Changelog
Current contract notes and compatibility guidance for Carden's documented API and private Node.js package.
On this page
Current documented contract
This page records the public integration contract described by these docs. It is a compatibility record, not a dated release announcement. Deployment availability and the private package version should be confirmed for your workspace.
| Area | Contract note |
|---|---|
| Sign-in and merchant context | WorkOS AuthKit identifies users; /dashboard is merchant-scoped and /admin is for authorized operators managing a selected client. |
| QuickBooks | Intuit OAuth authorizes the accounting connection; invoice import is asynchronous and separate from data validation. |
| Stripe enrichment v1 | Canonical invoice plus options returns stripe.payment_intent_enrichment with Stripe commercial fields. |
| Stripe payment reports v1 | Actual attempts and later observations return stripe.payment_report acknowledgments with duplicate detection. |
| API access | Carden integration keys are scoped to merchant/environment and permitted operations. Stripe OAuth and Stripe credential collection are not part of this flow. |
| Outbound webhooks | Signed Carden activity events use timestamp/body HMAC verification and event identity for idempotent consumers. |
Node.js package status
@carden/node is a private workspace package. No public npm publication, semantic release number, or release timestamp is asserted here. The enrichment, request-ID, report, and tracking methods are documented alongside the standalone PaymentIntent observation helper. Explicit HTTP examples remain available so consumers can validate the wire contract independently of the SDK.
When updating your supplied package, compare its TypeScript declarations and tested behavior with the deployed API. Keep stable event IDs, server-only credentials, and durable report delivery outside any helper's lifecycle.
Compatibility checklist
- Confirm the deployed endpoint and object/api_version envelope expected by your integration.
- Run canonical invoice fixtures and inspect any new validation failures without filling missing facts with fabricated values.
- Run report tests for retries, duplicate acknowledgments, unknown outcomes, captures, and refunds.
- Verify that helper or retry changes cannot execute another payment on report failure.
- Exercise webhook signature verification against raw bytes and tolerate duplicate delivery.
- Validate merchant/environment scoping and required key scopes before production cutover.