@laranex/myanmar-payments 4.0.0-dev.2 → 4.0.0-dev.3

package/CHANGELOG.md

@@ -12,10 +12,15 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - Exact `Amount` type (`Amount.kyat()`, `Amount.parse()`) kept as decimal text, so amounts never pass through a float; payment data also takes a whole-number `number` or `bigint` and rejects fractions. Decimals are accepted only where the gateway documents them (KBZ Pay up to 2 places, CyberSource any); every gateway except CyberSource is MMK only.
 - A config class per gateway with `fromEnv(process.env)`, reading the same `*_SANDBOX`, credential and URL variables as the PHP, Laravel and Go packages; a missing credential throws `ConfigurationError`. `MyanmarPayments` builds every gateway lazily from one config object or the environment.
 - Result classes: `RedirectPayment`, `FormPayment` (with `toHtml()`), `QrPayment` (with `qrImageDataUri()`) and `AppPayment`; `PaymentCallback` (with a gateway-independent `PaymentStatus` and the `Acknowledgement` each gateway expects, sent with `send(res)` or `toResponse()`) and `PaymentStatusResult`.
-- `CallbackRequest.fromNodeRequest()` (node:http, Express, Fastify, Koa), `CallbackRequest.fromWebRequest()` (Fetch API servers such as Next.js, Hono and Bun), `CallbackRequest.from()` and `CallbackRequest.fromJson()`. JSON numbers in callbacks are read without a float conversion, so signatures and amounts keep the gateway's exact text.
+- `CallbackRequest.fromNodeRequest()` (node:http, Express), `CallbackRequest.fromWebRequest()` (Fetch API servers such as Next.js, Hono and Bun), `CallbackRequest.from()` and `CallbackRequest.fromJson()`. JSON numbers in callbacks are read without a float conversion, so signatures and amounts keep the gateway's exact text.
 - Errors: `PaymentError` and its subclasses `InvalidPaymentDataError` (per-field `errors`), `ApiError` (`gatewayCode`, `gatewayMessage`, `httpStatus`, `raw`, `cause`), `SignatureVerificationError` and `ConfigurationError`.
 - No runtime dependencies: the global `fetch` (or an injected `fetch` / `HttpClient`, 30 second default timeout, `AbortSignal` per call) and `node:crypto`; an injectable `TokenCache` with an in-memory default for Yoma's access token.
+- CyberSource callbacks trust only the fields listed in `signed_field_names`: `decision` and `req_reference_number` must be signed, and unsigned fields are left out of the result and `raw`.
+- AYA Pay reads a `payload` whose `+` signs became spaces in an unencoded return query string.
 - Callback, return and cancel URLs only need to be valid absolute http or https URLs; there is no HTTPS-only rule (gateways may still require HTTPS in production).
 - Wave Money's sandbox is `https://preprodpayments.wavemoney.io:8107`, with checkout at `https://preprodpayments.wavemoney.io/authenticate`.
 - Agent skill in `skills/node-myanmar-payments` so coding agents use the package correctly; install it with `npx skills add laranex/node-myanmar-payments`.
 - Requires Node.js 20 or higher.
+
+### Changed since the pre-releases
+- `PaymentStatus.Cancelled` is renamed to `PaymentStatus.Canceled` and its value from `'cancelled'` to `'canceled'` (American English), with no alias. Code or stored statuses from the `v4.0.0-dev` pre-releases need the new name; gateway status literals such as Wave Money's `PAYMENT_REQUEST_CANCELLED` are unchanged.

package/README.md

@@ -1,7 +1,7 @@
 # Node Myanmar Payments
 
 [![npm](https://img.shields.io/npm/v/@laranex/myanmar-payments.svg?style=flat-square)](https://www.npmjs.com/package/@laranex/myanmar-payments)
-[![Tests](https://img.shields.io/github/actions/workflow/status/laranex/node-myanmar-payments/tests.yml?label=tests&style=flat-square)](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml)
+[![Tests](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml/badge.svg)](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml)
 [![License](https://img.shields.io/npm/l/@laranex/myanmar-payments.svg?style=flat-square)](LICENSE.md)
 
 Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed TypeScript API, ESM and CommonJS, no runtime dependencies. Built for humans and AI agents.

package/dist/cjs/aya-pay/aya-pay.js

@@ -246,7 +246,8 @@ class AyaPay {
     /** Decodes a `payload` + `checkSum` pair and returns the payload if the checksum matches. */
     verifiedPayload(input, context) {
         const fail = () => new errors_js_1.SignatureVerificationError(`AYA Pay ${context} checksum verification failed.`, (0, json_js_1.toPlainObject)(input));
-        const json = (0, crypto_js_1.decodeBase64)((0, values_js_1.get)(input, 'payload'));
+        // Base64 never contains spaces: a space is a `+` that an unencoded query string turned into one.
+        const json = (0, crypto_js_1.decodeBase64)((0, values_js_1.get)(input, 'payload').replace(/ /g, '+'));
         const payload = json === undefined ? undefined : (0, json_js_1.parseJsonObject)(json);
         if (payload === undefined) {
             throw fail();

package/dist/cjs/core/callback.d.ts

@@ -16,8 +16,8 @@ export interface CallbackRequestInit {
     query?: QueryInput | null | undefined;
 }
 /**
- * The parts of a Node `http.IncomingMessage` this package reads, so Express, Fastify (`request.raw`)
- * and Koa (`ctx.req`) requests work too.
+ * The parts of a Node `http.IncomingMessage` this package reads, so Express requests work too (and
+ * Koa's `ctx.req` when no body parser consumed it).
  */
 export interface NodeRequestLike extends AsyncIterable<unknown> {
     headers: Readonly<Record<string, string | readonly string[] | undefined>>;
@@ -57,10 +57,11 @@ export declare class CallbackRequest {
      */
     static fromJson(payload: unknown, headers?: HeadersInput | null): CallbackRequest;
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static fromNodeRequest(request: NodeRequestLike): Promise<CallbackRequest>;
     /**

package/dist/cjs/core/callback.js

@@ -37,10 +37,11 @@ class CallbackRequest {
         });
     }
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static async fromNodeRequest(request) {
         const headers = normalizeHeaders(request.headers);

package/dist/cjs/core/status.d.ts

@@ -1,7 +1,7 @@
 /**
  * A gateway-independent payment status. Every gateway's own status values are mapped onto these.
  */
-export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'cancelled' | 'expired' | 'unknown';
+export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'canceled' | 'expired' | 'unknown';
 /**
  * The payment statuses, plus helpers.
  *
@@ -18,13 +18,13 @@ export declare const PaymentStatus: Readonly<{
     /** The payment was attempted and failed or was rejected. */
     Failed: "failed";
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: "cancelled";
+    Canceled: "canceled";
     /** The payment window ran out before the customer paid. */
     Expired: "expired";
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
     Unknown: "unknown";
     /** Every status, in the order above. */
-    values: readonly ["successful", "pending", "failed", "cancelled", "expired", "unknown"];
+    values: readonly ["successful", "pending", "failed", "canceled", "expired", "unknown"];
     /** Whether the status will not change any more: `false` for `pending` and `unknown`. */
     isFinal(status: PaymentStatus): boolean;
 }>;

package/dist/cjs/core/status.js

@@ -18,7 +18,7 @@ exports.PaymentStatus = Object.freeze({
     /** The payment was attempted and failed or was rejected. */
     Failed: 'failed',
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: 'cancelled',
+    Canceled: 'canceled',
     /** The payment window ran out before the customer paid. */
     Expired: 'expired',
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
@@ -28,7 +28,7 @@ exports.PaymentStatus = Object.freeze({
         'successful',
         'pending',
         'failed',
-        'cancelled',
+        'canceled',
         'expired',
         'unknown',
     ]),

package/dist/cjs/cyber-source/cyber-source.d.ts

@@ -87,7 +87,8 @@ export declare class CyberSource {
     initiate(data: CyberSourcePaymentData): FormPayment;
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */

package/dist/cjs/cyber-source/cyber-source.js

@@ -77,7 +77,7 @@ const STATUSES = {
     REVIEW: 'pending',
     DECLINE: 'failed',
     ERROR: 'failed',
-    CANCEL: 'cancelled',
+    CANCEL: 'canceled',
 };
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -149,31 +149,39 @@ class CyberSource {
     }
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request) {
         const payload = (0, callback_js_1.losslessInput)(request);
         const expected = this.sign(payload);
-        if (expected === undefined || !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature'))) {
+        const names = signedNames(payload);
+        if (expected === undefined ||
+            !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature')) ||
+            !names.includes('decision') ||
+            !names.includes('req_reference_number')) {
             throw new errors_js_1.SignatureVerificationError('CyberSource callback signature verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
-        const decision = (0, values_js_1.trimmed)(payload, 'decision').toUpperCase();
+        // A signature only covers the listed fields, so anything else in the post could have been
+        // added by the sender (e.g. a `decision` next to the signed request fields).
+        const signed = {};
+        for (const name of [...names, 'signature']) {
+            (0, json_js_1.setKey)(signed, name, payload[name]);
+        }
+        const decision = (0, values_js_1.trimmed)(signed, 'decision').toUpperCase();
         return new callback_js_1.PaymentCallback({
-            orderId: (0, values_js_1.get)(payload, 'req_reference_number'),
+            orderId: (0, values_js_1.get)(signed, 'req_reference_number'),
             status: (0, status_js_1.resolveStatus)(STATUSES, decision),
             gatewayStatus: decision,
-            gatewayReference: (0, values_js_1.optional)(payload, 'transaction_id'),
-            amount: (0, values_js_1.get)(payload, 'auth_amount') || (0, values_js_1.optional)(payload, 'req_amount'),
-            raw: (0, json_js_1.toPlainObject)(payload),
+            gatewayReference: (0, values_js_1.optional)(signed, 'transaction_id'),
+            amount: (0, values_js_1.get)(signed, 'auth_amount') || (0, values_js_1.optional)(signed, 'req_amount'),
+            raw: (0, json_js_1.toPlainObject)(signed),
         });
     }
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */
     sign(fields) {
         const pairs = [];
-        for (const name of (0, values_js_1.get)(fields, 'signed_field_names').split(',')) {
-            if (name === '') {
-                continue;
-            }
+        for (const name of signedNames(fields)) {
             const value = (0, values_js_1.scalarString)(fields[name]);
             if (value === undefined) {
                 return undefined;
@@ -186,3 +194,9 @@ class CyberSource {
     }
 }
 exports.CyberSource = CyberSource;
+/** The names listed in `signed_field_names`, in order. */
+function signedNames(fields) {
+    return (0, values_js_1.get)(fields, 'signed_field_names')
+        .split(',')
+        .filter((name) => name !== '');
+}

package/dist/cjs/kbz-pay/kbz-pay.js

@@ -60,7 +60,7 @@ const STATUSES = {
     WAIT_PAY: 'pending',
     PAYING: 'pending',
     PAY_FAILED: 'failed',
-    ORDER_CLOSED: 'cancelled',
+    ORDER_CLOSED: 'canceled',
     ORDER_EXPIRED: 'expired',
 };
 /**

package/dist/cjs/wave-money/wave-money.js

@@ -71,7 +71,7 @@ const STATUSES = {
     INSUFFICIENT_BALANCE: 'pending',
     ACCOUNT_LOCKED: 'failed',
     BILL_COLLECTION_FAILED: 'failed',
-    PAYMENT_REQUEST_CANCELLED: 'cancelled',
+    PAYMENT_REQUEST_CANCELLED: 'canceled',
     TRANSACTION_TIMED_OUT: 'expired',
     SCHEDULER_TRANSACTION_TIMED_OUT: 'expired',
 };

package/dist/esm/aya-pay/aya-pay.js

@@ -242,7 +242,8 @@ export class AyaPay {
     /** Decodes a `payload` + `checkSum` pair and returns the payload if the checksum matches. */
     verifiedPayload(input, context) {
         const fail = () => new SignatureVerificationError(`AYA Pay ${context} checksum verification failed.`, toPlainObject(input));
-        const json = decodeBase64(get(input, 'payload'));
+        // Base64 never contains spaces: a space is a `+` that an unencoded query string turned into one.
+        const json = decodeBase64(get(input, 'payload').replace(/ /g, '+'));
         const payload = json === undefined ? undefined : parseJsonObject(json);
         if (payload === undefined) {
             throw fail();

package/dist/esm/core/callback.d.ts

@@ -16,8 +16,8 @@ export interface CallbackRequestInit {
     query?: QueryInput | null | undefined;
 }
 /**
- * The parts of a Node `http.IncomingMessage` this package reads, so Express, Fastify (`request.raw`)
- * and Koa (`ctx.req`) requests work too.
+ * The parts of a Node `http.IncomingMessage` this package reads, so Express requests work too (and
+ * Koa's `ctx.req` when no body parser consumed it).
  */
 export interface NodeRequestLike extends AsyncIterable<unknown> {
     headers: Readonly<Record<string, string | readonly string[] | undefined>>;
@@ -57,10 +57,11 @@ export declare class CallbackRequest {
      */
     static fromJson(payload: unknown, headers?: HeadersInput | null): CallbackRequest;
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static fromNodeRequest(request: NodeRequestLike): Promise<CallbackRequest>;
     /**

package/dist/esm/core/callback.js

@@ -31,10 +31,11 @@ export class CallbackRequest {
         });
     }
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static async fromNodeRequest(request) {
         const headers = normalizeHeaders(request.headers);

package/dist/esm/core/status.d.ts

@@ -1,7 +1,7 @@
 /**
  * A gateway-independent payment status. Every gateway's own status values are mapped onto these.
  */
-export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'cancelled' | 'expired' | 'unknown';
+export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'canceled' | 'expired' | 'unknown';
 /**
  * The payment statuses, plus helpers.
  *
@@ -18,13 +18,13 @@ export declare const PaymentStatus: Readonly<{
     /** The payment was attempted and failed or was rejected. */
     Failed: "failed";
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: "cancelled";
+    Canceled: "canceled";
     /** The payment window ran out before the customer paid. */
     Expired: "expired";
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
     Unknown: "unknown";
     /** Every status, in the order above. */
-    values: readonly ["successful", "pending", "failed", "cancelled", "expired", "unknown"];
+    values: readonly ["successful", "pending", "failed", "canceled", "expired", "unknown"];
     /** Whether the status will not change any more: `false` for `pending` and `unknown`. */
     isFinal(status: PaymentStatus): boolean;
 }>;

package/dist/esm/core/status.js

@@ -14,7 +14,7 @@ export const PaymentStatus = Object.freeze({
     /** The payment was attempted and failed or was rejected. */
     Failed: 'failed',
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: 'cancelled',
+    Canceled: 'canceled',
     /** The payment window ran out before the customer paid. */
     Expired: 'expired',
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
@@ -24,7 +24,7 @@ export const PaymentStatus = Object.freeze({
         'successful',
         'pending',
         'failed',
-        'cancelled',
+        'canceled',
         'expired',
         'unknown',
     ]),

package/dist/esm/cyber-source/cyber-source.d.ts

@@ -87,7 +87,8 @@ export declare class CyberSource {
     initiate(data: CyberSourcePaymentData): FormPayment;
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */

package/dist/esm/cyber-source/cyber-source.js

@@ -3,7 +3,7 @@ import { CallbackRequest, losslessInput, PaymentCallback } from '../core/callbac
 import { hmacSha256Base64, randomHex, safeEqual } from '../core/crypto.js';
 import { defaultEnv, envFirst, envSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
 import { SignatureVerificationError } from '../core/errors.js';
-import { toPlainObject } from '../core/json.js';
+import { setKey, toPlainObject } from '../core/json.js';
 import { FormPayment } from '../core/results.js';
 import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
@@ -74,7 +74,7 @@ const STATUSES = {
     REVIEW: 'pending',
     DECLINE: 'failed',
     ERROR: 'failed',
-    CANCEL: 'cancelled',
+    CANCEL: 'canceled',
 };
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -146,31 +146,39 @@ export class CyberSource {
     }
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request) {
         const payload = losslessInput(request);
         const expected = this.sign(payload);
-        if (expected === undefined || !safeEqual(expected, get(payload, 'signature'))) {
+        const names = signedNames(payload);
+        if (expected === undefined ||
+            !safeEqual(expected, get(payload, 'signature')) ||
+            !names.includes('decision') ||
+            !names.includes('req_reference_number')) {
             throw new SignatureVerificationError('CyberSource callback signature verification failed.', toPlainObject(payload));
         }
-        const decision = trimmed(payload, 'decision').toUpperCase();
+        // A signature only covers the listed fields, so anything else in the post could have been
+        // added by the sender (e.g. a `decision` next to the signed request fields).
+        const signed = {};
+        for (const name of [...names, 'signature']) {
+            setKey(signed, name, payload[name]);
+        }
+        const decision = trimmed(signed, 'decision').toUpperCase();
         return new PaymentCallback({
-            orderId: get(payload, 'req_reference_number'),
+            orderId: get(signed, 'req_reference_number'),
             status: resolveStatus(STATUSES, decision),
             gatewayStatus: decision,
-            gatewayReference: optional(payload, 'transaction_id'),
-            amount: get(payload, 'auth_amount') || optional(payload, 'req_amount'),
-            raw: toPlainObject(payload),
+            gatewayReference: optional(signed, 'transaction_id'),
+            amount: get(signed, 'auth_amount') || optional(signed, 'req_amount'),
+            raw: toPlainObject(signed),
         });
     }
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */
     sign(fields) {
         const pairs = [];
-        for (const name of get(fields, 'signed_field_names').split(',')) {
-            if (name === '') {
-                continue;
-            }
+        for (const name of signedNames(fields)) {
             const value = scalarString(fields[name]);
             if (value === undefined) {
                 return undefined;
@@ -182,3 +190,9 @@ export class CyberSource {
             : hmacSha256Base64(this.config.secretKey, pairs.join(','));
     }
 }
+/** The names listed in `signed_field_names`, in order. */
+function signedNames(fields) {
+    return get(fields, 'signed_field_names')
+        .split(',')
+        .filter((name) => name !== '');
+}

package/dist/esm/kbz-pay/kbz-pay.js

@@ -57,7 +57,7 @@ const STATUSES = {
     WAIT_PAY: 'pending',
     PAYING: 'pending',
     PAY_FAILED: 'failed',
-    ORDER_CLOSED: 'cancelled',
+    ORDER_CLOSED: 'canceled',
     ORDER_EXPIRED: 'expired',
 };
 /**

package/dist/esm/wave-money/wave-money.js

@@ -67,7 +67,7 @@ const STATUSES = {
     INSUFFICIENT_BALANCE: 'pending',
     ACCOUNT_LOCKED: 'failed',
     BILL_COLLECTION_FAILED: 'failed',
-    PAYMENT_REQUEST_CANCELLED: 'cancelled',
+    PAYMENT_REQUEST_CANCELLED: 'canceled',
     TRANSACTION_TIMED_OUT: 'expired',
     SCHEDULER_TRANSACTION_TIMED_OUT: 'expired',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@laranex/myanmar-payments",
-  "version": "4.0.0-dev.2",
+  "version": "4.0.0-dev.3",
   "description": "Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed TypeScript API, ESM and CommonJS, no runtime dependencies.",
   "keywords": [
     "laranex",

package/skills/node-myanmar-payments/SKILL.md

@@ -84,13 +84,14 @@ try {
 ```
 
 - Give the callback route the raw body: in Express use `express.raw({ type: '*/*' })` or mount it before `express.json()`.
+- Fastify consumes the body before your handler: keep it as a string with a content-type parser (`parseAs: 'string'`) and build `CallbackRequest.from({ body, headers: request.headers, query: request.query })`.
 - Check AYA's browser return with `aya.verifyRedirect(request)`.
 - For production, store the verified call, acknowledge immediately, then process it once in the background.
 
 ### Check status and handle errors
 
 - `kbz.status(orderId)`, `aya.status(orderId)` and `yoma.status(reference)` return `PaymentStatusResult` with `status` and `isSuccessful()`. Wave Money and CyberSource have no status API.
-- Statuses: `PaymentStatus.Successful`, `Pending`, `Failed`, `Cancelled`, `Expired`, `Unknown`; `PaymentStatus.isFinal(status)`.
+- Statuses: `PaymentStatus.Successful`, `Pending`, `Failed`, `Canceled`, `Expired`, `Unknown`; `PaymentStatus.isFinal(status)`.
 - Gateway failures throw `ApiError` (`gatewayCode`, `gatewayMessage`, `httpStatus`, `raw`, `cause` for network errors and aborts). All errors extend `PaymentError`.
 
 ## Test your app