Idempotency and safe retries

curl -X POST https://api.sendozi.com/v1/sms/send \
  -H "Authorization: Bearer $SENDOZI_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-48291-shipped" \
  -d '{
    "sender": "YourBrand",
    "recipient": "08012345678",
    "message": "Your order 48291 has shipped.",
    "route": "promotional"
  }'

const RETRYABLE = new Set([429, 500, 502, 503, 504]);

export async function sendWithRetry(payload, idempotencyKey, attempts = 4) {
  const body = JSON.stringify(payload); // serialised once, resent unchanged
  for (let attempt = 1; ; attempt += 1) {
    let response;
    try {
      response = await fetch("https://api.sendozi.com/v1/sms/send", {
        method: "POST",
        headers: {
          Authorization: `Bearer ${process.env.SENDOZI_API_KEY}`,
          "Content-Type": "application/json",
          "Idempotency-Key": idempotencyKey,
        },
        body,
        signal: AbortSignal.timeout(30_000),
      });
    } catch (error) {
      if (attempt >= attempts) throw error; // network error or timeout: retry
    }

    if (response) {
      const result = await response.json();
      if (result.success) return result.data;
      const inFlight = response.status === 409 && /still being processed/.test(result.error.message);
      if (!RETRYABLE.has(response.status) && !inFlight) {
        throw new Error(`${result.error.code}: ${result.error.message}`);
      }
      if (attempt >= attempts) throw new Error(result.error.code);
      const wait = Number(response.headers.get("retry-after"));
      if (wait > 0) {
        await new Promise((r) => setTimeout(r, wait * 1000));
        continue;
      }
    }
    await new Promise((r) => setTimeout(r, 2 ** attempt * 500 + Math.random() * 250));
  }
}

await sendWithRetry(payload, `order-${order.id}-shipped`);