Idempotency

async function postIdempotent(path: string, body: unknown, key = crypto.randomUUID()): Promise<Response> {
  for (let attempt = 0; attempt < 5; attempt++) {
    const res = await fetch(`${process.env.VOUCHER_API_BASE_URL}${path}`, {
      method: "POST",
      headers: { Authorization: `Bearer ${process.env.VOUCHER_API_KEY}`,
                 "Content-Type": "application/json", "Idempotency-Key": key },
      body: JSON.stringify(body),
    }).catch(() => undefined);                       // network error: retry with the same key
    if (res && res.status < 500 && res.status !== 409 && res.status !== 429) return res;
    if (res?.status === 409) {                       // only transient 409s are retried with the same key
      const { errors } = await res.clone().json();
      const code = errors?.[0]?.errorCode;
      if (!["idempotency-key-in-use", "concurrent-update"].includes(code)) return res;
    }
    const retryAfter = Number(res?.headers.get("Retry-After") ?? 0);
    await new Promise(r => setTimeout(r, Math.max(retryAfter * 1000, 2 ** attempt * 250 + Math.random() * 250)));
  }
  throw new Error("Gave up after 5 attempts; the same Idempotency-Key is still safe to retry later (24 h)");
}