@laranex/myanmar-payments 4.0.0-dev.4 → 4.0.0-dev.6

package/dist/esm/core/index.d.ts

@@ -3,6 +3,6 @@ export { MemoryTokenCache, type TokenCache } from './cache.js';
 export { Acknowledgement, CallbackRequest, PaymentCallback, PaymentStatusResult, type AcknowledgementInit, type BodyInput, type CallbackRequestInit, type HeadersInput, type NodeRequestLike, type PaymentCallbackInit, type PaymentStatusResultInit, type QueryInput, type ServerResponseLike, type WebRequestLike, } from './callback.js';
 export type { EnvSource } from './env.js';
 export { ApiError, ConfigurationError, InvalidPaymentDataError, PaymentError, SignatureVerificationError, } from './errors.js';
-export { DEFAULT_TIMEOUT_MS, FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
+export { FetchHttpClient, type FetchFunction, type FetchHttpClientOptions, type GatewayOptions, type HttpClient, type HttpRequest, type HttpResponse, type RequestOptions, } from './http.js';
 export { AppPayment, FormPayment, QrPayment, RedirectPayment, type FormField, type PaymentResult, } from './results.js';
 export { PaymentFlow, PaymentStatus, resolveStatus } from './status.js';

package/dist/esm/core/index.js

@@ -2,6 +2,6 @@ export { Amount } from './amount.js';
 export { MemoryTokenCache } from './cache.js';
 export { Acknowledgement, CallbackRequest, PaymentCallback, PaymentStatusResult, } from './callback.js';
 export { ApiError, ConfigurationError, InvalidPaymentDataError, PaymentError, SignatureVerificationError, } from './errors.js';
-export { DEFAULT_TIMEOUT_MS, FetchHttpClient, } from './http.js';
+export { FetchHttpClient, } from './http.js';
 export { AppPayment, FormPayment, QrPayment, RedirectPayment, } from './results.js';
 export { PaymentFlow, PaymentStatus, resolveStatus } from './status.js';

package/dist/esm/cyber-source/cyber-source.d.ts

@@ -10,30 +10,24 @@ export interface CyberSourceConfigOptions {
     accessKey: string;
     /** The profile's secret key, which signs the fields. */
     secretKey: string;
-    /**
-     * Use the test environment (default `true`).
-     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
-     */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the Secure Acceptance base URL. */
+    /** Overrides the Secure Acceptance base URL, e.g. to point at the test environment. */
     baseUrl?: string | undefined;
 }
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 export declare class CyberSourceConfig {
-    static readonly SANDBOX_URL = "https://testsecureacceptance.cybersource.com";
     static readonly PRODUCTION_URL = "https://secureacceptance.cybersource.com";
     readonly profileId: string;
     readonly accessKey: string;
     readonly secretKey: string;
-    readonly sandbox: boolean;
     /** The base URL in use. */
     readonly baseUrl: string;
     constructor(options: CyberSourceConfigOptions);
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): CyberSourceConfig;
 }
@@ -64,12 +58,12 @@ export interface CyberSourcePaymentData {
     returnUrl?: string | undefined;
     /** The page shown on cancel (`override_custom_cancel_page`), at most 255 characters. */
     cancelUrl?: string | undefined;
-    /** An ISO 4217 code (default `MMK`). */
-    currency?: string | undefined;
-    /** What to do with the card (default `sale`). */
-    transactionType?: CyberSourceTransactionType | undefined;
-    /** The hosted page language, e.g. `en-us` (the default). */
-    locale?: string | undefined;
+    /** An ISO 4217 code, e.g. `MMK`. */
+    currency: string;
+    /** What to do with the card, e.g. `sale`. */
+    transactionType: CyberSourceTransactionType;
+    /** The hosted page language, e.g. `en-us`. */
+    locale: string;
 }
 /**
  * CyberSource Secure Acceptance hosted checkout for card payments: signs the form and verifies the

package/dist/esm/cyber-source/cyber-source.js

@@ -1,7 +1,7 @@
 import {} from '../core/amount.js';
 import { CallbackRequest, losslessInput, PaymentCallback } from '../core/callback.js';
 import { hmacSha256Base64, randomHex, safeEqual } from '../core/crypto.js';
-import { defaultEnv, envFirst, envSandbox, parseSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
+import { defaultEnv, envFirst, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
 import { SignatureVerificationError } from '../core/errors.js';
 import { setKey, toPlainObject } from '../core/json.js';
 import { FormPayment } from '../core/results.js';
@@ -9,35 +9,31 @@ import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
 import { get, optional, scalarString, trimmed } from '../core/values.js';
 /**
- * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`.
+ * A CyberSource Secure Acceptance profile. A missing credential throws a `ConfigurationError`. The
+ * URL defaults to production.
  */
 export class CyberSourceConfig {
-    static SANDBOX_URL = 'https://testsecureacceptance.cybersource.com';
     static PRODUCTION_URL = 'https://secureacceptance.cybersource.com';
     profileId;
     accessKey;
     secretKey;
-    sandbox;
     /** The base URL in use. */
     baseUrl;
     constructor(options) {
         this.profileId = requireSetting('cyber_source', 'profile_id', options.profileId);
         this.accessKey = requireSetting('cyber_source', 'access_key', options.accessKey);
         this.secretKey = requireSetting('cyber_source', 'secret_key', options.secretKey);
-        this.sandbox = parseSandbox(options.sandbox);
-        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ??
-            (this.sandbox ? CyberSourceConfig.SANDBOX_URL : CyberSourceConfig.PRODUCTION_URL));
+        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ?? CyberSourceConfig.PRODUCTION_URL);
     }
     /**
      * Reads `CYBER_SOURCE_PROFILE_ID`, `CYBER_SOURCE_ACCESS_KEY`, `CYBER_SOURCE_SECRET_KEY`,
-     * `CYBER_SOURCE_SANDBOX` and `CYBER_SOURCE_BASE_URL`.
+     * and `CYBER_SOURCE_BASE_URL`.
      */
     static fromEnv(env = defaultEnv()) {
         return new CyberSourceConfig({
             profileId: envFirst(env, 'CYBER_SOURCE_PROFILE_ID'),
             accessKey: envFirst(env, 'CYBER_SOURCE_ACCESS_KEY'),
             secretKey: envFirst(env, 'CYBER_SOURCE_SECRET_KEY'),
-            sandbox: envSandbox(env, 'CYBER_SOURCE_SANDBOX'),
             baseUrl: envFirst(env, 'CYBER_SOURCE_BASE_URL'),
         });
     }
@@ -110,9 +106,12 @@ export class CyberSource {
             .string('cancelUrl', data.cancelUrl)
             .url('cancelUrl', data.cancelUrl)
             .max('cancelUrl', data.cancelUrl, 255)
-            .pattern('currency', String(data.currency || 'MMK'), /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
-            .pattern('locale', String(data.locale || 'en-us'), /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
-            .when(!TRANSACTION_TYPES.includes(String(data.transactionType || 'sale')), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('currency', data.currency)
+            .pattern('currency', data.currency, /^[A-Z]{3}$/, 'a three letter ISO 4217 code')
+            .required('transactionType', data.transactionType)
+            .when(!TRANSACTION_TYPES.includes(String(data.transactionType)), 'transactionType', 'The transactionType field is not a supported transaction type.')
+            .required('locale', data.locale)
+            .pattern('locale', data.locale, /^[a-z]{2}-[a-z]{2}$/, 'a locale code such as en-us')
             .validate();
     }
     /**
@@ -127,11 +126,11 @@ export class CyberSource {
             transaction_uuid: randomHex(),
             signed_field_names: SIGNED_FIELDS.join(','),
             signed_date_time: new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
-            locale: data.locale || 'en-us',
-            transaction_type: data.transactionType || 'sale',
+            locale: data.locale,
+            transaction_type: data.transactionType,
             reference_number: data.orderId,
             amount: String(toAmount(data.amount)),
-            currency: data.currency || 'MMK',
+            currency: data.currency,
             override_custom_receipt_page: data.returnUrl ?? '',
             override_backoffice_post_url: data.callbackUrl,
             override_custom_cancel_page: data.cancelUrl ?? '',

package/dist/esm/kbz-pay/kbz-pay.d.ts

@@ -13,36 +13,35 @@ export interface KbzPayConfigOptions {
     /** The `merch_code` KBZ issued. */
     merchantCode: string;
     /**
-     * Use the UAT endpoints (default `true`). UAT and production issue separate
-     * credentials. Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off`
-     * select production.
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). A client you pass keeps its own timeout.
      */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the API base URL, e.g. to go through a proxy. */
+    timeoutSeconds: number | string;
+    /** Overrides the API base URL, e.g. to point at UAT or go through a proxy. */
     apiUrl?: string | undefined;
     /** Overrides the PWA checkout URL. A trailing `#` or `#/` is normalized to `#/`. */
     pwaUrl?: string | undefined;
 }
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 export declare class KbzPayConfig {
-    static readonly SANDBOX_API_URL = "http://api-uat.kbzpay.com/payment/gateway/uat";
     static readonly PRODUCTION_API_URL = "https://api.kbzpay.com/payment/gateway";
-    static readonly SANDBOX_PWA_URL = "https://static.kbzpay.com/pgw/uat/pwa/#/";
     static readonly PRODUCTION_PWA_URL = "https://wap.kbzpay.com/pgw/pwa/#/";
     readonly appId: string;
     readonly appKey: string;
     readonly merchantCode: string;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly apiUrl: string;
     /** The PWA checkout URL in use, always ending in `/`. */
     readonly pwaUrl: string;
     constructor(options: KbzPayConfigOptions);
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
      */
     static fromEnv(env?: EnvSource): KbzPayConfig;
 }

package/dist/esm/kbz-pay/kbz-pay.js

@@ -1,7 +1,7 @@
 import {} from '../core/amount.js';
 import { Acknowledgement, CallbackRequest, losslessBody, PaymentCallback, PaymentStatusResult, } from '../core/callback.js';
 import { queryEscape, randomHex } from '../core/crypto.js';
-import { defaultEnv, envFirst, envSandbox, parseSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
+import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSeconds, requireSetting, trimUrl, } from '../core/env.js';
 import { ApiError, SignatureVerificationError } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { toPlainObject } from '../core/json.js';
@@ -11,17 +11,17 @@ import { toAmount, Validator } from '../core/validate.js';
 import { get, object, optional, trimmed } from '../core/values.js';
 import { KbzPaySigner } from './signer.js';
 /**
- * KBZ Pay credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * KBZ Pay credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production; UAT and production issue separate credentials.
  */
 export class KbzPayConfig {
-    static SANDBOX_API_URL = 'http://api-uat.kbzpay.com/payment/gateway/uat';
     static PRODUCTION_API_URL = 'https://api.kbzpay.com/payment/gateway';
-    static SANDBOX_PWA_URL = 'https://static.kbzpay.com/pgw/uat/pwa/#/';
     static PRODUCTION_PWA_URL = 'https://wap.kbzpay.com/pgw/pwa/#/';
     appId;
     appKey;
     merchantCode;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The API base URL in use. */
     apiUrl;
     /** The PWA checkout URL in use, always ending in `/`. */
@@ -30,22 +30,20 @@ export class KbzPayConfig {
         this.appId = requireSetting('kbz_pay', 'app_id', options.appId);
         this.appKey = requireSetting('kbz_pay', 'app_key', options.appKey);
         this.merchantCode = requireSetting('kbz_pay', 'merchant_code', options.merchantCode);
-        this.sandbox = parseSandbox(options.sandbox);
-        this.apiUrl = trimUrl(optionalSetting(options.apiUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_API_URL : KbzPayConfig.PRODUCTION_API_URL));
-        this.pwaUrl = `${trimUrl(optionalSetting(options.pwaUrl) ??
-            (this.sandbox ? KbzPayConfig.SANDBOX_PWA_URL : KbzPayConfig.PRODUCTION_PWA_URL))}/`;
+        this.timeoutSeconds = requireSeconds('kbz_pay', 'timeout_in_seconds', options.timeoutSeconds);
+        this.apiUrl = trimUrl(optionalSetting(options.apiUrl) ?? KbzPayConfig.PRODUCTION_API_URL);
+        this.pwaUrl = `${trimUrl(optionalSetting(options.pwaUrl) ?? KbzPayConfig.PRODUCTION_PWA_URL)}/`;
     }
     /**
-     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`, `KBZ_PAY_SANDBOX`,
-     * `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
+     * Reads `KBZ_PAY_APP_ID`, `KBZ_PAY_APP_KEY`, `KBZ_PAY_MERCHANT_CODE`,
+     * `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `KBZ_PAY_BASE_URL` and `KBZ_PAY_PWA_BASE_REDIRECT_URL`.
      */
     static fromEnv(env = defaultEnv()) {
         return new KbzPayConfig({
             appId: envFirst(env, 'KBZ_PAY_APP_ID'),
             appKey: envFirst(env, 'KBZ_PAY_APP_KEY'),
             merchantCode: envFirst(env, 'KBZ_PAY_MERCHANT_CODE'),
-            sandbox: envSandbox(env, 'KBZ_PAY_SANDBOX'),
+            timeoutSeconds: envFirst(env, HTTP_TIMEOUT_VARIABLE),
             apiUrl: envFirst(env, 'KBZ_PAY_BASE_URL'),
             pwaUrl: envFirst(env, 'KBZ_PAY_PWA_BASE_REDIRECT_URL'),
         });
@@ -73,7 +71,7 @@ export class KbzPay {
     constructor(config, options = {}) {
         this.config = config instanceof KbzPayConfig ? config : new KbzPayConfig(config);
         this.signer = new KbzPaySigner(this.config.appKey);
-        this.transport = new Transport(httpClientFrom(options));
+        this.transport = new Transport(httpClientFrom(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `KBZ_PAY_*` environment variables. */
     static fromEnv(env = defaultEnv(), options = {}) {

package/dist/esm/wave-money/wave-money.d.ts

@@ -11,41 +11,40 @@ export interface WaveMoneyConfigOptions {
     secretKey: string;
     /** Your business name, shown on Wave's payment page. */
     merchantName: string;
-    /** How long the customer has to pay, in seconds (default 300). */
-    timeToLiveSeconds?: number | undefined;
+    /** How long the customer has to pay, in seconds: a whole number greater than 0 (or its text). */
+    timeToLiveSeconds: number | string;
     /**
-     * Use the test environment (default `true`).
-     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). A client you pass keeps its own timeout.
      */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the API base URL. */
+    timeoutSeconds: number | string;
+    /** Overrides the API base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
     /** Overrides the host the customer is redirected to. Wave serves it without the API port. */
     authenticateUrl?: string | undefined;
 }
 /**
- * Wave Money credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Wave Money credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production.
  */
 export declare class WaveMoneyConfig {
-    static readonly SANDBOX_URL = "https://preprodpayments.wavemoney.io:8107";
     static readonly PRODUCTION_URL = "https://payments.wavemoney.io";
-    static readonly SANDBOX_AUTHENTICATE_URL = "https://preprodpayments.wavemoney.io";
     static readonly PRODUCTION_AUTHENTICATE_URL = "https://payments.wavemoney.io";
-    static readonly DEFAULT_TIME_TO_LIVE_SECONDS = 300;
     readonly merchantId: string;
     readonly secretKey: string;
     readonly merchantName: string;
     /** Seconds the customer has to pay. */
     readonly timeToLiveSeconds: number;
-    readonly sandbox: boolean;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The API base URL in use. */
     readonly baseUrl: string;
     /** The host the customer is redirected to. */
     readonly authenticateUrl: string;
     constructor(options: WaveMoneyConfigOptions);
     /**
-     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME` (falling back
-     * to `APP_NAME`), `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `WAVE_MONEY_SANDBOX`, `WAVE_MONEY_BASE_URL`
+     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME`,
+     * `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `WAVE_MONEY_BASE_URL`
      * and `WAVE_MONEY_AUTHENTICATE_URL`.
      */
     static fromEnv(env?: EnvSource): WaveMoneyConfig;

package/dist/esm/wave-money/wave-money.js

@@ -1,7 +1,7 @@
 import { Amount } from '../core/amount.js';
 import { CallbackRequest, losslessBody, PaymentCallback } from '../core/callback.js';
 import { hmacSha256Hex, queryEscape, randomHex, safeEqual } from '../core/crypto.js';
-import { defaultEnv, envFirst, envInt, envSandbox, parseSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
+import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSeconds, requireSetting, trimUrl, } from '../core/env.js';
 import { ApiError, SignatureVerificationError } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { isLosslessObject, toPlainObject } from '../core/json.js';
@@ -10,20 +10,19 @@ import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
 import { get, isNested, optional, scalarString, trimmed } from '../core/values.js';
 /**
- * Wave Money credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Wave Money credentials and endpoints. A missing setting throws a `ConfigurationError`. The URLs
+ * default to production.
  */
 export class WaveMoneyConfig {
-    static SANDBOX_URL = 'https://preprodpayments.wavemoney.io:8107';
     static PRODUCTION_URL = 'https://payments.wavemoney.io';
-    static SANDBOX_AUTHENTICATE_URL = 'https://preprodpayments.wavemoney.io';
     static PRODUCTION_AUTHENTICATE_URL = 'https://payments.wavemoney.io';
-    static DEFAULT_TIME_TO_LIVE_SECONDS = 300;
     merchantId;
     secretKey;
     merchantName;
     /** Seconds the customer has to pay. */
     timeToLiveSeconds;
-    sandbox;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The API base URL in use. */
     baseUrl;
     /** The host the customer is redirected to. */
@@ -32,31 +31,23 @@ export class WaveMoneyConfig {
         this.merchantId = requireSetting('wave_money', 'merchant_id', options.merchantId);
         this.secretKey = requireSetting('wave_money', 'secret_key', options.secretKey);
         this.merchantName = requireSetting('wave_money', 'merchant_name', options.merchantName);
-        const ttl = options.timeToLiveSeconds;
-        this.timeToLiveSeconds =
-            ttl !== undefined && Number.isInteger(ttl) && ttl > 0
-                ? ttl
-                : WaveMoneyConfig.DEFAULT_TIME_TO_LIVE_SECONDS;
-        this.sandbox = parseSandbox(options.sandbox);
-        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ??
-            (this.sandbox ? WaveMoneyConfig.SANDBOX_URL : WaveMoneyConfig.PRODUCTION_URL));
-        this.authenticateUrl = trimUrl(optionalSetting(options.authenticateUrl) ??
-            (this.sandbox
-                ? WaveMoneyConfig.SANDBOX_AUTHENTICATE_URL
-                : WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL));
+        this.timeToLiveSeconds = requireSeconds('wave_money', 'time_to_live_in_seconds', options.timeToLiveSeconds);
+        this.timeoutSeconds = requireSeconds('wave_money', 'timeout_in_seconds', options.timeoutSeconds);
+        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ?? WaveMoneyConfig.PRODUCTION_URL);
+        this.authenticateUrl = trimUrl(optionalSetting(options.authenticateUrl) ?? WaveMoneyConfig.PRODUCTION_AUTHENTICATE_URL);
     }
     /**
-     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME` (falling back
-     * to `APP_NAME`), `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `WAVE_MONEY_SANDBOX`, `WAVE_MONEY_BASE_URL`
+     * Reads `WAVE_MONEY_MERCHANT_ID`, `WAVE_MONEY_SECRET_KEY`, `WAVE_MONEY_MERCHANT_NAME`,
+     * `WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`, `WAVE_MONEY_BASE_URL`
      * and `WAVE_MONEY_AUTHENTICATE_URL`.
      */
     static fromEnv(env = defaultEnv()) {
         return new WaveMoneyConfig({
             merchantId: envFirst(env, 'WAVE_MONEY_MERCHANT_ID'),
             secretKey: envFirst(env, 'WAVE_MONEY_SECRET_KEY'),
-            merchantName: envFirst(env, 'WAVE_MONEY_MERCHANT_NAME', 'APP_NAME'),
-            timeToLiveSeconds: envInt(env, 'WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS'),
-            sandbox: envSandbox(env, 'WAVE_MONEY_SANDBOX'),
+            merchantName: envFirst(env, 'WAVE_MONEY_MERCHANT_NAME'),
+            timeToLiveSeconds: envFirst(env, 'WAVE_MONEY_TIME_TO_LIVE_IN_SECONDS'),
+            timeoutSeconds: envFirst(env, HTTP_TIMEOUT_VARIABLE),
             baseUrl: envFirst(env, 'WAVE_MONEY_BASE_URL'),
             authenticateUrl: envFirst(env, 'WAVE_MONEY_AUTHENTICATE_URL'),
         });
@@ -94,7 +85,7 @@ export class WaveMoney {
     transport;
     constructor(config, options = {}) {
         this.config = config instanceof WaveMoneyConfig ? config : new WaveMoneyConfig(config);
-        this.transport = new Transport(httpClientFrom(options));
+        this.transport = new Transport(httpClientFrom(options, this.config.timeoutSeconds));
     }
     /** A gateway configured from the `WAVE_MONEY_*` environment variables. */
     static fromEnv(env = defaultEnv(), options = {}) {

package/dist/esm/yoma-mmqr/yoma-mmqr.d.ts

@@ -16,38 +16,38 @@ export interface YomaMmqrConfigOptions {
     webhookHashKey: string;
     /** The secret you shared with Yoma; when set, callbacks must carry it in `X-Webhook-Secret`. */
     webhookSecret?: string | undefined;
+    /** The `{version}` segment of the API paths, e.g. `v1rc`. */
+    apiVersion: string;
     /**
-     * Use the UAT payment hub (default `true`).
-     * Text is read like a `*_SANDBOX` variable: `false`, `0`, `f`, `no` or `off` select production.
+     * Seconds before the default HTTP client gives up on a request, a whole number greater than 0
+     * (or its text). A client you pass keeps its own timeout.
      */
-    sandbox?: boolean | string | undefined;
-    /** Overrides the API base URL. */
+    timeoutSeconds: number | string;
+    /** Overrides the API base URL, e.g. to point at UAT. */
     baseUrl?: string | undefined;
-    /** The `{version}` segment of the API paths (default `v1rc`). */
-    apiVersion?: string | undefined;
 }
 /**
- * Yoma MMQR credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Yoma MMQR credentials and endpoints. A missing setting throws a `ConfigurationError`. The URL
+ * defaults to production.
  */
 export declare class YomaMmqrConfig {
-    static readonly SANDBOX_URL = "https://devapi.yomabank.net";
     static readonly PRODUCTION_URL = "https://paymenthubapi.yomabank.com";
-    static readonly DEFAULT_API_VERSION = "v1rc";
     readonly merchantId: string;
     readonly clientId: string;
     readonly clientSecret: string;
     readonly webhookHashKey: string;
     readonly webhookSecret: string | undefined;
-    readonly sandbox: boolean;
+    /** The `{version}` segment of the API paths. */
+    readonly apiVersion: string;
+    /** Seconds before the default HTTP client gives up on a request. */
+    readonly timeoutSeconds: number;
     /** The base URL in use. */
     readonly baseUrl: string;
-    /** The API version in use. */
-    readonly apiVersion: string;
     constructor(options: YomaMmqrConfigOptions);
     /**
      * Reads `YOMA_MMQR_MERCHANT_ID`, `YOMA_MMQR_CLIENT_ID`, `YOMA_MMQR_CLIENT_SECRET`,
-     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_WEBHOOK_SECRET`, `YOMA_MMQR_SANDBOX`,
-     * `YOMA_MMQR_BASE_URL` and `YOMA_MMQR_API_VERSION`.
+     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_API_VERSION`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`,
+     * `YOMA_MMQR_WEBHOOK_SECRET` and `YOMA_MMQR_BASE_URL`.
      */
     static fromEnv(env?: EnvSource): YomaMmqrConfig;
 }

package/dist/esm/yoma-mmqr/yoma-mmqr.js

@@ -2,7 +2,7 @@ import {} from '../core/amount.js';
 import { MemoryTokenCache } from '../core/cache.js';
 import { CallbackRequest, losslessBody, PaymentCallback, PaymentStatusResult, } from '../core/callback.js';
 import { hmacSha256Hex, safeEqual, sha256Hex } from '../core/crypto.js';
-import { defaultEnv, envFirst, envSandbox, parseSandbox, optionalSetting, requireSetting, trimUrl, } from '../core/env.js';
+import { defaultEnv, envFirst, HTTP_TIMEOUT_VARIABLE, optionalSetting, requireSeconds, requireSetting, trimUrl, } from '../core/env.js';
 import { ApiError, SignatureVerificationError } from '../core/errors.js';
 import { httpClientFrom, Transport, } from '../core/http.js';
 import { toPlainObject } from '../core/json.js';
@@ -11,37 +11,36 @@ import { resolveStatus } from '../core/status.js';
 import { toAmount, Validator } from '../core/validate.js';
 import { get, isNested, optional, trimmed } from '../core/values.js';
 /**
- * Yoma MMQR credentials and endpoints. A missing credential throws a `ConfigurationError`.
+ * Yoma MMQR credentials and endpoints. A missing setting throws a `ConfigurationError`. The URL
+ * defaults to production.
  */
 export class YomaMmqrConfig {
-    static SANDBOX_URL = 'https://devapi.yomabank.net';
     static PRODUCTION_URL = 'https://paymenthubapi.yomabank.com';
-    static DEFAULT_API_VERSION = 'v1rc';
     merchantId;
     clientId;
     clientSecret;
     webhookHashKey;
     webhookSecret;
-    sandbox;
+    /** The `{version}` segment of the API paths. */
+    apiVersion;
+    /** Seconds before the default HTTP client gives up on a request. */
+    timeoutSeconds;
     /** The base URL in use. */
     baseUrl;
-    /** The API version in use. */
-    apiVersion;
     constructor(options) {
         this.merchantId = requireSetting('yoma_mmqr', 'merchant_id', options.merchantId);
         this.clientId = requireSetting('yoma_mmqr', 'client_id', options.clientId);
         this.clientSecret = requireSetting('yoma_mmqr', 'client_secret', options.clientSecret);
         this.webhookHashKey = requireSetting('yoma_mmqr', 'webhook_hashkey', options.webhookHashKey);
+        this.apiVersion = requireSetting('yoma_mmqr', 'api_version', options.apiVersion);
+        this.timeoutSeconds = requireSeconds('yoma_mmqr', 'timeout_in_seconds', options.timeoutSeconds);
         this.webhookSecret = optionalSetting(options.webhookSecret);
-        this.sandbox = parseSandbox(options.sandbox);
-        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ??
-            (this.sandbox ? YomaMmqrConfig.SANDBOX_URL : YomaMmqrConfig.PRODUCTION_URL));
-        this.apiVersion = optionalSetting(options.apiVersion) ?? YomaMmqrConfig.DEFAULT_API_VERSION;
+        this.baseUrl = trimUrl(optionalSetting(options.baseUrl) ?? YomaMmqrConfig.PRODUCTION_URL);
     }
     /**
      * Reads `YOMA_MMQR_MERCHANT_ID`, `YOMA_MMQR_CLIENT_ID`, `YOMA_MMQR_CLIENT_SECRET`,
-     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_WEBHOOK_SECRET`, `YOMA_MMQR_SANDBOX`,
-     * `YOMA_MMQR_BASE_URL` and `YOMA_MMQR_API_VERSION`.
+     * `YOMA_MMQR_WEBHOOK_HASHKEY`, `YOMA_MMQR_API_VERSION`, `MYANMAR_PAYMENTS_HTTP_TIMEOUT`,
+     * `YOMA_MMQR_WEBHOOK_SECRET` and `YOMA_MMQR_BASE_URL`.
      */
     static fromEnv(env = defaultEnv()) {
         return new YomaMmqrConfig({
@@ -49,10 +48,10 @@ export class YomaMmqrConfig {
             clientId: envFirst(env, 'YOMA_MMQR_CLIENT_ID'),
             clientSecret: envFirst(env, 'YOMA_MMQR_CLIENT_SECRET'),
             webhookHashKey: envFirst(env, 'YOMA_MMQR_WEBHOOK_HASHKEY'),
+            apiVersion: envFirst(env, 'YOMA_MMQR_API_VERSION'),
+            timeoutSeconds: envFirst(env, HTTP_TIMEOUT_VARIABLE),
             webhookSecret: envFirst(env, 'YOMA_MMQR_WEBHOOK_SECRET'),
-            sandbox: envSandbox(env, 'YOMA_MMQR_SANDBOX'),
             baseUrl: envFirst(env, 'YOMA_MMQR_BASE_URL'),
-            apiVersion: envFirst(env, 'YOMA_MMQR_API_VERSION'),
         });
     }
 }
@@ -76,7 +75,7 @@ export class YomaMmqr {
     pendingToken;
     constructor(config, options = {}) {
         this.config = config instanceof YomaMmqrConfig ? config : new YomaMmqrConfig(config);
-        this.transport = new Transport(httpClientFrom(options));
+        this.transport = new Transport(httpClientFrom(options, this.config.timeoutSeconds));
         this.cache = options.tokenCache ?? new MemoryTokenCache();
     }
     /** A gateway configured from the `YOMA_MMQR_*` environment variables. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@laranex/myanmar-payments",
-  "version": "4.0.0-dev.4",
-  "description": "Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed TypeScript API, ESM and CommonJS, no runtime dependencies.",
+  "version": "4.0.0-dev.6",
+  "description": "Node.js SDK for Myanmar payment gateways: KBZ Pay, Wave Money, AYA Pay, Yoma MMQR and CyberSource. Typed requests and results, exact amounts, no runtime dependencies.",
   "keywords": [
     "laranex",
     "node-myanmar-payments",

package/skills/node-myanmar-payments/SKILL.md

@@ -23,7 +23,7 @@ Requires Node.js 20+ and has no runtime dependencies (global `fetch`, `node:cryp
 
 ## Configure
 
-`MyanmarPayments.fromEnv(process.env)` reads `KBZ_PAY_*`, `WAVE_MONEY_*`, `AYA_PAY_*` (or `AYA_PGW_*`), `YOMA_MMQR_*` and `CYBER_SOURCE_*` (the same variables as the PHP, Go and Python SDKs). `sandbox` defaults to `true`; set `*_SANDBOX=false` (or `sandbox: false`) in production.
+`MyanmarPayments.fromEnv(process.env)` reads `KBZ_PAY_*`, `WAVE_MONEY_*`, `AYA_PAY_*` (or `AYA_PGW_*`), `YOMA_MMQR_*` and `CYBER_SOURCE_*` plus `MYANMAR_PAYMENTS_HTTP_TIMEOUT` (the same variables as the PHP, Go and Python SDKs). Every gateway defaults to its production URLs; to test against UAT, set the URL overrides (`KBZ_PAY_BASE_URL`, `KBZ_PAY_PWA_BASE_REDIRECT_URL`, `WAVE_MONEY_BASE_URL`, `WAVE_MONEY_AUTHENTICATE_URL`, `AYA_PAY_BASE_URL`, `YOMA_MMQR_BASE_URL`, `CYBER_SOURCE_BASE_URL`) to the gateway's UAT URLs. Every other setting is required, with no defaults: credentials, `timeoutSeconds` (seconds, for every gateway except CyberSource), Wave's `merchantName` and `timeToLiveSeconds`, and Yoma's `apiVersion` (e.g. `v1rc`).
 
 ```ts
 import { MyanmarPayments } from '@laranex/myanmar-payments';
@@ -32,10 +32,10 @@ const payments = MyanmarPayments.fromEnv(process.env); // create once, share acr
 const kbz = payments.kbzPay(); // also waveMoney(), ayaPay(), yomaMmqr(), cyberSource()
 ```
 
-- Or build one gateway: `new KbzPay(new KbzPayConfig({ appId, appKey, merchantCode }))`, `KbzPay.fromEnv()` or `new KbzPay(KbzPayConfig.fromEnv(process.env))`.
-- Or pass the settings directly: gateways and `new MyanmarPayments({ kbzPay: { appId, appKey, merchantCode } })` take config objects or plain option objects; a string `sandbox` such as `'false'` is read like the variable.
-- Options (second argument): `{ httpClient, fetch, timeoutMs }` (default 30 seconds). Yoma and the facade also take `tokenCache` (any `TokenCache`, default `MemoryTokenCache`; back it with Redis when you run several processes).
-- A missing credential throws `ConfigurationError` (`gateway`, `key`).
+- Or build one gateway: `new KbzPay(new KbzPayConfig({ appId, appKey, merchantCode, timeoutSeconds: 30 }))`, `KbzPay.fromEnv()` or `new KbzPay(KbzPayConfig.fromEnv(process.env))`.
+- Or pass the settings directly: gateways and `new MyanmarPayments({ kbzPay: { appId, appKey, merchantCode, timeoutSeconds } })` take config objects or plain option objects; whole-number settings also take text such as `'30'`.
+- Options (second argument): `{ httpClient, fetch }`. Without `httpClient`, the gateway uses `fetch` with the config's `timeoutSeconds`; a client you pass keeps its own timeout. Yoma and the facade also take `tokenCache` (any `TokenCache`, default `MemoryTokenCache`; back it with Redis when you run several processes).
+- A missing setting throws `ConfigurationError` (`gateway`, `key`); a time setting that is not a whole number greater than 0 throws it too.
 
 ## Use
 
@@ -65,6 +65,8 @@ res.writeHead(302, { Location: payment.url }).end();
 
 AYA needs a channel: `await aya.services()` lists `AyaPayService` entries (`key`, `supports(method)`), then `aya.initiate({ orderId: 'ORDER123', amount: 1000, channel: 'kbz_pay', method: AyaPayMethod.Qr })`. Every network method takes `{ signal }` as its last argument.
 
+CyberSource has no payment defaults: pass `currency` (e.g. `'MMK'`), `transactionType` (e.g. `CyberSourceTransactionType.Sale`) and `locale` (e.g. `'en-us'`) on every `cyberSource.initiate(data)`.
+
 ### Handle the callback
 
 Build a `CallbackRequest` from the raw request, verify it, then reply: