@waffo/pancake-ts 0.2.1 → 0.2.2

package/dist/index.d.cts

@@ -18,6 +18,18 @@ interface WaffoPancakeConfig {
      */
     webhookPublicKey?: WebhookPublicKeys;
 }
+/**
+ * Options for {@link HttpClient.post}.
+ * Not exported publicly — used by resource classes.
+ */
+interface PostOptions {
+    /**
+     * Time window in seconds for idempotency key rotation.
+     * When set, a floored timestamp is mixed into the key so identical params
+     * produce a new key after the window elapses (e.g. 60 = per-minute dedup).
+     */
+    idempotencyWindow?: number;
+}
 /**
  * Single error object within the `errors` array.
  *
@@ -989,15 +1001,19 @@ declare class HttpClient {
      *
      * Behavior:
      * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+     * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+     *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
      * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
      * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
      *
      * @param path - API path (e.g. `/v1/actions/store/create-store`)
      * @param body - Request body object
+     * @param options - Optional settings
+     * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
      * @returns Parsed `data` field from the response
      * @throws {WaffoPancakeError} When the API returns errors
      */
-    post<T>(path: string, body: object): Promise<T>;
+    post<T>(path: string, body: object, options?: PostOptions): Promise<T>;
 }
 
 /** Authentication resource — issue session tokens for buyers. */

package/dist/index.d.ts

@@ -18,6 +18,18 @@ interface WaffoPancakeConfig {
      */
     webhookPublicKey?: WebhookPublicKeys;
 }
+/**
+ * Options for {@link HttpClient.post}.
+ * Not exported publicly — used by resource classes.
+ */
+interface PostOptions {
+    /**
+     * Time window in seconds for idempotency key rotation.
+     * When set, a floored timestamp is mixed into the key so identical params
+     * produce a new key after the window elapses (e.g. 60 = per-minute dedup).
+     */
+    idempotencyWindow?: number;
+}
 /**
  * Single error object within the `errors` array.
  *
@@ -989,15 +1001,19 @@ declare class HttpClient {
      *
      * Behavior:
      * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+     * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+     *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
      * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
      * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
      *
      * @param path - API path (e.g. `/v1/actions/store/create-store`)
      * @param body - Request body object
+     * @param options - Optional settings
+     * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
      * @returns Parsed `data` field from the response
      * @throws {WaffoPancakeError} When the API returns errors
      */
-    post<T>(path: string, body: object): Promise<T>;
+    post<T>(path: string, body: object, options?: PostOptions): Promise<T>;
 }
 
 /** Authentication resource — issue session tokens for buyers. */

package/dist/index.js

@@ -179,18 +179,26 @@ var HttpClient = class {
    *
    * Behavior:
    * - Generates a deterministic `X-Idempotency-Key` from `merchantId + path + body` (same request produces same key)
+   * - When `idempotencyWindow` is set, a floored timestamp is mixed into the key so identical params produce
+   *   a new key after the window elapses (useful for checkout where repeated creation is intentional)
    * - Auto-builds RSA-SHA256 signature (`X-Merchant-Id` / `X-Timestamp` / `X-Signature`)
    * - Unwraps the response envelope: returns `data` on success, throws `WaffoPancakeError` on failure
    *
    * @param path - API path (e.g. `/v1/actions/store/create-store`)
    * @param body - Request body object
+   * @param options - Optional settings
+   * @param options.idempotencyWindow - Time window in seconds for idempotency key rotation (e.g. 60 = per-minute dedup)
    * @returns Parsed `data` field from the response
    * @throws {WaffoPancakeError} When the API returns errors
    */
-  async post(path, body) {
+  async post(path, body, options) {
     const bodyStr = JSON.stringify(body);
-    const timestamp = Math.floor(Date.now() / 1e3).toString();
+    const now = Date.now();
+    const timestampSec = Math.floor(now / 1e3);
+    const timestamp = timestampSec.toString();
     const signature = signRequest("POST", path, timestamp, bodyStr, this.privateKey);
+    const idempotencyBase = `${this.merchantId}:${path}:${bodyStr}`;
+    const idempotencyInput = options?.idempotencyWindow ? `${idempotencyBase}:${Math.floor(timestampSec / options.idempotencyWindow)}` : idempotencyBase;
     const response = await this._fetch(`${this.baseUrl}${path}`, {
       method: "POST",
       headers: {
@@ -198,7 +206,7 @@ var HttpClient = class {
         "X-Merchant-Id": this.merchantId,
         "X-Timestamp": timestamp,
         "X-Signature": signature,
-        "X-Idempotency-Key": createHash2("sha256").update(`${this.merchantId}:${path}:${bodyStr}`).digest("hex")
+        "X-Idempotency-Key": createHash2("sha256").update(idempotencyInput).digest("hex")
       },
       body: bodyStr
     });
@@ -485,7 +493,8 @@ var CheckoutAnonymousResource = class {
     validateCheckoutCommon(params);
     return this.http.post(
       "/v1/actions/checkout/create-session",
-      params
+      params,
+      { idempotencyWindow: 60 }
     );
   }
 };
@@ -525,11 +534,11 @@ var CheckoutAuthenticatedResource = class {
       this.http.post("/v1/actions/auth/issue-session-token", {
         storeId: params.storeId,
         buyerIdentity
-      }),
+      }, { idempotencyWindow: 60 }),
       this.http.post("/v1/actions/checkout/create-session", {
         ...sessionFields,
         buyerEmail: buyerEmail ?? buyerIdentity
-      })
+      }, { idempotencyWindow: 60 })
     ]);
     return {
       sessionId: sessionResult.sessionId,
@@ -572,7 +581,7 @@ var CheckoutResource = class {
    * // Redirect to session.checkoutUrl
    */
   async createSession(params) {
-    return this.http.post("/v1/actions/checkout/create-session", params);
+    return this.http.post("/v1/actions/checkout/create-session", params, { idempotencyWindow: 60 });
   }
 };