@laranex/myanmar-payments 4.0.0-dev.10 → 4.0.0-dev.11

package/CHANGELOG.md

@@ -22,8 +22,8 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - Requires Node.js 20 or higher.
 
 ### Changed since the pre-releases
-- No sandbox switch: the sandbox setting (`sandbox`) and the `*_SANDBOX` variables are removed, and every gateway defaults to its production endpoints. The HTTP timeout (`timeout_in_seconds`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`) of every gateway that calls an API is optional and defaults to 30 seconds. Every other setting is required: Wave Money's `time_to_live_in_seconds` and `merchant_name` (no `APP_NAME` fallback), Yoma MMQR's `api_version`, and CyberSource's `currency`, `locale` and `transactionType` on each payment. A missing setting throws the configuration error naming it; a time setting that is not a whole number greater than 0 throws `The <gateway> configuration [<key>] must be a whole number greater than 0.` Upgrading: delete `*_SANDBOX`; to keep testing against UAT, set the URL overrides to the UAT URLs listed in the docs; set the newly required settings.
-  - In Node: config options `timeToLiveSeconds` and `apiVersion` are required and take a whole number or its text; `timeoutSeconds` (KBZ Pay, Wave Money, AYA Pay, Yoma MMQR) is optional, takes a whole number or its text and defaults to the new `DEFAULT_TIMEOUT_SECONDS` (30) when unset or blank; the `SANDBOX_*`, `DEFAULT_TIME_TO_LIVE_SECONDS` and `DEFAULT_API_VERSION` constants are removed. `GatewayOptions.timeoutMs` (so also the `MyanmarPayments` option) and `DEFAULT_TIMEOUT_MS` are removed; `FetchHttpClient` requires `timeoutMs`. `ConfigurationError` takes a third `invalid` argument for the whole-number message.
+- No sandbox switch: the sandbox setting (`sandbox`) and the `*_SANDBOX` variables are removed, and every gateway defaults to its production endpoints. The HTTP timeout (`timeout_in_seconds`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`) of every gateway that calls an API is optional and defaults to 30 seconds. Every other setting is required: Wave Money's `merchant_name` (no `APP_NAME` fallback), Yoma MMQR's `api_version`, and CyberSource's `currency`, `locale` and `transactionType` on each payment. A missing setting throws the configuration error naming it; a time setting that is not a whole number greater than 0 throws `The <gateway> configuration [<key>] must be a whole number greater than 0.` Upgrading: delete `*_SANDBOX`; to keep testing against UAT, set the URL overrides to the UAT URLs listed in the docs; set the newly required settings.
+  - In Node: the config option `apiVersion` is required; Wave Money's `timeToLiveSeconds` is optional and takes a whole number or its text; `timeoutSeconds` (KBZ Pay, Wave Money, AYA Pay, Yoma MMQR) is optional, takes a whole number or its text and defaults to the new `DEFAULT_TIMEOUT_SECONDS` (30) when unset or blank; the `SANDBOX_*`, `DEFAULT_TIME_TO_LIVE_SECONDS` and `DEFAULT_API_VERSION` constants are removed. `GatewayOptions.timeoutMs` (so also the `MyanmarPayments` option) and `DEFAULT_TIMEOUT_MS` are removed; `FetchHttpClient` requires `timeoutMs`. `ConfigurationError` takes a third `invalid` argument for the whole-number message.
 - `PaymentStatus.Cancelled` is renamed to `PaymentStatus.Canceled` and its value from `'cancelled'` to `'canceled'` (American English), with no alias. Code or stored statuses from the `v4.0.0-dev` pre-releases need the new name; gateway status literals such as Wave Money's `PAYMENT_REQUEST_CANCELLED` are unchanged.
 - Callback values that are JSON numbers are kept as their exact text, as strings, in `raw`, `parsedBody()`, `input()`, `queryInput()` and the `raw` of errors (`1000.50` is `'1000.50'`, not `1000.5`), like the PHP SDK.
 - A nested value (object or array) in a signed or hashed callback field now fails verification: KBZ Pay (any callback field), Wave Money (the hashed fields), AYA Pay (the signed payload fields) and Yoma MMQR (`status`). Before, KBZ Pay skipped it, Wave Money hashed it as `null` and AYA Pay signed it as empty.
@@ -32,5 +32,5 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - `Amount.equals()` compares by value, ignoring leading zeros too (`'01000'` equals `Amount.kyat(1000)`); text that is not plain digits with an optional fraction is never equal.
 - `CallbackRequest.rawBody` holds the exact bytes received (a string body is encoded as UTF-8), next to `body` as text, like Python's `raw_body` and Go's `Body`.
 - `WaveMoneyPaymentData` takes optional `merchantName` and `timeToLiveSeconds`, which override the configured `merchantName` and `timeToLiveSeconds` for one payment (request hash included); a blank `merchantName` or a `timeToLiveSeconds` that is not a whole number greater than 0 throws `InvalidPaymentDataError`, like the PHP SDK.
-- `KbzPayPaymentData.timeoutMinutes` is renamed to `timeToLiveSeconds` and takes seconds, like Wave Money: 60 to 7200, in whole minutes (a multiple of 60), because KBZ's `timeout_express` counts minutes (`1800` is sent as `30m`). Upgrading: multiply the old value by 60.
-- `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS` (`KbzPayConfig`'s `timeToLiveSeconds`) sets the time to live of every KBZ Pay order, like Wave Money's; a payment's own `timeToLiveSeconds` overrides it. It is optional: unset or blank leaves it to KBZ (7200). A value that is not a multiple of 60 from 60 to 7200 throws `ConfigurationError`: `The kbz_pay configuration [time_to_live_in_seconds] must be a multiple of 60 from 60 to 7200.` `ConfigurationError` takes an optional `requirement` for that message.
+- `KbzPayPaymentData.timeoutMinutes` is renamed to `timeToLiveMinutes` (still 1 to 120 minutes, the unit of KBZ's `timeout_express`), matching the new setting.
+- `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES` (`KbzPayConfig`'s `timeToLiveMinutes`) sets the time to live of every KBZ Pay order; a payment's own `timeToLiveMinutes` overrides it. It is optional, and so is Wave Money's `timeToLiveSeconds` (`WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`): a payment that sets no time to live while its gateway has none configured throws `InvalidPaymentDataError` (`The timeToLiveMinutes field is required when the kbz_pay configuration has no [time_to_live_in_minutes].`, and the same for Wave Money's `timeToLiveSeconds`) before any request is sent. A value that is not a whole number from 1 to 120 throws `ConfigurationError`: `The kbz_pay configuration [time_to_live_in_minutes] must be a whole number from 1 to 120.` `ConfigurationError` takes an optional `requirement` for that message.

package/dist/cjs/core/env.d.ts

@@ -9,6 +9,13 @@ export declare function envFirst(env: EnvSource, ...keys: string[]): string;
  * @internal
  */
 export declare function requireSeconds(gateway: string, key: string, value: unknown): number;
+/**
+ * An optional whole number of seconds: `undefined` when unset or blank, otherwise the same rules
+ * as {@link requireSeconds}.
+ *
+ * @internal
+ */
+export declare function optionalSeconds(gateway: string, key: string, value: unknown): number | undefined;
 /** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
 export declare const HTTP_TIMEOUT_VARIABLE = "MYANMAR_PAYMENTS_HTTP_TIMEOUT";
 /** Seconds before the default HTTP client gives up on a request when no timeout is configured. */

package/dist/cjs/core/env.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_TIMEOUT_SECONDS = exports.HTTP_TIMEOUT_VARIABLE = void 0;
 exports.envFirst = envFirst;
 exports.requireSeconds = requireSeconds;
+exports.optionalSeconds = optionalSeconds;
 exports.resolveTimeout = resolveTimeout;
 exports.requireSetting = requireSetting;
 exports.optionalSetting = optionalSetting;
@@ -41,6 +42,18 @@ function requireSeconds(gateway, key, value) {
     }
     return seconds;
 }
+/**
+ * An optional whole number of seconds: `undefined` when unset or blank, otherwise the same rules
+ * as {@link requireSeconds}.
+ *
+ * @internal
+ */
+function optionalSeconds(gateway, key, value) {
+    if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
+        return undefined;
+    }
+    return requireSeconds(gateway, key, value);
+}
 /** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
 exports.HTTP_TIMEOUT_VARIABLE = 'MYANMAR_PAYMENTS_HTTP_TIMEOUT';
 /** Seconds before the default HTTP client gives up on a request when no timeout is configured. */

package/dist/cjs/kbz-pay/kbz-pay.d.ts

@@ -23,10 +23,11 @@ export interface KbzPayConfigOptions {
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
     /**
-     * Seconds the customer has to pay each order, a multiple of 60 from 60 to 7200 (or its text).
-     * A payment's own `timeToLiveSeconds` overrides it; unset or blank leaves it to KBZ (7200).
+     * Minutes the customer has to pay each order, a whole number from 1 to 120 (or its text).
+     * A payment's own `timeToLiveMinutes` overrides it. Unset or blank is allowed, but then every
+     * payment must set its own.
      */
-    timeToLiveSeconds?: number | string | null | undefined;
+    timeToLiveMinutes?: number | string | null | undefined;
 }
 /**
  * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
@@ -44,13 +45,13 @@ export declare class KbzPayConfig {
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
-    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
-    readonly timeToLiveSeconds: number | undefined;
+    /** Minutes the customer has to pay each order unless the payment sets its own; `undefined` when unset. */
+    readonly timeToLiveMinutes: number | undefined;
     constructor(options: KbzPayConfigOptions);
     /**
      * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
      * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
-     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
+     * `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }
@@ -67,11 +68,10 @@ export interface KbzPayPaymentData {
     /** The product name shown to the customer. */
     title?: string | undefined;
     /**
-     * Seconds the customer has to pay before the order expires, 60 to 7200 in whole minutes (a multiple
-     * of 60). KBZ counts minutes, so 1800 is sent as `30m`. Overrides the config's `timeToLiveSeconds`;
-     * when both are unset KBZ allows 7200 (120 minutes).
+     * Minutes the customer has to pay before the order expires, 1 to 120. Overrides the config's
+     * `timeToLiveMinutes`; one of the two is required.
      */
-    timeToLiveSeconds?: number | undefined;
+    timeToLiveMinutes?: number | undefined;
     /** Free text KBZ sends back unchanged in the callback, at most 512 characters once URL-encoded. */
     callbackInfo?: string | undefined;
 }
@@ -95,13 +95,21 @@ export declare class KbzPay {
      *
      * The redirect only works on a phone with the KBZ Pay app installed, and its Referer must match
      * the URL registered with KBZ.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     pwa(data: KbzPayPaymentData, options?: RequestOptions): Promise<RedirectPayment>;
-    /** Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app. */
+    /**
+     * Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
+     */
     qr(data: KbzPayPaymentData, options?: RequestOptions): Promise<QrPayment>;
     /**
      * Creates an order and returns the signed values your mobile app passes to `KBZPay.startPay()`.
      * The SDK's own result only means the payment screen closed; rely on the callback or `status()`.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     app(data: KbzPayPaymentData, options?: RequestOptions): Promise<AppPayment>;
     /** Asks KBZ Pay for the current state of an order (`queryorder`). */

package/dist/cjs/kbz-pay/kbz-pay.js

@@ -12,23 +12,23 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 const signer_js_1 = require("./signer.js");
-/** What a valid KBZ Pay `time_to_live_in_seconds` is: KBZ counts whole minutes, up to 120. */
-const TIME_TO_LIVE_REQUIREMENT = 'a multiple of 60 from 60 to 7200';
+/** What a valid KBZ Pay `time_to_live_in_minutes` is: KBZ counts whole minutes, up to 120. */
+const TIME_TO_LIVE_REQUIREMENT = 'a whole number from 1 to 120';
 function resolveTimeToLive(value) {
     if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
         return undefined;
     }
-    let seconds;
+    let minutes;
     if (typeof value === 'number' && Number.isSafeInteger(value)) {
-        seconds = value;
+        minutes = value;
     }
     else if (typeof value === 'string' && /^[+-]?\d+$/.test(value.trim())) {
-        seconds = Number.parseInt(value.trim(), 10);
+        minutes = Number.parseInt(value.trim(), 10);
     }
-    if (seconds === undefined || seconds < 60 || seconds > 7200 || seconds % 60 !== 0) {
-        throw new errors_js_1.ConfigurationError('kbz_pay', 'time_to_live_in_seconds', true, TIME_TO_LIVE_REQUIREMENT);
+    if (minutes === undefined || minutes < 1 || minutes > 120) {
+        throw new errors_js_1.ConfigurationError('kbz_pay', 'time_to_live_in_minutes', true, TIME_TO_LIVE_REQUIREMENT);
     }
-    return seconds;
+    return minutes;
 }
 /**
  * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
@@ -46,8 +46,8 @@ class KbzPayConfig {
     apiUrl;
     /** The PWA checkout URL in use, always ending in `/`. */
     pwaUrl;
-    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
-    timeToLiveSeconds;
+    /** Minutes the customer has to pay each order unless the payment sets its own; `undefined` when unset. */
+    timeToLiveMinutes;
     constructor(options) {
         this.appId = (0, env_js_1.requireSetting)('kbz_pay', 'app_id', options.appId);
         this.appKey = (0, env_js_1.requireSetting)('kbz_pay', 'app_key', options.appKey);
@@ -55,12 +55,12 @@ class KbzPayConfig {
         this.timeoutSeconds = (0, env_js_1.resolveTimeout)('kbz_pay', options.timeoutSeconds);
         this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ?? KbzPayConfig.PRODUCTION_API_URL);
         this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ?? KbzPayConfig.PRODUCTION_PWA_URL)}/`;
-        this.timeToLiveSeconds = resolveTimeToLive(options.timeToLiveSeconds);
+        this.timeToLiveMinutes = resolveTimeToLive(options.timeToLiveMinutes);
     }
     /**
      * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
      * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
-     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
+     * `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new KbzPayConfig({
@@ -70,7 +70,7 @@ class KbzPayConfig {
             timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             apiUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_BASE_URL'),
             pwaUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_PWA_BASE_REDIRECT_URL'),
-            timeToLiveSeconds: (0, env_js_1.envFirst)(env, 'KBZ_PAY_TIME_TO_LIVE_IN_SECONDS'),
+            timeToLiveMinutes: (0, env_js_1.envFirst)(env, 'KBZ_PAY_TIME_TO_LIVE_IN_MINUTES'),
         });
     }
 }
@@ -116,8 +116,7 @@ class KbzPay {
             .max('callbackUrl', callbackUrl, 512)
             .when(callbackUrl.includes('?'), 'callbackUrl', 'The callbackUrl field must not contain a query string.')
             .string('title', data.title)
-            .between('timeToLiveSeconds', data.timeToLiveSeconds, 60, 7200)
-            .when(Number.isInteger(data.timeToLiveSeconds) && data.timeToLiveSeconds % 60 !== 0, 'timeToLiveSeconds', 'The timeToLiveSeconds field must be a multiple of 60.')
+            .between('timeToLiveMinutes', data.timeToLiveMinutes, 1, 120)
             .string('callbackInfo', data.callbackInfo)
             .max('callbackInfo', typeof data.callbackInfo === 'string' ? (0, crypto_js_1.queryEscape)(data.callbackInfo) : undefined, 512)
             .validate();
@@ -127,6 +126,8 @@ class KbzPay {
      *
      * The redirect only works on a phone with the KBZ Pay app installed, and its Referer must match
      * the URL registered with KBZ.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     async pwa(data, options = {}) {
         const order = await this.precreate(data, 'PWAAPP', options);
@@ -138,7 +139,11 @@ class KbzPay {
             raw: (0, json_js_1.toPlainObject)(order.response),
         });
     }
-    /** Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app. */
+    /**
+     * Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
+     */
     async qr(data, options = {}) {
         const order = await this.precreate(data, 'PAY_BY_QRCODE', options);
         const qrCode = (0, values_js_1.get)(order.response, 'qrCode');
@@ -150,9 +155,7 @@ class KbzPay {
         return new results_js_1.QrPayment({
             orderId: data.orderId,
             qrString: qrCode,
-            expiresAt: order.timeToLiveSeconds === undefined
-                ? undefined
-                : new Date(Date.now() + order.timeToLiveSeconds * 1000),
+            expiresAt: new Date(Date.now() + order.timeToLiveMinutes * 60_000),
             reference: order.prepayId,
             raw: (0, json_js_1.toPlainObject)(order.response),
         });
@@ -160,6 +163,8 @@ class KbzPay {
     /**
      * Creates an order and returns the signed values your mobile app passes to `KBZPay.startPay()`.
      * The SDK's own result only means the payment screen closed; rely on the callback or `status()`.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     async app(data, options = {}) {
         const order = await this.precreate(data, 'APP', options);
@@ -212,6 +217,12 @@ class KbzPay {
     }
     async precreate(data, tradeType, options) {
         KbzPay.validate(data);
+        const timeToLiveMinutes = data.timeToLiveMinutes ?? this.config.timeToLiveMinutes;
+        if (timeToLiveMinutes === undefined) {
+            throw new errors_js_1.InvalidPaymentDataError({
+                timeToLiveMinutes: 'The timeToLiveMinutes field is required when the kbz_pay configuration has no [time_to_live_in_minutes].',
+            });
+        }
         const biz = {
             appid: this.config.appId,
             merch_code: this.config.merchantCode,
@@ -223,10 +234,7 @@ class KbzPay {
         if (data.title) {
             biz.title = data.title;
         }
-        const timeToLiveSeconds = data.timeToLiveSeconds ?? this.config.timeToLiveSeconds;
-        if (timeToLiveSeconds !== undefined) {
-            biz.timeout_express = `${timeToLiveSeconds / 60}m`;
-        }
+        biz.timeout_express = `${timeToLiveMinutes}m`;
         if (data.callbackInfo) {
             biz.callback_info = (0, crypto_js_1.queryEscape)(data.callbackInfo);
         }
@@ -237,7 +245,7 @@ class KbzPay {
         if (prepayId === '') {
             throw new errors_js_1.ApiError('KBZ Pay did not return a prepay_id.', { raw: (0, json_js_1.toPlainObject)(response) });
         }
-        return { prepayId, nonce, timestamp: time, timeToLiveSeconds, response };
+        return { prepayId, nonce, timestamp: time, timeToLiveMinutes, response };
     }
     /** Sends a signed request and returns the `Response` object, throwing when KBZ reports an error. */
     async call(endpoint, method, version, biz, extra, nonce, time, signal) {

package/dist/cjs/wave-money/wave-money.d.ts

@@ -11,8 +11,12 @@ export interface WaveMoneyConfigOptions {
     secretKey: string;
     /** Your business name, shown on Wave's payment page. */
     merchantName: string;
-    /** How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). */
-    timeToLiveSeconds: number | string;
+    /**
+     * How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). A
+     * payment's own `timeToLiveSeconds` overrides it. Unset or blank is allowed, but then every
+     * payment must set its own.
+     */
+    timeToLiveSeconds?: number | string | null | undefined;
     /**
      * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
      * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
@@ -34,8 +38,8 @@ export declare class WaveMoneyConfig {
     readonly merchantId: string;
     readonly secretKey: string;
     readonly merchantName: string;
-    /** Seconds the customer has to pay. */
-    readonly timeToLiveSeconds: number;
+    /** Seconds the customer has to pay unless the payment sets its own; `undefined` when unset. */
+    readonly timeToLiveSeconds: number | undefined;
     /** Seconds before the default HTTP client gives up on a request. */
     readonly timeoutSeconds: number;
     /** The API base URL in use. */
@@ -86,7 +90,7 @@ export interface WaveMoneyPaymentData {
     merchantName?: string | null | undefined;
     /**
      * How long the customer has to pay this payment, in seconds: a whole number greater than 0.
-     * Defaults to the configured `timeToLiveSeconds` when unset.
+     * Defaults to the configured `timeToLiveSeconds` when unset; one of the two is required.
      */
     timeToLiveSeconds?: number | null | undefined;
 }
@@ -111,7 +115,8 @@ export declare class WaveMoney {
     /**
      * Creates a payment request and returns Wave's page to redirect the customer to. Once `data`
      * passes validation it fills `data.merchantReferenceId` with a random id when empty, so store it
-     * afterwards. Invalid data is left untouched.
+     * afterwards. Invalid data is left untouched. Throws `InvalidPaymentDataError` before any request
+     * when neither the payment nor the config sets a time to live.
      */
     initiate(data: WaveMoneyPaymentData, options?: RequestOptions): Promise<RedirectPayment>;
     /**

package/dist/cjs/wave-money/wave-money.js

@@ -22,7 +22,7 @@ class WaveMoneyConfig {
     merchantId;
     secretKey;
     merchantName;
-    /** Seconds the customer has to pay. */
+    /** Seconds the customer has to pay unless the payment sets its own; `undefined` when unset. */
     timeToLiveSeconds;
     /** Seconds before the default HTTP client gives up on a request. */
     timeoutSeconds;
@@ -34,7 +34,7 @@ class WaveMoneyConfig {
         this.merchantId = (0, env_js_1.requireSetting)('wave_money', 'merchant_id', options.merchantId);
         this.secretKey = (0, env_js_1.requireSetting)('wave_money', 'secret_key', options.secretKey);
         this.merchantName = (0, env_js_1.requireSetting)('wave_money', 'merchant_name', options.merchantName);
-        this.timeToLiveSeconds = (0, env_js_1.requireSeconds)('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
+        this.timeToLiveSeconds = (0, env_js_1.optionalSeconds)('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
         this.timeoutSeconds = (0, env_js_1.resolveTimeout)('wave_money', options.timeoutSeconds);
         this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? WaveMoneyConfig.PRODUCTION_URL);
         this.authenticateUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.authenticateUrl) ?? WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL);
@@ -149,15 +149,22 @@ class WaveMoney {
     /**
      * Creates a payment request and returns Wave's page to redirect the customer to. Once `data`
      * passes validation it fills `data.merchantReferenceId` with a random id when empty, so store it
-     * afterwards. Invalid data is left untouched.
+     * afterwards. Invalid data is left untouched. Throws `InvalidPaymentDataError` before any request
+     * when neither the payment nor the config sets a time to live.
      */
     async initiate(data, options = {}) {
         WaveMoney.validate(data);
+        const timeToLiveSeconds = data.timeToLiveSeconds ?? this.config.timeToLiveSeconds;
+        if (timeToLiveSeconds === undefined) {
+            throw new errors_js_1.InvalidPaymentDataError({
+                timeToLiveSeconds: 'The timeToLiveSeconds field is required when the wave_money configuration has no [time_to_live_in_seconds].',
+            });
+        }
         if (!data.merchantReferenceId) {
             data.merchantReferenceId = (0, crypto_js_1.randomHex)();
         }
         const amount = WaveMoney.resolvedAmount(data).toString();
-        const ttl = String(data.timeToLiveSeconds ?? this.config.timeToLiveSeconds);
+        const ttl = String(timeToLiveSeconds);
         // Wave documents items as [{"name": "...", "amount": 1000}] with a numeric amount; the amount
         // text is written as a JSON number without passing through a float.
         const items = `[${data.items

package/dist/esm/core/env.d.ts

@@ -9,6 +9,13 @@ export declare function envFirst(env: EnvSource, ...keys: string[]): string;
  * @internal
  */
 export declare function requireSeconds(gateway: string, key: string, value: unknown): number;
+/**
+ * An optional whole number of seconds: `undefined` when unset or blank, otherwise the same rules
+ * as {@link requireSeconds}.
+ *
+ * @internal
+ */
+export declare function optionalSeconds(gateway: string, key: string, value: unknown): number | undefined;
 /** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
 export declare const HTTP_TIMEOUT_VARIABLE = "MYANMAR_PAYMENTS_HTTP_TIMEOUT";
 /** Seconds before the default HTTP client gives up on a request when no timeout is configured. */

package/dist/esm/core/env.js

@@ -31,6 +31,18 @@ export function requireSeconds(gateway, key, value) {
     }
     return seconds;
 }
+/**
+ * An optional whole number of seconds: `undefined` when unset or blank, otherwise the same rules
+ * as {@link requireSeconds}.
+ *
+ * @internal
+ */
+export function optionalSeconds(gateway, key, value) {
+    if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
+        return undefined;
+    }
+    return requireSeconds(gateway, key, value);
+}
 /** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
 export const HTTP_TIMEOUT_VARIABLE = 'MYANMAR_PAYMENTS_HTTP_TIMEOUT';
 /** Seconds before the default HTTP client gives up on a request when no timeout is configured. */

package/dist/esm/kbz-pay/kbz-pay.d.ts

@@ -23,10 +23,11 @@ export interface KbzPayConfigOptions {
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
     /**
-     * Seconds the customer has to pay each order, a multiple of 60 from 60 to 7200 (or its text).
-     * A payment's own `timeToLiveSeconds` overrides it; unset or blank leaves it to KBZ (7200).
+     * Minutes the customer has to pay each order, a whole number from 1 to 120 (or its text).
+     * A payment's own `timeToLiveMinutes` overrides it. Unset or blank is allowed, but then every
+     * payment must set its own.
      */
-    timeToLiveSeconds?: number | string | null | undefined;
+    timeToLiveMinutes?: number | string | null | undefined;
 }
 /**
  * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
@@ -44,13 +45,13 @@ export declare class KbzPayConfig {
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
-    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
-    readonly timeToLiveSeconds: number | undefined;
+    /** Minutes the customer has to pay each order unless the payment sets its own; `undefined` when unset. */
+    readonly timeToLiveMinutes: number | undefined;
     constructor(options: KbzPayConfigOptions);
     /**
      * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
      * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
-     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
+     * `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }
@@ -67,11 +68,10 @@ export interface KbzPayPaymentData {
     /** The product name shown to the customer. */
     title?: string | undefined;
     /**
-     * Seconds the customer has to pay before the order expires, 60 to 7200 in whole minutes (a multiple
-     * of 60). KBZ counts minutes, so 1800 is sent as `30m`. Overrides the config's `timeToLiveSeconds`;
-     * when both are unset KBZ allows 7200 (120 minutes).
+     * Minutes the customer has to pay before the order expires, 1 to 120. Overrides the config's
+     * `timeToLiveMinutes`; one of the two is required.
      */
-    timeToLiveSeconds?: number | undefined;
+    timeToLiveMinutes?: number | undefined;
     /** Free text KBZ sends back unchanged in the callback, at most 512 characters once URL-encoded. */
     callbackInfo?: string | undefined;
 }
@@ -95,13 +95,21 @@ export declare class KbzPay {
      *
      * The redirect only works on a phone with the KBZ Pay app installed, and its Referer must match
      * the URL registered with KBZ.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     pwa(data: KbzPayPaymentData, options?: RequestOptions): Promise<RedirectPayment>;
-    /** Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app. */
+    /**
+     * Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
+     */
     qr(data: KbzPayPaymentData, options?: RequestOptions): Promise<QrPayment>;
     /**
      * Creates an order and returns the signed values your mobile app passes to `KBZPay.startPay()`.
      * The SDK's own result only means the payment screen closed; rely on the callback or `status()`.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     app(data: KbzPayPaymentData, options?: RequestOptions): Promise<AppPayment>;
     /** Asks KBZ Pay for the current state of an order (`queryorder`). */

package/dist/esm/kbz-pay/kbz-pay.js

@@ -2,7 +2,7 @@ import {} from '../core/amount.js';
 import { Acknowledgement, CallbackRequest, losslessBody, PaymentCallback, PaymentStatusResult, } from '../core/callback.js';
 import { queryEscape, randomHex } from '../core/crypto.js';
 import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSetting, resolveTimeout, trimUrl, } from '../core/env.js';
-import { ApiError, ConfigurationError, SignatureVerificationError } from '../core/errors.js';
+import { ApiError, ConfigurationError, InvalidPaymentDataError, SignatureVerificationError, } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { toPlainObject } from '../core/json.js';
 import { AppPayment, QrPayment, RedirectPayment } from '../core/results.js';
@@ -10,23 +10,23 @@ import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
 import { get, object, optional, trimmed } from '../core/values.js';
 import { KbzPaySigner } from './signer.js';
-/** What a valid KBZ Pay `time_to_live_in_seconds` is: KBZ counts whole minutes, up to 120. */
-const TIME_TO_LIVE_REQUIREMENT = 'a multiple of 60 from 60 to 7200';
+/** What a valid KBZ Pay `time_to_live_in_minutes` is: KBZ counts whole minutes, up to 120. */
+const TIME_TO_LIVE_REQUIREMENT = 'a whole number from 1 to 120';
 function resolveTimeToLive(value) {
     if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
         return undefined;
     }
-    let seconds;
+    let minutes;
     if (typeof value === 'number' && Number.isSafeInteger(value)) {
-        seconds = value;
+        minutes = value;
     }
     else if (typeof value === 'string' && /^[+-]?\d+$/.test(value.trim())) {
-        seconds = Number.parseInt(value.trim(), 10);
+        minutes = Number.parseInt(value.trim(), 10);
     }
-    if (seconds === undefined || seconds < 60 || seconds > 7200 || seconds % 60 !== 0) {
-        throw new ConfigurationError('kbz_pay', 'time_to_live_in_seconds', true, TIME_TO_LIVE_REQUIREMENT);
+    if (minutes === undefined || minutes < 1 || minutes > 120) {
+        throw new ConfigurationError('kbz_pay', 'time_to_live_in_minutes', true, TIME_TO_LIVE_REQUIREMENT);
     }
-    return seconds;
+    return minutes;
 }
 /**
  * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
@@ -44,8 +44,8 @@ export class KbzPayConfig {
     apiUrl;
     /** The PWA checkout URL in use, always ending in `/`. */
     pwaUrl;
-    /** Seconds the customer has to pay each order unless the payment sets its own; `undefined` leaves it to KBZ. */
-    timeToLiveSeconds;
+    /** Minutes the customer has to pay each order unless the payment sets its own; `undefined` when unset. */
+    timeToLiveMinutes;
     constructor(options) {
         this.appId = requireSetting('kbz_pay', 'app_id', options.appId);
         this.appKey = requireSetting('kbz_pay', 'app_key', options.appKey);
@@ -53,12 +53,12 @@ export class KbzPayConfig {
         this.timeoutSeconds = resolveTimeout('kbz_pay', options.timeoutSeconds);
         this.apiUrl = trimUrl(optionalSetting(options.apiUrl) ?? KbzPayConfig.PRODUCTION_API_URL);
         this.pwaUrl = `${trimUrl(optionalSetting(options.pwaUrl) ?? KbzPayConfig.PRODUCTION_PWA_URL)}/`;
-        this.timeToLiveSeconds = resolveTimeToLive(options.timeToLiveSeconds);
+        this.timeToLiveMinutes = resolveTimeToLive(options.timeToLiveMinutes);
     }
     /**
      * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
      * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL` and
-     * `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS`.
+     * `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES`.
      */
     static fromEnv(env = defaultEnv()) {
         return new KbzPayConfig({
@@ -68,7 +68,7 @@ export class KbzPayConfig {
             timeoutSeconds: envFirst(env, HTTP_TIMEOUT_VARIABLE),
             apiUrl: envFirst(env, 'KBZ_PAY_BASE_URL'),
             pwaUrl: envFirst(env, 'KBZ_PAY_PWA_BASE_REDIRECT_URL'),
-            timeToLiveSeconds: envFirst(env, 'KBZ_PAY_TIME_TO_LIVE_IN_SECONDS'),
+            timeToLiveMinutes: envFirst(env, 'KBZ_PAY_TIME_TO_LIVE_IN_MINUTES'),
         });
     }
 }
@@ -113,8 +113,7 @@ export class KbzPay {
             .max('callbackUrl', callbackUrl, 512)
             .when(callbackUrl.includes('?'), 'callbackUrl', 'The callbackUrl field must not contain a query string.')
             .string('title', data.title)
-            .between('timeToLiveSeconds', data.timeToLiveSeconds, 60, 7200)
-            .when(Number.isInteger(data.timeToLiveSeconds) && data.timeToLiveSeconds % 60 !== 0, 'timeToLiveSeconds', 'The timeToLiveSeconds field must be a multiple of 60.')
+            .between('timeToLiveMinutes', data.timeToLiveMinutes, 1, 120)
             .string('callbackInfo', data.callbackInfo)
             .max('callbackInfo', typeof data.callbackInfo === 'string' ? queryEscape(data.callbackInfo) : undefined, 512)
             .validate();
@@ -124,6 +123,8 @@ export class KbzPay {
      *
      * The redirect only works on a phone with the KBZ Pay app installed, and its Referer must match
      * the URL registered with KBZ.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     async pwa(data, options = {}) {
         const order = await this.precreate(data, 'PWAAPP', options);
@@ -135,7 +136,11 @@ export class KbzPay {
             raw: toPlainObject(order.response),
         });
     }
-    /** Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app. */
+    /**
+     * Creates an order and returns a QR payload for the customer to scan with the KBZ Pay app.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
+     */
     async qr(data, options = {}) {
         const order = await this.precreate(data, 'PAY_BY_QRCODE', options);
         const qrCode = get(order.response, 'qrCode');
@@ -147,9 +152,7 @@ export class KbzPay {
         return new QrPayment({
             orderId: data.orderId,
             qrString: qrCode,
-            expiresAt: order.timeToLiveSeconds === undefined
-                ? undefined
-                : new Date(Date.now() + order.timeToLiveSeconds * 1000),
+            expiresAt: new Date(Date.now() + order.timeToLiveMinutes * 60_000),
             reference: order.prepayId,
             raw: toPlainObject(order.response),
         });
@@ -157,6 +160,8 @@ export class KbzPay {
     /**
      * Creates an order and returns the signed values your mobile app passes to `KBZPay.startPay()`.
      * The SDK's own result only means the payment screen closed; rely on the callback or `status()`.
+     * Throws `InvalidPaymentDataError` before any request when neither the payment nor the config sets
+     * a time to live.
      */
     async app(data, options = {}) {
         const order = await this.precreate(data, 'APP', options);
@@ -209,6 +214,12 @@ export class KbzPay {
     }
     async precreate(data, tradeType, options) {
         KbzPay.validate(data);
+        const timeToLiveMinutes = data.timeToLiveMinutes ?? this.config.timeToLiveMinutes;
+        if (timeToLiveMinutes === undefined) {
+            throw new InvalidPaymentDataError({
+                timeToLiveMinutes: 'The timeToLiveMinutes field is required when the kbz_pay configuration has no [time_to_live_in_minutes].',
+            });
+        }
         const biz = {
             appid: this.config.appId,
             merch_code: this.config.merchantCode,
@@ -220,10 +231,7 @@ export class KbzPay {
         if (data.title) {
             biz.title = data.title;
         }
-        const timeToLiveSeconds = data.timeToLiveSeconds ?? this.config.timeToLiveSeconds;
-        if (timeToLiveSeconds !== undefined) {
-            biz.timeout_express = `${timeToLiveSeconds / 60}m`;
-        }
+        biz.timeout_express = `${timeToLiveMinutes}m`;
         if (data.callbackInfo) {
             biz.callback_info = queryEscape(data.callbackInfo);
         }
@@ -234,7 +242,7 @@ export class KbzPay {
         if (prepayId === '') {
             throw new ApiError('KBZ Pay did not return a prepay_id.', { raw: toPlainObject(response) });
         }
-        return { prepayId, nonce, timestamp: time, timeToLiveSeconds, response };
+        return { prepayId, nonce, timestamp: time, timeToLiveMinutes, response };
     }
     /** Sends a signed request and returns the `Response` object, throwing when KBZ reports an error. */
     async call(endpoint, method, version, biz, extra, nonce, time, signal) {

package/dist/esm/wave-money/wave-money.d.ts

@@ -11,8 +11,12 @@ export interface WaveMoneyConfigOptions {
     secretKey: string;
     /** Your business name, shown on Wave's payment page. */
     merchantName: string;
-    /** How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). */
-    timeToLiveSeconds: number | string;
+    /**
+     * How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). A
+     * payment's own `timeToLiveSeconds` overrides it. Unset or blank is allowed, but then every
+     * payment must set its own.
+     */
+    timeToLiveSeconds?: number | string | null | undefined;
     /**
      * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
      * (or its text). Defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`) when unset or blank. A
@@ -34,8 +38,8 @@ export declare class WaveMoneyConfig {
     readonly merchantId: string;
     readonly secretKey: string;
     readonly merchantName: string;
-    /** Seconds the customer has to pay. */
-    readonly timeToLiveSeconds: number;
+    /** Seconds the customer has to pay unless the payment sets its own; `undefined` when unset. */
+    readonly timeToLiveSeconds: number | undefined;
     /** Seconds before the default HTTP client gives up on a request. */
     readonly timeoutSeconds: number;
     /** The API base URL in use. */
@@ -86,7 +90,7 @@ export interface WaveMoneyPaymentData {
     merchantName?: string | null | undefined;
     /**
      * How long the customer has to pay this payment, in seconds: a whole number greater than 0.
-     * Defaults to the configured `timeToLiveSeconds` when unset.
+     * Defaults to the configured `timeToLiveSeconds` when unset; one of the two is required.
      */
     timeToLiveSeconds?: number | null | undefined;
 }
@@ -111,7 +115,8 @@ export declare class WaveMoney {
     /**
      * Creates a payment request and returns Wave's page to redirect the customer to. Once `data`
      * passes validation it fills `data.merchantReferenceId` with a random id when empty, so store it
-     * afterwards. Invalid data is left untouched.
+     * afterwards. Invalid data is left untouched. Throws `InvalidPaymentDataError` before any request
+     * when neither the payment nor the config sets a time to live.
      */
     initiate(data: WaveMoneyPaymentData, options?: RequestOptions): Promise<RedirectPayment>;
     /**

package/dist/esm/wave-money/wave-money.js

@@ -1,8 +1,8 @@
 import { Amount } from '../core/amount.js';
 import { CallbackRequest, losslessBody, PaymentCallback } from '../core/callback.js';
 import { hmacSha256Hex, queryEscape, randomHex, safeEqual } from '../core/crypto.js';
-import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSeconds, requireSetting, resolveTimeout, trimUrl, } from '../core/env.js';
-import { ApiError, SignatureVerificationError } from '../core/errors.js';
+import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, optionalSeconds, requireSetting, resolveTimeout, trimUrl, } from '../core/env.js';
+import { ApiError, InvalidPaymentDataError, SignatureVerificationError } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { isLosslessObject, toPlainObject } from '../core/json.js';
 import { RedirectPayment } from '../core/results.js';
@@ -19,7 +19,7 @@ export class WaveMoneyConfig {
     merchantId;
     secretKey;
     merchantName;
-    /** Seconds the customer has to pay. */
+    /** Seconds the customer has to pay unless the payment sets its own; `undefined` when unset. */
     timeToLiveSeconds;
     /** Seconds before the default HTTP client gives up on a request. */
     timeoutSeconds;
@@ -31,7 +31,7 @@ export class WaveMoneyConfig {
         this.merchantId = requireSetting('wave_money', 'merchant_id', options.merchantId);
         this.secretKey = requireSetting('wave_money', 'secret_key', options.secretKey);
         this.merchantName = requireSetting('wave_money', 'merchant_name', options.merchantName);
-        this.timeToLiveSeconds = requireSeconds('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
+        this.timeToLiveSeconds = optionalSeconds('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
         this.timeoutSeconds = resolveTimeout('wave_money', options.timeoutSeconds);
         this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ?? WaveMoneyConfig.PRODUCTION_URL);
         this.authenticateUrl = trimUrl(optionalSetting(options.authenticateUrl) ?? WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL);
@@ -145,15 +145,22 @@ export class WaveMoney {
     /**
      * Creates a payment request and returns Wave's page to redirect the customer to. Once `data`
      * passes validation it fills `data.merchantReferenceId` with a random id when empty, so store it
-     * afterwards. Invalid data is left untouched.
+     * afterwards. Invalid data is left untouched. Throws `InvalidPaymentDataError` before any request
+     * when neither the payment nor the config sets a time to live.
      */
     async initiate(data, options = {}) {
         WaveMoney.validate(data);
+        const timeToLiveSeconds = data.timeToLiveSeconds ?? this.config.timeToLiveSeconds;
+        if (timeToLiveSeconds === undefined) {
+            throw new InvalidPaymentDataError({
+                timeToLiveSeconds: 'The timeToLiveSeconds field is required when the wave_money configuration has no [time_to_live_in_seconds].',
+            });
+        }
         if (!data.merchantReferenceId) {
             data.merchantReferenceId = randomHex();
         }
         const amount = WaveMoney.resolvedAmount(data).toString();
-        const ttl = String(data.timeToLiveSeconds ?? this.config.timeToLiveSeconds);
+        const ttl = String(timeToLiveSeconds);
         // Wave documents items as [{"name": "...", "amount": 1000}] with a numeric amount; the amount
         // text is written as a JSON number without passing through a float.
         const items = `[${data.items

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@laranex/myanmar-payments",
-  "version": "4.0.0-dev.10",
+  "version": "4.0.0-dev.11",
   "description": "Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed requests and results, exact amounts, no runtime dependencies.",
   "keywords": [
     "laranex",

package/skills/node-myanmar-payments/SKILL.md

@@ -23,7 +23,7 @@ Requires Node.js 20+ and has no runtime dependencies (global `fetch`, `node:cryp
 
 ## Configure
 
-`MyanmarPayments.fromEnv(process.env)` reads `KBZ_PAY_*`, `WAVE_MONEY_*`, `AYA_PAY_*` (or `AYA_PGW_*`), `YOMA_MMQR_*` and `CYBER_SOURCE_*` plus `MYANMAR_PAYMENTS_HTTP_TIMEOUT` (the same variables as the PHP, Go and Python SDKs). Every gateway defaults to its production URLs; to test against UAT, set the URL overrides (`KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL`, `WAVE_MONEY_BASE_URL`, `WAVE_MONEY_AUTHENTICATE_URL`, `AYA_PAY_BASE_URL`, `YOMA_MMQR_BASE_URL`, `CYBER_SOURCE_BASE_URL`) to the gateway's UAT URLs. The HTTP timeout `timeoutSeconds` / `MYANMAR_PAYMENTS_HTTP_TIMEOUT` (seconds, for every gateway except CyberSource) is optional and defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`); an explicit value must be a whole number greater than 0. `KBZ_PAY_TIME_TO_LIVE_IN_SECONDS` (KBZ's `timeToLiveSeconds`) is optional: seconds each KBZ order stays payable, a multiple of 60 from 60 to 7200 (KBZ's 7200 when unset); a payment's `timeToLiveSeconds` overrides it. Every other setting is required, with no defaults: credentials, Wave's `merchantName` and `timeToLiveSeconds`, and Yoma's `apiVersion` (e.g. `v1rc`).
+`MyanmarPayments.fromEnv(process.env)` reads `KBZ_PAY_*`, `WAVE_MONEY_*`, `AYA_PAY_*` (or `AYA_PGW_*`), `YOMA_MMQR_*` and `CYBER_SOURCE_*` plus `MYANMAR_PAYMENTS_HTTP_TIMEOUT` (the same variables as the PHP, Go and Python SDKs). Every gateway defaults to its production URLs; to test against UAT, set the URL overrides (`KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL`, `WAVE_MONEY_BASE_URL`, `WAVE_MONEY_AUTHENTICATE_URL`, `AYA_PAY_BASE_URL`, `YOMA_MMQR_BASE_URL`, `CYBER_SOURCE_BASE_URL`) to the gateway's UAT URLs. The HTTP timeout `timeoutSeconds` / `MYANMAR_PAYMENTS_HTTP_TIMEOUT` (seconds, for every gateway except CyberSource) is optional and defaults to 30 (`DEFAULT_TIMEOUT_SECONDS`); an explicit value must be a whole number greater than 0. Time to live: `KBZ_PAY_TIME_TO_LIVE_IN_MINUTES` (KBZ's `timeToLiveMinutes`, 1 to 120) and `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS` (Wave's `timeToLiveSeconds`, greater than 0) are optional defaults; a payment's `timeToLiveMinutes` / `timeToLiveSeconds` overrides them, and a payment with neither throws `InvalidPaymentDataError` before any request. Every other setting is required, with no defaults: credentials, Wave's `merchantName`, and Yoma's `apiVersion` (e.g. `v1rc`).
 
 ```ts
 import { MyanmarPayments } from '@laranex/myanmar-payments';
@@ -58,7 +58,7 @@ const payment = await kbz.pwa({
 res.writeHead(302, { Location: payment.url }).end();
 ```
 
-- `RedirectPayment` (`url`) from `kbz.pwa(data)` and `wave.initiate(data)`. Wave fills `data.merchantReferenceId` when empty; store it. Pass `merchantName` or `timeToLiveSeconds` in Wave's payment data to override the configured `WAVE_MONEY_MERCHANT_NAME` or `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS` for that one payment (the settings stay required).
+- `RedirectPayment` (`url`) from `kbz.pwa(data)` and `wave.initiate(data)`. Wave fills `data.merchantReferenceId` when empty; store it. Pass `merchantName` or `timeToLiveSeconds` in Wave's payment data to override the configured `WAVE_MONEY_MERCHANT_NAME` or `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS` for that one payment (the merchant name setting stays required).
 - `FormPayment` from `aya.initiate(data)` and `cyberSource.initiate(data)` (no network call): send `payment.toHtml()` as an auto-submitting page, or render `action`, `fields` and `enctype` yourself.
 - `QrPayment` from `kbz.qr(data)` (encode `qrString`) and `yoma.initiate(data)` (`qrImageDataUri()`, `expiresAt`, `reference`). A Yoma QR lives `YomaMmqr.QR_LIFETIME_SECONDS` (120); renew it with `yoma.renewQr(orderId)`.
 - `AppPayment` from `kbz.app(data)`: `res.json(payment)` sends `orderId`, `orderInfo`, `sign` and `signType` to your mobile app.