@laranex/myanmar-payments 4.0.0-dev.1 → 4.0.0-dev.10

package/dist/cjs/wave-money/wave-money.d.ts

@@ -11,38 +11,41 @@ export interface WaveMoneyConfigOptions {
     secretKey: string;
     /** Your business name, shown on Wave's payment page. */
     merchantName: string;
-    /** How long the customer has to pay, in seconds (default 300). */
-    timeToLiveSeconds?: number | undefined;
-    /** Use the test environment (default `true`). */
-    sandbox?: boolean | undefined;
-    /** Overrides the API base URL. */
+    /** How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). */
+    timeToLiveSeconds: number | string;
+    /**
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
+     * client you pass keeps its own timeout.
+     */
+    timeoutSeconds?: number | string | null | undefined;
+    /** Overrides the API base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
     /** Overrides the host the customer is redirected to. Wave serves it without the API port. */
     authenticateUrl?: string | undefined;
 }
 /**
- * Wave Money credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Wave Money credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production.
  */
 export declare class WaveMoneyConfig {
-    static readonly SANDBOX_URL = "https://preprodpayments.wavemoney.io:8107";
     static readonly PRODUCTION_URL = "https://payments.wavemoney.io";
-    static readonly SANDBOX_AUTHENTICATE_URL = "https://preprodpayments.wavemoney.io";
     static readonly PRODUCTION_AUTHENTICATE_URL = "https://payments.wavemoney.io";
-    static readonly DEFAULT_TIME_TO_LIVE_SECONDS = 300;
     readonly merchantId: string;
     readonly secretKey: string;
     readonly merchantName: string;
     /** Seconds the customer has to pay. */
     readonly timeToLiveSeconds: number;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly baseUrl: string;
     /** The host the customer is redirected to. */
     readonly authenticateUrl: string;
     constructor(options: WaveMoneyConfigOptions);
     /**
-     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME` (falling back
-     * to `APP_NAME`), `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `WAVE_MONEY_SANDBOX`, `WAVE_MONEY_BASE_URL`
+     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME`,
+     * `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `WAVE_MONEY_BASE_URL`
      * and `WAVE_MONEY_AUTHENTICATE_URL`.
      */
     static fromEnv(env?: EnvSource): WaveMoneyConfig;
@@ -76,6 +79,16 @@ export interface WaveMoneyPaymentData {
      * this.
      */
     merchantReferenceId?: string | undefined;
+    /**
+     * The business name shown on Wave's page for this payment. Defaults to the configured
+     * `merchantName` when unset.
+     */
+    merchantName?: string | null | undefined;
+    /**
+     * How long the customer has to pay this payment, in seconds: a whole number greater than 0.
+     * Defaults to the configured `timeToLiveSeconds` when unset.
+     */
+    timeToLiveSeconds?: number | null | undefined;
 }
 /**
  * Wave Money (WavePay payment gateway): redirect payments and callbacks. Wave has no status API,
@@ -104,7 +117,7 @@ export declare class WaveMoney {
     /**
      * Verifies Wave's callback. Only `PAYMENT_CONFIRMED` means the customer paid. `orderId` falls
      * back to `merchantReferenceId` when it is missing, null or empty, because Wave marks `orderId` as
-     * optional.
+     * optional. A hashed field holding an object or array fails verification.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     private hash;

package/dist/cjs/wave-money/wave-money.js

@@ -13,20 +13,19 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * Wave Money credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Wave Money credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production.
  */
 class WaveMoneyConfig {
-    static SANDBOX_URL = 'https://preprodpayments.wavemoney.io:8107';
     static PRODUCTION_URL = 'https://payments.wavemoney.io';
-    static SANDBOX_AUTHENTICATE_URL = 'https://preprodpayments.wavemoney.io';
     static PRODUCTION_AUTHENTICATE_URL = 'https://payments.wavemoney.io';
-    static DEFAULT_TIME_TO_LIVE_SECONDS = 300;
     merchantId;
     secretKey;
     merchantName;
     /** Seconds the customer has to pay. */
     timeToLiveSeconds;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The API base URL in use. */
     baseUrl;
     /** The host the customer is redirected to. */
@@ -35,31 +34,23 @@ class WaveMoneyConfig {
         this.merchantId = (0, env_js_1.requireSetting)('wave_money', 'merchant_id', options.merchantId);
         this.secretKey = (0, env_js_1.requireSetting)('wave_money', 'secret_key', options.secretKey);
         this.merchantName = (0, env_js_1.requireSetting)('wave_money', 'merchant_name', options.merchantName);
-        const ttl = options.timeToLiveSeconds;
-        this.timeToLiveSeconds =
-            ttl !== undefined && Number.isInteger(ttl) && ttl > 0
-                ? ttl
-                : WaveMoneyConfig.DEFAULT_TIME_TO_LIVE_SECONDS;
-        this.sandbox = options.sandbox ?? true;
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? WaveMoneyConfig.SANDBOX_URL : WaveMoneyConfig.PRODUCTION_URL));
-        this.authenticateUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.authenticateUrl) ??
-            (this.sandbox
-                ? WaveMoneyConfig.SANDBOX_AUTHENTICATE_URL
-                : WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL));
+        this.timeToLiveSeconds = (0, env_js_1.requireSeconds)('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
+        this.timeoutSeconds = (0, env_js_1.resolveTimeout)('wave_money', options.timeoutSeconds);
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? WaveMoneyConfig.PRODUCTION_URL);
+        this.authenticateUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.authenticateUrl) ?? WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL);
     }
     /**
-     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME` (falling back
-     * to `APP_NAME`), `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `WAVE_MONEY_SANDBOX`, `WAVE_MONEY_BASE_URL`
+     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME`,
+     * `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `WAVE_MONEY_BASE_URL`
      * and `WAVE_MONEY_AUTHENTICATE_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new WaveMoneyConfig({
             merchantId: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_MERCHANT_ID'),
             secretKey: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_SECRET_KEY'),
-            merchantName: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_MERCHANT_NAME', 'APP_NAME'),
-            timeToLiveSeconds: (0, env_js_1.envInt)(env, 'WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'WAVE_MONEY_SANDBOX'),
+            merchantName: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_MERCHANT_NAME'),
+            timeToLiveSeconds: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS'),
+            timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             baseUrl: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_BASE_URL'),
             authenticateUrl: (0, env_js_1.envFirst)(env, 'WAVE_MONEY_AUTHENTICATE_URL'),
         });
@@ -71,7 +62,7 @@ const STATUSES = {
     INSUFFICIENT_BALANCE: 'pending',
     ACCOUNT_LOCKED: 'failed',
     BILL_COLLECTION_FAILED: 'failed',
-    PAYMENT_REQUEST_CANCELLED: 'cancelled',
+    PAYMENT_REQUEST_CANCELLED: 'canceled',
     TRANSACTION_TIMED_OUT: 'expired',
     SCHEDULER_TRANSACTION_TIMED_OUT: 'expired',
 };
@@ -98,7 +89,7 @@ class WaveMoney {
     transport;
     constructor(config, options = {}) {
         this.config = config instanceof WaveMoneyConfig ? config : new WaveMoneyConfig(config);
-        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options));
+        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `WAVE_MONEY_*` environment variables. */
     static fromEnv(env = (0, env_js_1.defaultEnv)(), options = {}) {
@@ -136,7 +127,11 @@ class WaveMoney {
             .url('returnUrl', data.returnUrl)
             .required('description', data.description)
             .when(items.length === 0, 'items', 'The items field must have at least one item.')
-            .string('merchantReferenceId', data.merchantReferenceId);
+            .string('merchantReferenceId', data.merchantReferenceId)
+            .string('merchantName', data.merchantName)
+            .when(typeof data.merchantName === 'string' && data.merchantName.trim() === '', 'merchantName', 'The merchantName field is required.')
+            .when(isSet(data.timeToLiveSeconds) && !Number.isInteger(data.timeToLiveSeconds), 'timeToLiveSeconds', 'The timeToLiveSeconds field must be an integer.')
+            .when(isSet(data.timeToLiveSeconds) && data.timeToLiveSeconds < 1, 'timeToLiveSeconds', 'The timeToLiveSeconds field must be greater than 0.');
         items.forEach((item, index) => {
             validator
                 .required(`items.${index}.name`, item?.name)
@@ -162,7 +157,7 @@ class WaveMoney {
             data.merchantReferenceId = (0, crypto_js_1.randomHex)();
         }
         const amount = WaveMoney.resolvedAmount(data).toString();
-        const ttl = String(this.config.timeToLiveSeconds);
+        const ttl = String(data.timeToLiveSeconds ?? this.config.timeToLiveSeconds);
         // Wave documents items as [{"name": "...", "amount": 1000}] with a numeric amount; the amount
         // text is written as a JSON number without passing through a float.
         const items = `[${data.items
@@ -177,7 +172,7 @@ class WaveMoney {
             backend_result_url: data.callbackUrl,
             amount,
             payment_description: data.description,
-            merchant_name: this.config.merchantName,
+            merchant_name: data.merchantName ?? this.config.merchantName,
             items,
             hash: this.hash([
                 ttl,
@@ -209,13 +204,15 @@ class WaveMoney {
     /**
      * Verifies Wave's callback. Only `PAYMENT_CONFIRMED` means the customer paid. `orderId` falls
      * back to `merchantReferenceId` when it is missing, null or empty, because Wave marks `orderId` as
-     * optional.
+     * optional. A hashed field holding an object or array fails verification.
      */
     handleCallback(request) {
         const payload = (0, callback_js_1.losslessBody)(request);
         const expected = this.hash(CALLBACK_FIELDS.map((field) => (0, values_js_1.scalarString)(payload[field]) ?? 'null'));
         const hashValue = payload.hashValue;
-        if (typeof hashValue !== 'string' || !(0, crypto_js_1.safeEqual)(expected, hashValue.toLowerCase())) {
+        if (typeof hashValue !== 'string' ||
+            CALLBACK_FIELDS.some((field) => (0, values_js_1.isNested)(payload[field])) ||
+            !(0, crypto_js_1.safeEqual)(expected, hashValue.toLowerCase())) {
             throw new errors_js_1.SignatureVerificationError('Wave Money callback hash verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
         const gatewayStatus = (0, values_js_1.trimmed)(payload, 'status');
@@ -233,6 +230,9 @@ class WaveMoney {
     }
 }
 exports.WaveMoney = WaveMoney;
+function isSet(value) {
+    return value !== undefined && value !== null;
+}
 function errorMessage(body) {
     const errors = body.errors;
     if ((0, json_js_1.isLosslessObject)(errors)) {

package/dist/cjs/yoma-mmqr/yoma-mmqr.d.ts

@@ -16,35 +16,39 @@ export interface YomaMmqrConfigOptions {
     webhookHashKey: string;
     /** The secret you shared with Yoma; when set, callbacks must carry it in `X-Webhook-Secret`. */
     webhookSecret?: string | undefined;
-    /** Use the UAT payment hub (default `true`). */
-    sandbox?: boolean | undefined;
-    /** Overrides the API base URL. */
+    /** The `{version}` segment of the API paths, e.g. `v1rc`. */
+    apiVersion: string;
+    /**
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
+     * client you pass keeps its own timeout.
+     */
+    timeoutSeconds?: number | string | null | undefined;
+    /** Overrides the API base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
-    /** The `{version}` segment of the API paths (default `v1rc`). */
-    apiVersion?: string | undefined;
 }
 /**
- * Yoma MMQR credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Yoma MMQR credentials and endpoints. A missing setting throws a `ConfigurationError`. The URL
+ * defaults to production.
  */
 export declare class YomaMmqrConfig {
-    static readonly SANDBOX_URL = "https://devapi.yomabank.net";
     static readonly PRODUCTION_URL = "https://paymenthubapi.yomabank.com";
-    static readonly DEFAULT_API_VERSION = "v1rc";
     readonly merchantId: string;
     readonly clientId: string;
     readonly clientSecret: string;
     readonly webhookHashKey: string;
     readonly webhookSecret: string | undefined;
-    readonly sandbox: boolean;
+    /** The `{version}` segment of the API paths. */
+    readonly apiVersion: string;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The base URL in use. */
     readonly baseUrl: string;
-    /** The API version in use. */
-    readonly apiVersion: string;
     constructor(options: YomaMmqrConfigOptions);
     /**
      * Reads `YOMA_MMQR_MERCHANT_ID`, `YOMA_MMQR_CLIENT_ID`, `YOMA_MMQR_CLIENT_SECRET`,
-     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_WEBHOOK_SECRET`, `YOMA_MMQR_SANDBOX`,
-     * `YOMA_MMQR_BASE_URL` and `YOMA_MMQR_API_VERSION`.
+     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_API_VERSION`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`,
+     * `YOMA_MMQR_WEBHOOK_SECRET` and `YOMA_MMQR_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): YomaMmqrConfig;
 }

package/dist/cjs/yoma-mmqr/yoma-mmqr.js

@@ -13,37 +13,36 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * Yoma MMQR credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Yoma MMQR credentials and endpoints. A missing setting throws a `ConfigurationError`. The URL
+ * defaults to production.
  */
 class YomaMmqrConfig {
-    static SANDBOX_URL = 'https://devapi.yomabank.net';
     static PRODUCTION_URL = 'https://paymenthubapi.yomabank.com';
-    static DEFAULT_API_VERSION = 'v1rc';
     merchantId;
     clientId;
     clientSecret;
     webhookHashKey;
     webhookSecret;
-    sandbox;
+    /** The `{version}` segment of the API paths. */
+    apiVersion;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The base URL in use. */
     baseUrl;
-    /** The API version in use. */
-    apiVersion;
     constructor(options) {
         this.merchantId = (0, env_js_1.requireSetting)('yoma_mmqr', 'merchant_id', options.merchantId);
         this.clientId = (0, env_js_1.requireSetting)('yoma_mmqr', 'client_id', options.clientId);
         this.clientSecret = (0, env_js_1.requireSetting)('yoma_mmqr', 'client_secret', options.clientSecret);
         this.webhookHashKey = (0, env_js_1.requireSetting)('yoma_mmqr', 'webhook_hashkey', options.webhookHashKey);
+        this.apiVersion = (0, env_js_1.requireSetting)('yoma_mmqr', 'api_version', options.apiVersion);
+        this.timeoutSeconds = (0, env_js_1.resolveTimeout)('yoma_mmqr', options.timeoutSeconds);
         this.webhookSecret = (0, env_js_1.optionalSetting)(options.webhookSecret);
-        this.sandbox = options.sandbox ?? true;
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? YomaMmqrConfig.SANDBOX_URL : YomaMmqrConfig.PRODUCTION_URL));
-        this.apiVersion = (0, env_js_1.optionalSetting)(options.apiVersion) ?? YomaMmqrConfig.DEFAULT_API_VERSION;
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? YomaMmqrConfig.PRODUCTION_URL);
     }
     /**
      * Reads `YOMA_MMQR_MERCHANT_ID`, `YOMA_MMQR_CLIENT_ID`, `YOMA_MMQR_CLIENT_SECRET`,
-     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_WEBHOOK_SECRET`, `YOMA_MMQR_SANDBOX`,
-     * `YOMA_MMQR_BASE_URL` and `YOMA_MMQR_API_VERSION`.
+     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_API_VERSION`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`,
+     * `YOMA_MMQR_WEBHOOK_SECRET` and `YOMA_MMQR_BASE_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new YomaMmqrConfig({
@@ -51,10 +50,10 @@ class YomaMmqrConfig {
             clientId: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_CLIENT_ID'),
             clientSecret: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_CLIENT_SECRET'),
             webhookHashKey: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_WEBHOOK_HASHKEY'),
+            apiVersion: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_API_VERSION'),
+            timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             webhookSecret: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_WEBHOOK_SECRET'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'YOMA_MMQR_SANDBOX'),
             baseUrl: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_BASE_URL'),
-            apiVersion: (0, env_js_1.envFirst)(env, 'YOMA_MMQR_API_VERSION'),
         });
     }
 }
@@ -79,7 +78,7 @@ class YomaMmqr {
     pendingToken;
     constructor(config, options = {}) {
         this.config = config instanceof YomaMmqrConfig ? config : new YomaMmqrConfig(config);
-        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options));
+        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options, this.config.timeoutSeconds));
         this.cache = options.tokenCache ?? new cache_js_1.MemoryTokenCache();
     }
     /** A gateway configured from the `YOMA_MMQR_*` environment variables. */
@@ -161,7 +160,9 @@ class YomaMmqr {
         const orderNumber = (0, values_js_1.get)(payload, 'orderNumber');
         const status = (0, values_js_1.trimmed)(payload, 'status');
         const expected = (0, crypto_js_1.hmacSha256Hex)(orderNumber + this.config.webhookHashKey, `orderNumber=${orderNumber}&status=${status}`);
-        if (orderNumber === '' || !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'hashValue').toLowerCase())) {
+        if (orderNumber === '' ||
+            (0, values_js_1.isNested)(payload.status) ||
+            !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'hashValue').toLowerCase())) {
             throw new errors_js_1.SignatureVerificationError('Yoma MMQR callback hash verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
         return new callback_js_1.PaymentCallback({
@@ -210,13 +211,14 @@ class YomaMmqr {
         if (!response.successful() || token === '') {
             throw apiError('token', response.status, body, (0, values_js_1.get)(body, 'error'));
         }
-        const expiresIn = Number.parseInt((0, values_js_1.get)(body, 'expires_in'), 10);
-        const ttl = Math.max(60, (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : 3600) - 60);
+        // The leading digits of `expires_in`; missing, non-numeric or 0 means an hour.
+        const expiresIn = Number(/^\d+/.exec((0, values_js_1.get)(body, 'expires_in'))?.[0] ?? 0);
+        const ttl = Math.max(60, (expiresIn > 0 ? expiresIn : 3600) - 60);
         await this.cache.set(this.tokenCacheKey(), token, ttl);
         return token;
     }
     tokenCacheKey() {
-        return `node-myanmar-payments.yoma-mmqr.token.${(0, crypto_js_1.sha256Hex)(`${this.config.baseUrl}|${this.config.clientId}`)}`;
+        return `myanmar-payments.yoma-mmqr.token.${(0, crypto_js_1.sha256Hex)(`${this.config.baseUrl}|${this.config.clientId}`)}`;
     }
 }
 exports.YomaMmqr = YomaMmqr;

package/dist/esm/aya-pay/aya-pay.d.ts

@@ -9,27 +9,31 @@ export interface AyaPayConfigOptions {
     appKey: string;
     /** The secret that signs requests and verifies callbacks. */
     appSecret: string;
-    /** Use the UAT environment (default `true`). */
-    sandbox?: boolean | undefined;
-    /** Overrides the gateway base URL. */
+    /**
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
+     * client you pass keeps its own timeout.
+     */
+    timeoutSeconds?: number | string | null | undefined;
+    /** Overrides the gateway base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
 }
 /**
- * AYA Payment Gateway (APG) credentials and endpoints. A missing credential throws a
- * `ConfigurationError`.
+ * AYA Payment Gateway (APG) credentials and endpoints. A missing setting throws a
+ * `ConfigurationError`. The URL defaults to production.
  */
 export declare class AyaPayConfig {
-    static readonly SANDBOX_URL = "https://uat-pgw.ayainnovation.com";
     static readonly PRODUCTION_URL = "https://pgw.ayainnovation.com";
     readonly appKey: string;
     readonly appSecret: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: AyaPayConfigOptions);
     /**
-     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `AYA_PAY_SANDBOX` and `AYA_PAY_BASE_URL`, falling
-     * back to the `AYA_PGW_*` names.
+     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT` and
+     * `AYA_PAY_BASE_URL`, falling back to the `AYA_PGW_*` names.
      */
     static fromEnv(env?: EnvSource): AyaPayConfig;
 }

package/dist/esm/aya-pay/aya-pay.js

@@ -1,42 +1,41 @@
 import {} from '../core/amount.js';
 import { CallbackRequest, losslessInput, losslessQueryInput, PaymentCallback, PaymentStatusResult, } from '../core/callback.js';
 import { decodeBase64, hmacSha256Hex, safeEqual } from '../core/crypto.js';
-import { defaultEnv, envFirst, envSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
+import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSetting, resolveTimeout, trimUrl, } from '../core/env.js';
 import { ApiError, SignatureVerificationError } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { isLosslessObject, parseJsonObject, toPlainObject, } from '../core/json.js';
 import { FormPayment } from '../core/results.js';
 import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
-import { get, object, optional, scalarString, trimmed } from '../core/values.js';
+import { get, isNested, object, optional, scalarString, trimmed } from '../core/values.js';
 /**
- * AYA Payment Gateway (APG) credentials and endpoints. A missing credential throws a
- * `ConfigurationError`.
+ * AYA Payment Gateway (APG) credentials and endpoints. A missing setting throws a
+ * `ConfigurationError`. The URL defaults to production.
  */
 export class AyaPayConfig {
-    static SANDBOX_URL = 'https://uat-pgw.ayainnovation.com';
     static PRODUCTION_URL = 'https://pgw.ayainnovation.com';
     appKey;
     appSecret;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.appKey = requireSetting('aya_pay', 'app_key', options.appKey);
         this.appSecret = requireSetting('aya_pay', 'app_secret', options.appSecret);
-        this.sandbox = options.sandbox ?? true;
-        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ??
-            (this.sandbox ? AyaPayConfig.SANDBOX_URL : AyaPayConfig.PRODUCTION_URL));
+        this.timeoutSeconds = resolveTimeout('aya_pay', options.timeoutSeconds);
+        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ?? AyaPayConfig.PRODUCTION_URL);
     }
     /**
-     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `AYA_PAY_SANDBOX` and `AYA_PAY_BASE_URL`, falling
-     * back to the `AYA_PGW_*` names.
+     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT` and
+     * `AYA_PAY_BASE_URL`, falling back to the `AYA_PGW_*` names.
      */
     static fromEnv(env = defaultEnv()) {
         return new AyaPayConfig({
             appKey: envFirst(env, 'AYA_PAY_APP_KEY', 'AYA_PGW_APP_KEY'),
             appSecret: envFirst(env, 'AYA_PAY_APP_SECRET', 'AYA_PGW_APP_SECRET'),
-            sandbox: envSandbox(env, 'AYA_PAY_SANDBOX'),
+            timeoutSeconds: envFirst(env, HTTP_TIMEOUT_VARIABLE),
             baseUrl: envFirst(env, 'AYA_PAY_BASE_URL', 'AYA_PGW_BASE_URL'),
         });
     }
@@ -119,7 +118,7 @@ export class AyaPay {
     transport;
     constructor(config, options = {}) {
         this.config = config instanceof AyaPayConfig ? config : new AyaPayConfig(config);
-        this.transport = new Transport(httpClientFrom(options));
+        this.transport = new Transport(httpClientFrom(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `AYA_PAY_*` (or `AYA_PGW_*`) environment variables. */
     static fromEnv(env = defaultEnv(), options = {}) {
@@ -242,7 +241,8 @@ export class AyaPay {
     /** Decodes a `payload` + `checkSum` pair and returns the payload if the checksum matches. */
     verifiedPayload(input, context) {
         const fail = () => new SignatureVerificationError(`AYA Pay ${context} checksum verification failed.`, toPlainObject(input));
-        const json = decodeBase64(get(input, 'payload'));
+        // Base64 never contains spaces: a space is a `+` that an unencoded query string turned into one.
+        const json = decodeBase64(get(input, 'payload').replace(/ /g, '+'));
         const payload = json === undefined ? undefined : parseJsonObject(json);
         if (payload === undefined) {
             throw fail();
@@ -251,6 +251,10 @@ export class AyaPay {
         for (const field of PAYLOAD_FIELDS) {
             const key = field === 'currencyCode' && 'currenyCode' in payload ? 'currenyCode' : field;
             if (Object.prototype.hasOwnProperty.call(payload, key)) {
+                // A nested value is never signed, so a payload carrying one is rejected.
+                if (isNested(payload[key])) {
+                    throw fail();
+                }
                 parts.push(scalarString(payload[key]) ?? '');
             }
         }

package/dist/esm/core/amount.d.ts

@@ -43,9 +43,10 @@ export declare class Amount {
     /** Whether the amount is greater than zero. */
     isPositive(): boolean;
     /**
-     * Whether both amounts have the same value, ignoring trailing fractional zeros
-     * (`1000`, `1000.0` and `1000.00` are equal). `undefined` is never equal, so a gateway amount
-     * that was not sent never matches.
+     * Whether both amounts have the same value. Leading zeros of the whole part and trailing zeros of
+     * the fraction are ignored (`1000`, `01000` and `1000.00` are equal). Text must be plain digits
+     * with an optional fraction, so `1,000` or ` 1000` is never equal, and neither is `null` or
+     * `undefined` (a gateway amount that was not sent never matches).
      */
     equals(other: Amount | string | null | undefined): boolean;
 }

package/dist/esm/core/amount.js

@@ -85,19 +85,28 @@ export class Amount {
         return !this.isZero();
     }
     /**
-     * Whether both amounts have the same value, ignoring trailing fractional zeros
-     * (`1000`, `1000.0` and `1000.00` are equal). `undefined` is never equal, so a gateway amount
-     * that was not sent never matches.
+     * Whether both amounts have the same value. Leading zeros of the whole part and trailing zeros of
+     * the fraction are ignored (`1000`, `01000` and `1000.00` are equal). Text must be plain digits
+     * with an optional fraction, so `1,000` or ` 1000` is never equal, and neither is `null` or
+     * `undefined` (a gateway amount that was not sent never matches).
      */
     equals(other) {
         if (other === undefined || other === null) {
             return false;
         }
-        const normalize = (value) => value.includes('.') ? value.replace(/0+$/, '').replace(/\.$/, '') : value;
         const text = other instanceof Amount ? other.value : other;
+        if (typeof text !== 'string' || !PATTERN.test(text)) {
+            return false;
+        }
         return normalize(this.value) === normalize(text);
     }
 }
+function normalize(value) {
+    const [whole = '', fraction = ''] = value.split('.');
+    const trimmedWhole = whole.replace(/^0+/, '') || '0';
+    const trimmedFraction = fraction.replace(/0+$/, '');
+    return trimmedFraction === '' ? trimmedWhole : `${trimmedWhole}.${trimmedFraction}`;
+}
 function invalid(message) {
     return new InvalidPaymentDataError({ amount: message });
 }

package/dist/esm/core/callback.d.ts

@@ -16,8 +16,8 @@ export interface CallbackRequestInit {
     query?: QueryInput | null | undefined;
 }
 /**
- * The parts of a Node `http.IncomingMessage` this package reads, so Express, Fastify (`request.raw`)
- * and Koa (`ctx.req`) requests work too.
+ * The parts of a Node `http.IncomingMessage` this package reads, so Express requests work too (and
+ * Koa's `ctx.req` when no body parser consumed it).
  */
 export interface NodeRequestLike extends AsyncIterable<unknown> {
     headers: Readonly<Record<string, string | readonly string[] | undefined>>;
@@ -42,8 +42,10 @@ export interface WebRequestLike {
  * {@link CallbackRequest.fromNodeRequest} or {@link CallbackRequest.fromWebRequest}.
  */
 export declare class CallbackRequest {
-    /** The raw request body, decoded as UTF-8. */
+    /** The request body as text: a string body as given, bytes decoded as UTF-8. */
     readonly body: string;
+    /** The exact bytes received. A string body is encoded as UTF-8. */
+    readonly rawBody: Uint8Array;
     /** The request headers, with lowercase names. Repeated headers are joined with `, `. */
     readonly headers: Readonly<Record<string, string>>;
     /** The query string parameters (the first value of each). */
@@ -57,10 +59,11 @@ export declare class CallbackRequest {
      */
     static fromJson(payload: unknown, headers?: HeadersInput | null): CallbackRequest;
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static fromNodeRequest(request: NodeRequestLike): Promise<CallbackRequest>;
     /**
@@ -70,7 +73,10 @@ export declare class CallbackRequest {
     static fromWebRequest(request: WebRequestLike): Promise<CallbackRequest>;
     /** The named header, matched case-insensitively, or `undefined`. */
     header(name: string): string | undefined;
-    /** The body decoded as JSON or as a urlencoded form. */
+    /**
+     * The body decoded as JSON or as a urlencoded form. JSON numbers keep their exact text, as strings
+     * (`1000.50` stays `"1000.50"`).
+     */
     parsedBody(): Record<string, unknown>;
     /** The parsed body merged over the query string. */
     input(): Record<string, unknown>;