@keytd/manat 0.0.0-stage → 0.2.0

package/dist/index.cjs

@@ -0,0 +1,1358 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AZERICARD_MAC_FIELDS: () => AZERICARD_MAC_FIELDS,
+  AzericardProvider: () => AzericardProvider,
+  EpointProvider: () => EpointProvider,
+  GoldenPayProvider: () => GoldenPayProvider,
+  KapitalBankProvider: () => KapitalBankProvider,
+  Manat: () => Manat,
+  ManatError: () => ManatError,
+  PayriffProvider: () => PayriffProvider,
+  YigimProvider: () => YigimProvider,
+  azericard: () => azericard,
+  azn: () => azn,
+  epoint: () => epoint,
+  fromDecimal: () => fromDecimal,
+  goldenPay: () => goldenPay,
+  isManatError: () => isManatError,
+  kapitalBank: () => kapitalBank,
+  payriff: () => payriff,
+  toDecimalString: () => toDecimalString,
+  yigim: () => yigim
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var ManatError = class extends Error {
+  code;
+  provider;
+  providerCode;
+  providerMessage;
+  raw;
+  constructor(code2, message, details = {}) {
+    super(message, details.cause === void 0 ? void 0 : { cause: details.cause });
+    this.name = "ManatError";
+    this.code = code2;
+    this.provider = details.provider;
+    this.providerCode = details.providerCode;
+    this.providerMessage = details.providerMessage;
+    this.raw = details.raw;
+  }
+};
+function isManatError(error, code2) {
+  return error instanceof ManatError && (code2 === void 0 || error.code === code2);
+}
+
+// src/money.ts
+var MINOR_DIGITS = { AZN: 2, USD: 2, EUR: 2, RUB: 2, TRY: 2, GBP: 2 };
+var NUMERIC_CODES = { AZN: "944", USD: "840", EUR: "978", RUB: "643", TRY: "949", GBP: "826" };
+function assertMoney(money, field = "amount") {
+  if (!money || typeof money !== "object") throw new ManatError("invalid_request", `${field} is required`);
+  if (!(money.currency in MINOR_DIGITS)) throw new ManatError("invalid_request", `${field}.currency "${money.currency}" is not supported`);
+  if (!Number.isSafeInteger(money.amount) || money.amount < 1) {
+    throw new ManatError("invalid_request", `${field}.amount must be a positive integer in minor units (2550 = 25.50), got ${money.amount}`);
+  }
+}
+function toDecimalString(money) {
+  assertMoney(money);
+  const digits = MINOR_DIGITS[money.currency];
+  const units = money.amount.toString().padStart(digits + 1, "0");
+  return `${units.slice(0, -digits)}.${units.slice(-digits)}`;
+}
+function fromDecimal(value, currency) {
+  const text = typeof value === "number" ? value.toString() : value.trim();
+  const digits = MINOR_DIGITS[currency];
+  const match = /^(\d+)(?:\.(\d+))?$/.exec(text);
+  if (!match || (match[2]?.length ?? 0) > digits) {
+    throw new ManatError("invalid_request", `"${text}" is not a valid ${currency} amount`);
+  }
+  const fraction = (match[2] ?? "").padEnd(digits, "0");
+  return { amount: Number(`${match[1]}${fraction}`), currency };
+}
+function currencyNumericCode(currency) {
+  return NUMERIC_CODES[currency];
+}
+function currencyFromNumeric(code2) {
+  return Object.keys(NUMERIC_CODES).find((c) => NUMERIC_CODES[c] === code2);
+}
+function azn(value) {
+  return fromDecimal(value, "AZN");
+}
+
+// src/manat.ts
+var Manat = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  get capabilities() {
+    return this.provider.capabilities;
+  }
+  supports(capability) {
+    return this.provider.capabilities.has(capability);
+  }
+  createPayment(request) {
+    if (!request?.orderId || typeof request.orderId !== "string") throw new ManatError("invalid_request", "orderId is required");
+    assertMoney(request.amount);
+    assertUrl(request.returnUrl, "returnUrl");
+    if (request.callbackUrl !== void 0) assertUrl(request.callbackUrl, "callbackUrl");
+    return this.provider.createPayment(request);
+  }
+  verifyCallback(callback) {
+    if (!callback || typeof callback.method !== "string") throw new ManatError("invalid_request", "callback.method is required");
+    return this.provider.verifyCallback(callback);
+  }
+  getStatus(input) {
+    requirePaymentId(input);
+    return this.call("getStatus", this.provider.getStatus, input);
+  }
+  refund(request) {
+    requirePaymentId(request);
+    if (request.amount !== void 0) assertMoney(request.amount);
+    return this.call("refund", this.provider.refund, request);
+  }
+  capture(input) {
+    requirePaymentId(input);
+    if (input.amount !== void 0) assertMoney(input.amount);
+    return this.call("capture", this.provider.capture, input);
+  }
+  cancel(input) {
+    requirePaymentId(input);
+    return this.call("cancel", this.provider.cancel, input);
+  }
+  call(name, fn, input) {
+    if (!fn || !this.provider.capabilities.has(name)) {
+      return Promise.reject(new ManatError("unsupported_operation", `${this.provider.name} does not support ${name}`, { provider: this.provider.name }));
+    }
+    return fn.call(this.provider, input);
+  }
+};
+function requirePaymentId(input) {
+  if (!input?.paymentId || typeof input.paymentId !== "string") throw new ManatError("invalid_request", "paymentId is required");
+}
+function assertUrl(value, field) {
+  try {
+    const url = new URL(String(value));
+    if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error("scheme");
+  } catch {
+    throw new ManatError("invalid_request", `${field} must be an absolute http(s) URL`);
+  }
+}
+
+// src/http.ts
+var HttpClient = class {
+  constructor(provider, options = {}) {
+    this.provider = provider;
+    const impl = options.fetch ?? globalThis.fetch;
+    if (!impl) throw new ManatError("invalid_request", "No fetch implementation available; pass options.fetch (Node 18+ has one built in)");
+    this.fetchImpl = impl;
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+  }
+  provider;
+  fetchImpl;
+  timeoutMs;
+  async send(request) {
+    const headers = { ...request.headers };
+    let body;
+    if (request.body instanceof URLSearchParams) {
+      body = request.body.toString();
+      headers["content-type"] ??= "application/x-www-form-urlencoded";
+    } else if (typeof request.body === "string") {
+      body = request.body;
+    } else if (request.body !== void 0) {
+      body = JSON.stringify(request.body);
+      headers["content-type"] ??= "application/json";
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const init = { method: request.method, headers, signal: controller.signal };
+      if (body !== void 0) init.body = body;
+      const response = await this.fetchImpl(request.url, init);
+      return { status: response.status, headers: response.headers, text: await response.text() };
+    } catch (error) {
+      const reason = controller.signal.aborted ? `timed out after ${this.timeoutMs} ms` : error?.message ?? "request failed";
+      throw new ManatError("network_error", `${this.provider}: ${request.method} ${request.url} ${reason}`, { provider: this.provider, cause: error });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async json(request) {
+    const response = await this.send({ ...request, headers: { accept: "application/json", ...request.headers } });
+    try {
+      return { status: response.status, data: response.text ? JSON.parse(response.text) : null };
+    } catch (error) {
+      throw new ManatError("network_error", `${this.provider}: expected JSON, got HTTP ${response.status} "${response.text.slice(0, 200)}"`, {
+        provider: this.provider,
+        raw: response.text,
+        cause: error
+      });
+    }
+  }
+};
+
+// src/providers/kapitalbank.ts
+var BASE_URLS = {
+  test: "https://txpgtst.kapitalbank.az/api",
+  production: "https://e-commerce.kapitalbank.az/api"
+};
+var CAPABILITIES = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund", "capture", "cancel"]);
+function mapKapitalStatus(order) {
+  switch (order.status) {
+    case "Preparing":
+      return "pending";
+    case "Authorized":
+      return "authorized";
+    case "PartPaid":
+    case "FullyPaid":
+    case "Funded":
+    case "Closed": {
+      const refunded = Number(order.clearedRefundAmount ?? 0);
+      if (refunded > 0) return refunded >= Number(order.clearedChargeAmount ?? Infinity) ? "refunded" : "partially_refunded";
+      return "paid";
+    }
+    case "Refunded":
+      return "refunded";
+    case "Cancelled":
+    case "Voided":
+    case "Expired":
+      return "cancelled";
+    case "Rejected":
+    case "Refused":
+    case "Declined":
+      return "failed";
+    default:
+      throw new ManatError("provider_error", `kapitalbank: unknown order status "${order.status}"`, { provider: "kapitalbank", raw: order });
+  }
+}
+var KapitalBankProvider = class {
+  name = "kapitalbank";
+  capabilities = CAPABILITIES;
+  http;
+  baseUrl;
+  authHeader;
+  constructor(config, options = {}) {
+    if (!config?.username || !config.password) throw new ManatError("invalid_request", "kapitalbank: username and password are required");
+    this.baseUrl = (config.baseUrl ?? BASE_URLS[config.environment ?? "production"]).replace(/\/+$/, "");
+    this.authHeader = `Basic ${Buffer.from(`${config.username}:${config.password}`, "utf8").toString("base64")}`;
+    this.http = new HttpClient(this.name, options);
+  }
+  async createPayment(request) {
+    const order = {
+      typeRid: request.intent === "authorize" ? "Order_DMS" : "Order_SMS",
+      amount: toDecimalString(request.amount),
+      currency: request.amount.currency,
+      language: request.language ?? "az",
+      description: request.description ?? request.orderId,
+      hppRedirectUrl: request.returnUrl
+    };
+    const data = await this.call("POST", "/order", { order });
+    const created = data.order;
+    if (!created?.id || !created.hppUrl || !created.password) {
+      throw new ManatError("provider_error", "kapitalbank: order response is missing id, hppUrl or password", { provider: this.name, raw: data });
+    }
+    const url = new URL(created.hppUrl);
+    url.searchParams.set("id", String(created.id));
+    url.searchParams.set("password", created.password);
+    return {
+      paymentId: String(created.id),
+      status: created.status ? mapKapitalStatus(created) : "pending",
+      next: { type: "redirect", url: url.toString() },
+      raw: data
+    };
+  }
+  async verifyCallback(callback) {
+    const id = pick(callback.query, "ID") ?? pick(callback.query, "id") ?? pickBody(callback.body, "ID");
+    if (!id || !/^\d+$/.test(id)) {
+      throw new ManatError("invalid_signature", "kapitalbank: callback has no numeric ID", { provider: this.name, raw: callback });
+    }
+    const state = await this.getStatus({ paymentId: id });
+    const event = { paymentId: state.paymentId, status: state.status, raw: state.raw };
+    if (state.amount) event.amount = state.amount;
+    return event;
+  }
+  async getStatus({ paymentId }) {
+    const order = await this.fetchOrder(paymentId);
+    return this.toState(order);
+  }
+  async refund(request) {
+    const amount = request.amount ?? await this.remainingRefundable(request.paymentId);
+    const data = await this.exec(request.paymentId, { phase: "Single", amount: toDecimalString(amount), type: "Refund" });
+    const state = await this.getStatus({ paymentId: request.paymentId });
+    const result = { paymentId: request.paymentId, status: state.status, raw: { exec: data, order: state.raw } };
+    const actionId = data.tran?.match?.tranActionId;
+    if (actionId) result.refundId = actionId;
+    return result;
+  }
+  async capture({ paymentId, amount }) {
+    const tran = { phase: "Clearing" };
+    tran.amount = toDecimalString(amount ?? (await this.getStatus({ paymentId })).amount ?? missingAmount(paymentId));
+    await this.exec(paymentId, tran);
+    return this.getStatus({ paymentId });
+  }
+  async cancel({ paymentId }) {
+    const current = await this.getStatus({ paymentId });
+    const phase = current.status === "authorized" ? "Auth" : "Single";
+    await this.exec(paymentId, { phase, voidKind: "Full" });
+    return this.getStatus({ paymentId });
+  }
+  async remainingRefundable(paymentId) {
+    const order = await this.fetchOrder(paymentId);
+    const currency = toCurrency(order.currency, paymentId);
+    const charged = fromDecimal(String(order.clearedChargeAmount ?? order.amount ?? 0), currency).amount;
+    const refunded = order.clearedRefundAmount ? fromDecimal(String(order.clearedRefundAmount), currency).amount : 0;
+    const remaining = charged - refunded;
+    if (remaining <= 0) throw new ManatError("invalid_request", `kapitalbank: order ${paymentId} has nothing left to refund`, { provider: this.name, raw: order });
+    return { amount: remaining, currency };
+  }
+  async fetchOrder(paymentId) {
+    assertOrderId(paymentId);
+    const data = await this.call("GET", `/order/${paymentId}?tranDetailLevel=2&tokenDetailLevel=2&orderDetailLevel=2`);
+    if (!data?.order) throw new ManatError("provider_error", `kapitalbank: no order in response for ${paymentId}`, { provider: this.name, raw: data });
+    return { ...data.order, id: data.order.id ?? paymentId };
+  }
+  toState(order) {
+    const state = { paymentId: String(order.id), status: mapKapitalStatus(order), raw: order };
+    if (order.amount !== void 0 && order.currency) {
+      state.amount = fromDecimal(String(order.amount), toCurrency(order.currency, String(order.id)));
+    }
+    if (order.clearedRefundAmount && order.currency) {
+      state.refundedAmount = fromDecimal(String(order.clearedRefundAmount), toCurrency(order.currency, String(order.id)));
+    }
+    return state;
+  }
+  exec(paymentId, tran) {
+    assertOrderId(paymentId);
+    return this.call("POST", `/order/${paymentId}/exec-tran`, { tran });
+  }
+  async call(method, path, body) {
+    const { status, data } = await this.http.json({
+      method,
+      url: `${this.baseUrl}${path}`,
+      headers: { authorization: this.authHeader },
+      body
+    });
+    if (status >= 400 || data && typeof data === "object" && "errorCode" in data && data.errorCode) {
+      const err = data ?? {};
+      throw new ManatError("provider_error", `kapitalbank: ${err.errorDescription ?? `HTTP ${status}`}`, {
+        provider: this.name,
+        ...err.errorCode ? { providerCode: err.errorCode } : {},
+        ...err.errorDescription ? { providerMessage: err.errorDescription } : {},
+        raw: data
+      });
+    }
+    return data;
+  }
+};
+function kapitalBank(config, options) {
+  return new KapitalBankProvider(config, options);
+}
+function assertOrderId(paymentId) {
+  if (!/^\d+$/.test(paymentId)) throw new ManatError("invalid_request", `kapitalbank: paymentId must be the numeric order id, got "${paymentId}"`);
+}
+function toCurrency(code2, paymentId) {
+  if (code2 === "AZN" || code2 === "USD" || code2 === "EUR" || code2 === "RUB" || code2 === "TRY" || code2 === "GBP") return code2;
+  throw new ManatError("provider_error", `kapitalbank: unexpected currency "${code2}" on order ${paymentId}`, { provider: "kapitalbank" });
+}
+function missingAmount(paymentId) {
+  throw new ManatError("provider_error", `kapitalbank: order ${paymentId} has no amount to capture`, { provider: "kapitalbank" });
+}
+function pick(source, key) {
+  const value = source?.[key];
+  return Array.isArray(value) ? value[0] : value;
+}
+function pickBody(body, key) {
+  if (!body) return void 0;
+  if (typeof body === "string") return new URLSearchParams(body).get(key) ?? void 0;
+  const value = body[key];
+  return typeof value === "string" ? value : void 0;
+}
+
+// src/providers/azericard.ts
+var import_node_crypto = require("crypto");
+var GATEWAY_URLS = {
+  test: "https://testmpi.3dsecure.az/cgi-bin/cgi_link",
+  production: "https://mpi.3dsecure.az/cgi-bin/cgi_link"
+};
+var AZERICARD_MAC_FIELDS = {
+  purchase: ["AMOUNT", "CURRENCY", "TERMINAL", "TRTYPE", "TIMESTAMP", "NONCE", "MERCH_URL"],
+  completion: ["AMOUNT", "CURRENCY", "TERMINAL", "TRTYPE", "ORDER", "RRN", "INT_REF"],
+  reversal: ["AMOUNT", "CURRENCY", "TERMINAL", "TRTYPE", "ORDER", "RRN", "INT_REF"],
+  callback: ["AMOUNT", "TERMINAL", "APPROVAL", "RRN", "INT_REF"],
+  status: ["ORDER", "TERMINAL", "TRTYPE", "TIMESTAMP", "NONCE"]
+};
+var ACTION_MESSAGES = {
+  "0": "Approved",
+  "1": "Duplicate transaction",
+  "2": "Transaction declined",
+  "3": "Transaction processing error",
+  "6": "Repeat of a declined transaction",
+  "7": "Repeat of a transaction with an authentication error",
+  "8": "Repeat of a transaction that terminated without a response"
+};
+var CAPABILITIES2 = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund", "capture", "cancel"]);
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function azericardMacSource(fields, order) {
+  return order.map((name) => {
+    const value = fields[name] ?? "";
+    return value === "" ? "-" : `${Buffer.byteLength(value, "utf8")}${value}`;
+  }).join("");
+}
+function azericardTimestamp(date) {
+  return date.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+}
+var AzericardProvider = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    if (!config?.terminal) throw new ManatError("invalid_request", "azericard: terminal is required");
+    if (!config.merchantName || !config.merchantUrl) throw new ManatError("invalid_request", "azericard: merchantName and merchantUrl are required");
+    if (!config.privateKey) throw new ManatError("invalid_request", "azericard: privateKey (PEM) is required");
+    this.privateKey = loadKey(() => (0, import_node_crypto.createPrivateKey)(config.privateKey), "privateKey");
+    assertRsa2048(this.privateKey, "privateKey");
+    this.gatewayKey = config.gatewayPublicKey ? loadKey(() => (0, import_node_crypto.createPublicKey)(config.gatewayPublicKey), "gatewayPublicKey") : void 0;
+    this.url = config.gatewayUrl ?? GATEWAY_URLS[config.environment ?? "production"];
+    this.macFields = { ...AZERICARD_MAC_FIELDS, ...config.macFields };
+    this.clock = config.clock ?? (() => /* @__PURE__ */ new Date());
+    this.makeNonce = config.nonce ?? (() => (0, import_node_crypto.randomBytes)(16).toString("hex"));
+    this.http = new HttpClient(this.name, options);
+  }
+  config;
+  name = "azericard";
+  capabilities = CAPABILITIES2;
+  http;
+  url;
+  privateKey;
+  gatewayKey;
+  macFields;
+  clock;
+  makeNonce;
+  async createPayment(request) {
+    if (!/^\d{6,32}$/.test(request.orderId)) {
+      throw new ManatError(
+        "invalid_request",
+        `azericard: orderId must be 6\u201332 digits (got "${request.orderId}"); its last 6 digits must be unique per terminal per day`
+      );
+    }
+    const fields = compact({
+      AMOUNT: toDecimalString(request.amount),
+      CURRENCY: request.amount.currency,
+      ORDER: request.orderId,
+      DESC: truncate(request.description ?? `Order ${request.orderId}`, 50),
+      MERCH_NAME: truncate(this.config.merchantName, 50),
+      MERCH_URL: this.config.merchantUrl,
+      TERMINAL: this.config.terminal,
+      EMAIL: this.config.email,
+      TRTYPE: request.intent === "authorize" ? "0" : "1",
+      COUNTRY: this.config.country,
+      MERCH_GMT: this.config.merchantGmt,
+      TIMESTAMP: azericardTimestamp(this.clock()),
+      NONCE: this.makeNonce(),
+      BACKREF: request.callbackUrl ?? request.returnUrl,
+      LANG: request.language ?? "az"
+    });
+    fields.P_SIGN = this.sign(fields, "purchase");
+    return {
+      paymentId: request.orderId,
+      status: "pending",
+      next: { type: "form", url: this.url, method: "POST", fields },
+      raw: { fields }
+    };
+  }
+  async verifyCallback(callback) {
+    if (!this.gatewayKey) {
+      throw new ManatError("invalid_request", "azericard: gatewayPublicKey is required to verify callbacks; never accept them unverified");
+    }
+    const fields = readFields(callback);
+    const signature = fields.P_SIGN;
+    if (!signature || !/^[0-9a-fA-F]+$/.test(signature) || signature.length % 2 !== 0) {
+      throw new ManatError("invalid_signature", "azericard: callback has no valid P_SIGN", { provider: this.name, raw: fields });
+    }
+    const source = azericardMacSource(fields, this.macFields.callback);
+    if (!(0, import_node_crypto.verify)("sha256", Buffer.from(source, "utf8"), this.gatewayKey, Buffer.from(signature, "hex"))) {
+      throw new ManatError("invalid_signature", "azericard: callback P_SIGN does not match", { provider: this.name, raw: fields });
+    }
+    if (fields.TERMINAL !== this.config.terminal) {
+      throw new ManatError("invalid_signature", `azericard: callback is for terminal ${fields.TERMINAL}, not ${this.config.terminal}`, { provider: this.name, raw: fields });
+    }
+    if (!fields.ORDER) throw new ManatError("invalid_signature", "azericard: callback has no ORDER", { provider: this.name, raw: fields });
+    const amount = parseAmount(fields.AMOUNT, fields.CURRENCY);
+    const approved = fields.ACTION === "0" && !!fields.APPROVAL;
+    const event = { paymentId: fields.ORDER, orderId: fields.ORDER, status: approved ? statusForTrtype(fields.TRTYPE) : "failed", raw: fields };
+    if (amount) event.amount = amount;
+    if (approved && fields.RRN && fields.INT_REF && amount && fields.TIMESTAMP) {
+      event.providerRef = encodeRef({ rrn: fields.RRN, intRef: fields.INT_REF, amount, timestamp: fields.TIMESTAMP, trtype: fields.TRTYPE ?? "1" });
+    }
+    return event;
+  }
+  /** TRTYPE 90 answers for one transaction type, so the purchase (or pre-auth), completion and reversals are each queried. */
+  async getStatus({ paymentId }) {
+    if (!/^\d{6,32}$/.test(paymentId)) throw new ManatError("invalid_request", `azericard: paymentId must be the numeric ORDER, got "${paymentId}"`);
+    let trtype = "1";
+    let data = await this.queryStatus(paymentId, trtype);
+    if (data.responseCode === "-24") {
+      trtype = "0";
+      data = await this.queryStatus(paymentId, trtype);
+    }
+    let status = mapStatusResponse(data, trtype);
+    const amount = parseAmount(data.amount, data.currency);
+    const state = { paymentId, status, raw: { [trtype]: data } };
+    if (amount) state.amount = amount;
+    if ((status === "paid" || status === "authorized") && amount) {
+      const related = await this.relatedTransactions(paymentId, trtype === "0" ? ["21", "22", "24"] : ["22", "24"]);
+      state.raw = { [trtype]: data, ...related.raw };
+      if (status === "authorized" && related.approved.has("21")) status = "paid";
+      const refunded = related.approvedAmount("22", amount.currency) + related.approvedAmount("24", amount.currency);
+      if (refunded > 0) {
+        state.refundedAmount = { amount: refunded, currency: amount.currency };
+        if (status === "authorized") status = "cancelled";
+        else status = refunded >= amount.amount ? "refunded" : "partially_refunded";
+      }
+      state.status = status;
+      const paidAt = data.tranDate ? bakuTimeToGmt(data.tranDate) : data.timestamp;
+      if (data.rrn && data.intRef && paidAt) {
+        state.providerRef = encodeRef({ rrn: data.rrn, intRef: data.intRef, amount, timestamp: paidAt, trtype: related.approved.has("21") ? "21" : trtype });
+      }
+    }
+    return state;
+  }
+  async relatedTransactions(order, types) {
+    const raw = {};
+    const approved = /* @__PURE__ */ new Map();
+    for (const type of types) {
+      const data = await this.queryStatus(order, type);
+      raw[type] = data;
+      if (data.actionCode === "0" && data.responseCode === "00") approved.set(type, data);
+    }
+    return {
+      raw,
+      approved,
+      approvedAmount(type, currency) {
+        const entry = approved.get(type);
+        const money = entry ? parseAmount(entry.amount, entry.currency ?? currency) : void 0;
+        return money && money.currency === currency ? money.amount : 0;
+      }
+    };
+  }
+  async queryStatus(order, tranTrtype) {
+    const fields = {
+      TRAN_TRTYPE: tranTrtype,
+      ORDER: order,
+      TERMINAL: this.config.terminal,
+      TRTYPE: "90",
+      TIMESTAMP: azericardTimestamp(this.clock()),
+      NONCE: this.makeNonce()
+    };
+    fields.P_SIGN = this.sign(fields, "status");
+    const { status, data } = await this.http.json({ method: "POST", url: this.url, body: new URLSearchParams(fields) });
+    if (status >= 400 || !data || typeof data !== "object") {
+      throw new ManatError("provider_error", `azericard: status request failed (HTTP ${status})`, { provider: this.name, raw: data });
+    }
+    return data;
+  }
+  async capture(input) {
+    const ref = requireRef(input.providerRef);
+    const amount = input.amount ?? ref.amount;
+    await this.send("completion", "21", input.paymentId, ref, amount);
+    return { paymentId: input.paymentId, status: "paid", amount, providerRef: encodeRef({ ...ref, amount, trtype: "21" }), raw: null };
+  }
+  async cancel(input) {
+    const ref = requireRef(input.providerRef);
+    await this.send("reversal", "22", input.paymentId, ref, ref.amount);
+    return { paymentId: input.paymentId, status: "cancelled", amount: ref.amount, raw: null };
+  }
+  async refund(request) {
+    const ref = requireRef(request.providerRef);
+    const amount = request.amount ?? ref.amount;
+    if (amount.currency !== ref.amount.currency || amount.amount > ref.amount.amount) {
+      throw new ManatError("invalid_request", "azericard: refund amount exceeds the paid amount or uses another currency");
+    }
+    const paidAt = parseTimestamp(ref.timestamp);
+    let trtype = "24";
+    if (paidAt && this.clock().getTime() - paidAt.getTime() < DAY_MS) {
+      const online = await this.queryStatus(request.paymentId, "22");
+      trtype = online.actionCode === "0" && online.responseCode === "00" ? "24" : "22";
+    }
+    const text = await this.send("reversal", trtype, request.paymentId, ref, amount);
+    return { paymentId: request.paymentId, status: amount.amount < ref.amount.amount ? "partially_refunded" : "refunded", raw: { trtype, action: text } };
+  }
+  async send(message, trtype, order, ref, amount) {
+    const fields = {
+      AMOUNT: toDecimalString(amount),
+      CURRENCY: amount.currency,
+      ORDER: order,
+      RRN: ref.rrn,
+      INT_REF: ref.intRef,
+      TERMINAL: this.config.terminal,
+      TRTYPE: trtype,
+      TIMESTAMP: azericardTimestamp(this.clock()),
+      NONCE: this.makeNonce()
+    };
+    fields.P_SIGN = this.sign(fields, message);
+    const response = await this.http.send({ method: "POST", url: this.url, body: new URLSearchParams(fields) });
+    const action = response.text.trim();
+    if (response.status >= 400) {
+      throw new ManatError("provider_error", `azericard: HTTP ${response.status}`, { provider: this.name, raw: response.text });
+    }
+    if (action !== "0") {
+      const message2 = ACTION_MESSAGES[action] ?? `Unexpected response "${action.slice(0, 100)}"`;
+      throw new ManatError("provider_error", `azericard: ${message2}`, { provider: this.name, providerCode: action.slice(0, 20), providerMessage: message2, raw: response.text });
+    }
+    return action;
+  }
+  sign(fields, message) {
+    const source = azericardMacSource(fields, this.macFields[message]);
+    return (0, import_node_crypto.sign)("sha256", Buffer.from(source, "utf8"), this.privateKey).toString("hex");
+  }
+};
+function azericard(config, options) {
+  return new AzericardProvider(config, options);
+}
+function mapStatusResponse(data, tranTrtype) {
+  if (data.actionCode === "0" && data.responseCode === "00") return tranTrtype === "0" ? "authorized" : "paid";
+  if (data.responseCode === "-40") return "pending";
+  return "failed";
+}
+function bakuTimeToGmt(value) {
+  const m = /^(\d{4})\.(\d{2})\.(\d{2}) (\d{2}):(\d{2}):(\d{2})$/.exec(value);
+  if (!m) return void 0;
+  return azericardTimestamp(new Date(Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4] - 4, +m[5], +m[6])));
+}
+function statusForTrtype(trtype) {
+  switch (trtype) {
+    case "0":
+      return "authorized";
+    case "22":
+    case "24":
+      return "refunded";
+    default:
+      return "paid";
+  }
+}
+function encodeRef(ref) {
+  return ["az1", ref.rrn, ref.intRef, toDecimalString(ref.amount), ref.amount.currency, ref.timestamp, ref.trtype].join("|");
+}
+function requireRef(value) {
+  const parts = value?.split("|") ?? [];
+  if (parts.length !== 7 || parts[0] !== "az1" || !parts[1] || !parts[2]) {
+    throw new ManatError("invalid_request", "azericard: providerRef from the payment callback is required (store event.providerRef with the order)");
+  }
+  const [, rrn, intRef, amount, currency, timestamp, trtype] = parts;
+  return { rrn, intRef, amount: fromDecimal(amount, toCurrency2(currency)), timestamp, trtype };
+}
+function parseAmount(amount, currency) {
+  if (!amount || !currency) return void 0;
+  const alpha = /^\d{3}$/.test(currency) ? currencyFromNumeric(currency) : currency;
+  return alpha ? fromDecimal(amount, toCurrency2(alpha)) : void 0;
+}
+function toCurrency2(code2) {
+  if (code2 === "AZN" || code2 === "USD" || code2 === "EUR" || code2 === "RUB" || code2 === "TRY" || code2 === "GBP") return code2;
+  throw new ManatError("provider_error", `azericard: unsupported currency "${code2}"`, { provider: "azericard" });
+}
+function parseTimestamp(value) {
+  const m = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})$/.exec(value);
+  return m ? new Date(Date.UTC(+m[1], +m[2] - 1, +m[3], +m[4], +m[5], +m[6])) : void 0;
+}
+function readFields(callback) {
+  const out = {};
+  const add = (key, value) => {
+    const v = Array.isArray(value) ? value[0] : value;
+    if (typeof v === "string") out[key.toUpperCase()] = v.trim();
+  };
+  for (const [k, v] of Object.entries(callback.query ?? {})) add(k, v);
+  if (typeof callback.body === "string") new URLSearchParams(callback.body).forEach((v, k) => add(k, v));
+  else for (const [k, v] of Object.entries(callback.body ?? {})) add(k, v);
+  return out;
+}
+function compact(fields) {
+  return Object.fromEntries(Object.entries(fields).filter((entry) => entry[1] !== void 0 && entry[1] !== ""));
+}
+function truncate(value, max) {
+  const chars = Array.from(value);
+  return chars.length > max ? chars.slice(0, max).join("") : value;
+}
+function loadKey(load, name) {
+  try {
+    return load();
+  } catch (error) {
+    throw new ManatError("invalid_request", `azericard: ${name} is not a valid PEM key`, { cause: error });
+  }
+}
+function assertRsa2048(key, name) {
+  const bits = key.asymmetricKeyDetails?.modulusLength ?? 0;
+  if (key.asymmetricKeyType !== "rsa" || bits < 2048) throw new ManatError("invalid_request", `azericard: ${name} must be an RSA key of at least 2048 bits`);
+}
+
+// src/providers/payriff.ts
+var DEFAULT_BASE_URL = "https://api.payriff.com";
+var SUCCESS = "00000";
+var CAPABILITIES3 = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund", "capture"]);
+function mapPayriffStatus(status) {
+  switch (status) {
+    case "CREATED":
+    case "PENDING":
+    case "ACCEPTED":
+    case "IN_REVIEW":
+      return "pending";
+    case "APPROVED":
+    case "PAID":
+    case "PARTIAL":
+    // pre-auth partially captured
+    case "CASH":
+      return "paid";
+    case "PREAUTH_APPROVED":
+      return "authorized";
+    case "REFUNDED":
+    case "REFUND_IN_PROGRESS":
+      return "refunded";
+    case "PARTIAL_REFUND":
+      return "partially_refunded";
+    case "CANCELED":
+    case "EXPIRED":
+    case "REVERSE":
+    case "PREAUTH_EXPIRED":
+      return "cancelled";
+    case "DECLINED":
+      return "failed";
+    default:
+      throw new ManatError("provider_error", `payriff: unknown paymentStatus "${status}"`, { provider: "payriff" });
+  }
+}
+var PayriffProvider = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    if (!config?.secretKey) throw new ManatError("invalid_request", "payriff: secretKey is required");
+    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.http = new HttpClient(this.name, options);
+  }
+  config;
+  name = "payriff";
+  capabilities = CAPABILITIES3;
+  http;
+  baseUrl;
+  async createPayment(request) {
+    if (request.callbackUrl !== void 0 && !request.callbackUrl.startsWith("https://")) {
+      throw new ManatError("invalid_request", "payriff: callbackUrl must be an HTTPS URL");
+    }
+    const body = {
+      amount: Number(toDecimalString(request.amount)),
+      currency: request.amount.currency,
+      language: (request.language ?? "az").toUpperCase(),
+      operation: request.intent === "authorize" ? "PRE_AUTH" : "PURCHASE",
+      description: request.description ?? `Order ${request.orderId}`,
+      redirectUrl: request.returnUrl
+    };
+    if (request.callbackUrl) body.callbackUrl = request.callbackUrl;
+    if (request.metadata && Object.keys(request.metadata).length) body.metadata = request.metadata;
+    const payload = await this.call("POST", "/api/v3/orders", body);
+    if (!payload?.orderId || !payload.paymentUrl) {
+      throw new ManatError("provider_error", "payriff: order response has no orderId or paymentUrl", { provider: this.name, raw: payload });
+    }
+    return { paymentId: payload.orderId, status: "pending", next: { type: "redirect", url: payload.paymentUrl }, raw: payload };
+  }
+  async verifyCallback(callback) {
+    const orderId = callbackOrderId(callback);
+    if (!orderId) throw new ManatError("invalid_signature", "payriff: callback has no payload.orderId", { provider: this.name, raw: callback.body });
+    const state = await this.getStatus({ paymentId: orderId });
+    const event = { paymentId: state.paymentId, status: state.status, raw: state.raw };
+    if (state.amount) event.amount = state.amount;
+    return event;
+  }
+  async getStatus({ paymentId }) {
+    const order = await this.call("GET", `/api/v3/orders/${encodeId(paymentId)}`);
+    if (!order?.orderId) throw new ManatError("provider_error", `payriff: no order in response for ${paymentId}`, { provider: this.name, raw: order });
+    const state = { paymentId: order.orderId, status: orderStatus(order), raw: order };
+    if (order.amount !== void 0 && order.currencyType) state.amount = fromDecimal(String(order.amount), toCurrency3(order.currencyType));
+    return state;
+  }
+  async refund(request) {
+    const amount = request.amount ?? (await this.getStatus({ paymentId: request.paymentId })).amount;
+    if (!amount) throw new ManatError("provider_error", `payriff: order ${request.paymentId} has no amount to refund`, { provider: this.name });
+    const body = { orderId: request.paymentId, refundReason: "Refund", amount: Number(toDecimalString(amount)) };
+    const envelope = await this.callEnvelope("POST", "/api/v3/refund", body);
+    const state = await this.getStatus({ paymentId: request.paymentId });
+    const result = { paymentId: request.paymentId, status: state.status, raw: { refund: envelope, order: state.raw } };
+    if (envelope.responseId) result.refundId = envelope.responseId;
+    return result;
+  }
+  async capture({ paymentId, amount }) {
+    const body = { orderId: paymentId };
+    if (amount) body.amount = Number(toDecimalString(amount));
+    await this.call("POST", "/api/v3/complete", body);
+    return this.getStatus({ paymentId });
+  }
+  async call(method, path, body) {
+    const envelope = await this.callEnvelope(method, path, body);
+    return envelope.payload;
+  }
+  async callEnvelope(method, path, body) {
+    const { status, data } = await this.http.json({
+      method,
+      url: `${this.baseUrl}${path}`,
+      headers: { authorization: this.config.secretKey },
+      body
+    });
+    if (!data || typeof data !== "object" || !("code" in data)) {
+      throw new ManatError("provider_error", `payriff: unexpected response (HTTP ${status})`, { provider: this.name, raw: data });
+    }
+    if (status >= 400 || data.code !== SUCCESS) {
+      throw new ManatError("provider_error", `payriff: ${data.message ?? `code ${data.code}`}`, {
+        provider: this.name,
+        ...data.code ? { providerCode: data.code } : {},
+        ...data.message ? { providerMessage: data.message } : {},
+        raw: data
+      });
+    }
+    return data;
+  }
+};
+function payriff(config, options) {
+  return new PayriffProvider(config, options);
+}
+function orderStatus(order) {
+  const status = mapPayriffStatus(order.paymentStatus);
+  if (status === "refunded" && order.transactions?.some((transaction) => transaction.status === "PARTIAL_REFUND")) return "partially_refunded";
+  return status;
+}
+function callbackOrderId(callback) {
+  let body = callback.body;
+  if (typeof body === "string") {
+    try {
+      body = JSON.parse(body);
+    } catch {
+      body = void 0;
+    }
+  }
+  const payload = body && typeof body === "object" ? body.payload : void 0;
+  const fromBody = payload && typeof payload.orderId === "string" ? payload.orderId : void 0;
+  const query = callback.query?.orderId;
+  return fromBody ?? (typeof query === "string" ? query : void 0);
+}
+function encodeId(paymentId) {
+  if (!/^[A-Za-z0-9-]{1,64}$/.test(paymentId)) throw new ManatError("invalid_request", `payriff: invalid paymentId "${paymentId}"`);
+  return paymentId;
+}
+function toCurrency3(code2) {
+  if (code2 === "AZN" || code2 === "USD" || code2 === "EUR" || code2 === "RUB" || code2 === "TRY" || code2 === "GBP") return code2;
+  throw new ManatError("provider_error", `payriff: unsupported currency "${code2}"`, { provider: "payriff" });
+}
+
+// src/crypto.ts
+var import_node_crypto2 = require("crypto");
+function hash(algorithm, data, encoding = "hex") {
+  return (0, import_node_crypto2.createHash)(algorithm).update(data).digest(encoding);
+}
+function safeEqual(actual, expected, options = {}) {
+  if (typeof actual !== "string") return false;
+  const a = Buffer.from(options.caseInsensitive ? actual.toLowerCase() : actual, "utf8");
+  const b = Buffer.from(options.caseInsensitive ? expected.toLowerCase() : expected, "utf8");
+  if (a.length !== b.length) return false;
+  return (0, import_node_crypto2.timingSafeEqual)(a, b);
+}
+
+// src/providers/epoint.ts
+var DEFAULT_BASE_URL2 = "https://epoint.az/api/1";
+var CAPABILITIES4 = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund"]);
+var CURRENCIES = /* @__PURE__ */ new Set(["AZN", "USD", "EUR", "RUB"]);
+function epointSignature(privateKey, data) {
+  return hash("sha1", privateKey + data + privateKey, "base64");
+}
+function epointEncode(privateKey, json) {
+  const data = Buffer.from(json, "utf8").toString("base64");
+  return { data, signature: epointSignature(privateKey, data) };
+}
+function mapEpointStatus(status) {
+  switch (status) {
+    case "new":
+      return "pending";
+    case "success":
+      return "paid";
+    case "returned":
+      return "refunded";
+    case "failed":
+    case "error":
+      return "failed";
+    default:
+      throw new ManatError("provider_error", `epoint: unknown status "${status}"`, { provider: "epoint" });
+  }
+}
+var EpointProvider = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    if (!config?.publicKey) throw new ManatError("invalid_request", "epoint: publicKey is required");
+    if (!config.privateKey) throw new ManatError("invalid_request", "epoint: privateKey is required");
+    this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL2).replace(/\/+$/, "");
+    this.http = new HttpClient(this.name, options);
+  }
+  config;
+  name = "epoint";
+  capabilities = CAPABILITIES4;
+  http;
+  baseUrl;
+  async createPayment(request) {
+    if (request.intent === "authorize") {
+      throw new ManatError("unsupported_operation", "epoint: pre-authorisation is not supported (Epoint statuses do not tell a hold from a capture)", { provider: this.name });
+    }
+    if (!CURRENCIES.has(request.amount.currency)) {
+      throw new ManatError("invalid_request", `epoint: currency ${request.amount.currency} is not supported (AZN, USD, EUR, RUB)`);
+    }
+    if (request.orderId.length > 255) throw new ManatError("invalid_request", "epoint: orderId is longer than 255 characters");
+    const payload = {
+      public_key: this.config.publicKey,
+      amount: toDecimalString(request.amount),
+      currency: request.amount.currency,
+      language: request.language ?? "az",
+      order_id: request.orderId
+    };
+    if (request.description) payload.description = truncate2(request.description, 1e3);
+    payload.success_redirect_url = request.returnUrl;
+    payload.error_redirect_url = request.returnUrl;
+    const response = await this.call("request", payload);
+    if (response.status !== "success" || !response.redirect_url || !response.transaction) {
+      throw this.error("payment was not created", response);
+    }
+    return { paymentId: response.transaction, status: "pending", next: { type: "redirect", url: response.redirect_url }, raw: response };
+  }
+  async verifyCallback(callback) {
+    const fields = formFields(callback.body);
+    const data = fields.data;
+    const signature = fields.signature;
+    if (!data || !signature) {
+      throw new ManatError("invalid_signature", "epoint: callback has no data/signature (the browser redirect is not signed; use getStatus)", { provider: this.name, raw: callback.body });
+    }
+    if (!safeEqual(signature, epointSignature(this.config.privateKey, data))) {
+      throw new ManatError("invalid_signature", "epoint: callback signature does not match", { provider: this.name, raw: callback.body });
+    }
+    const payload = decodeData(data);
+    if (!payload?.transaction) throw new ManatError("provider_error", "epoint: signed callback has no transaction", { provider: this.name, raw: payload });
+    const event = { paymentId: payload.transaction, status: mapEpointStatus(payload.status), raw: payload };
+    if (payload.order_id) event.orderId = String(payload.order_id);
+    return event;
+  }
+  async getStatus({ paymentId }) {
+    const response = await this.call("get-status", { public_key: this.config.publicKey, transaction: paymentId });
+    if (response.status === "server_error" || !response.transaction) throw this.error("status is not available", response);
+    if (response.transaction !== paymentId) throw this.error(`status is for transaction ${response.transaction}, not ${paymentId}`, response);
+    return { paymentId, status: mapEpointStatus(response.status), raw: response };
+  }
+  async refund(request) {
+    const payload = {
+      public_key: this.config.publicKey,
+      language: "az",
+      transaction: request.paymentId
+    };
+    if (request.amount) payload.amount = toDecimalString(request.amount);
+    payload.currency = request.amount?.currency ?? "AZN";
+    const response = await this.call("reverse", payload);
+    if (response.status !== "success") throw this.error("refund failed", response);
+    const state = await this.getStatus({ paymentId: request.paymentId });
+    const status = state.status === "paid" ? "partially_refunded" : state.status;
+    return { paymentId: request.paymentId, status, raw: { refund: response, payment: state.raw } };
+  }
+  async call(method, payload) {
+    const { data, signature } = epointEncode(this.config.privateKey, JSON.stringify(payload));
+    const { status, data: body } = await this.http.json({
+      method: "POST",
+      url: `${this.baseUrl}/${method}`,
+      body: new URLSearchParams({ data, signature })
+    });
+    if (!body || typeof body !== "object") throw new ManatError("provider_error", `epoint: unexpected response (HTTP ${status})`, { provider: this.name, raw: body });
+    if (status >= 400) throw this.error(`HTTP ${status}`, body);
+    return body;
+  }
+  error(what, response) {
+    return new ManatError("provider_error", `epoint: ${response.message ?? what}`, {
+      provider: this.name,
+      ...response.code ? { providerCode: String(response.code) } : {},
+      ...response.message ? { providerMessage: response.message } : {},
+      raw: response
+    });
+  }
+};
+function epoint(config, options) {
+  return new EpointProvider(config, options);
+}
+function formFields(body) {
+  if (typeof body === "string") return Object.fromEntries(new URLSearchParams(body));
+  if (!body || typeof body !== "object") return {};
+  const pick4 = (key) => typeof body[key] === "string" ? body[key] : void 0;
+  return { data: pick4("data"), signature: pick4("signature") };
+}
+function decodeData(data) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(data)) throw new ManatError("provider_error", "epoint: callback data is not base64", { provider: "epoint", raw: data });
+  try {
+    const value = JSON.parse(Buffer.from(data, "base64").toString("utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+  } catch {
+    throw new ManatError("provider_error", "epoint: callback data is not JSON", { provider: "epoint", raw: data });
+  }
+}
+function truncate2(value, max) {
+  const chars = Array.from(value);
+  return chars.length > max ? chars.slice(0, max).join("") : value;
+}
+
+// src/providers/goldenpay.ts
+var BASE_URLS2 = {
+  test: "https://rest-newpgtest.goldenpay.az",
+  production: "https://rest-pg.goldenpay.az"
+};
+var CAPABILITIES5 = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund"]);
+var SUCCESS2 = 1;
+var REVERSED = 817;
+var MAX_DESCRIPTION_BYTES = 500;
+function mapGoldenPayStatus(code2) {
+  switch (code2) {
+    case SUCCESS2:
+      return "paid";
+    case 813:
+    // payment page not opened yet, or waiting for payment
+    case 818:
+      return "pending";
+    case 814:
+    // cancelled by the customer
+    case 819:
+      return "cancelled";
+    case 815:
+    // payment error
+    case 816:
+      return "failed";
+    case REVERSED:
+      return "refunded";
+    default:
+      throw new ManatError("provider_error", `goldenpay: status code ${code2} does not describe a payment`, { provider: "goldenpay" });
+  }
+}
+var PAYMENT_CODES = /* @__PURE__ */ new Set([SUCCESS2, 813, 814, 815, 816, REVERSED, 818, 819]);
+var GoldenPayProvider = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    if (!config?.authKey) throw new ManatError("invalid_request", "goldenpay: authKey is required");
+    if (!config.merchantName) throw new ManatError("invalid_request", "goldenpay: merchantName is required");
+    this.baseUrl = (config.baseUrl ?? BASE_URLS2[config.environment ?? "production"]).replace(/\/+$/, "");
+    this.http = new HttpClient(this.name, options);
+  }
+  config;
+  name = "goldenpay";
+  capabilities = CAPABILITIES5;
+  http;
+  baseUrl;
+  async createPayment(request) {
+    if (request.intent === "authorize") {
+      throw new ManatError("unsupported_operation", "goldenpay: pre-authorisation is not supported", { provider: this.name });
+    }
+    assertAzn(request.amount);
+    const description = truncateBytes(request.description ?? request.orderId, MAX_DESCRIPTION_BYTES);
+    const amount = request.amount.amount;
+    const body = {
+      merchantName: this.config.merchantName,
+      amount,
+      lang: request.language ?? "az",
+      description,
+      redirectUrl: request.returnUrl,
+      hashCode: md5(this.config.authKey + this.config.merchantName + amount + description)
+    };
+    const response = await this.call("POST", "getPaymentKey", body);
+    if (response.status?.code !== SUCCESS2 || !response.paymentKey) throw this.error("payment was not created", response);
+    const url = `${this.baseUrl}/pay/${encodeURIComponent(response.paymentKey)}`;
+    return { paymentId: response.paymentKey, status: "pending", next: { type: "redirect", url }, raw: response };
+  }
+  async verifyCallback(callback) {
+    const key = pick2(callback.query, "payment_key") ?? pick2(callback.query, "paymentKey") ?? pickBody2(callback.body, "payment_key") ?? pickBody2(callback.body, "paymentKey");
+    if (!key || !PAYMENT_KEY.test(key)) {
+      throw new ManatError("invalid_signature", "goldenpay: redirect has no payment_key", { provider: this.name, raw: callback });
+    }
+    const state = await this.getStatus({ paymentId: key });
+    const event = { paymentId: state.paymentId, status: state.status, raw: state.raw };
+    if (state.amount) event.amount = state.amount;
+    return event;
+  }
+  async getStatus({ paymentId }) {
+    assertPaymentKey(paymentId);
+    const query = new URLSearchParams({ payment_key: paymentId, hash_code: md5(this.config.authKey + paymentId) });
+    const response = await this.call("GET", `getPaymentResult?${query}`);
+    const code2 = response.status?.code;
+    if (code2 === void 0 || !PAYMENT_CODES.has(code2)) throw this.error("status is not available", response);
+    if (response.paymentKey && response.paymentKey !== paymentId) throw this.error(`result is for payment ${response.paymentKey}, not ${paymentId}`, response);
+    const state = { paymentId, status: mapGoldenPayStatus(code2), raw: response };
+    if (typeof response.amount === "number" && response.amount > 0) state.amount = { amount: response.amount, currency: "AZN" };
+    return state;
+  }
+  async refund(request) {
+    if (request.amount) assertAzn(request.amount);
+    const payment = await this.getStatus({ paymentId: request.paymentId });
+    const amount = request.amount ?? payment.amount;
+    if (!amount) throw new ManatError("provider_error", `goldenpay: payment ${request.paymentId} has no amount to refund`, { provider: this.name, raw: payment.raw });
+    const hashCode = md5(this.config.authKey + request.paymentId);
+    const response = await this.call("POST", "reversePaymentKey", {
+      paymentKey: request.paymentId,
+      hashCode,
+      amount: amount.amount,
+      secretKey: md5(hashCode + amount.amount)
+    });
+    const code2 = response.status?.code;
+    if (code2 !== REVERSED && code2 !== SUCCESS2) throw this.error("refund failed", response);
+    const partial = payment.amount !== void 0 && amount.amount < payment.amount.amount;
+    return { paymentId: request.paymentId, status: partial ? "partially_refunded" : "refunded", raw: { refund: response, payment: payment.raw } };
+  }
+  async call(method, path, body) {
+    const { status, data } = await this.http.json({ method, url: `${this.baseUrl}/${path}`, body });
+    if (!data || typeof data !== "object" || !data.status) throw new ManatError("provider_error", `goldenpay: unexpected response (HTTP ${status})`, { provider: this.name, raw: data });
+    if (status >= 400) throw this.error(`HTTP ${status}`, data);
+    return data;
+  }
+  error(what, response) {
+    const { code: code2, message } = response.status ?? {};
+    const fromProvider = code2 !== void 0 && code2 !== SUCCESS2;
+    return new ManatError("provider_error", `goldenpay: ${fromProvider && message ? message : what}`, {
+      provider: this.name,
+      ...fromProvider ? { providerCode: String(code2) } : {},
+      ...fromProvider && message ? { providerMessage: message } : {},
+      raw: response
+    });
+  }
+};
+function goldenPay(config, options) {
+  return new GoldenPayProvider(config, options);
+}
+var PAYMENT_KEY = /^[A-Za-z0-9-]{1,64}$/;
+function assertPaymentKey(paymentId) {
+  if (!PAYMENT_KEY.test(paymentId)) throw new ManatError("invalid_request", `goldenpay: invalid paymentId "${paymentId}"`);
+}
+function assertAzn(money) {
+  if (money?.currency !== "AZN") throw new ManatError("invalid_request", `goldenpay: only AZN is supported, got ${money?.currency}`);
+}
+function md5(value) {
+  return hash("md5", value);
+}
+function truncateBytes(value, max) {
+  if (Buffer.byteLength(value, "utf8") <= max) return value;
+  let out = "";
+  for (const char of value) {
+    if (Buffer.byteLength(out + char, "utf8") > max) break;
+    out += char;
+  }
+  return out;
+}
+function pick2(source, key) {
+  const value = source?.[key];
+  return Array.isArray(value) ? value[0] : value;
+}
+function pickBody2(body, key) {
+  if (!body) return void 0;
+  if (typeof body === "string") return new URLSearchParams(body).get(key) ?? void 0;
+  const value = body[key];
+  return typeof value === "string" ? value : void 0;
+}
+
+// src/providers/yigim.ts
+var BASE_URLS3 = {
+  test: "https://sandbox.api.pay.yigim.az",
+  production: "https://api.pay.yigim.az"
+};
+var CAPABILITIES6 = /* @__PURE__ */ new Set(["createPayment", "verifyCallback", "getStatus", "refund", "capture", "cancel"]);
+var OK = 0;
+var DEFAULT_TEMPLATE = "TPL0001";
+var REFERENCE = /^[^\s\u0000-\u001f]{1,255}$/;
+function mapYigimStatus(status) {
+  switch (status) {
+    case "S0":
+    // created, waiting for card data
+    case "S2":
+    // in progress
+    case "S7":
+    // system malfunction
+    case "09":
+      return "pending";
+    case "S1":
+      return "authorized";
+    case "00":
+      return "paid";
+    case "S4":
+      return "cancelled";
+    case "S3":
+    // unknown error
+    case "01":
+    // refer to issuer
+    case "02":
+    // expired card
+    case "03":
+    // invalid amount
+    case "04":
+    // inactive card
+    case "05":
+    // insufficient funds
+    case "06":
+    // suspected fraud
+    case "07":
+    // exceeds withdrawal limit
+    case "08":
+      return "failed";
+    default:
+      throw new ManatError("provider_error", `yigim: unknown payment status "${status}"`, { provider: "yigim" });
+  }
+}
+var YigimProvider = class {
+  constructor(config, options = {}) {
+    this.config = config;
+    if (!config?.merchant) throw new ManatError("invalid_request", "yigim: merchant is required");
+    if (!config.apiKey) throw new ManatError("invalid_request", "yigim: apiKey is required");
+    if (!config.biller) throw new ManatError("invalid_request", "yigim: biller is required");
+    this.baseUrl = (config.baseUrl ?? BASE_URLS3[config.environment ?? "production"]).replace(/\/+$/, "");
+    this.http = new HttpClient(this.name, options);
+  }
+  config;
+  name = "yigim";
+  capabilities = CAPABILITIES6;
+  http;
+  baseUrl;
+  async createPayment(request) {
+    assertReference(request.orderId);
+    if (/[&;]/.test(request.returnUrl)) {
+      throw new ManatError("invalid_request", 'yigim: returnUrl may carry at most one query parameter and no ";"');
+    }
+    const params = {
+      reference: request.orderId,
+      type: request.intent === "authorize" ? "DMS" : "SMS",
+      amount: String(request.amount.amount),
+      currency: currencyNumericCode(request.amount.currency),
+      biller: this.config.biller
+    };
+    if (request.description) params.description = request.description;
+    params.template = this.config.template ?? DEFAULT_TEMPLATE;
+    params.language = request.language ?? "az";
+    if (request.callbackUrl) params.callback = request.callbackUrl.includes("?") ? request.callbackUrl : `${request.callbackUrl}?`;
+    params.extra = `back-url=${request.returnUrl};fail-url=${request.returnUrl}`;
+    const reply = await this.call("payment/create", params);
+    if (!reply.url) throw this.error("payment page URL is missing", reply);
+    return { paymentId: request.orderId, status: "pending", next: { type: "redirect", url: reply.url }, raw: reply };
+  }
+  async verifyCallback(callback) {
+    const reference = pick3(callback.query, "reference") ?? pickBody3(callback.body, "reference");
+    if (!reference || !REFERENCE.test(reference)) {
+      throw new ManatError("invalid_signature", "yigim: callback has no reference", { provider: this.name, raw: callback });
+    }
+    const state = await this.getStatus({ paymentId: reference });
+    const event = { paymentId: state.paymentId, orderId: state.paymentId, status: state.status, raw: state.raw };
+    if (state.amount) event.amount = state.amount;
+    return event;
+  }
+  async getStatus({ paymentId }) {
+    assertReference(paymentId);
+    const reply = await this.call("payment/status", { reference: paymentId });
+    if (reply.reference && reply.reference !== paymentId) throw this.error(`status is for payment ${reply.reference}, not ${paymentId}`, reply);
+    const state = { paymentId, status: mapYigimStatus(reply.status), raw: reply };
+    const currency = typeof reply.currency === "string" ? currencyFromNumeric(reply.currency) : void 0;
+    if (reply.amount !== void 0 && reply.amount !== "" && currency) state.amount = fromDecimal(String(reply.amount), currency);
+    return state;
+  }
+  async refund(request) {
+    const reply = await this.call("payment/refund", withAmount(request.paymentId, request.amount));
+    const state = await this.getStatus({ paymentId: request.paymentId });
+    return { paymentId: request.paymentId, status: refundStatus(state, request.amount), raw: { refund: reply, payment: state.raw } };
+  }
+  async capture({ paymentId, amount }) {
+    await this.call("payment/charge", withAmount(paymentId, amount));
+    return this.getStatus({ paymentId });
+  }
+  async cancel({ paymentId }) {
+    await this.call("payment/cancel", { reference: paymentId });
+    return this.getStatus({ paymentId });
+  }
+  async call(command, params) {
+    assertReference(params.reference ?? "");
+    const { status, data } = await this.http.json({
+      method: "GET",
+      url: `${this.baseUrl}/${command}?${new URLSearchParams(params)}`,
+      headers: { "x-merchant": this.config.merchant, "x-api-key": this.config.apiKey, "x-type": "JSON" }
+    });
+    const reply = unwrap(data);
+    if (!reply || code(reply) === void 0) {
+      throw new ManatError("provider_error", `yigim: unexpected response (HTTP ${status})`, { provider: this.name, raw: data });
+    }
+    if (status >= 400 || code(reply) !== OK) throw this.error(`HTTP ${status}`, reply);
+    return reply;
+  }
+  error(what, reply) {
+    const fromProvider = code(reply) !== void 0 && code(reply) !== OK;
+    return new ManatError("provider_error", `yigim: ${fromProvider && reply.message ? reply.message : what}`, {
+      provider: this.name,
+      ...fromProvider ? { providerCode: String(reply.code) } : {},
+      ...fromProvider && reply.message ? { providerMessage: reply.message } : {},
+      raw: reply
+    });
+  }
+};
+function yigim(config, options) {
+  return new YigimProvider(config, options);
+}
+function code(reply) {
+  if (typeof reply.code === "number") return reply.code;
+  return typeof reply.code === "string" && /^-?\d+$/.test(reply.code) ? Number(reply.code) : void 0;
+}
+function unwrap(data) {
+  if (!data || typeof data !== "object") return void 0;
+  const inner = data.response;
+  return inner && typeof inner === "object" ? inner : data;
+}
+function withAmount(reference, amount) {
+  return amount ? { reference, amount: String(amount.amount) } : { reference };
+}
+function refundStatus(state, amount) {
+  if (state.status !== "paid") return state.status;
+  return amount && state.amount && amount.amount < state.amount.amount ? "partially_refunded" : "refunded";
+}
+function assertReference(reference) {
+  if (!REFERENCE.test(reference)) throw new ManatError("invalid_request", `yigim: invalid reference "${reference}"`);
+}
+function pick3(source, key) {
+  const value = source?.[key];
+  return Array.isArray(value) ? value[0] : value;
+}
+function pickBody3(body, key) {
+  if (!body) return void 0;
+  if (typeof body === "string") return new URLSearchParams(body).get(key) ?? void 0;
+  const value = body[key];
+  return typeof value === "string" ? value : void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AZERICARD_MAC_FIELDS,
+  AzericardProvider,
+  EpointProvider,
+  GoldenPayProvider,
+  KapitalBankProvider,
+  Manat,
+  ManatError,
+  PayriffProvider,
+  YigimProvider,
+  azericard,
+  azn,
+  epoint,
+  fromDecimal,
+  goldenPay,
+  isManatError,
+  kapitalBank,
+  payriff,
+  toDecimalString,
+  yigim
+});