@laranex/myanmar-payments 4.0.0-dev.0 → 4.0.0-dev.10

package/dist/cjs/core/index.d.ts

@@ -1,8 +1,8 @@
 export { Amount, type AmountInput } from './amount.js';
 export { MemoryTokenCache, type TokenCache } from './cache.js';
 export { Acknowledgement, CallbackRequest, PaymentCallback, PaymentStatusResult, type AcknowledgementInit, type BodyInput, type CallbackRequestInit, type HeadersInput, type NodeRequestLike, type PaymentCallbackInit, type PaymentStatusResultInit, type QueryInput, type ServerResponseLike, type WebRequestLike, } from './callback.js';
-export type { EnvSource } from './env.js';
+export { DEFAULT_TIMEOUT_SECONDS, type EnvSource } from './env.js';
 export { ApiError, ConfigurationError, InvalidPaymentDataError, PaymentError, SignatureVerificationError, } from './errors.js';
-export { DEFAULT_TIMEOUT_MS, FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
+export { FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
 export { AppPayment, FormPayment, QrPayment, RedirectPayment, type FormField, type PaymentResult, } from './results.js';
 export { PaymentFlow, PaymentStatus, resolveStatus } from './status.js';

package/dist/cjs/core/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.DEFAULT_TIMEOUT_MS = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
+exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.DEFAULT_TIMEOUT_SECONDS = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
 var amount_js_1 = require("./amount.js");
 Object.defineProperty(exports, "Amount", { enumerable: true, get: function () { return amount_js_1.Amount; } });
 var cache_js_1 = require("./cache.js");
@@ -10,6 +10,8 @@ Object.defineProperty(exports, "Acknowledgement", { enumerable: true, get: funct
 Object.defineProperty(exports, "CallbackRequest", { enumerable: true, get: function () { return callback_js_1.CallbackRequest; } });
 Object.defineProperty(exports, "PaymentCallback", { enumerable: true, get: function () { return callback_js_1.PaymentCallback; } });
 Object.defineProperty(exports, "PaymentStatusResult", { enumerable: true, get: function () { return callback_js_1.PaymentStatusResult; } });
+var env_js_1 = require("./env.js");
+Object.defineProperty(exports, "DEFAULT_TIMEOUT_SECONDS", { enumerable: true, get: function () { return env_js_1.DEFAULT_TIMEOUT_SECONDS; } });
 var errors_js_1 = require("./errors.js");
 Object.defineProperty(exports, "ApiError", { enumerable: true, get: function () { return errors_js_1.ApiError; } });
 Object.defineProperty(exports, "ConfigurationError", { enumerable: true, get: function () { return errors_js_1.ConfigurationError; } });
@@ -17,7 +19,6 @@ Object.defineProperty(exports, "InvalidPaymentDataError", { enumerable: true, ge
 Object.defineProperty(exports, "PaymentError", { enumerable: true, get: function () { return errors_js_1.PaymentError; } });
 Object.defineProperty(exports, "SignatureVerificationError", { enumerable: true, get: function () { return errors_js_1.SignatureVerificationError; } });
 var http_js_1 = require("./http.js");
-Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", { enumerable: true, get: function () { return http_js_1.DEFAULT_TIMEOUT_MS; } });
 Object.defineProperty(exports, "FetchHttpClient", { enumerable: true, get: function () { return http_js_1.FetchHttpClient; } });
 var results_js_1 = require("./results.js");
 Object.defineProperty(exports, "AppPayment", { enumerable: true, get: function () { return results_js_1.AppPayment; } });

package/dist/cjs/core/json.d.ts

@@ -32,8 +32,8 @@ export declare function parseJsonObject(text: string): LosslessObject | undefine
 /** @internal */
 export declare function isLosslessObject(value: unknown): value is LosslessObject;
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */

package/dist/cjs/core/json.js

@@ -56,14 +56,14 @@ function isLosslessObject(value) {
         !(value instanceof JsonNumber));
 }
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */
 function toPlain(value) {
     if (value instanceof JsonNumber) {
-        return Number(value.text);
+        return value.text;
     }
     if (Array.isArray(value)) {
         return value.map(toPlain);

package/dist/cjs/core/status.d.ts

@@ -1,7 +1,7 @@
 /**
  * A gateway-independent payment status. Every gateway's own status values are mapped onto these.
  */
-export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'cancelled' | 'expired' | 'unknown';
+export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'canceled' | 'expired' | 'unknown';
 /**
  * The payment statuses, plus helpers.
  *
@@ -18,13 +18,13 @@ export declare const PaymentStatus: Readonly<{
     /** The payment was attempted and failed or was rejected. */
     Failed: "failed";
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: "cancelled";
+    Canceled: "canceled";
     /** The payment window ran out before the customer paid. */
     Expired: "expired";
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
     Unknown: "unknown";
     /** Every status, in the order above. */
-    values: readonly ["successful", "pending", "failed", "cancelled", "expired", "unknown"];
+    values: readonly ["successful", "pending", "failed", "canceled", "expired", "unknown"];
     /** Whether the status will not change any more: `false` for `pending` and `unknown`. */
     isFinal(status: PaymentStatus): boolean;
 }>;

package/dist/cjs/core/status.js

@@ -18,7 +18,7 @@ exports.PaymentStatus = Object.freeze({
     /** The payment was attempted and failed or was rejected. */
     Failed: 'failed',
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: 'cancelled',
+    Canceled: 'canceled',
     /** The payment window ran out before the customer paid. */
     Expired: 'expired',
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
@@ -28,7 +28,7 @@ exports.PaymentStatus = Object.freeze({
         'successful',
         'pending',
         'failed',
-        'cancelled',
+        'canceled',
         'expired',
         'unknown',
     ]),

package/dist/cjs/core/values.d.ts

@@ -14,3 +14,5 @@ export declare function optional(source: Record<string, unknown>, key: string):
 export declare function trimmed(source: Record<string, unknown>, key: string): string;
 /** The value at `key` when it is an object (not an array). @internal */
 export declare function object(source: Record<string, unknown>, key: string): LosslessObject | undefined;
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+export declare function isNested(value: unknown): boolean;

package/dist/cjs/core/values.js

@@ -5,6 +5,7 @@ exports.get = get;
 exports.optional = optional;
 exports.trimmed = trimmed;
 exports.object = object;
+exports.isNested = isNested;
 const json_js_1 = require("./json.js");
 /**
  * Returns a scalar as the text a gateway signs: strings as is, numbers exactly as sent, booleans as
@@ -43,3 +44,7 @@ function object(source, key) {
     const value = source[key];
     return (0, json_js_1.isLosslessObject)(value) ? value : undefined;
 }
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+function isNested(value) {
+    return typeof value === 'object' && value !== null && !(value instanceof json_js_1.JsonNumber);
+}

package/dist/cjs/cyber-source/cyber-source.d.ts

@@ -10,27 +10,24 @@ export interface CyberSourceConfigOptions {
     accessKey: string;
     /** The profile's secret key, which signs the fields. */
     secretKey: string;
-    /** Use the test environment (default `true`). */
-    sandbox?: boolean | undefined;
-    /** Overrides the Secure Acceptance base URL. */
+    /** Overrides the Secure Acceptance base URL, e.g. to point at the test environment. */
     baseUrl?: string | undefined;
 }
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 export declare class CyberSourceConfig {
-    static readonly SANDBOX_URL = "https://testsecureacceptance.cybersource.com";
     static readonly PRODUCTION_URL = "https://secureacceptance.cybersource.com";
     readonly profileId: string;
     readonly accessKey: string;
     readonly secretKey: string;
-    readonly sandbox: boolean;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: CyberSourceConfigOptions);
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): CyberSourceConfig;
 }
@@ -61,12 +58,12 @@ export interface CyberSourcePaymentData {
     returnUrl?: string | undefined;
     /** The page shown on cancel (`override_custom_cancel_page`), at most 255 characters. */
     cancelUrl?: string | undefined;
-    /** An ISO 4217 code (default `MMK`). */
-    currency?: string | undefined;
-    /** What to do with the card (default `sale`). */
-    transactionType?: CyberSourceTransactionType | undefined;
-    /** The hosted page language, e.g. `en-us` (the default). */
-    locale?: string | undefined;
+    /** An ISO 4217 code, e.g. `MMK`. */
+    currency: string;
+    /** What to do with the card, e.g. `sale`. */
+    transactionType: CyberSourceTransactionType;
+    /** The hosted page language, e.g. `en-us`. */
+    locale: string;
 }
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -87,7 +84,8 @@ export declare class CyberSource {
     initiate(data: CyberSourcePaymentData): FormPayment;
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */

package/dist/cjs/cyber-source/cyber-source.js

@@ -11,35 +11,31 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 class CyberSourceConfig {
-    static SANDBOX_URL = 'https://testsecureacceptance.cybersource.com';
     static PRODUCTION_URL = 'https://secureacceptance.cybersource.com';
     profileId;
     accessKey;
     secretKey;
-    sandbox;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.profileId = (0, env_js_1.requireSetting)('cyber_source', 'profile_id', options.profileId);
         this.accessKey = (0, env_js_1.requireSetting)('cyber_source', 'access_key', options.accessKey);
         this.secretKey = (0, env_js_1.requireSetting)('cyber_source', 'secret_key', options.secretKey);
-        this.sandbox = options.sandbox ?? true;
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? CyberSourceConfig.SANDBOX_URL : CyberSourceConfig.PRODUCTION_URL));
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? CyberSourceConfig.PRODUCTION_URL);
     }
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new CyberSourceConfig({
             profileId: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_PROFILE_ID'),
             accessKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_ACCESS_KEY'),
             secretKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_SECRET_KEY'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'CYBER_SOURCE_SANDBOX'),
             baseUrl: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_BASE_URL'),
         });
     }
@@ -77,7 +73,7 @@ const STATUSES = {
     REVIEW: 'pending',
     DECLINE: 'failed',
     ERROR: 'failed',
-    CANCEL: 'cancelled',
+    CANCEL: 'canceled',
 };
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -113,9 +109,12 @@ class CyberSource {
             .string('cancelUrl', data.cancelUrl)
             .url('cancelUrl', data.cancelUrl)
             .max('cancelUrl', data.cancelUrl, 255)
-            .pattern('currency', String(data.currency || 'MMK'), /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
-            .pattern('locale', String(data.locale || 'en-us'), /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
-            .when(!TRANSACTION_TYPES.includes(String(data.transactionType || 'sale')), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('currency', data.currency)
+            .pattern('currency', data.currency, /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
+            .required('transactionType', data.transactionType)
+            .when(!TRANSACTION_TYPES.includes(String(data.transactionType)), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('locale', data.locale)
+            .pattern('locale', data.locale, /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
             .validate();
     }
     /**
@@ -130,11 +129,11 @@ class CyberSource {
             transaction_uuid: (0, crypto_js_1.randomHex)(),
             signed_field_names: SIGNED_FIELDS.join(','),
             signed_date_time: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
-            locale: data.locale || 'en-us',
-            transaction_type: data.transactionType || 'sale',
+            locale: data.locale,
+            transaction_type: data.transactionType,
             reference_number: data.orderId,
             amount: String((0, validate_js_1.toAmount)(data.amount)),
-            currency: data.currency || 'MMK',
+            currency: data.currency,
             override_custom_receipt_page: data.returnUrl ?? '',
             override_backoffice_post_url: data.callbackUrl,
             override_custom_cancel_page: data.cancelUrl ?? '',
@@ -149,31 +148,39 @@ class CyberSource {
     }
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request) {
         const payload = (0, callback_js_1.losslessInput)(request);
         const expected = this.sign(payload);
-        if (expected === undefined || !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature'))) {
+        const names = signedNames(payload);
+        if (expected === undefined ||
+            !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature')) ||
+            !names.includes('decision') ||
+            !names.includes('req_reference_number')) {
             throw new errors_js_1.SignatureVerificationError('CyberSource callback signature verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
-        const decision = (0, values_js_1.trimmed)(payload, 'decision').toUpperCase();
+        // A signature only covers the listed fields, so anything else in the post could have been
+        // added by the sender (e.g. a `decision` next to the signed request fields).
+        const signed = {};
+        for (const name of [...names, 'signature']) {
+            (0, json_js_1.setKey)(signed, name, payload[name]);
+        }
+        const decision = (0, values_js_1.trimmed)(signed, 'decision').toUpperCase();
         return new callback_js_1.PaymentCallback({
-            orderId: (0, values_js_1.get)(payload, 'req_reference_number'),
+            orderId: (0, values_js_1.get)(signed, 'req_reference_number'),
             status: (0, status_js_1.resolveStatus)(STATUSES, decision),
             gatewayStatus: decision,
-            gatewayReference: (0, values_js_1.optional)(payload, 'transaction_id'),
-            amount: (0, values_js_1.get)(payload, 'auth_amount') || (0, values_js_1.optional)(payload, 'req_amount'),
-            raw: (0, json_js_1.toPlainObject)(payload),
+            gatewayReference: (0, values_js_1.optional)(signed, 'transaction_id'),
+            amount: (0, values_js_1.get)(signed, 'auth_amount') || (0, values_js_1.optional)(signed, 'req_amount'),
+            raw: (0, json_js_1.toPlainObject)(signed),
         });
     }
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */
     sign(fields) {
         const pairs = [];
-        for (const name of (0, values_js_1.get)(fields, 'signed_field_names').split(',')) {
-            if (name === '') {
-                continue;
-            }
+        for (const name of signedNames(fields)) {
             const value = (0, values_js_1.scalarString)(fields[name]);
             if (value === undefined) {
                 return undefined;
@@ -186,3 +193,9 @@ class CyberSource {
     }
 }
 exports.CyberSource = CyberSource;
+/** The names listed in `signed_field_names`, in order. */
+function signedNames(fields) {
+    return (0, values_js_1.get)(fields, 'signed_field_names')
+        .split(',')
+        .filter((name) => name !== '');
+}

package/dist/cjs/kbz-pay/kbz-pay.d.ts

@@ -12,33 +12,45 @@ export interface KbzPayConfigOptions {
     appKey: string;
     /** The `merch_code` KBZ issued. */
     merchantCode: string;
-    /** Use the UAT endpoints (default `true`). UAT and production issue separate credentials. */
-    sandbox?: boolean | undefined;
-    /** Overrides the API base URL, e.g. to go through a proxy. */
+    /**
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
+     * client you pass keeps its own timeout.
+     */
+    timeoutSeconds?: number | string | null | undefined;
+    /** Overrides the API base URL, e.g. to point at UAT or go through a proxy. */
     apiUrl?: string | undefined;
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
+    /**
+     * Seconds the customer has to pay each order, a multiple of 60 from 60 to 7200 (or its text).
+     * A payment's own `timeToLiveSeconds` overrides it; unset or blank leaves it to KBZ (7200).
+     */
+    timeToLiveSeconds?: number | string | null | undefined;
 }
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 export declare class KbzPayConfig {
-    static readonly SANDBOX_API_URL = "http://api-uat.kbzpay.com/payment/gateway/uat";
     static readonly PRODUCTION_API_URL = "https://api.kbzpay.com/payment/gateway";
-    static readonly SANDBOX_PWA_URL = "https://static.kbzpay.com/pgw/uat/pwa/#/";
     static readonly PRODUCTION_PWA_URL = "https://wap.kbzpay.com/pgw/pwa/#/";
     readonly appId: string;
     readonly appKey: string;
     readonly merchantCode: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
+    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
+    readonly timeToLiveSeconds: number | undefined;
     constructor(options: KbzPayConfigOptions);
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
+     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }
@@ -54,8 +66,12 @@ export interface KbzPayPaymentData {
     callbackUrl: string;
     /** The product name shown to the customer. */
     title?: string | undefined;
-    /** How long the order stays payable, 1 to 120 minutes. KBZ defaults to 120. */
-    timeoutMinutes?: number | undefined;
+    /**
+     * Seconds the customer has to pay before the order expires, 60 to 7200 in whole minutes (a multiple
+     * of 60). KBZ counts minutes, so 1800 is sent as `30m`. Overrides the config's `timeToLiveSeconds`;
+     * when both are unset KBZ allows 7200 (120 minutes).
+     */
+    timeToLiveSeconds?: number | undefined;
     /** Free text KBZ sends back unchanged in the callback, at most 512 characters once URL-encoded. */
     callbackInfo?: string | undefined;
 }

package/dist/cjs/kbz-pay/kbz-pay.js

@@ -12,44 +12,65 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 const signer_js_1 = require("./signer.js");
+/** What a valid KBZ Pay `time_to_live_in_seconds` is: KBZ counts whole minutes, up to 120. */
+const TIME_TO_LIVE_REQUIREMENT = 'a multiple of 60 from 60 to 7200';
+function resolveTimeToLive(value) {
+    if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
+        return undefined;
+    }
+    let seconds;
+    if (typeof value === 'number' && Number.isSafeInteger(value)) {
+        seconds = value;
+    }
+    else if (typeof value === 'string' && /^[+-]?\d+$/.test(value.trim())) {
+        seconds = Number.parseInt(value.trim(), 10);
+    }
+    if (seconds === undefined || seconds < 60 || seconds > 7200 || seconds % 60 !== 0) {
+        throw new errors_js_1.ConfigurationError('kbz_pay', 'time_to_live_in_seconds', true, TIME_TO_LIVE_REQUIREMENT);
+    }
+    return seconds;
+}
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 class KbzPayConfig {
-    static SANDBOX_API_URL = 'http://api-uat.kbzpay.com/payment/gateway/uat';
     static PRODUCTION_API_URL = 'https://api.kbzpay.com/payment/gateway';
-    static SANDBOX_PWA_URL = 'https://static.kbzpay.com/pgw/uat/pwa/#/';
     static PRODUCTION_PWA_URL = 'https://wap.kbzpay.com/pgw/pwa/#/';
     appId;
     appKey;
     merchantCode;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The API base URL in use. */
     apiUrl;
     /** The PWA checkout URL in use, always ending in `/`. */
     pwaUrl;
+    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
+    timeToLiveSeconds;
     constructor(options) {
         this.appId = (0, env_js_1.requireSetting)('kbz_pay', 'app_id', options.appId);
         this.appKey = (0, env_js_1.requireSetting)('kbz_pay', 'app_key', options.appKey);
         this.merchantCode = (0, env_js_1.requireSetting)('kbz_pay', 'merchant_code', options.merchantCode);
-        this.sandbox = options.sandbox ?? true;
-        this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_API_URL : KbzPayConfig.PRODUCTION_API_URL));
-        this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_PWA_URL : KbzPayConfig.PRODUCTION_PWA_URL))}/`;
+        this.timeoutSeconds = (0, env_js_1.resolveTimeout)('kbz_pay', options.timeoutSeconds);
+        this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ?? KbzPayConfig.PRODUCTION_API_URL);
+        this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ?? KbzPayConfig.PRODUCTION_PWA_URL)}/`;
+        this.timeToLiveSeconds = resolveTimeToLive(options.timeToLiveSeconds);
     }
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
+     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new KbzPayConfig({
             appId: (0, env_js_1.envFirst)(env, 'KBZ_PAY_APP_ID'),
             appKey: (0, env_js_1.envFirst)(env, 'KBZ_PAY_APP_KEY'),
             merchantCode: (0, env_js_1.envFirst)(env, 'KBZ_PAY_MERCHANT_CODE'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'KBZ_PAY_SANDBOX'),
+            timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             apiUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_BASE_URL'),
             pwaUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_PWA_BASE_REDIRECT_URL'),
+            timeToLiveSeconds: (0, env_js_1.envFirst)(env, 'KBZ_PAY_TIME_TO_LIVE_IN_SECONDS'),
         });
     }
 }
@@ -60,7 +81,7 @@ const STATUSES = {
     WAIT_PAY: 'pending',
     PAYING: 'pending',
     PAY_FAILED: 'failed',
-    ORDER_CLOSED: 'cancelled',
+    ORDER_CLOSED: 'canceled',
     ORDER_EXPIRED: 'expired',
 };
 /**
@@ -76,7 +97,7 @@ class KbzPay {
     constructor(config, options = {}) {
         this.config = config instanceof KbzPayConfig ? config : new KbzPayConfig(config);
         this.signer = new signer_js_1.KbzPaySigner(this.config.appKey);
-        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options));
+        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `KBZ_PAY_*` environment variables. */
     static fromEnv(env = (0, env_js_1.defaultEnv)(), options = {}) {
@@ -95,7 +116,8 @@ class KbzPay {
             .max('callbackUrl', callbackUrl, 512)
             .when(callbackUrl.includes('?'), 'callbackUrl', 'The callbackUrl field must not contain a query string.')
             .string('title', data.title)
-            .between('timeoutMinutes', data.timeoutMinutes, 1, 120)
+            .between('timeToLiveSeconds', data.timeToLiveSeconds, 60, 7200)
+            .when(Number.isInteger(data.timeToLiveSeconds) && data.timeToLiveSeconds % 60 !== 0, 'timeToLiveSeconds', 'The timeToLiveSeconds field must be a multiple of 60.')
             .string('callbackInfo', data.callbackInfo)
             .max('callbackInfo', typeof data.callbackInfo === 'string' ? (0, crypto_js_1.queryEscape)(data.callbackInfo) : undefined, 512)
             .validate();
@@ -128,9 +150,9 @@ class KbzPay {
         return new results_js_1.QrPayment({
             orderId: data.orderId,
             qrString: qrCode,
-            expiresAt: data.timeoutMinutes === undefined
+            expiresAt: order.timeToLiveSeconds === undefined
                 ? undefined
-                : new Date(Date.now() + data.timeoutMinutes * 60_000),
+                : new Date(Date.now() + order.timeToLiveSeconds * 1000),
             reference: order.prepayId,
             raw: (0, json_js_1.toPlainObject)(order.response),
         });
@@ -201,8 +223,9 @@ class KbzPay {
         if (data.title) {
             biz.title = data.title;
         }
-        if (data.timeoutMinutes !== undefined) {
-            biz.timeout_express = `${data.timeoutMinutes}m`;
+        const timeToLiveSeconds = data.timeToLiveSeconds ?? this.config.timeToLiveSeconds;
+        if (timeToLiveSeconds !== undefined) {
+            biz.timeout_express = `${timeToLiveSeconds / 60}m`;
         }
         if (data.callbackInfo) {
             biz.callback_info = (0, crypto_js_1.queryEscape)(data.callbackInfo);
@@ -214,7 +237,7 @@ class KbzPay {
         if (prepayId === '') {
             throw new errors_js_1.ApiError('KBZ Pay did not return a prepay_id.', { raw: (0, json_js_1.toPlainObject)(response) });
         }
-        return { prepayId, nonce, timestamp: time, response };
+        return { prepayId, nonce, timestamp: time, timeToLiveSeconds, response };
     }
     /** Sends a signed request and returns the `Response` object, throwing when KBZ reports an error. */
     async call(endpoint, method, version, biz, extra, nonce, time, signal) {

package/dist/cjs/kbz-pay/signer.d.ts

@@ -10,6 +10,9 @@ export declare class KbzPaySigner {
     signString(fields: Readonly<Record<string, unknown>>): string;
     /** The uppercase SHA-256 signature of `fields`. */
     sign(fields: Readonly<Record<string, unknown>>): string;
-    /** Whether `fields.sign` matches, compared in constant time. */
+    /**
+     * Whether `fields.sign` matches, compared in constant time. Nested values are never signed, so
+     * fields holding an object or array fail rather than being partly trusted.
+     */
     verify(fields: Readonly<Record<string, unknown>>): boolean;
 }

package/dist/cjs/kbz-pay/signer.js

@@ -27,10 +27,15 @@ class KbzPaySigner {
     sign(fields) {
         return (0, crypto_js_1.sha256Hex)(`${this.signString(fields)}&key=${this.appKey}`).toUpperCase();
     }
-    /** Whether `fields.sign` matches, compared in constant time. */
+    /**
+     * Whether `fields.sign` matches, compared in constant time. Nested values are never signed, so
+     * fields holding an object or array fail rather than being partly trusted.
+     */
     verify(fields) {
         const sign = fields.sign;
-        return typeof sign === 'string' && (0, crypto_js_1.safeEqual)(this.sign(fields), sign.toUpperCase());
+        return (typeof sign === 'string' &&
+            !Object.values(fields).some(values_js_1.isNested) &&
+            (0, crypto_js_1.safeEqual)(this.sign(fields), sign.toUpperCase()));
     }
 }
 exports.KbzPaySigner = KbzPaySigner;