey = resolveIdempotencyKey(params.idempotencyKey);
+    if (idempotencyKey) {
+      headers[IDEMPOTENCY_KEY_HEADER] = idempotencyKey;
+    }
+    let response;
+    for (let attempt = 0; ; attempt++) {
+      response = await fetchWithNetworkRetry(
+        `${this.baseUrl}/v1/checkouts/sessions?expand=true`,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify(payload)
+        }
       );
-    }
-    if (!response.ok) {
-      throw await buildApiErrorFromResponse(response, "Failed to create checkout session");
+      if (response.status === 204) {
+        throw new FloPayError3(
+          "Session auto-completed \u2014 payment method already on file",
+          "api_error",
+          { code: "session_auto_completed" }
+        );
+      }
+      if (response.ok) break;
+      const error = await buildApiErrorFromResponse(response, "Failed to create checkout session");
+      if (error.code === IDEMPOTENCY_IN_PROGRESS_CODE && attempt < IDEMPOTENCY_IN_PROGRESS_RETRY_ATTEMPTS) {
+        await delay(150 * 2 ** attempt);
+        continue;
+      }
+      throw error;
     }
     const body = await response.json();
     if (body.data && "gateways" in body.data) {
@@ -1786,9 +1818,12 @@ async function loadFloPay(publishableKey, options) {
 // src/create-checkout-session.ts
 import {
   FloPayError as FloPayError7,
+  IDEMPOTENCY_IN_PROGRESS_CODE as IDEMPOTENCY_IN_PROGRESS_CODE2,
+  IDEMPOTENCY_KEY_HEADER as IDEMPOTENCY_KEY_HEADER2,
   SDK_VERSION as SDK_VERSION2,
   buildProductPayload as buildProductPayload2,
   foldIntoProducts as foldIntoProducts2,
+  resolveIdempotencyKey as resolveIdempotencyKey2,
   resolveSessionCurrency as resolveSessionCurrency2
 } from "@flopay/shared";
 var MAX_COUPON_CODES = 5;
@@ -1829,8 +1864,10 @@ async function createCheckoutSession(options) {
     timeoutMs = 12e3,
     clientId,
     currency,
-    utmMetadata
+    utmMetadata,
+    idempotencyKey
   } = options;
+  const resolvedIdempotencyKey = resolveIdempotencyKey2(idempotencyKey);
   if (couponCodes.length > MAX_COUPON_CODES) {
     throw new FloPayError7(
       `Too many coupon codes \u2014 a checkout session accepts at most ${MAX_COUPON_CODES}.`,
@@ -1879,12 +1916,16 @@ async function createCheckoutSession(options) {
   const url = `${billingApiUrl.replace(/\/+$/, "")}/v1/checkouts/sessions`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const headers = { "Content-Type": "application/json" };
+  if (resolvedIdempotencyKey) {
+    headers[IDEMPOTENCY_KEY_HEADER2] = resolvedIdempotencyKey;
+  }
   let status;
   let body;
   try {
     const response = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers,
       body: JSON.stringify(payload),
       signal: controller.signal
     });
@@ -1954,13 +1995,19 @@ async function createCheckoutSessionWithRetries(options) {
   if (!Number.isFinite(maxRetries) || !Number.isInteger(maxRetries) || maxRetries <= 0) {
     throw new Error("Number of retries must be greater than 0");
   }
+  const attemptOptions = {
+    ...sessionOptions,
+    idempotencyKey: resolveIdempotencyKey2(sessionOptions.idempotencyKey)
+  };
   let lastErr;
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
-      return await createCheckoutSession(sessionOptions);
+      return await createCheckoutSession(attemptOptions);
     } catch (err) {
       lastErr = err;
-      if (err instanceof Error && err.name === "AbortError" && attempt < maxRetries) {
+      const isTransportAbort = err instanceof Error && err.name === "AbortError";
+      const isInProgressReplay = err instanceof FloPayError7 && err.code === IDEMPOTENCY_IN_PROGRESS_CODE2;
+      if ((isTransportAbort || isInProgressReplay) && attempt < maxRetries) {
         await new Promise((r) => setTimeout(r, 100 * Math.pow(2, attempt)));
         continue;
       }