@garuhq/node 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to `@garuhq/node` are documented in this file. Format:
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versioning: [SemVer](https://semver.org/).
 
+## [0.12.1] — 2026-05-19
+
+### Fixed
+
+- `webhookEvents.resend(id)` now auto-attaches `X-Idempotency-Key`
+  (UUIDv4) so transient transport retries (5xx → SDK backoff) cannot
+  create duplicate clones. Previously, a 503 mid-flight after the
+  backend had already committed the clone could trigger an SDK retry
+  and produce a second clone with a different id. With the
+  idempotency key in place, the backend returns the original clone on
+  the second call within 24h. Pass `{ idempotencyKey }` to dedupe
+  across your own retry layer.
+
+### Added
+
+- `ResendWebhookEventParams` type exported from the package root —
+  the optional `{ idempotencyKey?: string }` for `resend()`.
+- README quickstart entry for `webhookEvents`
+  (`list` / `get` / `resend` / `retry`), including the audit-trail
+  contract and the SDK→gateway idempotency note.
+
 ## [0.12.0] — 2026-05-19
 
 ### Added

package/README.md

@@ -292,6 +292,38 @@ app.post('/webhooks/garu', express.raw({ type: 'application/json' }), (req, res)
 > [!IMPORTANT]
 > Always pass the raw request body to `verify()`. Parsing and re-serializing JSON will break the signature check.
 
+## Webhook events
+
+The seller-facing delivery log for outbound webhooks. Use it to audit deliveries, surface failures, and replay events when a customer's endpoint missed one. Webhook endpoint *configuration* (URL, subscribed events, secret) is still dashboard-only — this resource only covers the event log + manual retries.
+
+```ts
+// Surface anything that didn't make it through
+const failed = await garu.webhookEvents.list({ status: 'failed', limit: 50 });
+
+// Inspect one event end-to-end
+const event = await garu.webhookEvents.get(42);
+console.log(event.responseStatus, event.responseBody);
+
+// Audit-trail-preserving replay (recommended)
+const clone = await garu.webhookEvents.resend(42);
+clone.id !== event.id;             // true — fresh row with its own id
+clone.manualResendOf === event.id; // true — points back at the source
+```
+
+`resend(id)` is the audit-preserving counterpart to `retry(id)` — the backend inserts a fresh event whose `manualResendOf` points back at the source, then dispatches that clone. The original row stays exactly as it was, so the historical record of the prior failure (status, response status/body, attempts) survives. Works on any source status (`success` / `failed` / `pending`).
+
+Outbound deliveries of a resent event carry `Idempotency-Key: resend_<originalId>`, so recipient handlers can distinguish a resend from a fresh delivery both by the header prefix and by reading the response payload's `manualResendOf` field.
+
+> [!NOTE]
+> The SDK auto-attaches `X-Idempotency-Key` (UUIDv4) on `resend()` so transient transport retries can't create duplicate clones. Pass `{ idempotencyKey }` to dedupe across your own retry layer.
+
+| Method                          | Purpose                                                                            |
+| ------------------------------- | ---------------------------------------------------------------------------------- |
+| `list(params?)`                 | Paginated event log. Filter by `status`, `eventType`, `endpointId`. Newest first. |
+| `get(id)`                       | One event — full payload, endpoint snapshot, most recent response.                |
+| `resend(id, params?)`           | Clone-on-resend. Returns the new event; original is untouched. **Preferred.**     |
+| `retry(id)`                     | Legacy in-place reset (mutates the original row). Soft-deprecated.                |
+
 ## Error handling
 
 Every error extends `GaruError`. API errors include `status`, `requestId`, and `body`.

package/dist/index.cjs

@@ -943,6 +943,11 @@ var WebhookEvents = class {
    * original — distinguishable both by the `resend_` prefix and by reading
    * the response payload's `manualResendOf` field.
    *
+   * **SDK→gateway dedup**: the SDK auto-attaches `X-Idempotency-Key`
+   * (UUIDv4 unless you pass `idempotencyKey`) so transient transport
+   * retries (5xx → SDK backoff) cannot create duplicate clones — the
+   * backend returns the original clone on the second call within 24h.
+   *
    * Returns the *clone* event (new id), not the original. The original is
    * unchanged on the server.
    *
@@ -952,10 +957,12 @@ var WebhookEvents = class {
    * clone.id !== event.id;            // true — clone has its own id
    * clone.manualResendOf === event.id; // true — points back at the source
    */
-  async resend(id) {
+  async resend(id, params = {}) {
+    const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();
     return this.http.call(
       (signal) => this.http.client.POST(`/api/webhook-events/${id}/resend`, {
         body: {},
+        headers: { "X-Idempotency-Key": idempotencyKey },
         signal
       }).then((r) => r)
     );

package/dist/index.d.cts

@@ -618,6 +618,16 @@ interface ListWebhookEventsParams {
     /** Filter by the destination endpoint that should receive (or received) the event. */
     endpointId?: number;
 }
+interface ResendWebhookEventParams {
+    /**
+     * SDK→gateway idempotency key. If omitted, the SDK generates a UUIDv4
+     * and forwards it as `X-Idempotency-Key`. Within 24h the backend
+     * returns the original clone instead of creating a new one — pass a
+     * stable key from your own retry layer to dedupe across SDK
+     * invocations.
+     */
+    idempotencyKey?: string;
+}
 /**
  * Per-product portal customization (Atletia coach-as-product modeling and
  * any other B2B2C platform). `null` fields inherit from the seller-level
@@ -1163,6 +1173,11 @@ declare class WebhookEvents {
      * original — distinguishable both by the `resend_` prefix and by reading
      * the response payload's `manualResendOf` field.
      *
+     * **SDK→gateway dedup**: the SDK auto-attaches `X-Idempotency-Key`
+     * (UUIDv4 unless you pass `idempotencyKey`) so transient transport
+     * retries (5xx → SDK backoff) cannot create duplicate clones — the
+     * backend returns the original clone on the second call within 24h.
+     *
      * Returns the *clone* event (new id), not the original. The original is
      * unchanged on the server.
      *
@@ -1172,7 +1187,7 @@ declare class WebhookEvents {
      * clone.id !== event.id;            // true — clone has its own id
      * clone.manualResendOf === event.id; // true — points back at the source
      */
-    resend(id: number): Promise<WebhookEvent>;
+    resend(id: number, params?: ResendWebhookEventParams): Promise<WebhookEvent>;
 }
 
 interface GaruOptions {
@@ -1274,4 +1289,4 @@ declare class GaruServerError extends GaruAPIError {
     constructor(message: string, status: number, requestId: string | null, body: unknown);
 }
 
-export { type CancelAtPeriodEndScheduledChargeParams, type CancelRecurrenceScheduledChargeParams, type CardInfo, type ChangePaymentMethodScheduledChargeParams, type Charge, type ChargeList, type ChargeStatus, type CreateChargeParams, type CreateCustomerParams, type CreateScheduledChargeParams, type Customer, type CustomerList, type CustomerRecord, type FailurePayload, Garu, GaruAPIError, GaruAuthenticationError, GaruConnectionError, GaruError, type GaruErrorCode, type GaruFailureCode, GaruNotFoundError, type GaruOptions, GaruPermissionError, GaruRateLimitError, GaruServerError, GaruSignatureVerificationError, GaruValidationError, type ListChargesParams, type ListCustomersParams, type ListProductsParams, type ListScheduledChargeAttemptsParams, type ListScheduledChargesParams, type ListWebhookEventsParams, type MarkPaidScheduledChargeParams, type MetaFeatures, type MetaResponse, type PaginatedList, type PauseScheduledChargeParams, type PaymentMethod, type PaymentMethodExpiredPayload, type PaymentMethodExpiringPayload, type PostponeScheduledChargeParams, type Product, type ProductList, type ProductPortalConfig, type RecurrenceConfig, type RecurrenceInterval, type RefundChargeParams, type ScheduledChargeActor, type ScheduledChargeAttempt, type ScheduledChargeAttemptList, type ScheduledChargeAttemptSource, type ScheduledChargeAttemptStatus, type ScheduledChargeDetail, type ScheduledChargeEvent, type ScheduledChargeEventType, type ScheduledChargeLinkedTransaction, type ScheduledChargeList, type ScheduledChargeRecord, type ScheduledChargeStatus, type ScheduledChargeType, type ScheduledPaymentMethod, type SetProductPortalConfigParams, type UpdateCustomerParams, type VerifiedWebhook, type VerifyWebhookParams, type WebhookEvent, type WebhookEventEndpoint, type WebhookEventList, type WebhookEventStatus, type WirePaymentMethodId, webhooks };
+export { type CancelAtPeriodEndScheduledChargeParams, type CancelRecurrenceScheduledChargeParams, type CardInfo, type ChangePaymentMethodScheduledChargeParams, type Charge, type ChargeList, type ChargeStatus, type CreateChargeParams, type CreateCustomerParams, type CreateScheduledChargeParams, type Customer, type CustomerList, type CustomerRecord, type FailurePayload, Garu, GaruAPIError, GaruAuthenticationError, GaruConnectionError, GaruError, type GaruErrorCode, type GaruFailureCode, GaruNotFoundError, type GaruOptions, GaruPermissionError, GaruRateLimitError, GaruServerError, GaruSignatureVerificationError, GaruValidationError, type ListChargesParams, type ListCustomersParams, type ListProductsParams, type ListScheduledChargeAttemptsParams, type ListScheduledChargesParams, type ListWebhookEventsParams, type MarkPaidScheduledChargeParams, type MetaFeatures, type MetaResponse, type PaginatedList, type PauseScheduledChargeParams, type PaymentMethod, type PaymentMethodExpiredPayload, type PaymentMethodExpiringPayload, type PostponeScheduledChargeParams, type Product, type ProductList, type ProductPortalConfig, type RecurrenceConfig, type RecurrenceInterval, type RefundChargeParams, type ResendWebhookEventParams, type ScheduledChargeActor, type ScheduledChargeAttempt, type ScheduledChargeAttemptList, type ScheduledChargeAttemptSource, type ScheduledChargeAttemptStatus, type ScheduledChargeDetail, type ScheduledChargeEvent, type ScheduledChargeEventType, type ScheduledChargeLinkedTransaction, type ScheduledChargeList, type ScheduledChargeRecord, type ScheduledChargeStatus, type ScheduledChargeType, type ScheduledPaymentMethod, type SetProductPortalConfigParams, type UpdateCustomerParams, type VerifiedWebhook, type VerifyWebhookParams, type WebhookEvent, type WebhookEventEndpoint, type WebhookEventList, type WebhookEventStatus, type WirePaymentMethodId, webhooks };

package/dist/index.d.ts

@@ -618,6 +618,16 @@ interface ListWebhookEventsParams {
     /** Filter by the destination endpoint that should receive (or received) the event. */
     endpointId?: number;
 }
+interface ResendWebhookEventParams {
+    /**
+     * SDK→gateway idempotency key. If omitted, the SDK generates a UUIDv4
+     * and forwards it as `X-Idempotency-Key`. Within 24h the backend
+     * returns the original clone instead of creating a new one — pass a
+     * stable key from your own retry layer to dedupe across SDK
+     * invocations.
+     */
+    idempotencyKey?: string;
+}
 /**
  * Per-product portal customization (Atletia coach-as-product modeling and
  * any other B2B2C platform). `null` fields inherit from the seller-level
@@ -1163,6 +1173,11 @@ declare class WebhookEvents {
      * original — distinguishable both by the `resend_` prefix and by reading
      * the response payload's `manualResendOf` field.
      *
+     * **SDK→gateway dedup**: the SDK auto-attaches `X-Idempotency-Key`
+     * (UUIDv4 unless you pass `idempotencyKey`) so transient transport
+     * retries (5xx → SDK backoff) cannot create duplicate clones — the
+     * backend returns the original clone on the second call within 24h.
+     *
      * Returns the *clone* event (new id), not the original. The original is
      * unchanged on the server.
      *
@@ -1172,7 +1187,7 @@ declare class WebhookEvents {
      * clone.id !== event.id;            // true — clone has its own id
      * clone.manualResendOf === event.id; // true — points back at the source
      */
-    resend(id: number): Promise<WebhookEvent>;
+    resend(id: number, params?: ResendWebhookEventParams): Promise<WebhookEvent>;
 }
 
 interface GaruOptions {
@@ -1274,4 +1289,4 @@ declare class GaruServerError extends GaruAPIError {
     constructor(message: string, status: number, requestId: string | null, body: unknown);
 }
 
-export { type CancelAtPeriodEndScheduledChargeParams, type CancelRecurrenceScheduledChargeParams, type CardInfo, type ChangePaymentMethodScheduledChargeParams, type Charge, type ChargeList, type ChargeStatus, type CreateChargeParams, type CreateCustomerParams, type CreateScheduledChargeParams, type Customer, type CustomerList, type CustomerRecord, type FailurePayload, Garu, GaruAPIError, GaruAuthenticationError, GaruConnectionError, GaruError, type GaruErrorCode, type GaruFailureCode, GaruNotFoundError, type GaruOptions, GaruPermissionError, GaruRateLimitError, GaruServerError, GaruSignatureVerificationError, GaruValidationError, type ListChargesParams, type ListCustomersParams, type ListProductsParams, type ListScheduledChargeAttemptsParams, type ListScheduledChargesParams, type ListWebhookEventsParams, type MarkPaidScheduledChargeParams, type MetaFeatures, type MetaResponse, type PaginatedList, type PauseScheduledChargeParams, type PaymentMethod, type PaymentMethodExpiredPayload, type PaymentMethodExpiringPayload, type PostponeScheduledChargeParams, type Product, type ProductList, type ProductPortalConfig, type RecurrenceConfig, type RecurrenceInterval, type RefundChargeParams, type ScheduledChargeActor, type ScheduledChargeAttempt, type ScheduledChargeAttemptList, type ScheduledChargeAttemptSource, type ScheduledChargeAttemptStatus, type ScheduledChargeDetail, type ScheduledChargeEvent, type ScheduledChargeEventType, type ScheduledChargeLinkedTransaction, type ScheduledChargeList, type ScheduledChargeRecord, type ScheduledChargeStatus, type ScheduledChargeType, type ScheduledPaymentMethod, type SetProductPortalConfigParams, type UpdateCustomerParams, type VerifiedWebhook, type VerifyWebhookParams, type WebhookEvent, type WebhookEventEndpoint, type WebhookEventList, type WebhookEventStatus, type WirePaymentMethodId, webhooks };
+export { type CancelAtPeriodEndScheduledChargeParams, type CancelRecurrenceScheduledChargeParams, type CardInfo, type ChangePaymentMethodScheduledChargeParams, type Charge, type ChargeList, type ChargeStatus, type CreateChargeParams, type CreateCustomerParams, type CreateScheduledChargeParams, type Customer, type CustomerList, type CustomerRecord, type FailurePayload, Garu, GaruAPIError, GaruAuthenticationError, GaruConnectionError, GaruError, type GaruErrorCode, type GaruFailureCode, GaruNotFoundError, type GaruOptions, GaruPermissionError, GaruRateLimitError, GaruServerError, GaruSignatureVerificationError, GaruValidationError, type ListChargesParams, type ListCustomersParams, type ListProductsParams, type ListScheduledChargeAttemptsParams, type ListScheduledChargesParams, type ListWebhookEventsParams, type MarkPaidScheduledChargeParams, type MetaFeatures, type MetaResponse, type PaginatedList, type PauseScheduledChargeParams, type PaymentMethod, type PaymentMethodExpiredPayload, type PaymentMethodExpiringPayload, type PostponeScheduledChargeParams, type Product, type ProductList, type ProductPortalConfig, type RecurrenceConfig, type RecurrenceInterval, type RefundChargeParams, type ResendWebhookEventParams, type ScheduledChargeActor, type ScheduledChargeAttempt, type ScheduledChargeAttemptList, type ScheduledChargeAttemptSource, type ScheduledChargeAttemptStatus, type ScheduledChargeDetail, type ScheduledChargeEvent, type ScheduledChargeEventType, type ScheduledChargeLinkedTransaction, type ScheduledChargeList, type ScheduledChargeRecord, type ScheduledChargeStatus, type ScheduledChargeType, type ScheduledPaymentMethod, type SetProductPortalConfigParams, type UpdateCustomerParams, type VerifiedWebhook, type VerifyWebhookParams, type WebhookEvent, type WebhookEventEndpoint, type WebhookEventList, type WebhookEventStatus, type WirePaymentMethodId, webhooks };

package/dist/index.js

@@ -937,6 +937,11 @@ var WebhookEvents = class {
    * original — distinguishable both by the `resend_` prefix and by reading
    * the response payload's `manualResendOf` field.
    *
+   * **SDK→gateway dedup**: the SDK auto-attaches `X-Idempotency-Key`
+   * (UUIDv4 unless you pass `idempotencyKey`) so transient transport
+   * retries (5xx → SDK backoff) cannot create duplicate clones — the
+   * backend returns the original clone on the second call within 24h.
+   *
    * Returns the *clone* event (new id), not the original. The original is
    * unchanged on the server.
    *
@@ -946,10 +951,12 @@ var WebhookEvents = class {
    * clone.id !== event.id;            // true — clone has its own id
    * clone.manualResendOf === event.id; // true — points back at the source
    */
-  async resend(id) {
+  async resend(id, params = {}) {
+    const idempotencyKey = params.idempotencyKey ?? generateIdempotencyKey();
     return this.http.call(
       (signal) => this.http.client.POST(`/api/webhook-events/${id}/resend`, {
         body: {},
+        headers: { "X-Idempotency-Key": idempotencyKey },
         signal
       }).then((r) => r)
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@garuhq/node",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Official Node.js / TypeScript SDK for the Garu payment gateway.",
   "license": "MIT",
   "homepage": "https://garu.com.br",