@laranex/myanmar-payments 4.0.0-dev.1 → 4.0.0-dev.11

package/dist/cjs/core/http.js

@@ -1,21 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Transport = exports.GatewayResponse = exports.FetchHttpClient = exports.DEFAULT_TIMEOUT_MS = void 0;
+exports.Transport = exports.GatewayResponse = exports.FetchHttpClient = void 0;
 exports.httpClientFrom = httpClientFrom;
 const errors_js_1 = require("./errors.js");
 const json_js_1 = require("./json.js");
-/** The default request timeout: 30 seconds. */
-exports.DEFAULT_TIMEOUT_MS = 30_000;
 /**
- * The default {@link HttpClient}: the global `fetch` (or the one you pass) with a 30 second
- * timeout.
+ * The default {@link HttpClient}: the global `fetch` (or the one you pass) with the timeout you
+ * give it. Gateways build one with their `timeoutSeconds` setting when you pass no client.
  */
 class FetchHttpClient {
     fetchFunction;
     timeoutMs;
-    constructor(options = {}) {
+    constructor(options) {
         this.fetchFunction = options.fetch;
-        this.timeoutMs = options.timeoutMs ?? exports.DEFAULT_TIMEOUT_MS;
+        this.timeoutMs = options.timeoutMs;
     }
     async send(request) {
         const fetchFunction = this.fetchFunction ?? globalThis.fetch;
@@ -43,9 +41,9 @@ class FetchHttpClient {
 }
 exports.FetchHttpClient = FetchHttpClient;
 /** @internal */
-function httpClientFrom(options = {}) {
+function httpClientFrom(options, timeoutSeconds) {
     return (options.httpClient ??
-        new FetchHttpClient({ fetch: options.fetch, timeoutMs: options.timeoutMs }));
+        new FetchHttpClient({ fetch: options.fetch, timeoutMs: timeoutSeconds * 1000 }));
 }
 /** A decoded gateway response. @internal */
 class GatewayResponse {

package/dist/cjs/core/index.d.ts

@@ -1,8 +1,8 @@
 export { Amount, type AmountInput } from './amount.js';
 export { MemoryTokenCache, type TokenCache } from './cache.js';
 export { Acknowledgement, CallbackRequest, PaymentCallback, PaymentStatusResult, type AcknowledgementInit, type BodyInput, type CallbackRequestInit, type HeadersInput, type NodeRequestLike, type PaymentCallbackInit, type PaymentStatusResultInit, type QueryInput, type ServerResponseLike, type WebRequestLike, } from './callback.js';
-export type { EnvSource } from './env.js';
+export { DEFAULT_TIMEOUT_SECONDS, type EnvSource } from './env.js';
 export { ApiError, ConfigurationError, InvalidPaymentDataError, PaymentError, SignatureVerificationError, } from './errors.js';
-export { DEFAULT_TIMEOUT_MS, FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
+export { FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
 export { AppPayment, FormPayment, QrPayment, RedirectPayment, type FormField, type PaymentResult, } from './results.js';
 export { PaymentFlow, PaymentStatus, resolveStatus } from './status.js';

package/dist/cjs/core/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.DEFAULT_TIMEOUT_MS = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
+exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.DEFAULT_TIMEOUT_SECONDS = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
 var amount_js_1 = require("./amount.js");
 Object.defineProperty(exports, "Amount", { enumerable: true, get: function () { return amount_js_1.Amount; } });
 var cache_js_1 = require("./cache.js");
@@ -10,6 +10,8 @@ Object.defineProperty(exports, "Acknowledgement", { enumerable: true, get: funct
 Object.defineProperty(exports, "CallbackRequest", { enumerable: true, get: function () { return callback_js_1.CallbackRequest; } });
 Object.defineProperty(exports, "PaymentCallback", { enumerable: true, get: function () { return callback_js_1.PaymentCallback; } });
 Object.defineProperty(exports, "PaymentStatusResult", { enumerable: true, get: function () { return callback_js_1.PaymentStatusResult; } });
+var env_js_1 = require("./env.js");
+Object.defineProperty(exports, "DEFAULT_TIMEOUT_SECONDS", { enumerable: true, get: function () { return env_js_1.DEFAULT_TIMEOUT_SECONDS; } });
 var errors_js_1 = require("./errors.js");
 Object.defineProperty(exports, "ApiError", { enumerable: true, get: function () { return errors_js_1.ApiError; } });
 Object.defineProperty(exports, "ConfigurationError", { enumerable: true, get: function () { return errors_js_1.ConfigurationError; } });
@@ -17,7 +19,6 @@ Object.defineProperty(exports, "InvalidPaymentDataError", { enumerable: true, ge
 Object.defineProperty(exports, "PaymentError", { enumerable: true, get: function () { return errors_js_1.PaymentError; } });
 Object.defineProperty(exports, "SignatureVerificationError", { enumerable: true, get: function () { return errors_js_1.SignatureVerificationError; } });
 var http_js_1 = require("./http.js");
-Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", { enumerable: true, get: function () { return http_js_1.DEFAULT_TIMEOUT_MS; } });
 Object.defineProperty(exports, "FetchHttpClient", { enumerable: true, get: function () { return http_js_1.FetchHttpClient; } });
 var results_js_1 = require("./results.js");
 Object.defineProperty(exports, "AppPayment", { enumerable: true, get: function () { return results_js_1.AppPayment; } });

package/dist/cjs/core/json.d.ts

@@ -32,8 +32,8 @@ export declare function parseJsonObject(text: string): LosslessObject | undefine
 /** @internal */
 export declare function isLosslessObject(value: unknown): value is LosslessObject;
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */

package/dist/cjs/core/json.js

@@ -56,14 +56,14 @@ function isLosslessObject(value) {
         !(value instanceof JsonNumber));
 }
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */
 function toPlain(value) {
     if (value instanceof JsonNumber) {
-        return Number(value.text);
+        return value.text;
     }
     if (Array.isArray(value)) {
         return value.map(toPlain);

package/dist/cjs/core/status.d.ts

@@ -1,7 +1,7 @@
 /**
  * A gateway-independent payment status. Every gateway's own status values are mapped onto these.
  */
-export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'cancelled' | 'expired' | 'unknown';
+export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'canceled' | 'expired' | 'unknown';
 /**
  * The payment statuses, plus helpers.
  *
@@ -18,13 +18,13 @@ export declare const PaymentStatus: Readonly<{
     /** The payment was attempted and failed or was rejected. */
     Failed: "failed";
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: "cancelled";
+    Canceled: "canceled";
     /** The payment window ran out before the customer paid. */
     Expired: "expired";
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
     Unknown: "unknown";
     /** Every status, in the order above. */
-    values: readonly ["successful", "pending", "failed", "cancelled", "expired", "unknown"];
+    values: readonly ["successful", "pending", "failed", "canceled", "expired", "unknown"];
     /** Whether the status will not change any more: `false` for `pending` and `unknown`. */
     isFinal(status: PaymentStatus): boolean;
 }>;

package/dist/cjs/core/status.js

@@ -18,7 +18,7 @@ exports.PaymentStatus = Object.freeze({
     /** The payment was attempted and failed or was rejected. */
     Failed: 'failed',
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: 'cancelled',
+    Canceled: 'canceled',
     /** The payment window ran out before the customer paid. */
     Expired: 'expired',
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
@@ -28,7 +28,7 @@ exports.PaymentStatus = Object.freeze({
         'successful',
         'pending',
         'failed',
-        'cancelled',
+        'canceled',
         'expired',
         'unknown',
     ]),

package/dist/cjs/core/values.d.ts

@@ -14,3 +14,5 @@ export declare function optional(source: Record<string, unknown>, key: string):
 export declare function trimmed(source: Record<string, unknown>, key: string): string;
 /** The value at `key` when it is an object (not an array). @internal */
 export declare function object(source: Record<string, unknown>, key: string): LosslessObject | undefined;
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+export declare function isNested(value: unknown): boolean;

package/dist/cjs/core/values.js

@@ -5,6 +5,7 @@ exports.get = get;
 exports.optional = optional;
 exports.trimmed = trimmed;
 exports.object = object;
+exports.isNested = isNested;
 const json_js_1 = require("./json.js");
 /**
  * Returns a scalar as the text a gateway signs: strings as is, numbers exactly as sent, booleans as
@@ -43,3 +44,7 @@ function object(source, key) {
     const value = source[key];
     return (0, json_js_1.isLosslessObject)(value) ? value : undefined;
 }
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+function isNested(value) {
+    return typeof value === 'object' && value !== null && !(value instanceof json_js_1.JsonNumber);
+}

package/dist/cjs/cyber-source/cyber-source.d.ts

@@ -10,27 +10,24 @@ export interface CyberSourceConfigOptions {
     accessKey: string;
     /** The profile's secret key, which signs the fields. */
     secretKey: string;
-    /** Use the test environment (default `true`). */
-    sandbox?: boolean | undefined;
-    /** Overrides the Secure Acceptance base URL. */
+    /** Overrides the Secure Acceptance base URL, e.g. to point at the test environment. */
     baseUrl?: string | undefined;
 }
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 export declare class CyberSourceConfig {
-    static readonly SANDBOX_URL = "https://testsecureacceptance.cybersource.com";
     static readonly PRODUCTION_URL = "https://secureacceptance.cybersource.com";
     readonly profileId: string;
     readonly accessKey: string;
     readonly secretKey: string;
-    readonly sandbox: boolean;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: CyberSourceConfigOptions);
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): CyberSourceConfig;
 }
@@ -61,12 +58,12 @@ export interface CyberSourcePaymentData {
     returnUrl?: string | undefined;
     /** The page shown on cancel (`override_custom_cancel_page`), at most 255 characters. */
     cancelUrl?: string | undefined;
-    /** An ISO 4217 code (default `MMK`). */
-    currency?: string | undefined;
-    /** What to do with the card (default `sale`). */
-    transactionType?: CyberSourceTransactionType | undefined;
-    /** The hosted page language, e.g. `en-us` (the default). */
-    locale?: string | undefined;
+    /** An ISO 4217 code, e.g. `MMK`. */
+    currency: string;
+    /** What to do with the card, e.g. `sale`. */
+    transactionType: CyberSourceTransactionType;
+    /** The hosted page language, e.g. `en-us`. */
+    locale: string;
 }
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -87,7 +84,8 @@ export declare class CyberSource {
     initiate(data: CyberSourcePaymentData): FormPayment;
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */

package/dist/cjs/cyber-source/cyber-source.js

@@ -11,35 +11,31 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 class CyberSourceConfig {
-    static SANDBOX_URL = 'https://testsecureacceptance.cybersource.com';
     static PRODUCTION_URL = 'https://secureacceptance.cybersource.com';
     profileId;
     accessKey;
     secretKey;
-    sandbox;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.profileId = (0, env_js_1.requireSetting)('cyber_source', 'profile_id', options.profileId);
         this.accessKey = (0, env_js_1.requireSetting)('cyber_source', 'access_key', options.accessKey);
         this.secretKey = (0, env_js_1.requireSetting)('cyber_source', 'secret_key', options.secretKey);
-        this.sandbox = options.sandbox ?? true;
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? CyberSourceConfig.SANDBOX_URL : CyberSourceConfig.PRODUCTION_URL));
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? CyberSourceConfig.PRODUCTION_URL);
     }
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new CyberSourceConfig({
             profileId: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_PROFILE_ID'),
             accessKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_ACCESS_KEY'),
             secretKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_SECRET_KEY'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'CYBER_SOURCE_SANDBOX'),
             baseUrl: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_BASE_URL'),
         });
     }
@@ -77,7 +73,7 @@ const STATUSES = {
     REVIEW: 'pending',
     DECLINE: 'failed',
     ERROR: 'failed',
-    CANCEL: 'cancelled',
+    CANCEL: 'canceled',
 };
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -113,9 +109,12 @@ class CyberSource {
             .string('cancelUrl', data.cancelUrl)
             .url('cancelUrl', data.cancelUrl)
             .max('cancelUrl', data.cancelUrl, 255)
-            .pattern('currency', String(data.currency || 'MMK'), /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
-            .pattern('locale', String(data.locale || 'en-us'), /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
-            .when(!TRANSACTION_TYPES.includes(String(data.transactionType || 'sale')), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('currency', data.currency)
+            .pattern('currency', data.currency, /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
+            .required('transactionType', data.transactionType)
+            .when(!TRANSACTION_TYPES.includes(String(data.transactionType)), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('locale', data.locale)
+            .pattern('locale', data.locale, /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
             .validate();
     }
     /**
@@ -130,11 +129,11 @@ class CyberSource {
             transaction_uuid: (0, crypto_js_1.randomHex)(),
             signed_field_names: SIGNED_FIELDS.join(','),
             signed_date_time: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
-            locale: data.locale || 'en-us',
-            transaction_type: data.transactionType || 'sale',
+            locale: data.locale,
+            transaction_type: data.transactionType,
             reference_number: data.orderId,
             amount: String((0, validate_js_1.toAmount)(data.amount)),
-            currency: data.currency || 'MMK',
+            currency: data.currency,
             override_custom_receipt_page: data.returnUrl ?? '',
             override_backoffice_post_url: data.callbackUrl,
             override_custom_cancel_page: data.cancelUrl ?? '',
@@ -149,31 +148,39 @@ class CyberSource {
     }
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request) {
         const payload = (0, callback_js_1.losslessInput)(request);
         const expected = this.sign(payload);
-        if (expected === undefined || !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature'))) {
+        const names = signedNames(payload);
+        if (expected === undefined ||
+            !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature')) ||
+            !names.includes('decision') ||
+            !names.includes('req_reference_number')) {
             throw new errors_js_1.SignatureVerificationError('CyberSource callback signature verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
-        const decision = (0, values_js_1.trimmed)(payload, 'decision').toUpperCase();
+        // A signature only covers the listed fields, so anything else in the post could have been
+        // added by the sender (e.g. a `decision` next to the signed request fields).
+        const signed = {};
+        for (const name of [...names, 'signature']) {
+            (0, json_js_1.setKey)(signed, name, payload[name]);
+        }
+        const decision = (0, values_js_1.trimmed)(signed, 'decision').toUpperCase();
         return new callback_js_1.PaymentCallback({
-            orderId: (0, values_js_1.get)(payload, 'req_reference_number'),
+            orderId: (0, values_js_1.get)(signed, 'req_reference_number'),
             status: (0, status_js_1.resolveStatus)(STATUSES, decision),
             gatewayStatus: decision,
-            gatewayReference: (0, values_js_1.optional)(payload, 'transaction_id'),
-            amount: (0, values_js_1.get)(payload, 'auth_amount') || (0, values_js_1.optional)(payload, 'req_amount'),
-            raw: (0, json_js_1.toPlainObject)(payload),
+            gatewayReference: (0, values_js_1.optional)(signed, 'transaction_id'),
+            amount: (0, values_js_1.get)(signed, 'auth_amount') || (0, values_js_1.optional)(signed, 'req_amount'),
+            raw: (0, json_js_1.toPlainObject)(signed),
         });
     }
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */
     sign(fields) {
         const pairs = [];
-        for (const name of (0, values_js_1.get)(fields, 'signed_field_names').split(',')) {
-            if (name === '') {
-                continue;
-            }
+        for (const name of signedNames(fields)) {
             const value = (0, values_js_1.scalarString)(fields[name]);
             if (value === undefined) {
                 return undefined;
@@ -186,3 +193,9 @@ class CyberSource {
     }
 }
 exports.CyberSource = CyberSource;
+/** The names listed in `signed_field_names`, in order. */
+function signedNames(fields) {
+    return (0, values_js_1.get)(fields, 'signed_field_names')
+        .split(',')
+        .filter((name) => name !== '');
+}

package/dist/cjs/kbz-pay/kbz-pay.d.ts

@@ -12,33 +12,46 @@ export interface KbzPayConfigOptions {
     appKey: string;
     /** The `merch_code` KBZ issued. */
     merchantCode: string;
-    /** Use the UAT endpoints (default `true`). UAT and production issue separate credentials. */
-    sandbox?: boolean | undefined;
-    /** Overrides the API base URL, e.g. to go through a proxy. */
+    /**
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
+     * client you pass keeps its own timeout.
+     */
+    timeoutSeconds?: number | string | null | undefined;
+    /** Overrides the API base URL, e.g. to point at UAT or go through a proxy. */
     apiUrl?: string | undefined;
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
+    /**
+     * Minutes the customer has to pay each order, a whole number from 1 to 120 (or its text).
+     * A payment's own `timeToLiveMinutes` overrides it. Unset or blank is allowed, but then every
+     * payment must set its own.
+     */
+    timeToLiveMinutes?: number | string | null | undefined;
 }
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 export declare class KbzPayConfig {
-    static readonly SANDBOX_API_URL = "http://api-uat.kbzpay.com/payment/gateway/uat";
     static readonly PRODUCTION_API_URL = "https://api.kbzpay.com/payment/gateway";
-    static readonly SANDBOX_PWA_URL = "https://static.kbzpay.com/pgw/uat/pwa/#/";
     static readonly PRODUCTION_PWA_URL = "https://wap.kbzpay.com/pgw/pwa/#/";
     readonly appId: string;
     readonly appKey: string;
     readonly merchantCode: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
+    /** Minutes the customer has to pay each order unless the payment sets its own; `undefined` when unset. */
+    readonly timeToLiveMinutes: number | undefined;
     constructor(options: KbzPayConfigOptions);
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
+     * `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }
@@ -54,8 +67,11 @@ export interface KbzPayPaymentData {
     callbackUrl: string;
     /** The product name shown to the customer. */
     title?: string | undefined;
-    /** How long the order stays payable, 1 to 120 minutes. KBZ defaults to 120. */
-    timeoutMinutes?: number | undefined;
+    /**
+     * Minutes the customer has to pay before the order expires, 1 to 120. Overrides the config's
+     * `timeToLiveMinutes`; one of the two is required.
+     */
+    timeToLiveMinutes?: number | undefined;
     /** Free text KBZ sends back unchanged in the callback, at most 512 characters once URL-encoded. */
     callbackInfo?: string | undefined;
 }
@@ -79,13 +95,21 @@ export declare class KbzPay {
      *
      * The redirect only works on a phone with the KBZ Pay app installed, and its Referer must match
      * the URL registered with KBZ.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     pwa(data: KbzPayPaymentData, options?: RequestOptions): Promise<RedirectPayment>;
-    /** Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app. */
+    /**
+     * Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
+     */
     qr(data: KbzPayPaymentData, options?: RequestOptions): Promise<QrPayment>;
     /**
      * Creates an order and returns the signed values your mobile app passes to `KBZPay.startPay()`.
      * The SDK's own result only means the payment screen closed; rely on the callback or `status()`.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     app(data: KbzPayPaymentData, options?: RequestOptions): Promise<AppPayment>;
     /** Asks KBZ Pay for the current state of an order (`queryorder`). */