@laranex/myanmar-payments 4.0.0-dev.4 → 4.0.0-dev.5

package/CHANGELOG.md

@@ -10,19 +10,20 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - Gateways: KBZ Pay (`pwa`, `qr`, `app`, `status`), Wave Money (`initiate`), AYA Payment Gateway (`services`, `initiate`, `status`, `verifyRedirect`), Yoma MMQR (`initiate`, `renewQr`, `status`, `forgetToken`) and CyberSource Secure Acceptance (`initiate`); every gateway validates its payment data (`KbzPay.validate()` and so on) and verifies callbacks with `handleCallback`.
 - Subpath exports per gateway (`@laranex/myanmar-payments/kbz-pay`, `/wave-money`, `/aya-pay`, `/yoma-mmqr`, `/cyber-source`) next to the root export, as ES modules and CommonJS with type declarations.
 - Exact `Amount` type (`Amount.kyat()`, `Amount.parse()`) kept as decimal text, so amounts never pass through a float; payment data also takes a whole-number `number` or `bigint` and rejects fractions. Decimals are accepted only where the gateway documents them (KBZ Pay up to 2 places, CyberSource any); every gateway except CyberSource is MMK only.
-- A config class per gateway with `fromEnv(process.env)`, reading the same `*_SANDBOX`, credential and URL variables as the PHP, Laravel and Go packages; a missing credential throws `ConfigurationError`. `MyanmarPayments` builds every gateway lazily from one config object or the environment.
+- A config class per gateway with `fromEnv(process.env)`, reading the same credential, setting and URL variables as the PHP, Laravel and Go packages; a missing setting throws `ConfigurationError`. `MyanmarPayments` builds every gateway lazily from one config object or the environment.
 - Result classes: `RedirectPayment`, `FormPayment` (with `toHtml()`), `QrPayment` (with `qrImageDataUri()`) and `AppPayment`; `PaymentCallback` (with a gateway-independent `PaymentStatus` and the `Acknowledgement` each gateway expects, sent with `send(res)` or `toResponse()`) and `PaymentStatusResult`.
 - `CallbackRequest.fromNodeRequest()` (node:http, Express), `CallbackRequest.fromWebRequest()` (Fetch API servers such as Next.js, Hono and Bun), `CallbackRequest.from()` and `CallbackRequest.fromJson()`. JSON numbers in callbacks are read without a float conversion, so signatures and amounts keep the gateway's exact text.
 - Errors: `PaymentError` and its subclasses `InvalidPaymentDataError` (per-field `errors`), `ApiError` (`gatewayCode`, `gatewayMessage`, `httpStatus`, `raw`, `cause`), `SignatureVerificationError` and `ConfigurationError`.
-- No runtime dependencies: the global `fetch` (or an injected `fetch` / `HttpClient`, 30 second default timeout, `AbortSignal` per call) and `node:crypto`; an injectable `TokenCache` with an in-memory default for Yoma's access token.
+- No runtime dependencies: the global `fetch` (or an injected `fetch` / `HttpClient`, the configured `timeoutSeconds`, `AbortSignal` per call) and `node:crypto`; an injectable `TokenCache` with an in-memory default for Yoma's access token.
 - CyberSource callbacks trust only the fields listed in `signed_field_names`: `decision` and `req_reference_number` must be signed, and unsigned fields are left out of the result and `raw`.
 - AYA Pay reads a `payload` whose `+` signs became spaces in an unencoded return query string.
 - Callback, return and cancel URLs only need to be valid absolute http or https URLs; there is no HTTPS-only rule (gateways may still require HTTPS in production).
-- Wave Money's sandbox is `https://preprodpayments.wavemoney.io:8107`, with checkout at `https://preprodpayments.wavemoney.io/authenticate`.
 - Agent skill in `skills/node-myanmar-payments` so coding agents use the package correctly; install it with `npx skills add laranex/node-myanmar-payments`.
 - Requires Node.js 20 or higher.
 
 ### Changed since the pre-releases
+- No sandbox switch: the sandbox setting (`sandbox`) and the `*_SANDBOX` variables are removed, and every gateway defaults to its production endpoints. Every other setting is required: the HTTP timeout (`timeout_in_seconds`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`) for every gateway that calls an API, Wave Money's `time_to_live_in_seconds` and `merchant_name` (no `APP_NAME` fallback), Yoma MMQR's `api_version`, and CyberSource's `currency`, `locale` and `transactionType` on each payment. A missing setting throws the configuration error naming it; a time setting that is not a whole number greater than 0 throws `The <gateway> configuration [<key>] must be a whole number greater than 0.` Upgrading: delete `*_SANDBOX`; to keep testing against UAT, set the URL overrides to the UAT URLs listed in the docs; set the newly required settings.
+  - In Node: config options `timeoutSeconds` (KBZ Pay, Wave Money, AYA Pay, Yoma MMQR), `timeToLiveSeconds` and `apiVersion` are required and take a whole number or its text; the `SANDBOX_*`, `DEFAULT_TIME_TO_LIVE_SECONDS` and `DEFAULT_API_VERSION` constants are removed. `GatewayOptions.timeoutMs` (so also the `MyanmarPayments` option) and `DEFAULT_TIMEOUT_MS` are removed; `FetchHttpClient` requires `timeoutMs`. `ConfigurationError` takes a third `invalid` argument for the whole-number message.
 - `PaymentStatus.Cancelled` is renamed to `PaymentStatus.Canceled` and its value from `'cancelled'` to `'canceled'` (American English), with no alias. Code or stored statuses from the `v4.0.0-dev` pre-releases need the new name; gateway status literals such as Wave Money's `PAYMENT_REQUEST_CANCELLED` are unchanged.
 - Callback values that are JSON numbers are kept as their exact text, as strings, in `raw`, `parsedBody()`, `input()`, `queryInput()` and the `raw` of errors (`1000.50` is `'1000.50'`, not `1000.5`), like the PHP SDK.
 - A nested value (object or array) in a signed or hashed callback field now fails verification: KBZ Pay (any callback field), Wave Money (the hashed fields), AYA Pay (the signed payload fields) and Yoma MMQR (`status`). Before, KBZ Pay skipped it, Wave Money hashed it as `null` and AYA Pay signed it as empty.
@@ -30,4 +31,3 @@ Initial release. The version number matches the other Laranex Myanmar payments p
 - Yoma MMQR caches its access token under `myanmar-payments.yoma-mmqr.token.<sha256 of base URL and client id>` (was `node-myanmar-payments.…`), the same key as the PHP, Go and Python SDKs, and reads `expires_in` from its leading digits.
 - `Amount.equals()` compares by value, ignoring leading zeros too (`'01000'` equals `Amount.kyat(1000)`); text that is not plain digits with an optional fraction is never equal.
 - `CallbackRequest.rawBody` holds the exact bytes received (a string body is encoded as UTF-8), next to `body` as text, like Python's `raw_body` and Go's `Body`.
-- A config's `sandbox` option also takes a string, read like the `*_SANDBOX` variable (`false`, `0`, `f`, `no` or `off` select production).

package/dist/cjs/aya-pay/aya-pay.d.ts

@@ -10,29 +10,29 @@ export interface AyaPayConfigOptions {
     /** The secret that signs requests and verifies callbacks. */
     appSecret: string;
     /**
-     * Use the UAT environment (default `true`).
-     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). A client you pass keeps its own timeout.
      */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the gateway base URL. */
+    timeoutSeconds: number | string;
+    /** Overrides the gateway base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
 }
 /**
- * AYA Payment Gateway (APG) credentials and endpoints. A missing credential throws a
- * `ConfigurationError`.
+ * AYA Payment Gateway (APG) credentials and endpoints. A missing setting throws a
+ * `ConfigurationError`. The URL defaults to production.
  */
 export declare class AyaPayConfig {
-    static readonly SANDBOX_URL = "https://uat-pgw.ayainnovation.com";
     static readonly PRODUCTION_URL = "https://pgw.ayainnovation.com";
     readonly appKey: string;
     readonly appSecret: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: AyaPayConfigOptions);
     /**
-     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `AYA_PAY_SANDBOX` and `AYA_PAY_BASE_URL`, falling
-     * back to the `AYA_PGW_*` names.
+     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT` and
+     * `AYA_PAY_BASE_URL`, falling back to the `AYA_PGW_*` names.
      */
     static fromEnv(env?: EnvSource): AyaPayConfig;
 }

package/dist/cjs/aya-pay/aya-pay.js

@@ -12,33 +12,32 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * AYA Payment Gateway (APG) credentials and endpoints. A missing credential throws a
- * `ConfigurationError`.
+ * AYA Payment Gateway (APG) credentials and endpoints. A missing setting throws a
+ * `ConfigurationError`. The URL defaults to production.
  */
 class AyaPayConfig {
-    static SANDBOX_URL = 'https://uat-pgw.ayainnovation.com';
     static PRODUCTION_URL = 'https://pgw.ayainnovation.com';
     appKey;
     appSecret;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.appKey = (0, env_js_1.requireSetting)('aya_pay', 'app_key', options.appKey);
         this.appSecret = (0, env_js_1.requireSetting)('aya_pay', 'app_secret', options.appSecret);
-        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? AyaPayConfig.SANDBOX_URL : AyaPayConfig.PRODUCTION_URL));
+        this.timeoutSeconds = (0, env_js_1.requireSeconds)('aya_pay', 'timeout_in_seconds', options.timeoutSeconds);
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? AyaPayConfig.PRODUCTION_URL);
     }
     /**
-     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `AYA_PAY_SANDBOX` and `AYA_PAY_BASE_URL`, falling
-     * back to the `AYA_PGW_*` names.
+     * Reads `AYA_PAY_APP_KEY`, `AYA_PAY_APP_SECRET`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT` and
+     * `AYA_PAY_BASE_URL`, falling back to the `AYA_PGW_*` names.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new AyaPayConfig({
             appKey: (0, env_js_1.envFirst)(env, 'AYA_PAY_APP_KEY', 'AYA_PGW_APP_KEY'),
             appSecret: (0, env_js_1.envFirst)(env, 'AYA_PAY_APP_SECRET', 'AYA_PGW_APP_SECRET'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'AYA_PAY_SANDBOX'),
+            timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             baseUrl: (0, env_js_1.envFirst)(env, 'AYA_PAY_BASE_URL', 'AYA_PGW_BASE_URL'),
         });
     }
@@ -123,7 +122,7 @@ class AyaPay {
     transport;
     constructor(config, options = {}) {
         this.config = config instanceof AyaPayConfig ? config : new AyaPayConfig(config);
-        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options));
+        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `AYA_PAY_*` (or `AYA_PGW_*`) environment variables. */
     static fromEnv(env = (0, env_js_1.defaultEnv)(), options = {}) {

package/dist/cjs/core/env.d.ts

@@ -3,21 +3,14 @@ export type EnvSource = Readonly<Record<string, string | undefined>>;
 /** The first non-empty value among `keys`, trimmed, or `''`. @internal */
 export declare function envFirst(env: EnvSource, ...keys: string[]): string;
 /**
- * Reads a `*_SANDBOX` variable. Only `false`, `0`, `f`, `no` and `off` (any case) select
- * production; unset or unrecognized values mean sandbox.
+ * A required whole number of seconds: an integer greater than 0, or text such as `'300'`. Unset
+ * or blank throws the missing {@link ConfigurationError}; anything else throws the invalid one.
  *
  * @internal
  */
-export declare function envSandbox(env: EnvSource, key: string): boolean;
-/**
- * A `sandbox` setting: booleans as is, text parsed like a `*_SANDBOX` variable (`false`, `0`, `f`,
- * `no` and `off` in any case select production; anything else means sandbox), unset means sandbox.
- *
- * @internal
- */
-export declare function parseSandbox(value: boolean | string | undefined | null): boolean;
-/** An integer variable, or `undefined` when unset or not an integer. @internal */
-export declare function envInt(env: EnvSource, key: string): number | undefined;
+export declare function requireSeconds(gateway: string, key: string, value: unknown): number;
+/** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
+export declare const HTTP_TIMEOUT_VARIABLE = "MYANMAR_PAYMENTS_HTTP_TIMEOUT";
 /** The trimmed value, or throws a {@link ConfigurationError} naming `key`. @internal */
 export declare function requireSetting(gateway: string, key: string, value: unknown): string;
 /** A trimmed optional string, `undefined` when blank. @internal */

package/dist/cjs/core/env.js

@@ -1,9 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP_TIMEOUT_VARIABLE = void 0;
 exports.envFirst = envFirst;
-exports.envSandbox = envSandbox;
-exports.parseSandbox = parseSandbox;
-exports.envInt = envInt;
+exports.requireSeconds = requireSeconds;
 exports.requireSetting = requireSetting;
 exports.optionalSetting = optionalSetting;
 exports.trimUrl = trimUrl;
@@ -20,31 +19,29 @@ function envFirst(env, ...keys) {
     return '';
 }
 /**
- * Reads a `*_SANDBOX` variable. Only `false`, `0`, `f`, `no` and `off` (any case) select
- * production; unset or unrecognized values mean sandbox.
+ * A required whole number of seconds: an integer greater than 0, or text such as `'300'`. Unset
+ * or blank throws the missing {@link ConfigurationError}; anything else throws the invalid one.
  *
  * @internal
  */
-function envSandbox(env, key) {
-    return parseSandbox(env[key] ?? '');
-}
-/**
- * A `sandbox` setting: booleans as is, text parsed like a `*_SANDBOX` variable (`false`, `0`, `f`,
- * `no` and `off` in any case select production; anything else means sandbox), unset means sandbox.
- *
- * @internal
- */
-function parseSandbox(value) {
-    if (typeof value === 'boolean') {
-        return value;
+function requireSeconds(gateway, key, value) {
+    if (value === undefined || value === null || (typeof value === 'string' && value.trim() === '')) {
+        throw new errors_js_1.ConfigurationError(gateway, key);
     }
-    return !['false', '0', 'f', 'no', 'off'].includes((value ?? '').trim().toLowerCase());
-}
-/** An integer variable, or `undefined` when unset or not an integer. @internal */
-function envInt(env, key) {
-    const value = env[key]?.trim() ?? '';
-    return /^[+-]?\d+$/.test(value) ? Number.parseInt(value, 10) : undefined;
+    let seconds;
+    if (typeof value === 'number' && Number.isSafeInteger(value)) {
+        seconds = value;
+    }
+    else if (typeof value === 'string' && /^[+-]?\d+$/.test(value.trim())) {
+        seconds = Number.parseInt(value.trim(), 10);
+    }
+    if (seconds === undefined || !Number.isSafeInteger(seconds) || seconds <= 0) {
+        throw new errors_js_1.ConfigurationError(gateway, key, true);
+    }
+    return seconds;
 }
+/** The variable holding the HTTP timeout of every gateway that calls an API. @internal */
+exports.HTTP_TIMEOUT_VARIABLE = 'MYANMAR_PAYMENTS_HTTP_TIMEOUT';
 /** The trimmed value, or throws a {@link ConfigurationError} naming `key`. @internal */
 function requireSetting(gateway, key, value) {
     if (typeof value !== 'string' || value.trim() === '') {

package/dist/cjs/core/errors.d.ts

@@ -45,12 +45,17 @@ export declare class SignatureVerificationError extends PaymentError {
     constructor(message: string, raw?: Record<string, unknown>);
 }
 /**
- * Thrown when a gateway is missing a credential or setting it needs.
+ * Thrown when a gateway is missing a credential or setting it needs, or a whole-number setting
+ * is not a whole number greater than 0.
  */
 export declare class ConfigurationError extends PaymentError {
     /** The gateway, e.g. `kbz_pay`. */
     readonly gateway: string;
-    /** The missing setting, e.g. `app_key`. */
+    /** The missing or invalid setting, e.g. `app_key`. */
     readonly key: string;
-    constructor(gateway: string, key: string);
+    /**
+     * @param invalid `true` when the setting is set but is not a whole number greater than 0;
+     *   `false` (the default) when it is missing.
+     */
+    constructor(gateway: string, key: string, invalid?: boolean);
 }

package/dist/cjs/core/errors.js

@@ -62,15 +62,22 @@ class SignatureVerificationError extends PaymentError {
 }
 exports.SignatureVerificationError = SignatureVerificationError;
 /**
- * Thrown when a gateway is missing a credential or setting it needs.
+ * Thrown when a gateway is missing a credential or setting it needs, or a whole-number setting
+ * is not a whole number greater than 0.
  */
 class ConfigurationError extends PaymentError {
     /** The gateway, e.g. `kbz_pay`. */
     gateway;
-    /** The missing setting, e.g. `app_key`. */
+    /** The missing or invalid setting, e.g. `app_key`. */
     key;
-    constructor(gateway, key) {
-        super(`The ${gateway} configuration is missing [${key}].`);
+    /**
+     * @param invalid `true` when the setting is set but is not a whole number greater than 0;
+     *   `false` (the default) when it is missing.
+     */
+    constructor(gateway, key, invalid = false) {
+        super(invalid
+            ? `The ${gateway} configuration [${key}] must be a whole number greater than 0.`
+            : `The ${gateway} configuration is missing [${key}].`);
         this.gateway = gateway;
         this.key = key;
     }

package/dist/cjs/core/http.d.ts

@@ -27,29 +27,28 @@ export type FetchFunction = (input: string, init: RequestInit) => Promise<Respon
 export interface FetchHttpClientOptions {
     /** The `fetch` to call; defaults to the global `fetch`. */
     fetch?: FetchFunction | undefined;
-    /** Milliseconds before a request is aborted; defaults to 30000. `0` disables the timeout. */
-    timeoutMs?: number | undefined;
+    /** Milliseconds before a request is aborted. `0` disables the timeout. */
+    timeoutMs: number;
 }
-/** The default request timeout: 30 seconds. */
-export declare const DEFAULT_TIMEOUT_MS = 30000;
 /**
- * The default {@link HttpClient}: the global `fetch` (or the one you pass) with a 30 second
- * timeout.
+ * The default {@link HttpClient}: the global `fetch` (or the one you pass) with the timeout you
+ * give it. Gateways build one with their `timeoutSeconds` setting when you pass no client.
  */
 export declare class FetchHttpClient implements HttpClient {
     private readonly fetchFunction;
     private readonly timeoutMs;
-    constructor(options?: FetchHttpClientOptions);
+    constructor(options: FetchHttpClientOptions);
     send(request: HttpRequest): Promise<HttpResponse>;
 }
 /** Options every gateway that calls an API accepts. */
 export interface GatewayOptions {
-    /** Sends the requests. Takes precedence over `fetch` and `timeoutMs`. */
+    /**
+     * Sends the requests, with its own timeout. Takes precedence over `fetch`. Without one, the
+     * gateway uses a {@link FetchHttpClient} with the config's `timeoutSeconds`.
+     */
     httpClient?: HttpClient | undefined;
     /** The `fetch` the default client calls, e.g. a mocked one in tests. */
     fetch?: FetchFunction | undefined;
-    /** Milliseconds before the default client aborts a request; defaults to 30000. */
-    timeoutMs?: number | undefined;
 }
 /** Per-call options of every network method. */
 export interface RequestOptions {
@@ -57,7 +56,7 @@ export interface RequestOptions {
     signal?: AbortSignal | undefined;
 }
 /** @internal */
-export declare function httpClientFrom(options?: GatewayOptions): HttpClient;
+export declare function httpClientFrom(options: GatewayOptions, timeoutSeconds: number): HttpClient;
 /** A decoded gateway response. @internal */
 export declare class GatewayResponse {
     readonly status: number;

package/dist/cjs/core/http.js

@@ -1,21 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Transport = exports.GatewayResponse = exports.FetchHttpClient = exports.DEFAULT_TIMEOUT_MS = void 0;
+exports.Transport = exports.GatewayResponse = exports.FetchHttpClient = void 0;
 exports.httpClientFrom = httpClientFrom;
 const errors_js_1 = require("./errors.js");
 const json_js_1 = require("./json.js");
-/** The default request timeout: 30 seconds. */
-exports.DEFAULT_TIMEOUT_MS = 30_000;
 /**
- * The default {@link HttpClient}: the global `fetch` (or the one you pass) with a 30 second
- * timeout.
+ * The default {@link HttpClient}: the global `fetch` (or the one you pass) with the timeout you
+ * give it. Gateways build one with their `timeoutSeconds` setting when you pass no client.
  */
 class FetchHttpClient {
     fetchFunction;
     timeoutMs;
-    constructor(options = {}) {
+    constructor(options) {
         this.fetchFunction = options.fetch;
-        this.timeoutMs = options.timeoutMs ?? exports.DEFAULT_TIMEOUT_MS;
+        this.timeoutMs = options.timeoutMs;
     }
     async send(request) {
         const fetchFunction = this.fetchFunction ?? globalThis.fetch;
@@ -43,9 +41,9 @@ class FetchHttpClient {
 }
 exports.FetchHttpClient = FetchHttpClient;
 /** @internal */
-function httpClientFrom(options = {}) {
+function httpClientFrom(options, timeoutSeconds) {
     return (options.httpClient ??
-        new FetchHttpClient({ fetch: options.fetch, timeoutMs: options.timeoutMs }));
+        new FetchHttpClient({ fetch: options.fetch, timeoutMs: timeoutSeconds * 1000 }));
 }
 /** A decoded gateway response. @internal */
 class GatewayResponse {

package/dist/cjs/core/index.d.ts

@@ -3,6 +3,6 @@ export { MemoryTokenCache, type TokenCache } from './cache.js';
 export { Acknowledgement, CallbackRequest, PaymentCallback, PaymentStatusResult, type AcknowledgementInit, type BodyInput, type CallbackRequestInit, type HeadersInput, type NodeRequestLike, type PaymentCallbackInit, type PaymentStatusResultInit, type QueryInput, type ServerResponseLike, type WebRequestLike, } from './callback.js';
 export type { EnvSource } from './env.js';
 export { ApiError, ConfigurationError, InvalidPaymentDataError, PaymentError, SignatureVerificationError, } from './errors.js';
-export { DEFAULT_TIMEOUT_MS, FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
+export { FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
 export { AppPayment, FormPayment, QrPayment, RedirectPayment, type FormField, type PaymentResult, } from './results.js';
 export { PaymentFlow, PaymentStatus, resolveStatus } from './status.js';

package/dist/cjs/core/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.DEFAULT_TIMEOUT_MS = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
+exports.resolveStatus = exports.PaymentStatus = exports.PaymentFlow = exports.RedirectPayment = exports.QrPayment = exports.FormPayment = exports.AppPayment = exports.FetchHttpClient = exports.SignatureVerificationError = exports.PaymentError = exports.InvalidPaymentDataError = exports.ConfigurationError = exports.ApiError = exports.PaymentStatusResult = exports.PaymentCallback = exports.CallbackRequest = exports.Acknowledgement = exports.MemoryTokenCache = exports.Amount = void 0;
 var amount_js_1 = require("./amount.js");
 Object.defineProperty(exports, "Amount", { enumerable: true, get: function () { return amount_js_1.Amount; } });
 var cache_js_1 = require("./cache.js");
@@ -17,7 +17,6 @@ Object.defineProperty(exports, "InvalidPaymentDataError", { enumerable: true, ge
 Object.defineProperty(exports, "PaymentError", { enumerable: true, get: function () { return errors_js_1.PaymentError; } });
 Object.defineProperty(exports, "SignatureVerificationError", { enumerable: true, get: function () { return errors_js_1.SignatureVerificationError; } });
 var http_js_1 = require("./http.js");
-Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", { enumerable: true, get: function () { return http_js_1.DEFAULT_TIMEOUT_MS; } });
 Object.defineProperty(exports, "FetchHttpClient", { enumerable: true, get: function () { return http_js_1.FetchHttpClient; } });
 var results_js_1 = require("./results.js");
 Object.defineProperty(exports, "AppPayment", { enumerable: true, get: function () { return results_js_1.AppPayment; } });

package/dist/cjs/cyber-source/cyber-source.d.ts

@@ -10,30 +10,24 @@ export interface CyberSourceConfigOptions {
     accessKey: string;
     /** The profile's secret key, which signs the fields. */
     secretKey: string;
-    /**
-     * Use the test environment (default `true`).
-     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
-     */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the Secure Acceptance base URL. */
+    /** Overrides the Secure Acceptance base URL, e.g. to point at the test environment. */
     baseUrl?: string | undefined;
 }
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 export declare class CyberSourceConfig {
-    static readonly SANDBOX_URL = "https://testsecureacceptance.cybersource.com";
     static readonly PRODUCTION_URL = "https://secureacceptance.cybersource.com";
     readonly profileId: string;
     readonly accessKey: string;
     readonly secretKey: string;
-    readonly sandbox: boolean;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: CyberSourceConfigOptions);
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): CyberSourceConfig;
 }
@@ -64,12 +58,12 @@ export interface CyberSourcePaymentData {
     returnUrl?: string | undefined;
     /** The page shown on cancel (`override_custom_cancel_page`), at most 255 characters. */
     cancelUrl?: string | undefined;
-    /** An ISO 4217 code (default `MMK`). */
-    currency?: string | undefined;
-    /** What to do with the card (default `sale`). */
-    transactionType?: CyberSourceTransactionType | undefined;
-    /** The hosted page language, e.g. `en-us` (the default). */
-    locale?: string | undefined;
+    /** An ISO 4217 code, e.g. `MMK`. */
+    currency: string;
+    /** What to do with the card, e.g. `sale`. */
+    transactionType: CyberSourceTransactionType;
+    /** The hosted page language, e.g. `en-us`. */
+    locale: string;
 }
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the

package/dist/cjs/cyber-source/cyber-source.js

@@ -11,35 +11,31 @@ const status_js_1 = require("../core/status.js");
 const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 class CyberSourceConfig {
-    static SANDBOX_URL = 'https://testsecureacceptance.cybersource.com';
     static PRODUCTION_URL = 'https://secureacceptance.cybersource.com';
     profileId;
     accessKey;
     secretKey;
-    sandbox;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.profileId = (0, env_js_1.requireSetting)('cyber_source', 'profile_id', options.profileId);
         this.accessKey = (0, env_js_1.requireSetting)('cyber_source', 'access_key', options.accessKey);
         this.secretKey = (0, env_js_1.requireSetting)('cyber_source', 'secret_key', options.secretKey);
-        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
-        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ??
-            (this.sandbox ? CyberSourceConfig.SANDBOX_URL : CyberSourceConfig.PRODUCTION_URL));
+        this.baseUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.baseUrl) ?? CyberSourceConfig.PRODUCTION_URL);
     }
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new CyberSourceConfig({
             profileId: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_PROFILE_ID'),
             accessKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_ACCESS_KEY'),
             secretKey: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_SECRET_KEY'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'CYBER_SOURCE_SANDBOX'),
             baseUrl: (0, env_js_1.envFirst)(env, 'CYBER_SOURCE_BASE_URL'),
         });
     }
@@ -113,9 +109,12 @@ class CyberSource {
             .string('cancelUrl', data.cancelUrl)
             .url('cancelUrl', data.cancelUrl)
             .max('cancelUrl', data.cancelUrl, 255)
-            .pattern('currency', String(data.currency || 'MMK'), /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
-            .pattern('locale', String(data.locale || 'en-us'), /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
-            .when(!TRANSACTION_TYPES.includes(String(data.transactionType || 'sale')), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('currency', data.currency)
+            .pattern('currency', data.currency, /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
+            .required('transactionType', data.transactionType)
+            .when(!TRANSACTION_TYPES.includes(String(data.transactionType)), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('locale', data.locale)
+            .pattern('locale', data.locale, /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
             .validate();
     }
     /**
@@ -130,11 +129,11 @@ class CyberSource {
             transaction_uuid: (0, crypto_js_1.randomHex)(),
             signed_field_names: SIGNED_FIELDS.join(','),
             signed_date_time: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
-            locale: data.locale || 'en-us',
-            transaction_type: data.transactionType || 'sale',
+            locale: data.locale,
+            transaction_type: data.transactionType,
             reference_number: data.orderId,
             amount: String((0, validate_js_1.toAmount)(data.amount)),
-            currency: data.currency || 'MMK',
+            currency: data.currency,
             override_custom_receipt_page: data.returnUrl ?? '',
             override_backoffice_post_url: data.callbackUrl,
             override_custom_cancel_page: data.cancelUrl ?? '',

package/dist/cjs/kbz-pay/kbz-pay.d.ts

@@ -13,36 +13,35 @@ export interface KbzPayConfigOptions {
     /** The `merch_code` KBZ issued. */
     merchantCode: string;
     /**
-     * Use the UAT endpoints (default `true`). UAT and production issue separate
-     * credentials. Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off`
-     * select production.
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). A client you pass keeps its own timeout.
      */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the API base URL, e.g. to go through a proxy. */
+    timeoutSeconds: number | string;
+    /** Overrides the API base URL, e.g. to point at UAT or go through a proxy. */
     apiUrl?: string | undefined;
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
 }
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 export declare class KbzPayConfig {
-    static readonly SANDBOX_API_URL = "http://api-uat.kbzpay.com/payment/gateway/uat";
     static readonly PRODUCTION_API_URL = "https://api.kbzpay.com/payment/gateway";
-    static readonly SANDBOX_PWA_URL = "https://static.kbzpay.com/pgw/uat/pwa/#/";
     static readonly PRODUCTION_PWA_URL = "https://wap.kbzpay.com/pgw/pwa/#/";
     readonly appId: string;
     readonly appKey: string;
     readonly merchantCode: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
     constructor(options: KbzPayConfigOptions);
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }

package/dist/cjs/kbz-pay/kbz-pay.js

@@ -13,17 +13,17 @@ const validate_js_1 = require("../core/validate.js");
 const values_js_1 = require("../core/values.js");
 const signer_js_1 = require("./signer.js");
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 class KbzPayConfig {
-    static SANDBOX_API_URL = 'http://api-uat.kbzpay.com/payment/gateway/uat';
     static PRODUCTION_API_URL = 'https://api.kbzpay.com/payment/gateway';
-    static SANDBOX_PWA_URL = 'https://static.kbzpay.com/pgw/uat/pwa/#/';
     static PRODUCTION_PWA_URL = 'https://wap.kbzpay.com/pgw/pwa/#/';
     appId;
     appKey;
     merchantCode;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The API base URL in use. */
     apiUrl;
     /** The PWA checkout URL in use, always ending in `/`. */
@@ -32,22 +32,20 @@ class KbzPayConfig {
         this.appId = (0, env_js_1.requireSetting)('kbz_pay', 'app_id', options.appId);
         this.appKey = (0, env_js_1.requireSetting)('kbz_pay', 'app_key', options.appKey);
         this.merchantCode = (0, env_js_1.requireSetting)('kbz_pay', 'merchant_code', options.merchantCode);
-        this.sandbox = (0, env_js_1.parseSandbox)(options.sandbox);
-        this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_API_URL : KbzPayConfig.PRODUCTION_API_URL));
-        this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_PWA_URL : KbzPayConfig.PRODUCTION_PWA_URL))}/`;
+        this.timeoutSeconds = (0, env_js_1.requireSeconds)('kbz_pay', 'timeout_in_seconds', options.timeoutSeconds);
+        this.apiUrl = (0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.apiUrl) ?? KbzPayConfig.PRODUCTION_API_URL);
+        this.pwaUrl = `${(0, env_js_1.trimUrl)((0, env_js_1.optionalSetting)(options.pwaUrl) ?? KbzPayConfig.PRODUCTION_PWA_URL)}/`;
     }
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
      */
     static fromEnv(env = (0, env_js_1.defaultEnv)()) {
         return new KbzPayConfig({
             appId: (0, env_js_1.envFirst)(env, 'KBZ_PAY_APP_ID'),
             appKey: (0, env_js_1.envFirst)(env, 'KBZ_PAY_APP_KEY'),
             merchantCode: (0, env_js_1.envFirst)(env, 'KBZ_PAY_MERCHANT_CODE'),
-            sandbox: (0, env_js_1.envSandbox)(env, 'KBZ_PAY_SANDBOX'),
+            timeoutSeconds: (0, env_js_1.envFirst)(env, env_js_1.HTTP_TIMEOUT_VARIABLE),
             apiUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_BASE_URL'),
             pwaUrl: (0, env_js_1.envFirst)(env, 'KBZ_PAY_PWA_BASE_REDIRECT_URL'),
         });
@@ -76,7 +74,7 @@ class KbzPay {
     constructor(config, options = {}) {
         this.config = config instanceof KbzPayConfig ? config : new KbzPayConfig(config);
         this.signer = new signer_js_1.KbzPaySigner(this.config.appKey);
-        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options));
+        this.transport = new http_js_1.Transport((0, http_js_1.httpClientFrom)(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `KBZ_PAY_*` environment variables. */
     static fromEnv(env = (0, env_js_1.defaultEnv)(), options = {}) {