@laranex/myanmar-payments 4.0.0-dev.2 → 4.0.0-dev.4

package/CHANGELOG.md

@@ -12,10 +12,22 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - Exact `Amount` type (`Amount.kyat()`, `Amount.parse()`) kept as decimal text, so amounts never pass through a float; payment data also takes a whole-number `number` or `bigint` and rejects fractions. Decimals are accepted only where the gateway documents them (KBZ Pay up to 2 places, CyberSource any); every gateway except CyberSource is MMK only.
 - A config class per gateway with `fromEnv(process.env)`, reading the same `*_SANDBOX`, credential and URL variables as the PHP, Laravel and Go packages; a missing credential throws `ConfigurationError`. `MyanmarPayments` builds every gateway lazily from one config object or the environment.
 - Result classes: `RedirectPayment`, `FormPayment` (with `toHtml()`), `QrPayment` (with `qrImageDataUri()`) and `AppPayment`; `PaymentCallback` (with a gateway-independent `PaymentStatus` and the `Acknowledgement` each gateway expects, sent with `send(res)` or `toResponse()`) and `PaymentStatusResult`.
-- `CallbackRequest.fromNodeRequest()` (node:http, Express, Fastify, Koa), `CallbackRequest.fromWebRequest()` (Fetch API servers such as Next.js, Hono and Bun), `CallbackRequest.from()` and `CallbackRequest.fromJson()`. JSON numbers in callbacks are read without a float conversion, so signatures and amounts keep the gateway's exact text.
+- `CallbackRequest.fromNodeRequest()` (node:http, Express), `CallbackRequest.fromWebRequest()` (Fetch API servers such as Next.js, Hono and Bun), `CallbackRequest.from()` and `CallbackRequest.fromJson()`. JSON numbers in callbacks are read without a float conversion, so signatures and amounts keep the gateway's exact text.
 - Errors: `PaymentError` and its subclasses `InvalidPaymentDataError` (per-field `errors`), `ApiError` (`gatewayCode`, `gatewayMessage`, `httpStatus`, `raw`, `cause`), `SignatureVerificationError` and `ConfigurationError`.
 - No runtime dependencies: the global `fetch` (or an injected `fetch` / `HttpClient`, 30 second default timeout, `AbortSignal` per call) and `node:crypto`; an injectable `TokenCache` with an in-memory default for Yoma's access token.
+- CyberSource callbacks trust only the fields listed in `signed_field_names`: `decision` and `req_reference_number` must be signed, and unsigned fields are left out of the result and `raw`.
+- AYA Pay reads a `payload` whose `+` signs became spaces in an unencoded return query string.
 - Callback, return and cancel URLs only need to be valid absolute http or https URLs; there is no HTTPS-only rule (gateways may still require HTTPS in production).
 - Wave Money's sandbox is `https://preprodpayments.wavemoney.io:8107`, with checkout at `https://preprodpayments.wavemoney.io/authenticate`.
 - Agent skill in `skills/node-myanmar-payments` so coding agents use the package correctly; install it with `npx skills add laranex/node-myanmar-payments`.
 - Requires Node.js 20 or higher.
+
+### Changed since the pre-releases
+- `PaymentStatus.Cancelled` is renamed to `PaymentStatus.Canceled` and its value from `'cancelled'` to `'canceled'` (American English), with no alias. Code or stored statuses from the `v4.0.0-dev` pre-releases need the new name; gateway status literals such as Wave Money's `PAYMENT_REQUEST_CANCELLED` are unchanged.
+- Callback values that are JSON numbers are kept as their exact text, as strings, in `raw`, `parsedBody()`, `input()`, `queryInput()` and the `raw` of errors (`1000.50` is `'1000.50'`, not `1000.5`), like the PHP SDK.
+- A nested value (object or array) in a signed or hashed callback field now fails verification: KBZ Pay (any callback field), Wave Money (the hashed fields), AYA Pay (the signed payload fields) and Yoma MMQR (`status`). Before, KBZ Pay skipped it, Wave Money hashed it as `null` and AYA Pay signed it as empty.
+- AYA Pay accepts a base64 `payload` without padding as well as with full padding; partial padding, the URL-safe alphabet, line breaks and payloads that are not UTF-8 are rejected.
+- Yoma MMQR caches its access token under `myanmar-payments.yoma-mmqr.token.<sha256 of base URL and client id>` (was `node-myanmar-payments.…`), the same key as the PHP, Go and Python SDKs, and reads `expires_in` from its leading digits.
+- `Amount.equals()` compares by value, ignoring leading zeros too (`'01000'` equals `Amount.kyat(1000)`); text that is not plain digits with an optional fraction is never equal.
+- `CallbackRequest.rawBody` holds the exact bytes received (a string body is encoded as UTF-8), next to `body` as text, like Python's `raw_body` and Go's `Body`.
+- A config's `sandbox` option also takes a string, read like the `*_SANDBOX` variable (`false`, `0`, `f`, `no` or `off` select production).

package/README.md

@@ -1,7 +1,7 @@
 # Node Myanmar Payments
 
 [![npm](https://img.shields.io/npm/v/@laranex/myanmar-payments.svg?style=flat-square)](https://www.npmjs.com/package/@laranex/myanmar-payments)
-[![Tests](https://img.shields.io/github/actions/workflow/status/laranex/node-myanmar-payments/tests.yml?label=tests&style=flat-square)](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml)
+[![Tests](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml/badge.svg)](https://github.com/laranex/node-myanmar-payments/actions/workflows/tests.yml)
 [![License](https://img.shields.io/npm/l/@laranex/myanmar-payments.svg?style=flat-square)](LICENSE.md)
 
 Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed TypeScript API, ESM and CommonJS, no runtime dependencies. Built for humans and AI agents.

package/dist/cjs/aya-pay/aya-pay.d.ts

@@ -9,8 +9,11 @@ export interface AyaPayConfigOptions {
     appKey: string;
     /** The secret that signs requests and verifies callbacks. */
     appSecret: string;
-    /** Use the UAT environment (default `true`). */
-    sandbox?: boolean | undefined;
+    /**
+     * Use the UAT environment (default `true`).
+     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     */
+    sandbox?: boolean | string | undefined;
     /** Overrides the gateway base URL. */
     baseUrl?: string | undefined;
 }

package/dist/cjs/aya-pay/aya-pay.js

@@ -26,7 +26,7 @@ class AyaPayConfig {
     constructor(options) {
         this.appKey = (0, env_js_1.requireSetting)('aya_pay', 'app_key', options.appKey);
         this.appSecret = (0, env_js_1.requireSetting)('aya_pay', 'app_secret', options.appSecret);
-        this.sandbox = options.sandbox ?? true;
+        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
         this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
             (this.sandbox ? AyaPayConfig.SANDBOX_URL : AyaPayConfig.PRODUCTION_URL));
     }
@@ -246,7 +246,8 @@ class AyaPay {
     /** Decodes a `payload` + `checkSum` pair and returns the payload if the checksum matches. */
     verifiedPayload(input, context) {
         const fail = () => new errors_js_1.SignatureVerificationError(`AYA Pay ${context} checksum verification failed.`, (0, json_js_1.toPlainObject)(input));
-        const json = (0, crypto_js_1.decodeBase64)((0, values_js_1.get)(input, 'payload'));
+        // Base64 never contains spaces: a space is a `+` that an unencoded query string turned into one.
+        const json = (0, crypto_js_1.decodeBase64)((0, values_js_1.get)(input, 'payload').replace(/ /g, '+'));
         const payload = json === undefined ? undefined : (0, json_js_1.parseJsonObject)(json);
         if (payload === undefined) {
             throw fail();
@@ -255,6 +256,10 @@ class AyaPay {
         for (const field of PAYLOAD_FIELDS) {
             const key = field === 'currencyCode' && 'currenyCode' in payload ? 'currenyCode' : field;
             if (Object.prototype.hasOwnProperty.call(payload, key)) {
+                // A nested value is never signed, so a payload carrying one is rejected.
+                if ((0, values_js_1.isNested)(payload[key])) {
+                    throw fail();
+                }
                 parts.push((0, values_js_1.scalarString)(payload[key]) ?? '');
             }
         }

package/dist/cjs/core/amount.d.ts

@@ -43,9 +43,10 @@ export declare class Amount {
     /** Whether the amount is greater than zero. */
     isPositive(): boolean;
     /**
-     * Whether both amounts have the same value, ignoring trailing fractional zeros
-     * (`1000`, `1000.0` and `1000.00` are equal). `undefined` is never equal, so a gateway amount
-     * that was not sent never matches.
+     * Whether both amounts have the same value. Leading zeros of the whole part and trailing zeros of
+     * the fraction are ignored (`1000`, `01000` and `1000.00` are equal). Text must be plain digits
+     * with an optional fraction, so `1,000` or ` 1000` is never equal, and neither is `null` or
+     * `undefined` (a gateway amount that was not sent never matches).
      */
     equals(other: Amount | string | null | undefined): boolean;
 }

package/dist/cjs/core/amount.js

@@ -88,20 +88,29 @@ class Amount {
         return !this.isZero();
     }
     /**
-     * Whether both amounts have the same value, ignoring trailing fractional zeros
-     * (`1000`, `1000.0` and `1000.00` are equal). `undefined` is never equal, so a gateway amount
-     * that was not sent never matches.
+     * Whether both amounts have the same value. Leading zeros of the whole part and trailing zeros of
+     * the fraction are ignored (`1000`, `01000` and `1000.00` are equal). Text must be plain digits
+     * with an optional fraction, so `1,000` or ` 1000` is never equal, and neither is `null` or
+     * `undefined` (a gateway amount that was not sent never matches).
      */
     equals(other) {
         if (other === undefined || other === null) {
             return false;
         }
-        const normalize = (value) => value.includes('.') ? value.replace(/0+$/, '').replace(/\.$/, '') : value;
         const text = other instanceof Amount ? other.value : other;
+        if (typeof text !== 'string' || !PATTERN.test(text)) {
+            return false;
+        }
         return normalize(this.value) === normalize(text);
     }
 }
 exports.Amount = Amount;
+function normalize(value) {
+    const [whole = '', fraction = ''] = value.split('.');
+    const trimmedWhole = whole.replace(/^0+/, '') || '0';
+    const trimmedFraction = fraction.replace(/0+$/, '');
+    return trimmedFraction === '' ? trimmedWhole : `${trimmedWhole}.${trimmedFraction}`;
+}
 function invalid(message) {
     return new errors_js_1.InvalidPaymentDataError({ amount: message });
 }

package/dist/cjs/core/callback.d.ts

@@ -16,8 +16,8 @@ export interface CallbackRequestInit {
     query?: QueryInput | null | undefined;
 }
 /**
- * The parts of a Node `http.IncomingMessage` this package reads, so Express, Fastify (`request.raw`)
- * and Koa (`ctx.req`) requests work too.
+ * The parts of a Node `http.IncomingMessage` this package reads, so Express requests work too (and
+ * Koa's `ctx.req` when no body parser consumed it).
  */
 export interface NodeRequestLike extends AsyncIterable<unknown> {
     headers: Readonly<Record<string, string | readonly string[] | undefined>>;
@@ -42,8 +42,10 @@ export interface WebRequestLike {
  * {@link CallbackRequest.fromNodeRequest} or {@link CallbackRequest.fromWebRequest}.
  */
 export declare class CallbackRequest {
-    /** The raw request body, decoded as UTF-8. */
+    /** The request body as text: a string body as given, bytes decoded as UTF-8. */
     readonly body: string;
+    /** The exact bytes received. A string body is encoded as UTF-8. */
+    readonly rawBody: Uint8Array;
     /** The request headers, with lowercase names. Repeated headers are joined with `, `. */
     readonly headers: Readonly<Record<string, string>>;
     /** The query string parameters (the first value of each). */
@@ -57,10 +59,11 @@ export declare class CallbackRequest {
      */
     static fromJson(payload: unknown, headers?: HeadersInput | null): CallbackRequest;
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static fromNodeRequest(request: NodeRequestLike): Promise<CallbackRequest>;
     /**
@@ -70,7 +73,10 @@ export declare class CallbackRequest {
     static fromWebRequest(request: WebRequestLike): Promise<CallbackRequest>;
     /** The named header, matched case-insensitively, or `undefined`. */
     header(name: string): string | undefined;
-    /** The body decoded as JSON or as a urlencoded form. */
+    /**
+     * The body decoded as JSON or as a urlencoded form. JSON numbers keep their exact text, as strings
+     * (`1000.50` stays `"1000.50"`).
+     */
     parsedBody(): Record<string, unknown>;
     /** The parsed body merged over the query string. */
     input(): Record<string, unknown>;

package/dist/cjs/core/callback.js

@@ -11,14 +11,17 @@ const json_js_1 = require("./json.js");
  * {@link CallbackRequest.fromNodeRequest} or {@link CallbackRequest.fromWebRequest}.
  */
 class CallbackRequest {
-    /** The raw request body, decoded as UTF-8. */
+    /** The request body as text: a string body as given, bytes decoded as UTF-8. */
     body;
+    /** The exact bytes received. A string body is encoded as UTF-8. */
+    rawBody;
     /** The request headers, with lowercase names. Repeated headers are joined with `, `. */
     headers;
     /** The query string parameters (the first value of each). */
     query;
     constructor(init = {}) {
-        this.body = bodyText(init.body);
+        this.rawBody = bodyBytes(init.body);
+        this.body = typeof init.body === 'string' ? init.body : new TextDecoder().decode(this.rawBody);
         this.headers = Object.freeze(normalizeHeaders(init.headers));
         this.query = Object.freeze(normalizeQuery(init.query));
     }
@@ -37,10 +40,11 @@ class CallbackRequest {
         });
     }
     /**
-     * Reads a Node `http.IncomingMessage` (also Express `req`, Fastify `request.raw`, Koa `ctx.req`).
-     * Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured it as
-     * text or bytes. When a body parser already consumed the stream, the parsed `body` is encoded
-     * again as JSON or a form.
+     * Reads a Node `http.IncomingMessage` (also Express `req`, or Koa `ctx.req` without a body
+     * parser). Reads the raw body from the stream, or from `rawBody`/`body` when middleware captured
+     * it as text or bytes. When a body parser already consumed the stream, the parsed `body` is
+     * encoded again as JSON or a form. Fastify parses the body before your handler runs: use
+     * {@link CallbackRequest.from} with the raw body there.
      */
     static async fromNodeRequest(request) {
         const headers = normalizeHeaders(request.headers);
@@ -73,7 +77,10 @@ class CallbackRequest {
     header(name) {
         return this.headers[name.toLowerCase()];
     }
-    /** The body decoded as JSON or as a urlencoded form. */
+    /**
+     * The body decoded as JSON or as a urlencoded form. JSON numbers keep their exact text, as strings
+     * (`1000.50` stays `"1000.50"`).
+     */
     parsedBody() {
         return (0, json_js_1.toPlainObject)(losslessBody(this));
     }
@@ -216,14 +223,15 @@ class PaymentStatusResult {
     }
 }
 exports.PaymentStatusResult = PaymentStatusResult;
-function bodyText(body) {
+function bodyBytes(body) {
     if (body === undefined || body === null) {
-        return '';
+        return new Uint8Array();
     }
     if (typeof body === 'string') {
-        return body;
+        return new TextEncoder().encode(body);
     }
-    return new TextDecoder().decode(body);
+    // A copy, so later changes to the caller's buffer cannot alter what was verified.
+    return body instanceof ArrayBuffer ? new Uint8Array(body.slice(0)) : Uint8Array.from(body);
 }
 function rawBody(value) {
     if (typeof value === 'string' || value instanceof Uint8Array || value instanceof ArrayBuffer) {

package/dist/cjs/core/crypto.d.ts

@@ -15,5 +15,10 @@ export declare function randomHex(bytes?: number): string;
  * @internal
  */
 export declare function queryEscape(value: string): string;
-/** Decodes strict standard base64 (with padding), or `undefined`. @internal */
+/**
+ * Decodes standard base64 (`A-Z a-z 0-9 + /`), either correctly padded or without any padding, to
+ * UTF-8 text. Partial padding, other characters and bytes that are not UTF-8 return `undefined`.
+ *
+ * @internal
+ */
 export declare function decodeBase64(value: string): string | undefined;

package/dist/cjs/core/crypto.js

@@ -41,10 +41,24 @@ function queryEscape(value) {
         .replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`)
         .replace(/%20/g, '+');
 }
-/** Decodes strict standard base64 (with padding), or `undefined`. @internal */
+const UTF8 = new TextDecoder('utf-8', { fatal: true });
+/**
+ * Decodes standard base64 (`A-Z a-z 0-9 + /`), either correctly padded or without any padding, to
+ * UTF-8 text. Partial padding, other characters and bytes that are not UTF-8 return `undefined`.
+ *
+ * @internal
+ */
 function decodeBase64(value) {
-    if (value === '' || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
+        return undefined;
+    }
+    if (value.includes('=') ? value.length % 4 !== 0 : value.length % 4 === 1) {
+        return undefined;
+    }
+    try {
+        return UTF8.decode(Buffer.from(value, 'base64'));
+    }
+    catch {
         return undefined;
     }
-    return Buffer.from(value, 'base64').toString('utf8');
 }

package/dist/cjs/core/env.d.ts

@@ -9,6 +9,13 @@ export declare function envFirst(env: EnvSource, ...keys: string[]): string;
  * @internal
  */
 export declare function envSandbox(env: EnvSource, key: string): boolean;
+/**
+ * A `sandbox` setting: booleans as is, text parsed like a `*_SANDBOX` variable (`false`, `0`, `f`,
+ * `no` and `off` in any case select production; anything else means sandbox), unset means sandbox.
+ *
+ * @internal
+ */
+export declare function parseSandbox(value: boolean | string | undefined | null): boolean;
 /** An integer variable, or `undefined` when unset or not an integer. @internal */
 export declare function envInt(env: EnvSource, key: string): number | undefined;
 /** The trimmed value, or throws a {@link ConfigurationError} naming `key`. @internal */

package/dist/cjs/core/env.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.envFirst = envFirst;
 exports.envSandbox = envSandbox;
+exports.parseSandbox = parseSandbox;
 exports.envInt = envInt;
 exports.requireSetting = requireSetting;
 exports.optionalSetting = optionalSetting;
@@ -25,8 +26,19 @@ function envFirst(env, ...keys) {
  * @internal
  */
 function envSandbox(env, key) {
-    const value = env[key]?.trim().toLowerCase() ?? '';
-    return !['false', '0', 'f', 'no', 'off'].includes(value);
+    return parseSandbox(env[key] ?? '');
+}
+/**
+ * A `sandbox` setting: booleans as is, text parsed like a `*_SANDBOX` variable (`false`, `0`, `f`,
+ * `no` and `off` in any case select production; anything else means sandbox), unset means sandbox.
+ *
+ * @internal
+ */
+function parseSandbox(value) {
+    if (typeof value === 'boolean') {
+        return value;
+    }
+    return !['false', '0', 'f', 'no', 'off'].includes((value ?? '').trim().toLowerCase());
 }
 /** An integer variable, or `undefined` when unset or not an integer. @internal */
 function envInt(env, key) {

package/dist/cjs/core/json.d.ts

@@ -32,8 +32,8 @@ export declare function parseJsonObject(text: string): LosslessObject | undefine
 /** @internal */
 export declare function isLosslessObject(value: unknown): value is LosslessObject;
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */

package/dist/cjs/core/json.js

@@ -56,14 +56,14 @@ function isLosslessObject(value) {
         !(value instanceof JsonNumber));
 }
 /**
- * Converts a lossless value to plain JavaScript values (numbers become `number`), for the `raw`
- * fields of results.
+ * Converts a lossless value to plain JavaScript values for the `raw` fields of results. Numbers
+ * become their exact text as a string (`1000.50` stays `"1000.50"`), so no precision is lost.
  *
  * @internal
  */
 function toPlain(value) {
     if (value instanceof JsonNumber) {
-        return Number(value.text);
+        return value.text;
     }
     if (Array.isArray(value)) {
         return value.map(toPlain);

package/dist/cjs/core/status.d.ts

@@ -1,7 +1,7 @@
 /**
  * A gateway-independent payment status. Every gateway's own status values are mapped onto these.
  */
-export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'cancelled' | 'expired' | 'unknown';
+export type PaymentStatus = 'successful' | 'pending' | 'failed' | 'canceled' | 'expired' | 'unknown';
 /**
  * The payment statuses, plus helpers.
  *
@@ -18,13 +18,13 @@ export declare const PaymentStatus: Readonly<{
     /** The payment was attempted and failed or was rejected. */
     Failed: "failed";
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: "cancelled";
+    Canceled: "canceled";
     /** The payment window ran out before the customer paid. */
     Expired: "expired";
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
     Unknown: "unknown";
     /** Every status, in the order above. */
-    values: readonly ["successful", "pending", "failed", "cancelled", "expired", "unknown"];
+    values: readonly ["successful", "pending", "failed", "canceled", "expired", "unknown"];
     /** Whether the status will not change any more: `false` for `pending` and `unknown`. */
     isFinal(status: PaymentStatus): boolean;
 }>;

package/dist/cjs/core/status.js

@@ -18,7 +18,7 @@ exports.PaymentStatus = Object.freeze({
     /** The payment was attempted and failed or was rejected. */
     Failed: 'failed',
     /** The payment or order was canceled or closed before completing. */
-    Cancelled: 'cancelled',
+    Canceled: 'canceled',
     /** The payment window ran out before the customer paid. */
     Expired: 'expired',
     /** The gateway sent a status this package does not recognize. Inspect `gatewayStatus`. */
@@ -28,7 +28,7 @@ exports.PaymentStatus = Object.freeze({
         'successful',
         'pending',
         'failed',
-        'cancelled',
+        'canceled',
         'expired',
         'unknown',
     ]),

package/dist/cjs/core/values.d.ts

@@ -14,3 +14,5 @@ export declare function optional(source: Record<string, unknown>, key: string):
 export declare function trimmed(source: Record<string, unknown>, key: string): string;
 /** The value at `key` when it is an object (not an array). @internal */
 export declare function object(source: Record<string, unknown>, key: string): LosslessObject | undefined;
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+export declare function isNested(value: unknown): boolean;

package/dist/cjs/core/values.js

@@ -5,6 +5,7 @@ exports.get = get;
 exports.optional = optional;
 exports.trimmed = trimmed;
 exports.object = object;
+exports.isNested = isNested;
 const json_js_1 = require("./json.js");
 /**
  * Returns a scalar as the text a gateway signs: strings as is, numbers exactly as sent, booleans as
@@ -43,3 +44,7 @@ function object(source, key) {
     const value = source[key];
     return (0, json_js_1.isLosslessObject)(value) ? value : undefined;
 }
+/** Whether `value` is an object or array, which a gateway never signs. @internal */
+function isNested(value) {
+    return typeof value === 'object' && value !== null && !(value instanceof json_js_1.JsonNumber);
+}

package/dist/cjs/cyber-source/cyber-source.d.ts

@@ -10,8 +10,11 @@ export interface CyberSourceConfigOptions {
     accessKey: string;
     /** The profile's secret key, which signs the fields. */
     secretKey: string;
-    /** Use the test environment (default `true`). */
-    sandbox?: boolean | undefined;
+    /**
+     * Use the test environment (default `true`).
+     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     */
+    sandbox?: boolean | string | undefined;
     /** Overrides the Secure Acceptance base URL. */
     baseUrl?: string | undefined;
 }
@@ -87,7 +90,8 @@ export declare class CyberSource {
     initiate(data: CyberSourcePaymentData): FormPayment;
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */

package/dist/cjs/cyber-source/cyber-source.js

@@ -26,7 +26,7 @@ class CyberSourceConfig {
         this.profileId = (0, env_js_1.requireSetting)('cyber_source', 'profile_id', options.profileId);
         this.accessKey = (0, env_js_1.requireSetting)('cyber_source', 'access_key', options.accessKey);
         this.secretKey = (0, env_js_1.requireSetting)('cyber_source', 'secret_key', options.secretKey);
-        this.sandbox = options.sandbox ?? true;
+        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
         this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
             (this.sandbox ? CyberSourceConfig.SANDBOX_URL : CyberSourceConfig.PRODUCTION_URL));
     }
@@ -77,7 +77,7 @@ const STATUSES = {
     REVIEW: 'pending',
     DECLINE: 'failed',
     ERROR: 'failed',
-    CANCEL: 'cancelled',
+    CANCEL: 'canceled',
 };
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the
@@ -149,31 +149,39 @@ class CyberSource {
     }
     /**
      * Verifies CyberSource's result post. The same check works for the browser post to your receipt
-     * page.
+     * page. Only the fields listed in `signed_field_names` are trusted: `decision` and
+     * `req_reference_number` must be signed, and unsigned fields are left out of the result.
      */
     handleCallback(request) {
         const payload = (0, callback_js_1.losslessInput)(request);
         const expected = this.sign(payload);
-        if (expected === undefined || !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature'))) {
+        const names = signedNames(payload);
+        if (expected === undefined ||
+            !(0, crypto_js_1.safeEqual)(expected, (0, values_js_1.get)(payload, 'signature')) ||
+            !names.includes('decision') ||
+            !names.includes('req_reference_number')) {
             throw new errors_js_1.SignatureVerificationError('CyberSource callback signature verification failed.', (0, json_js_1.toPlainObject)(payload));
         }
-        const decision = (0, values_js_1.trimmed)(payload, 'decision').toUpperCase();
+        // A signature only covers the listed fields, so anything else in the post could have been
+        // added by the sender (e.g. a `decision` next to the signed request fields).
+        const signed = {};
+        for (const name of [...names, 'signature']) {
+            (0, json_js_1.setKey)(signed, name, payload[name]);
+        }
+        const decision = (0, values_js_1.trimmed)(signed, 'decision').toUpperCase();
         return new callback_js_1.PaymentCallback({
-            orderId: (0, values_js_1.get)(payload, 'req_reference_number'),
+            orderId: (0, values_js_1.get)(signed, 'req_reference_number'),
             status: (0, status_js_1.resolveStatus)(STATUSES, decision),
             gatewayStatus: decision,
-            gatewayReference: (0, values_js_1.optional)(payload, 'transaction_id'),
-            amount: (0, values_js_1.get)(payload, 'auth_amount') || (0, values_js_1.optional)(payload, 'req_amount'),
-            raw: (0, json_js_1.toPlainObject)(payload),
+            gatewayReference: (0, values_js_1.optional)(signed, 'transaction_id'),
+            amount: (0, values_js_1.get)(signed, 'auth_amount') || (0, values_js_1.optional)(signed, 'req_amount'),
+            raw: (0, json_js_1.toPlainObject)(signed),
         });
     }
     /** Signs the fields listed in `signed_field_names`; `undefined` when a listed field is missing. */
     sign(fields) {
         const pairs = [];
-        for (const name of (0, values_js_1.get)(fields, 'signed_field_names').split(',')) {
-            if (name === '') {
-                continue;
-            }
+        for (const name of signedNames(fields)) {
             const value = (0, values_js_1.scalarString)(fields[name]);
             if (value === undefined) {
                 return undefined;
@@ -186,3 +194,9 @@ class CyberSource {
     }
 }
 exports.CyberSource = CyberSource;
+/** The names listed in `signed_field_names`, in order. */
+function signedNames(fields) {
+    return (0, values_js_1.get)(fields, 'signed_field_names')
+        .split(',')
+        .filter((name) => name !== '');
+}

package/dist/cjs/kbz-pay/kbz-pay.d.ts

@@ -12,8 +12,12 @@ export interface KbzPayConfigOptions {
     appKey: string;
     /** The `merch_code` KBZ issued. */
     merchantCode: string;
-    /** Use the UAT endpoints (default `true`). UAT and production issue separate credentials. */
-    sandbox?: boolean | undefined;
+    /**
+     * Use the UAT endpoints (default `true`). UAT and production issue separate
+     * credentials. Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off`
+     * select production.
+     */
+    sandbox?: boolean | string | undefined;
     /** Overrides the API base URL, e.g. to go through a proxy. */
     apiUrl?: string | undefined;
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */

package/dist/cjs/kbz-pay/kbz-pay.js

@@ -32,7 +32,7 @@ class KbzPayConfig {
         this.appId = (0, env_js_1.requireSetting)('kbz_pay', 'app_id', options.appId);
         this.appKey = (0, env_js_1.requireSetting)('kbz_pay', 'app_key', options.appKey);
         this.merchantCode = (0, env_js_1.requireSetting)('kbz_pay', 'merchant_code', options.merchantCode);
-        this.sandbox = options.sandbox ?? true;
+        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
         this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ??
             (this.sandbox ? KbzPayConfig.SANDBOX_API_URL : KbzPayConfig.PRODUCTION_API_URL));
         this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ??
@@ -60,7 +60,7 @@ const STATUSES = {
     WAIT_PAY: 'pending',
     PAYING: 'pending',
     PAY_FAILED: 'failed',
-    ORDER_CLOSED: 'cancelled',
+    ORDER_CLOSED: 'canceled',
     ORDER_EXPIRED: 'expired',
 };
 /**

package/dist/cjs/kbz-pay/signer.d.ts

@@ -10,6 +10,9 @@ export declare class KbzPaySigner {
     signString(fields: Readonly<Record<string, unknown>>): string;
     /** The uppercase SHA-256 signature of `fields`. */
     sign(fields: Readonly<Record<string, unknown>>): string;
-    /** Whether `fields.sign` matches, compared in constant time. */
+    /**
+     * Whether `fields.sign` matches, compared in constant time. Nested values are never signed, so
+     * fields holding an object or array fail rather than being partly trusted.
+     */
     verify(fields: Readonly<Record<string, unknown>>): boolean;
 }

package/dist/cjs/kbz-pay/signer.js

@@ -27,10 +27,15 @@ class KbzPaySigner {
     sign(fields) {
         return (0, crypto_js_1.sha256Hex)(`${this.signString(fields)}&key=${this.appKey}`).toUpperCase();
     }
-    /** Whether `fields.sign` matches, compared in constant time. */
+    /**
+     * Whether `fields.sign` matches, compared in constant time. Nested values are never signed, so
+     * fields holding an object or array fail rather than being partly trusted.
+     */
     verify(fields) {
         const sign = fields.sign;
-        return typeof sign === 'string' && (0, crypto_js_1.safeEqual)(this.sign(fields), sign.toUpperCase());
+        return (typeof sign === 'string' &&
+            !Object.values(fields).some(values_js_1.isNested) &&
+            (0, crypto_js_1.safeEqual)(this.sign(fields), sign.toUpperCase()));
     }
 }
 exports.KbzPaySigner = KbzPaySigner;

package/dist/cjs/wave-money/wave-money.d.ts

@@ -13,8 +13,11 @@ export interface WaveMoneyConfigOptions {
     merchantName: string;
     /** How long the customer has to pay, in seconds (default 300). */
     timeToLiveSeconds?: number | undefined;
-    /** Use the test environment (default `true`). */
-    sandbox?: boolean | undefined;
+    /**
+     * Use the test environment (default `true`).
+     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     */
+    sandbox?: boolean | string | undefined;
     /** Overrides the API base URL. */
     baseUrl?: string | undefined;
     /** Overrides the host the customer is redirected to. Wave serves it without the API port. */
@@ -104,7 +107,7 @@ export declare class WaveMoney {
     /**
      * Verifies Wave's callback. Only `PAYMENT_CONFIRMED` means the customer paid. `orderId` falls
      * back to `merchantReferenceId` when it is missing, null or empty, because Wave marks `orderId` as
-     * optional.
+     * optional. A hashed field holding an object or array fails verification.
      */
     handleCallback(request: CallbackRequest): PaymentCallback;
     private hash;