@momorail/cinetpay 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Momorail contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,142 @@
+import { IdempotencyStore, PaymentProvider, ProviderCapabilities, CollectionInput, ProviderCallOptions, Transaction, DisbursementInput, TransactionRef, RawWebhook, WebhookEvent } from '@momorail/core';
+
+type CinetpayChannels = 'ALL' | 'MOBILE_MONEY' | 'CREDIT_CARD' | 'WALLET';
+interface CinetpayOptions {
+    /** API key from the CinetPay dashboard. */
+    apikey: string;
+    /** Site id from the CinetPay dashboard. */
+    siteId: string;
+    /** Secret key from the CinetPay dashboard, used to verify the webhook `x-token`. */
+    secretKey: string;
+    /** Fallback `notify_url` when a collection doesn't set `callbackUrl`. */
+    notifyUrl?: string;
+    /** Fallback `return_url` when a collection doesn't set `returnUrl`. */
+    returnUrl?: string;
+    /** Channels to offer on the hosted checkout. Default `'ALL'`. */
+    channels?: CinetpayChannels;
+    /** Override the API base URL (e.g. a mock in tests). Default the production checkout host. */
+    baseUrl?: string;
+    /** Per-request timeout in ms. Default 15000. */
+    timeoutMs?: number;
+    /** Injectable fetch implementation. Default the global `fetch`. */
+    fetch?: typeof fetch;
+    /**
+     * Account password for the CinetPay **Transfer** API. Provide it to enable
+     * disbursement — without it `capabilities().disbursement` is `false`.
+     */
+    transferPassword?: string;
+    /** Override the Transfer API base URL (tests). Default `https://client.cinetpay.com/v1`. */
+    transferBaseUrl?: string;
+    /** Language for Transfer API messages. Default `'en'`. */
+    transferLang?: string;
+    /** Where the adapter remembers created transactions. Default: in-memory, per process. */
+    idempotencyStore?: IdempotencyStore;
+}
+/**
+ * CinetPay Checkout adapter. Implements collection (hosted checkout), status
+ * lookup, and webhook verification. Disbursement is a later milestone (it uses
+ * CinetPay's separate Transfer API).
+ *
+ * The adapter records each created transaction in an {@link IdempotencyStore}
+ * (in-memory per process by default; pass `idempotencyStore` for a shared,
+ * restart-surviving one). It is used to enrich the sparse `/payment/check`
+ * response (which omits the payment token) so `getTransaction` returns a stable
+ * `id`, and to make a retried `collection` with the same `reference` return the
+ * first transaction rather than starting a second.
+ */
+declare class CinetpayProvider implements PaymentProvider {
+    #private;
+    readonly id = "cinetpay";
+    constructor(options: CinetpayOptions);
+    capabilities(): ProviderCapabilities;
+    collection(input: CollectionInput, options?: ProviderCallOptions): Promise<Transaction>;
+    disbursement(input: DisbursementInput, _options?: ProviderCallOptions): Promise<Transaction>;
+    getTransaction(ref: TransactionRef, options?: ProviderCallOptions): Promise<Transaction>;
+    parseWebhook(raw: RawWebhook): Promise<WebhookEvent>;
+}
+
+/**
+ * Raw CinetPay Checkout API shapes (v2). Only the fields Momorail reads are
+ * modelled; everything the provider returns is still handed back untouched on
+ * `Transaction.providerRaw`.
+ *
+ * @see https://docs.cinetpay.com/api/1.0-en/checkout/initialisation
+ * @see https://docs.cinetpay.com/api/1.0-en/checkout/verification
+ */
+interface CinetpayInitResponse {
+    /** `"201"` on success (`CREATED`). */
+    code: string;
+    message: string;
+    description?: string;
+    data?: {
+        payment_token?: string;
+        payment_url?: string;
+    };
+    api_response_id?: string;
+}
+interface CinetpayCheckResponse {
+    /** `"00"` = accepted; other values carry an error or a not-yet-final state. */
+    code: string;
+    message: string;
+    data?: {
+        amount?: number | string;
+        currency?: string;
+        /** `ACCEPTED` | `REFUSED` | `PENDING` | `INITIATED` | `EXPIRED` | `UNKNOWN` */
+        status?: string;
+        payment_method?: string;
+        description?: string;
+        metadata?: string;
+        operator_id?: string;
+        payment_date?: string;
+        fund_availability_date?: string;
+    } | null;
+}
+/** Form fields CinetPay POSTs to `notify_url`. All values arrive as strings. */
+interface CinetpayNotifyBody {
+    cpm_site_id?: string;
+    cpm_trans_id?: string;
+    cpm_trans_date?: string;
+    cpm_amount?: string;
+    cpm_currency?: string;
+    signature?: string;
+    payment_method?: string;
+    cel_phone_num?: string;
+    cpm_phone_prefixe?: string;
+    cpm_language?: string;
+    cpm_version?: string;
+    cpm_payment_config?: string;
+    cpm_page_action?: string;
+    cpm_custom?: string;
+    cpm_designation?: string;
+    cpm_error_message?: string;
+    [key: string]: string | undefined;
+}
+
+/** Parse an `application/x-www-form-urlencoded` (or already-parsed) notify body. */
+declare function parseNotifyBody(body: string | Uint8Array | Record<string, unknown>): CinetpayNotifyBody;
+/** The exact string CinetPay signs for a given notify body. */
+declare function cinetpaySignaturePayload(fields: CinetpayNotifyBody): string;
+declare function computeCinetpayToken(fields: CinetpayNotifyBody, secretKey: string): string;
+/**
+ * Verify the `x-token` header against the body. Returns the parsed fields on
+ * success; throws {@link WebhookVerificationError} otherwise.
+ */
+declare function verifyCinetpayNotification(headers: Record<string, string | string[] | undefined>, body: string | Uint8Array | Record<string, unknown>, secretKey: string): CinetpayNotifyBody;
+
+/** CinetPay Transfer envelope. `code` is `0` (number) on success here, unlike Checkout's `"00"`. */
+interface TransferEnvelope<T = unknown> {
+    code: number | string;
+    message?: string;
+    description?: string;
+    data?: T;
+}
+interface TransferRecord {
+    client_transaction_id?: string;
+    transaction_id?: string;
+    amount?: number | string;
+    /** `NEW` | `REC` | `VAL` | `REJECT` | `PENDING` … */
+    treatment_status?: string;
+    comment?: string;
+}
+
+export { type CinetpayChannels, type CinetpayCheckResponse, type CinetpayInitResponse, type CinetpayNotifyBody, type CinetpayOptions, CinetpayProvider, type TransferEnvelope, type TransferRecord, cinetpaySignaturePayload, computeCinetpayToken, parseNotifyBody, verifyCinetpayNotification };

package/dist/index.js

@@ -0,0 +1,650 @@
+// src/provider.ts
+import {
+  IdempotencyCache,
+  MemoryIdempotencyStore,
+  MomorailError as MomorailError2,
+  TransactionNotFoundError as TransactionNotFoundError2,
+  ValidationError,
+  isOperator,
+  webhookEventTypeForStatus
+} from "@momorail/core";
+
+// src/http.ts
+import { ProviderUnavailableError as ProviderUnavailableError2 } from "@momorail/core";
+
+// src/mapping.ts
+import {
+  AuthError,
+  MomorailError,
+  ProviderUnavailableError,
+  RateLimitError,
+  TransactionNotFoundError
+} from "@momorail/core";
+var PROVIDER_ID = "cinetpay";
+var SUCCESS_CODES = /* @__PURE__ */ new Set(["00", "201"]);
+var AUTH_CODES = /* @__PURE__ */ new Set(["403", "608", "609"]);
+function isNotFound(res) {
+  if (res.code === "404") return true;
+  if (/not[\s_]*found/i.test(res.message)) return true;
+  if (SUCCESS_CODES.has(res.code) || res.code === "662") return false;
+  return res.data == null;
+}
+function mapCheckStatus(res) {
+  switch (res.data?.status?.toUpperCase()) {
+    case "ACCEPTED":
+      return "succeeded";
+    case "REFUSED":
+      return "failed";
+    case "PENDING":
+    case "INITIATED":
+    case "WAITING_FOR_CUSTOMER":
+      return "processing";
+    case "EXPIRED":
+      return "expired";
+    default:
+      break;
+  }
+  switch (res.code) {
+    case "00":
+      return "succeeded";
+    case "627":
+    case "600":
+      return "failed";
+    case "662":
+      return "processing";
+    default:
+      return "unknown";
+  }
+}
+function mapTransferStatus(status) {
+  switch (status?.toUpperCase()) {
+    case "VAL":
+      return "succeeded";
+    case "REJECT":
+    case "REJECTED":
+    case "REFUND":
+      return "failed";
+    case "NEW":
+    case "REC":
+    case "PENDING":
+    case "CREATED":
+      return "processing";
+    default:
+      return "unknown";
+  }
+}
+var FAILURE_REASONS = {
+  "627": "user_declined",
+  "600": "provider_error",
+  "602": "insufficient_funds",
+  "604": "limit_exceeded"
+};
+function mapFailureReason(res) {
+  return FAILURE_REASONS[res.code] ?? "other";
+}
+function cinetpayError(code, message, providerRaw) {
+  const opts = { provider: PROVIDER_ID, providerRaw };
+  if (AUTH_CODES.has(code)) {
+    return new AuthError(`CinetPay rejected the credentials (${code}: ${message})`, opts);
+  }
+  if (code === "404" || /not[\s_]*found/i.test(message)) {
+    return new TransactionNotFoundError(
+      `CinetPay has no such transaction (${code}: ${message})`,
+      opts
+    );
+  }
+  if (code === "429") {
+    return new RateLimitError(`CinetPay throttled the request (${code}: ${message})`, opts);
+  }
+  if (code === "500" || code === "503") {
+    return new ProviderUnavailableError(`CinetPay is unavailable (${code}: ${message})`, opts);
+  }
+  return new MomorailError(`CinetPay error (${code}: ${message})`, "provider_error", opts);
+}
+
+// src/http.ts
+var HttpClient = class {
+  #baseUrl;
+  #timeoutMs;
+  #fetch;
+  constructor(options) {
+    this.#baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.#timeoutMs = options.timeoutMs;
+    this.#fetch = options.fetch;
+  }
+  async postJson(path, body, signal) {
+    const timeout = AbortSignal.timeout(this.#timeoutMs);
+    const composite = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    let response;
+    try {
+      response = await this.#fetch(`${this.#baseUrl}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal: composite
+      });
+    } catch (cause) {
+      if (signal?.aborted) throw cause;
+      throw new ProviderUnavailableError2("CinetPay request failed to complete", {
+        provider: PROVIDER_ID,
+        cause
+      });
+    }
+    const text = await response.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : {};
+    } catch (cause) {
+      throw new ProviderUnavailableError2("CinetPay returned a non-JSON response", {
+        provider: PROVIDER_ID,
+        providerRaw: text,
+        cause
+      });
+    }
+    if (response.status >= 500) {
+      throw new ProviderUnavailableError2(`CinetPay responded ${response.status}`, {
+        provider: PROVIDER_ID,
+        providerRaw: parsed
+      });
+    }
+    return parsed;
+  }
+};
+
+// src/transfer.ts
+import { AuthError as AuthError2, ProviderUnavailableError as ProviderUnavailableError3, RateLimitError as RateLimitError2 } from "@momorail/core";
+var DEFAULT_TRANSFER_BASE_URL = "https://client.cinetpay.com/v1";
+var okCode = (code) => Number(code) === 0;
+var TransferClient = class {
+  #baseUrl;
+  #timeoutMs;
+  #fetch;
+  #apikey;
+  #password;
+  #lang;
+  #token;
+  #tokenExpiresAt = 0;
+  constructor(options) {
+    this.#baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.#timeoutMs = options.timeoutMs;
+    this.#fetch = options.fetch;
+    this.#apikey = options.apikey;
+    this.#password = options.password;
+    this.#lang = options.lang;
+  }
+  async addContact(contact) {
+    await this.#withToken(
+      (token) => this.#form(`/transfer/contact?token=${token}&lang=${this.#lang}`, {
+        data: JSON.stringify([contact])
+      }),
+      // A contact that already exists is not an error for our purposes.
+      (env) => okCode(env.code) || /exist|d[ée]j[àa]|already/i.test(env.message ?? "")
+    );
+  }
+  send(entry) {
+    return this.#withToken(
+      (token) => this.#form(`/transfer/money/send/contact?token=${token}&lang=${this.#lang}`, {
+        data: JSON.stringify([pruneUndefined(entry)])
+      })
+    );
+  }
+  check(clientTransactionId) {
+    const q = new URLSearchParams({ lang: this.#lang, client_transaction_id: clientTransactionId });
+    return this.#withToken(
+      (token) => this.#form(`/transfer/check/money?token=${token}&${q}`, void 0, "GET")
+    );
+  }
+  async #login() {
+    const env = await this.#form("/auth/login", {
+      apikey: this.#apikey,
+      password: this.#password
+    });
+    const token = env.data?.token;
+    if (!okCode(env.code) || !token) {
+      throw new AuthError2(
+        `CinetPay Transfer login failed (${env.code}: ${env.message ?? "no token"})`,
+        { provider: PROVIDER_ID, providerRaw: env }
+      );
+    }
+    this.#token = token;
+    this.#tokenExpiresAt = Date.now() + 4 * 6e4;
+    return token;
+  }
+  async #tokenValue() {
+    if (this.#token && Date.now() < this.#tokenExpiresAt) return this.#token;
+    return this.#login();
+  }
+  /** Run `call` with a valid token; on a token-auth failure, re-login once and retry. */
+  async #withToken(call, accept = (env) => okCode(env.code)) {
+    let env = await call(await this.#tokenValue());
+    if (!accept(env) && /token/i.test(`${env.code} ${env.message ?? ""}`)) {
+      this.#token = void 0;
+      env = await call(await this.#tokenValue());
+    }
+    return env;
+  }
+  async #form(path, fields, method = "POST") {
+    let response;
+    try {
+      response = await this.#fetch(`${this.#baseUrl}${path}`, {
+        method,
+        headers: method === "POST" ? { "content-type": "application/x-www-form-urlencoded", accept: "application/json" } : { accept: "application/json" },
+        body: method === "POST" && fields ? new URLSearchParams(fields).toString() : void 0,
+        signal: AbortSignal.timeout(this.#timeoutMs)
+      });
+    } catch (cause) {
+      throw new ProviderUnavailableError3("CinetPay Transfer request failed to complete", {
+        provider: PROVIDER_ID,
+        cause
+      });
+    }
+    if (response.status === 429) {
+      throw new RateLimitError2("CinetPay Transfer throttled the request", {
+        provider: PROVIDER_ID
+      });
+    }
+    const text = await response.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : {};
+    } catch (cause) {
+      throw new ProviderUnavailableError3("CinetPay Transfer returned a non-JSON response", {
+        provider: PROVIDER_ID,
+        providerRaw: text,
+        cause
+      });
+    }
+    if (response.status >= 500) {
+      throw new ProviderUnavailableError3(`CinetPay Transfer responded ${response.status}`, {
+        provider: PROVIDER_ID,
+        providerRaw: parsed
+      });
+    }
+    return parsed;
+  }
+};
+function pruneUndefined(obj) {
+  const out = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+
+// src/webhook.ts
+import { createHmac, timingSafeEqual } from "crypto";
+import { WebhookVerificationError } from "@momorail/core";
+var HMAC_FIELDS = [
+  "cpm_site_id",
+  "cpm_trans_id",
+  "cpm_trans_date",
+  "cpm_amount",
+  "cpm_currency",
+  "signature",
+  "payment_method",
+  "cel_phone_num",
+  "cpm_phone_prefixe",
+  "cpm_language",
+  "cpm_version",
+  "cpm_payment_config",
+  "cpm_page_action",
+  "cpm_custom",
+  "cpm_designation",
+  "cpm_error_message"
+];
+function parseNotifyBody(body) {
+  if (typeof body === "string" || body instanceof Uint8Array) {
+    const raw = typeof body === "string" ? body : new TextDecoder().decode(body);
+    const params = new URLSearchParams(raw);
+    return Object.fromEntries(params.entries());
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(body)) {
+    if (value != null) out[key] = String(value);
+  }
+  return out;
+}
+function cinetpaySignaturePayload(fields) {
+  return HMAC_FIELDS.map((name) => fields[name] ?? "").join("");
+}
+function computeCinetpayToken(fields, secretKey) {
+  return createHmac("sha256", secretKey).update(cinetpaySignaturePayload(fields), "utf8").digest("hex");
+}
+function safeEqualHex(a, b) {
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+  } catch {
+    return false;
+  }
+}
+function verifyCinetpayNotification(headers, body, secretKey) {
+  const headerToken = headerValue(headers, "x-token");
+  if (!headerToken) {
+    throw new WebhookVerificationError("Missing x-token header on CinetPay notification", {
+      provider: PROVIDER_ID
+    });
+  }
+  const fields = parseNotifyBody(body);
+  const expected = computeCinetpayToken(fields, secretKey);
+  if (!safeEqualHex(headerToken.toLowerCase(), expected)) {
+    throw new WebhookVerificationError("CinetPay x-token does not match the request body", {
+      provider: PROVIDER_ID
+    });
+  }
+  return fields;
+}
+function headerValue(headers, name) {
+  const direct = headers[name] ?? headers[name.toLowerCase()];
+  const found = direct ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
+  return Array.isArray(found) ? found[0] : found;
+}
+
+// src/provider.ts
+var DEFAULT_BASE_URL = "https://api-checkout.cinetpay.com/v2";
+var DEFAULT_TIMEOUT_MS = 15e3;
+var CALLING_CODE = {
+  ci: "225",
+  sn: "221",
+  ml: "223",
+  bf: "226",
+  bj: "229",
+  tg: "228",
+  ne: "227",
+  cm: "237",
+  cg: "242",
+  cd: "243",
+  td: "235",
+  ga: "241"
+};
+var CAPABILITIES = {
+  collection: true,
+  disbursement: false,
+  lookupByReference: true,
+  hostedCheckout: true,
+  operators: [
+    "orange_ml",
+    "moov_ml",
+    "orange_ci",
+    "mtn_ci",
+    "moov_ci",
+    "wave_ci",
+    "orange_sn",
+    "free_sn",
+    "orange_bf",
+    "moov_bf",
+    "mtn_bj",
+    "moov_bj"
+  ],
+  currencies: ["XOF", "XAF"]
+};
+var CinetpayProvider = class {
+  id = PROVIDER_ID;
+  #apikey;
+  #siteId;
+  #secretKey;
+  #notifyUrl;
+  #returnUrl;
+  #channels;
+  #http;
+  #transfer;
+  #cache;
+  constructor(options) {
+    for (const key of ["apikey", "siteId", "secretKey"]) {
+      if (!options[key]?.trim()) {
+        throw new ValidationError(`CinetpayProvider requires a non-empty "${key}"`);
+      }
+    }
+    this.#apikey = options.apikey;
+    this.#siteId = options.siteId;
+    this.#secretKey = options.secretKey;
+    this.#notifyUrl = options.notifyUrl;
+    this.#returnUrl = options.returnUrl;
+    this.#channels = options.channels ?? "ALL";
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    this.#cache = new IdempotencyCache(
+      options.idempotencyStore ?? new MemoryIdempotencyStore(),
+      this.id
+    );
+    this.#http = new HttpClient({
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
+      timeoutMs,
+      fetch: fetchImpl
+    });
+    this.#transfer = options.transferPassword ? new TransferClient({
+      baseUrl: options.transferBaseUrl ?? DEFAULT_TRANSFER_BASE_URL,
+      timeoutMs,
+      fetch: fetchImpl,
+      apikey: options.apikey,
+      password: options.transferPassword,
+      lang: options.transferLang ?? "en"
+    }) : void 0;
+  }
+  capabilities() {
+    return { ...CAPABILITIES, disbursement: this.#transfer !== void 0 };
+  }
+  async collection(input, options) {
+    if (input.customer.operator !== void 0 && !isOperator(input.customer.operator)) {
+      throw new ValidationError(`Unknown operator: ${input.customer.operator}`, {
+        provider: this.id
+      });
+    }
+    const cached = await this.#cache.byReference(input.reference);
+    if (cached) return structuredClone(cached);
+    const notifyUrl = input.callbackUrl ?? this.#notifyUrl;
+    const returnUrl = input.returnUrl ?? this.#returnUrl;
+    if (!notifyUrl) {
+      throw new ValidationError(
+        "CinetPay needs a webhook URL: pass collection input.callbackUrl or set CinetpayOptions.notifyUrl",
+        { provider: this.id }
+      );
+    }
+    const body = pruneUndefined2({
+      apikey: this.#apikey,
+      site_id: this.#siteId,
+      transaction_id: input.reference,
+      amount: input.amount.amount,
+      currency: input.amount.currency,
+      description: input.description ?? `Payment ${input.reference}`,
+      notify_url: notifyUrl,
+      return_url: returnUrl,
+      channels: this.#channels,
+      customer_name: input.customer.lastName,
+      customer_surname: input.customer.firstName,
+      customer_email: input.customer.email,
+      customer_phone_number: input.customer.phone,
+      metadata: input.metadata ? JSON.stringify(input.metadata) : void 0
+    });
+    const res = await this.#http.postJson("/payment", body, options?.signal);
+    if (res.code !== "201" || !res.data?.payment_token) {
+      throw cinetpayError(res.code, res.message, res);
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const txn = {
+      provider: this.id,
+      id: res.data.payment_token,
+      reference: input.reference,
+      type: "collection",
+      status: "pending",
+      amount: input.amount,
+      operator: input.customer.operator,
+      customer: input.customer,
+      checkoutUrl: res.data.payment_url,
+      providerRaw: res,
+      createdAt: now,
+      updatedAt: now
+    };
+    await this.#cache.remember(txn);
+    return structuredClone(txn);
+  }
+  async disbursement(input, _options) {
+    if (!this.#transfer) {
+      throw new MomorailError2(
+        "CinetPay disbursement needs CinetpayOptions.transferPassword (the Transfer API)",
+        "not_supported",
+        { provider: this.id }
+      );
+    }
+    const operator = input.recipient.operator;
+    if (!operator || !isOperator(operator)) {
+      throw new ValidationError("CinetPay disbursement needs recipient.operator", {
+        provider: this.id
+      });
+    }
+    const prefix = CALLING_CODE[countryOf(operator)];
+    if (!prefix) {
+      throw new ValidationError(`CinetPay has no calling code for operator "${operator}"`, {
+        provider: this.id
+      });
+    }
+    if (input.amount.amount % 5 !== 0) {
+      throw new ValidationError("CinetPay transfers must be a multiple of 5", {
+        provider: this.id
+      });
+    }
+    const cached = await this.#cache.byReference(input.reference);
+    if (cached) return structuredClone(cached);
+    const phone = stripPrefix(input.recipient.phone, prefix);
+    await this.#transfer.addContact({
+      prefix,
+      phone,
+      name: input.recipient.lastName ?? "Momorail",
+      surname: input.recipient.firstName ?? "Recipient",
+      email: input.recipient.email ?? `${input.reference}@recipient.invalid`
+    });
+    const res = await this.#transfer.send({
+      prefix,
+      phone,
+      amount: input.amount.amount,
+      client_transaction_id: input.reference,
+      notify_url: input.callbackUrl ?? this.#notifyUrl
+    });
+    const record = firstRecord(res.data);
+    if (Number(res.code) !== 0) {
+      throw cinetpayError(String(res.code), res.message ?? "transfer failed", res);
+    }
+    const status = mapTransferStatus(record?.treatment_status);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const txn = {
+      provider: this.id,
+      id: String(record?.transaction_id ?? input.reference),
+      reference: input.reference,
+      type: "disbursement",
+      status: status === "unknown" ? "processing" : status,
+      amount: input.amount,
+      operator,
+      customer: input.recipient,
+      providerRaw: res,
+      createdAt: now,
+      updatedAt: now
+    };
+    await this.#cache.remember(txn);
+    return structuredClone(txn);
+  }
+  async getTransaction(ref, options) {
+    const known = (ref.reference ? await this.#cache.byReference(ref.reference) : void 0) ?? (ref.id ? await this.#cache.byId(ref.id) : void 0);
+    if (known?.type === "disbursement" && this.#transfer) {
+      const res2 = await this.#transfer.check(known.reference);
+      const record = firstRecord(res2.data);
+      if (!record) {
+        throw new TransactionNotFoundError2("CinetPay has no such transfer", { provider: this.id });
+      }
+      const status2 = mapTransferStatus(record.treatment_status);
+      const now2 = (/* @__PURE__ */ new Date()).toISOString();
+      const txn2 = {
+        ...known,
+        status: status2 === "unknown" ? known.status : status2,
+        failureReason: status2 === "failed" ? "provider_error" : known.failureReason,
+        providerRaw: res2,
+        updatedAt: now2
+      };
+      await this.#cache.remember(txn2);
+      return structuredClone(txn2);
+    }
+    const lookup = pruneUndefined2({
+      apikey: this.#apikey,
+      site_id: this.#siteId,
+      transaction_id: ref.reference ?? known?.reference,
+      token: ref.reference ? void 0 : ref.id
+    });
+    if (!lookup.transaction_id && !lookup.token) {
+      throw new ValidationError("getTransaction requires an id or a reference", {
+        provider: this.id
+      });
+    }
+    const res = await this.#http.postJson(
+      "/payment/check",
+      lookup,
+      options?.signal
+    );
+    if (isNotFound(res)) {
+      throw cinetpayError(res.code === "00" ? "404" : res.code, res.message, res);
+    }
+    const status = mapCheckStatus(res);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const txn = {
+      provider: this.id,
+      id: known?.id ?? ref.id ?? ref.reference ?? "",
+      reference: known?.reference ?? ref.reference ?? ref.id ?? "",
+      type: "collection",
+      status,
+      amount: known?.amount ?? coerceAmount(res),
+      operator: known?.operator,
+      customer: known?.customer,
+      checkoutUrl: known?.checkoutUrl,
+      failureReason: status === "failed" ? mapFailureReason(res) : void 0,
+      providerRaw: res,
+      createdAt: known?.createdAt ?? now,
+      updatedAt: now
+    };
+    await this.#cache.remember(txn);
+    return structuredClone(txn);
+  }
+  async parseWebhook(raw) {
+    const fields = verifyCinetpayNotification(raw.headers, raw.body, this.#secretKey);
+    const transactionId = fields.cpm_trans_id;
+    if (!transactionId) {
+      throw new ValidationError("CinetPay notification is missing cpm_trans_id", {
+        provider: this.id
+      });
+    }
+    const transaction = await this.getTransaction({ reference: transactionId });
+    return {
+      type: webhookEventTypeForStatus(transaction.status),
+      transaction,
+      providerRaw: fields
+    };
+  }
+};
+function countryOf(operator) {
+  return operator.slice(operator.lastIndexOf("_") + 1);
+}
+function stripPrefix(phone, prefix) {
+  const digits = phone.replace(/\D/g, "");
+  return digits.startsWith(prefix) ? digits.slice(prefix.length) : digits;
+}
+function firstRecord(data) {
+  return Array.isArray(data) ? data[0] : void 0;
+}
+function coerceAmount(res) {
+  const raw = res.data?.amount;
+  const amount = typeof raw === "string" ? Number.parseInt(raw, 10) : raw ?? 0;
+  const currency = res.data?.currency === "XAF" ? "XAF" : "XOF";
+  return { amount: Number.isFinite(amount) ? amount : 0, currency };
+}
+function pruneUndefined2(obj) {
+  const out = {};
+  for (const [key, value] of Object.entries(obj)) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
+export {
+  CinetpayProvider,
+  cinetpaySignaturePayload,
+  computeCinetpayToken,
+  parseNotifyBody,
+  verifyCinetpayNotification
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provider.ts","../src/http.ts","../src/mapping.ts","../src/transfer.ts","../src/webhook.ts"],"sourcesContent":["import {\n  type CollectionInput,\n  type DisbursementInput,\n  IdempotencyCache,\n  type IdempotencyStore,\n  MemoryIdempotencyStore,\n  MomorailError,\n  type Operator,\n  type PaymentProvider,\n  type ProviderCallOptions,\n  type ProviderCapabilities,\n  type RawWebhook,\n  type Transaction,\n  TransactionNotFoundError,\n  type TransactionRef,\n  ValidationError,\n  type WebhookEvent,\n  isOperator,\n  webhookEventTypeForStatus,\n} from '@momorail/core';\nimport { HttpClient } from './http.js';\nimport {\n  PROVIDER_ID,\n  cinetpayError,\n  isNotFound,\n  mapCheckStatus,\n  mapFailureReason,\n  mapTransferStatus,\n} from './mapping.js';\nimport { DEFAULT_TRANSFER_BASE_URL, TransferClient, type TransferRecord } from './transfer.js';\nimport type { CinetpayCheckResponse, CinetpayInitResponse } from './types.js';\nimport { verifyCinetpayNotification } from './webhook.js';\n\nconst DEFAULT_BASE_URL = 'https://api-checkout.cinetpay.com/v2';\nconst DEFAULT_TIMEOUT_MS = 15_000;\n\n/** ISO country → E.164 calling code, for the markets CinetPay Transfer covers. */\nconst CALLING_CODE: Record<string, string> = {\n  ci: '225',\n  sn: '221',\n  ml: '223',\n  bf: '226',\n  bj: '229',\n  tg: '228',\n  ne: '227',\n  cm: '237',\n  cg: '242',\n  cd: '243',\n  td: '235',\n  ga: '241',\n};\n\nexport type CinetpayChannels = 'ALL' | 'MOBILE_MONEY' | 'CREDIT_CARD' | 'WALLET';\n\nexport interface CinetpayOptions {\n  /** API key from the CinetPay dashboard. */\n  apikey: string;\n  /** Site id from the CinetPay dashboard. */\n  siteId: string;\n  /** Secret key from the CinetPay dashboard, used to verify the webhook `x-token`. */\n  secretKey: string;\n  /** Fallback `notify_url` when a collection doesn't set `callbackUrl`. */\n  notifyUrl?: string;\n  /** Fallback `return_url` when a collection doesn't set `returnUrl`. */\n  returnUrl?: string;\n  /** Channels to offer on the hosted checkout. Default `'ALL'`. */\n  channels?: CinetpayChannels;\n  /** Override the API base URL (e.g. a mock in tests). Default the production checkout host. */\n  baseUrl?: string;\n  /** Per-request timeout in ms. Default 15000. */\n  timeoutMs?: number;\n  /** Injectable fetch implementation. Default the global `fetch`. */\n  fetch?: typeof fetch;\n  /**\n   * Account password for the CinetPay **Transfer** API. Provide it to enable\n   * disbursement — without it `capabilities().disbursement` is `false`.\n   */\n  transferPassword?: string;\n  /** Override the Transfer API base URL (tests). Default `https://client.cinetpay.com/v1`. */\n  transferBaseUrl?: string;\n  /** Language for Transfer API messages. Default `'en'`. */\n  transferLang?: string;\n  /** Where the adapter remembers created transactions. Default: in-memory, per process. */\n  idempotencyStore?: IdempotencyStore;\n}\n\nconst CAPABILITIES: ProviderCapabilities = {\n  collection: true,\n  disbursement: false,\n  lookupByReference: true,\n  hostedCheckout: true,\n  operators: [\n    'orange_ml',\n    'moov_ml',\n    'orange_ci',\n    'mtn_ci',\n    'moov_ci',\n    'wave_ci',\n    'orange_sn',\n    'free_sn',\n    'orange_bf',\n    'moov_bf',\n    'mtn_bj',\n    'moov_bj',\n  ],\n  currencies: ['XOF', 'XAF'],\n};\n\n/**\n * CinetPay Checkout adapter. Implements collection (hosted checkout), status\n * lookup, and webhook verification. Disbursement is a later milestone (it uses\n * CinetPay's separate Transfer API).\n *\n * The adapter records each created transaction in an {@link IdempotencyStore}\n * (in-memory per process by default; pass `idempotencyStore` for a shared,\n * restart-surviving one). It is used to enrich the sparse `/payment/check`\n * response (which omits the payment token) so `getTransaction` returns a stable\n * `id`, and to make a retried `collection` with the same `reference` return the\n * first transaction rather than starting a second.\n */\nexport class CinetpayProvider implements PaymentProvider {\n  readonly id = PROVIDER_ID;\n\n  readonly #apikey: string;\n  readonly #siteId: string;\n  readonly #secretKey: string;\n  readonly #notifyUrl: string | undefined;\n  readonly #returnUrl: string | undefined;\n  readonly #channels: CinetpayChannels;\n  readonly #http: HttpClient;\n  readonly #transfer: TransferClient | undefined;\n  readonly #cache: IdempotencyCache;\n\n  constructor(options: CinetpayOptions) {\n    for (const key of ['apikey', 'siteId', 'secretKey'] as const) {\n      if (!options[key]?.trim()) {\n        throw new ValidationError(`CinetpayProvider requires a non-empty \"${key}\"`);\n      }\n    }\n    this.#apikey = options.apikey;\n    this.#siteId = options.siteId;\n    this.#secretKey = options.secretKey;\n    this.#notifyUrl = options.notifyUrl;\n    this.#returnUrl = options.returnUrl;\n    this.#channels = options.channels ?? 'ALL';\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const fetchImpl = options.fetch ?? globalThis.fetch;\n    this.#cache = new IdempotencyCache(\n      options.idempotencyStore ?? new MemoryIdempotencyStore(),\n      this.id,\n    );\n    this.#http = new HttpClient({\n      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,\n      timeoutMs,\n      fetch: fetchImpl,\n    });\n    this.#transfer = options.transferPassword\n      ? new TransferClient({\n          baseUrl: options.transferBaseUrl ?? DEFAULT_TRANSFER_BASE_URL,\n          timeoutMs,\n          fetch: fetchImpl,\n          apikey: options.apikey,\n          password: options.transferPassword,\n          lang: options.transferLang ?? 'en',\n        })\n      : undefined;\n  }\n\n  capabilities(): ProviderCapabilities {\n    return { ...CAPABILITIES, disbursement: this.#transfer !== undefined };\n  }\n\n  async collection(input: CollectionInput, options?: ProviderCallOptions): Promise<Transaction> {\n    if (input.customer.operator !== undefined && !isOperator(input.customer.operator)) {\n      throw new ValidationError(`Unknown operator: ${input.customer.operator}`, {\n        provider: this.id,\n      });\n    }\n\n    const cached = await this.#cache.byReference(input.reference);\n    if (cached) return structuredClone(cached);\n\n    const notifyUrl = input.callbackUrl ?? this.#notifyUrl;\n    const returnUrl = input.returnUrl ?? this.#returnUrl;\n    if (!notifyUrl) {\n      throw new ValidationError(\n        'CinetPay needs a webhook URL: pass collection input.callbackUrl or set CinetpayOptions.notifyUrl',\n        { provider: this.id },\n      );\n    }\n\n    const body = pruneUndefined({\n      apikey: this.#apikey,\n      site_id: this.#siteId,\n      transaction_id: input.reference,\n      amount: input.amount.amount,\n      currency: input.amount.currency,\n      description: input.description ?? `Payment ${input.reference}`,\n      notify_url: notifyUrl,\n      return_url: returnUrl,\n      channels: this.#channels,\n      customer_name: input.customer.lastName,\n      customer_surname: input.customer.firstName,\n      customer_email: input.customer.email,\n      customer_phone_number: input.customer.phone,\n      metadata: input.metadata ? JSON.stringify(input.metadata) : undefined,\n    });\n\n    const res = await this.#http.postJson<CinetpayInitResponse>('/payment', body, options?.signal);\n    if (res.code !== '201' || !res.data?.payment_token) {\n      throw cinetpayError(res.code, res.message, res);\n    }\n\n    const now = new Date().toISOString();\n    const txn: Transaction = {\n      provider: this.id,\n      id: res.data.payment_token,\n      reference: input.reference,\n      type: 'collection',\n      status: 'pending',\n      amount: input.amount,\n      operator: input.customer.operator,\n      customer: input.customer,\n      checkoutUrl: res.data.payment_url,\n      providerRaw: res,\n      createdAt: now,\n      updatedAt: now,\n    };\n\n    await this.#cache.remember(txn);\n    return structuredClone(txn);\n  }\n\n  async disbursement(\n    input: DisbursementInput,\n    _options?: ProviderCallOptions,\n  ): Promise<Transaction> {\n    if (!this.#transfer) {\n      throw new MomorailError(\n        'CinetPay disbursement needs CinetpayOptions.transferPassword (the Transfer API)',\n        'not_supported',\n        { provider: this.id },\n      );\n    }\n    const operator = input.recipient.operator;\n    if (!operator || !isOperator(operator)) {\n      throw new ValidationError('CinetPay disbursement needs recipient.operator', {\n        provider: this.id,\n      });\n    }\n    const prefix = CALLING_CODE[countryOf(operator)];\n    if (!prefix) {\n      throw new ValidationError(`CinetPay has no calling code for operator \"${operator}\"`, {\n        provider: this.id,\n      });\n    }\n    if (input.amount.amount % 5 !== 0) {\n      throw new ValidationError('CinetPay transfers must be a multiple of 5', {\n        provider: this.id,\n      });\n    }\n\n    const cached = await this.#cache.byReference(input.reference);\n    if (cached) return structuredClone(cached);\n\n    const phone = stripPrefix(input.recipient.phone, prefix);\n    await this.#transfer.addContact({\n      prefix,\n      phone,\n      name: input.recipient.lastName ?? 'Momorail',\n      surname: input.recipient.firstName ?? 'Recipient',\n      email: input.recipient.email ?? `${input.reference}@recipient.invalid`,\n    });\n\n    const res = await this.#transfer.send({\n      prefix,\n      phone,\n      amount: input.amount.amount,\n      client_transaction_id: input.reference,\n      notify_url: input.callbackUrl ?? this.#notifyUrl,\n    });\n    const record = firstRecord(res.data);\n    if (Number(res.code) !== 0) {\n      throw cinetpayError(String(res.code), res.message ?? 'transfer failed', res);\n    }\n\n    const status = mapTransferStatus(record?.treatment_status);\n    const now = new Date().toISOString();\n    const txn: Transaction = {\n      provider: this.id,\n      id: String(record?.transaction_id ?? input.reference),\n      reference: input.reference,\n      type: 'disbursement',\n      status: status === 'unknown' ? 'processing' : status,\n      amount: input.amount,\n      operator,\n      customer: input.recipient,\n      providerRaw: res,\n      createdAt: now,\n      updatedAt: now,\n    };\n\n    await this.#cache.remember(txn);\n    return structuredClone(txn);\n  }\n\n  async getTransaction(ref: TransactionRef, options?: ProviderCallOptions): Promise<Transaction> {\n    const known =\n      (ref.reference ? await this.#cache.byReference(ref.reference) : undefined) ??\n      (ref.id ? await this.#cache.byId(ref.id) : undefined);\n\n    if (known?.type === 'disbursement' && this.#transfer) {\n      const res = await this.#transfer.check(known.reference);\n      const record = firstRecord(res.data);\n      if (!record) {\n        throw new TransactionNotFoundError('CinetPay has no such transfer', { provider: this.id });\n      }\n      const status = mapTransferStatus(record.treatment_status);\n      const now = new Date().toISOString();\n      const txn: Transaction = {\n        ...known,\n        status: status === 'unknown' ? known.status : status,\n        failureReason: status === 'failed' ? 'provider_error' : known.failureReason,\n        providerRaw: res,\n        updatedAt: now,\n      };\n      await this.#cache.remember(txn);\n      return structuredClone(txn);\n    }\n\n    const lookup = pruneUndefined({\n      apikey: this.#apikey,\n      site_id: this.#siteId,\n      transaction_id: ref.reference ?? known?.reference,\n      token: ref.reference ? undefined : ref.id,\n    });\n    if (!lookup.transaction_id && !lookup.token) {\n      throw new ValidationError('getTransaction requires an id or a reference', {\n        provider: this.id,\n      });\n    }\n\n    const res = await this.#http.postJson<CinetpayCheckResponse>(\n      '/payment/check',\n      lookup,\n      options?.signal,\n    );\n\n    if (isNotFound(res)) {\n      throw cinetpayError(res.code === '00' ? '404' : res.code, res.message, res);\n    }\n\n    const status = mapCheckStatus(res);\n    const now = new Date().toISOString();\n    const txn: Transaction = {\n      provider: this.id,\n      id: known?.id ?? ref.id ?? ref.reference ?? '',\n      reference: known?.reference ?? ref.reference ?? ref.id ?? '',\n      type: 'collection',\n      status,\n      amount: known?.amount ?? coerceAmount(res),\n      operator: known?.operator,\n      customer: known?.customer,\n      checkoutUrl: known?.checkoutUrl,\n      failureReason: status === 'failed' ? mapFailureReason(res) : undefined,\n      providerRaw: res,\n      createdAt: known?.createdAt ?? now,\n      updatedAt: now,\n    };\n\n    await this.#cache.remember(txn);\n    return structuredClone(txn);\n  }\n\n  async parseWebhook(raw: RawWebhook): Promise<WebhookEvent> {\n    const fields = verifyCinetpayNotification(raw.headers, raw.body, this.#secretKey);\n    const transactionId = fields.cpm_trans_id;\n    if (!transactionId) {\n      throw new ValidationError('CinetPay notification is missing cpm_trans_id', {\n        provider: this.id,\n      });\n    }\n\n    const transaction = await this.getTransaction({ reference: transactionId });\n    return {\n      type: webhookEventTypeForStatus(transaction.status),\n      transaction,\n      providerRaw: fields,\n    };\n  }\n}\n\nfunction countryOf(operator: Operator): string {\n  return operator.slice(operator.lastIndexOf('_') + 1);\n}\n\nfunction stripPrefix(phone: string, prefix: string): string {\n  const digits = phone.replace(/\\D/g, '');\n  return digits.startsWith(prefix) ? digits.slice(prefix.length) : digits;\n}\n\nfunction firstRecord(data: TransferRecord[] | undefined): TransferRecord | undefined {\n  return Array.isArray(data) ? data[0] : undefined;\n}\n\nfunction coerceAmount(res: CinetpayCheckResponse): Transaction['amount'] {\n  const raw = res.data?.amount;\n  const amount = typeof raw === 'string' ? Number.parseInt(raw, 10) : (raw ?? 0);\n  const currency = res.data?.currency === 'XAF' ? 'XAF' : 'XOF';\n  return { amount: Number.isFinite(amount) ? amount : 0, currency };\n}\n\nfunction pruneUndefined<T extends Record<string, unknown>>(obj: T): { [K in keyof T]: T[K] } {\n  const out = {} as { [K in keyof T]: T[K] };\n  for (const [key, value] of Object.entries(obj)) {\n    if (value !== undefined) out[key as keyof T] = value as T[keyof T];\n  }\n  return out;\n}\n","import { ProviderUnavailableError } from '@momorail/core';\nimport { PROVIDER_ID } from './mapping.js';\n\nexport type FetchLike = typeof fetch;\n\nexport interface HttpClientOptions {\n  baseUrl: string;\n  timeoutMs: number;\n  fetch: FetchLike;\n}\n\n/** Minimal JSON POST helper: merges abort signals, enforces a timeout, parses JSON. */\nexport class HttpClient {\n  readonly #baseUrl: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: FetchLike;\n\n  constructor(options: HttpClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/$/, '');\n    this.#timeoutMs = options.timeoutMs;\n    this.#fetch = options.fetch;\n  }\n\n  async postJson<T>(path: string, body: unknown, signal?: AbortSignal): Promise<T> {\n    const timeout = AbortSignal.timeout(this.#timeoutMs);\n    const composite = signal ? AbortSignal.any([signal, timeout]) : timeout;\n\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method: 'POST',\n        headers: { 'content-type': 'application/json', accept: 'application/json' },\n        body: JSON.stringify(body),\n        signal: composite,\n      });\n    } catch (cause) {\n      if (signal?.aborted) throw cause;\n      throw new ProviderUnavailableError('CinetPay request failed to complete', {\n        provider: PROVIDER_ID,\n        cause,\n      });\n    }\n\n    const text = await response.text();\n    let parsed: unknown;\n    try {\n      parsed = text ? JSON.parse(text) : {};\n    } catch (cause) {\n      throw new ProviderUnavailableError('CinetPay returned a non-JSON response', {\n        provider: PROVIDER_ID,\n        providerRaw: text,\n        cause,\n      });\n    }\n\n    if (response.status >= 500) {\n      throw new ProviderUnavailableError(`CinetPay responded ${response.status}`, {\n        provider: PROVIDER_ID,\n        providerRaw: parsed,\n      });\n    }\n\n    return parsed as T;\n  }\n}\n","import {\n  AuthError,\n  type FailureReason,\n  MomorailError,\n  ProviderUnavailableError,\n  RateLimitError,\n  TransactionNotFoundError,\n  type TransactionStatus,\n} from '@momorail/core';\nimport type { CinetpayCheckResponse } from './types.js';\n\nexport const PROVIDER_ID = 'cinetpay';\n\nconst SUCCESS_CODES = new Set(['00', '201']);\n/** Codes that mean the caller's apikey / site_id pair was rejected. */\nconst AUTH_CODES = new Set(['403', '608', '609']);\n\n/**\n * True when a `/payment/check` response means \"no such transaction\".\n *\n * NOTE: CinetPay's exact not-found code is not unambiguous in the public docs\n * (`404` / `AUTH_NOT_FOUND` are both seen). This also treats a null `data` with\n * a non-success, non-pending code as not-found. Re-confirm against the sandbox\n * before a production release.\n */\nexport function isNotFound(res: CinetpayCheckResponse): boolean {\n  if (res.code === '404') return true;\n  if (/not[\\s_]*found/i.test(res.message)) return true;\n  if (SUCCESS_CODES.has(res.code) || res.code === '662') return false;\n  return res.data == null;\n}\n\n/**\n * Reduce a `/payment/check` response to a Momorail status. Prefers the explicit\n * `data.status` string and falls back to the top-level `code`.\n */\nexport function mapCheckStatus(res: CinetpayCheckResponse): TransactionStatus {\n  switch (res.data?.status?.toUpperCase()) {\n    case 'ACCEPTED':\n      return 'succeeded';\n    case 'REFUSED':\n      return 'failed';\n    case 'PENDING':\n    case 'INITIATED':\n    case 'WAITING_FOR_CUSTOMER':\n      return 'processing';\n    case 'EXPIRED':\n      return 'expired';\n    default:\n      break;\n  }\n\n  switch (res.code) {\n    case '00':\n      return 'succeeded';\n    case '627':\n    case '600':\n      return 'failed';\n    case '662':\n      return 'processing';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Map a CinetPay Transfer `treatment_status` onto a Momorail status. */\nexport function mapTransferStatus(status: string | undefined): TransactionStatus {\n  switch (status?.toUpperCase()) {\n    case 'VAL':\n      return 'succeeded';\n    case 'REJECT':\n    case 'REJECTED':\n    case 'REFUND':\n      return 'failed';\n    case 'NEW':\n    case 'REC':\n    case 'PENDING':\n    case 'CREATED':\n      return 'processing';\n    default:\n      return 'unknown';\n  }\n}\n\nconst FAILURE_REASONS: Record<string, FailureReason> = {\n  '627': 'user_declined',\n  '600': 'provider_error',\n  '602': 'insufficient_funds',\n  '604': 'limit_exceeded',\n};\n\nexport function mapFailureReason(res: CinetpayCheckResponse): FailureReason {\n  return FAILURE_REASONS[res.code] ?? 'other';\n}\n\n/**\n * Translate a non-OK CinetPay response (either endpoint) into the matching\n * `MomorailError` subclass. `code` is CinetPay's top-level `code` field.\n */\nexport function cinetpayError(code: string, message: string, providerRaw: unknown): MomorailError {\n  const opts = { provider: PROVIDER_ID, providerRaw } as const;\n\n  if (AUTH_CODES.has(code)) {\n    return new AuthError(`CinetPay rejected the credentials (${code}: ${message})`, opts);\n  }\n  if (code === '404' || /not[\\s_]*found/i.test(message)) {\n    return new TransactionNotFoundError(\n      `CinetPay has no such transaction (${code}: ${message})`,\n      opts,\n    );\n  }\n  if (code === '429') {\n    return new RateLimitError(`CinetPay throttled the request (${code}: ${message})`, opts);\n  }\n  if (code === '500' || code === '503') {\n    return new ProviderUnavailableError(`CinetPay is unavailable (${code}: ${message})`, opts);\n  }\n  return new MomorailError(`CinetPay error (${code}: ${message})`, 'provider_error', opts);\n}\n","import { AuthError, ProviderUnavailableError, RateLimitError } from '@momorail/core';\nimport type { FetchLike } from './http.js';\nimport { PROVIDER_ID } from './mapping.js';\n\nexport const DEFAULT_TRANSFER_BASE_URL = 'https://client.cinetpay.com/v1';\n\n/** CinetPay Transfer envelope. `code` is `0` (number) on success here, unlike Checkout's `\"00\"`. */\nexport interface TransferEnvelope<T = unknown> {\n  code: number | string;\n  message?: string;\n  description?: string;\n  data?: T;\n}\n\nexport interface TransferContact {\n  prefix: string;\n  phone: string;\n  name: string;\n  surname: string;\n  email: string;\n}\n\nexport interface TransferSendEntry {\n  prefix: string;\n  phone: string;\n  amount: number;\n  client_transaction_id: string;\n  notify_url?: string;\n  payment_method?: string;\n}\n\nexport interface TransferRecord {\n  client_transaction_id?: string;\n  transaction_id?: string;\n  amount?: number | string;\n  /** `NEW` | `REC` | `VAL` | `REJECT` | `PENDING` … */\n  treatment_status?: string;\n  comment?: string;\n}\n\nexport interface TransferClientOptions {\n  baseUrl: string;\n  timeoutMs: number;\n  fetch: FetchLike;\n  apikey: string;\n  password: string;\n  lang: string;\n}\n\nconst okCode = (code: number | string): boolean => Number(code) === 0;\n\n/**\n * Thin client for CinetPay's Transfer API. Owns the short-lived login token\n * (~5 min TTL): it is fetched lazily, reused, and re-fetched once on a\n * token-auth failure. All calls are `application/x-www-form-urlencoded`;\n * responses are JSON. The caller's abort signal is not forwarded — only the\n * per-request timeout applies.\n */\nexport class TransferClient {\n  readonly #baseUrl: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: FetchLike;\n  readonly #apikey: string;\n  readonly #password: string;\n  readonly #lang: string;\n\n  #token: string | undefined;\n  #tokenExpiresAt = 0;\n\n  constructor(options: TransferClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/$/, '');\n    this.#timeoutMs = options.timeoutMs;\n    this.#fetch = options.fetch;\n    this.#apikey = options.apikey;\n    this.#password = options.password;\n    this.#lang = options.lang;\n  }\n\n  async addContact(contact: TransferContact): Promise<void> {\n    await this.#withToken(\n      (token) =>\n        this.#form(`/transfer/contact?token=${token}&lang=${this.#lang}`, {\n          data: JSON.stringify([contact]),\n        }),\n      // A contact that already exists is not an error for our purposes.\n      (env) => okCode(env.code) || /exist|d[ée]j[àa]|already/i.test(env.message ?? ''),\n    );\n  }\n\n  send(entry: TransferSendEntry): Promise<TransferEnvelope<TransferRecord[]>> {\n    return this.#withToken((token) =>\n      this.#form(`/transfer/money/send/contact?token=${token}&lang=${this.#lang}`, {\n        data: JSON.stringify([pruneUndefined(entry)]),\n      }),\n    );\n  }\n\n  check(clientTransactionId: string): Promise<TransferEnvelope<TransferRecord[]>> {\n    const q = new URLSearchParams({ lang: this.#lang, client_transaction_id: clientTransactionId });\n    return this.#withToken((token) =>\n      this.#form(`/transfer/check/money?token=${token}&${q}`, undefined, 'GET'),\n    );\n  }\n\n  async #login(): Promise<string> {\n    const env = await this.#form<{ token?: string }>('/auth/login', {\n      apikey: this.#apikey,\n      password: this.#password,\n    });\n    const token = env.data?.token;\n    if (!okCode(env.code) || !token) {\n      throw new AuthError(\n        `CinetPay Transfer login failed (${env.code}: ${env.message ?? 'no token'})`,\n        { provider: PROVIDER_ID, providerRaw: env },\n      );\n    }\n    this.#token = token;\n    this.#tokenExpiresAt = Date.now() + 4 * 60_000; // 5 min TTL, refresh a minute early\n    return token;\n  }\n\n  async #tokenValue(): Promise<string> {\n    if (this.#token && Date.now() < this.#tokenExpiresAt) return this.#token;\n    return this.#login();\n  }\n\n  /** Run `call` with a valid token; on a token-auth failure, re-login once and retry. */\n  async #withToken<T>(\n    call: (token: string) => Promise<TransferEnvelope<T>>,\n    accept: (env: TransferEnvelope<T>) => boolean = (env) => okCode(env.code),\n  ): Promise<TransferEnvelope<T>> {\n    let env = await call(await this.#tokenValue());\n    if (!accept(env) && /token/i.test(`${env.code} ${env.message ?? ''}`)) {\n      this.#token = undefined;\n      env = await call(await this.#tokenValue());\n    }\n    return env;\n  }\n\n  async #form<T>(\n    path: string,\n    fields: Record<string, string> | undefined,\n    method: 'GET' | 'POST' = 'POST',\n  ): Promise<TransferEnvelope<T>> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        headers:\n          method === 'POST'\n            ? { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }\n            : { accept: 'application/json' },\n        body: method === 'POST' && fields ? new URLSearchParams(fields).toString() : undefined,\n        signal: AbortSignal.timeout(this.#timeoutMs),\n      });\n    } catch (cause) {\n      throw new ProviderUnavailableError('CinetPay Transfer request failed to complete', {\n        provider: PROVIDER_ID,\n        cause,\n      });\n    }\n\n    if (response.status === 429) {\n      throw new RateLimitError('CinetPay Transfer throttled the request', {\n        provider: PROVIDER_ID,\n      });\n    }\n\n    const text = await response.text();\n    let parsed: TransferEnvelope<T>;\n    try {\n      parsed = (text ? JSON.parse(text) : {}) as TransferEnvelope<T>;\n    } catch (cause) {\n      throw new ProviderUnavailableError('CinetPay Transfer returned a non-JSON response', {\n        provider: PROVIDER_ID,\n        providerRaw: text,\n        cause,\n      });\n    }\n\n    if (response.status >= 500) {\n      throw new ProviderUnavailableError(`CinetPay Transfer responded ${response.status}`, {\n        provider: PROVIDER_ID,\n        providerRaw: parsed,\n      });\n    }\n\n    return parsed;\n  }\n}\n\nfunction pruneUndefined<T extends object>(obj: T): { [K in keyof T]: T[K] } {\n  const out = {} as { [K in keyof T]: T[K] };\n  for (const [key, value] of Object.entries(obj)) {\n    if (value !== undefined) out[key as keyof T] = value as T[keyof T];\n  }\n  return out;\n}\n","import { createHmac, timingSafeEqual } from 'node:crypto';\nimport { WebhookVerificationError } from '@momorail/core';\nimport { PROVIDER_ID } from './mapping.js';\nimport type { CinetpayNotifyBody } from './types.js';\n\n/**\n * Field order CinetPay concatenates before HMAC-ing the notify body. See\n * https://docs.cinetpay.com/api/1.0-en/checkout/hmac — the string is the raw\n * values joined with no separator, then `hash_hmac('sha256', data, secretKey)`.\n */\nconst HMAC_FIELDS = [\n  'cpm_site_id',\n  'cpm_trans_id',\n  'cpm_trans_date',\n  'cpm_amount',\n  'cpm_currency',\n  'signature',\n  'payment_method',\n  'cel_phone_num',\n  'cpm_phone_prefixe',\n  'cpm_language',\n  'cpm_version',\n  'cpm_payment_config',\n  'cpm_page_action',\n  'cpm_custom',\n  'cpm_designation',\n  'cpm_error_message',\n] as const satisfies readonly (keyof CinetpayNotifyBody)[];\n\n/** Parse an `application/x-www-form-urlencoded` (or already-parsed) notify body. */\nexport function parseNotifyBody(\n  body: string | Uint8Array | Record<string, unknown>,\n): CinetpayNotifyBody {\n  if (typeof body === 'string' || body instanceof Uint8Array) {\n    const raw = typeof body === 'string' ? body : new TextDecoder().decode(body);\n    const params = new URLSearchParams(raw);\n    return Object.fromEntries(params.entries());\n  }\n  const out: CinetpayNotifyBody = {};\n  for (const [key, value] of Object.entries(body)) {\n    if (value != null) out[key] = String(value);\n  }\n  return out;\n}\n\n/** The exact string CinetPay signs for a given notify body. */\nexport function cinetpaySignaturePayload(fields: CinetpayNotifyBody): string {\n  return HMAC_FIELDS.map((name) => fields[name] ?? '').join('');\n}\n\nexport function computeCinetpayToken(fields: CinetpayNotifyBody, secretKey: string): string {\n  return createHmac('sha256', secretKey)\n    .update(cinetpaySignaturePayload(fields), 'utf8')\n    .digest('hex');\n}\n\nfunction safeEqualHex(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  try {\n    return timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Verify the `x-token` header against the body. Returns the parsed fields on\n * success; throws {@link WebhookVerificationError} otherwise.\n */\nexport function verifyCinetpayNotification(\n  headers: Record<string, string | string[] | undefined>,\n  body: string | Uint8Array | Record<string, unknown>,\n  secretKey: string,\n): CinetpayNotifyBody {\n  const headerToken = headerValue(headers, 'x-token');\n  if (!headerToken) {\n    throw new WebhookVerificationError('Missing x-token header on CinetPay notification', {\n      provider: PROVIDER_ID,\n    });\n  }\n\n  const fields = parseNotifyBody(body);\n  const expected = computeCinetpayToken(fields, secretKey);\n  if (!safeEqualHex(headerToken.toLowerCase(), expected)) {\n    throw new WebhookVerificationError('CinetPay x-token does not match the request body', {\n      provider: PROVIDER_ID,\n    });\n  }\n  return fields;\n}\n\nfunction headerValue(\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined {\n  const direct = headers[name] ?? headers[name.toLowerCase()];\n  const found =\n    direct ??\n    Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];\n  return Array.isArray(found) ? found[0] : found;\n}\n"],"mappings":";AAAA;AAAA,EAGE;AAAA,EAEA;AAAA,EACA,iBAAAA;AAAA,EAOA,4BAAAC;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,OACK;;;ACnBP,SAAS,4BAAAC,iCAAgC;;;ACAzC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAGA,IAAM,cAAc;AAE3B,IAAM,gBAAgB,oBAAI,IAAI,CAAC,MAAM,KAAK,CAAC;AAE3C,IAAM,aAAa,oBAAI,IAAI,CAAC,OAAO,OAAO,KAAK,CAAC;AAUzC,SAAS,WAAW,KAAqC;AAC9D,MAAI,IAAI,SAAS,MAAO,QAAO;AAC/B,MAAI,kBAAkB,KAAK,IAAI,OAAO,EAAG,QAAO;AAChD,MAAI,cAAc,IAAI,IAAI,IAAI,KAAK,IAAI,SAAS,MAAO,QAAO;AAC9D,SAAO,IAAI,QAAQ;AACrB;AAMO,SAAS,eAAe,KAA+C;AAC5E,UAAQ,IAAI,MAAM,QAAQ,YAAY,GAAG;AAAA,IACvC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE;AAAA,EACJ;AAEA,UAAQ,IAAI,MAAM;AAAA,IAChB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,kBAAkB,QAA+C;AAC/E,UAAQ,QAAQ,YAAY,GAAG;AAAA,IAC7B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,IAAM,kBAAiD;AAAA,EACrD,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AAAA,EACP,OAAO;AACT;AAEO,SAAS,iBAAiB,KAA2C;AAC1E,SAAO,gBAAgB,IAAI,IAAI,KAAK;AACtC;AAMO,SAAS,cAAc,MAAc,SAAiB,aAAqC;AAChG,QAAM,OAAO,EAAE,UAAU,aAAa,YAAY;AAElD,MAAI,WAAW,IAAI,IAAI,GAAG;AACxB,WAAO,IAAI,UAAU,sCAAsC,IAAI,KAAK,OAAO,KAAK,IAAI;AAAA,EACtF;AACA,MAAI,SAAS,SAAS,kBAAkB,KAAK,OAAO,GAAG;AACrD,WAAO,IAAI;AAAA,MACT,qCAAqC,IAAI,KAAK,OAAO;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACA,MAAI,SAAS,OAAO;AAClB,WAAO,IAAI,eAAe,mCAAmC,IAAI,KAAK,OAAO,KAAK,IAAI;AAAA,EACxF;AACA,MAAI,SAAS,SAAS,SAAS,OAAO;AACpC,WAAO,IAAI,yBAAyB,4BAA4B,IAAI,KAAK,OAAO,KAAK,IAAI;AAAA,EAC3F;AACA,SAAO,IAAI,cAAc,mBAAmB,IAAI,KAAK,OAAO,KAAK,kBAAkB,IAAI;AACzF;;;AD1GO,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,SAAK,WAAW,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,SAAK,aAAa,QAAQ;AAC1B,SAAK,SAAS,QAAQ;AAAA,EACxB;AAAA,EAEA,MAAM,SAAY,MAAc,MAAe,QAAkC;AAC/E,UAAM,UAAU,YAAY,QAAQ,KAAK,UAAU;AACnD,UAAM,YAAY,SAAS,YAAY,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI;AAEhE,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,QAC1E,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,QAAQ,QAAS,OAAM;AAC3B,YAAM,IAAIC,0BAAyB,uCAAuC;AAAA,QACxE,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI;AACJ,QAAI;AACF,eAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACtC,SAAS,OAAO;AACd,YAAM,IAAIA,0BAAyB,yCAAyC;AAAA,QAC1E,UAAU;AAAA,QACV,aAAa;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,SAAS,UAAU,KAAK;AAC1B,YAAM,IAAIA,0BAAyB,sBAAsB,SAAS,MAAM,IAAI;AAAA,QAC1E,UAAU;AAAA,QACV,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AACF;;;AEhEA,SAAS,aAAAC,YAAW,4BAAAC,2BAA0B,kBAAAC,uBAAsB;AAI7D,IAAM,4BAA4B;AA6CzC,IAAM,SAAS,CAAC,SAAmC,OAAO,IAAI,MAAM;AAS7D,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET;AAAA,EACA,kBAAkB;AAAA,EAElB,YAAY,SAAgC;AAC1C,SAAK,WAAW,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,SAAK,aAAa,QAAQ;AAC1B,SAAK,SAAS,QAAQ;AACtB,SAAK,UAAU,QAAQ;AACvB,SAAK,YAAY,QAAQ;AACzB,SAAK,QAAQ,QAAQ;AAAA,EACvB;AAAA,EAEA,MAAM,WAAW,SAAyC;AACxD,UAAM,KAAK;AAAA,MACT,CAAC,UACC,KAAK,MAAM,2BAA2B,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,QAChE,MAAM,KAAK,UAAU,CAAC,OAAO,CAAC;AAAA,MAChC,CAAC;AAAA;AAAA,MAEH,CAAC,QAAQ,OAAO,IAAI,IAAI,KAAK,4BAA4B,KAAK,IAAI,WAAW,EAAE;AAAA,IACjF;AAAA,EACF;AAAA,EAEA,KAAK,OAAuE;AAC1E,WAAO,KAAK;AAAA,MAAW,CAAC,UACtB,KAAK,MAAM,sCAAsC,KAAK,SAAS,KAAK,KAAK,IAAI;AAAA,QAC3E,MAAM,KAAK,UAAU,CAAC,eAAe,KAAK,CAAC,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,qBAA0E;AAC9E,UAAM,IAAI,IAAI,gBAAgB,EAAE,MAAM,KAAK,OAAO,uBAAuB,oBAAoB,CAAC;AAC9F,WAAO,KAAK;AAAA,MAAW,CAAC,UACtB,KAAK,MAAM,+BAA+B,KAAK,IAAI,CAAC,IAAI,QAAW,KAAK;AAAA,IAC1E;AAAA,EACF;AAAA,EAEA,MAAM,SAA0B;AAC9B,UAAM,MAAM,MAAM,KAAK,MAA0B,eAAe;AAAA,MAC9D,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,QAAQ,IAAI,MAAM;AACxB,QAAI,CAAC,OAAO,IAAI,IAAI,KAAK,CAAC,OAAO;AAC/B,YAAM,IAAIC;AAAA,QACR,mCAAmC,IAAI,IAAI,KAAK,IAAI,WAAW,UAAU;AAAA,QACzE,EAAE,UAAU,aAAa,aAAa,IAAI;AAAA,MAC5C;AAAA,IACF;AACA,SAAK,SAAS;AACd,SAAK,kBAAkB,KAAK,IAAI,IAAI,IAAI;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAA+B;AACnC,QAAI,KAAK,UAAU,KAAK,IAAI,IAAI,KAAK,gBAAiB,QAAO,KAAK;AAClE,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA,EAGA,MAAM,WACJ,MACA,SAAgD,CAAC,QAAQ,OAAO,IAAI,IAAI,GAC1C;AAC9B,QAAI,MAAM,MAAM,KAAK,MAAM,KAAK,YAAY,CAAC;AAC7C,QAAI,CAAC,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,IAAI,IAAI,IAAI,IAAI,WAAW,EAAE,EAAE,GAAG;AACrE,WAAK,SAAS;AACd,YAAM,MAAM,KAAK,MAAM,KAAK,YAAY,CAAC;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,MACJ,MACA,QACA,SAAyB,QACK;AAC9B,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,SACE,WAAW,SACP,EAAE,gBAAgB,qCAAqC,QAAQ,mBAAmB,IAClF,EAAE,QAAQ,mBAAmB;AAAA,QACnC,MAAM,WAAW,UAAU,SAAS,IAAI,gBAAgB,MAAM,EAAE,SAAS,IAAI;AAAA,QAC7E,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,MAC7C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAIC,0BAAyB,gDAAgD;AAAA,QACjF,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,SAAS,WAAW,KAAK;AAC3B,YAAM,IAAIC,gBAAe,2CAA2C;AAAA,QAClE,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI;AACJ,QAAI;AACF,eAAU,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,IACvC,SAAS,OAAO;AACd,YAAM,IAAID,0BAAyB,kDAAkD;AAAA,QACnF,UAAU;AAAA,QACV,aAAa;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH;AAEA,QAAI,SAAS,UAAU,KAAK;AAC1B,YAAM,IAAIA,0BAAyB,+BAA+B,SAAS,MAAM,IAAI;AAAA,QACnF,UAAU;AAAA,QACV,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAiC,KAAkC;AAC1E,QAAM,MAAM,CAAC;AACb,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,UAAU,OAAW,KAAI,GAAc,IAAI;AAAA,EACjD;AACA,SAAO;AACT;;;ACrMA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,gCAAgC;AASzC,IAAM,cAAc;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,gBACd,MACoB;AACpB,MAAI,OAAO,SAAS,YAAY,gBAAgB,YAAY;AAC1D,UAAM,MAAM,OAAO,SAAS,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC3E,UAAM,SAAS,IAAI,gBAAgB,GAAG;AACtC,WAAO,OAAO,YAAY,OAAO,QAAQ,CAAC;AAAA,EAC5C;AACA,QAAM,MAA0B,CAAC;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAC/C,QAAI,SAAS,KAAM,KAAI,GAAG,IAAI,OAAO,KAAK;AAAA,EAC5C;AACA,SAAO;AACT;AAGO,SAAS,yBAAyB,QAAoC;AAC3E,SAAO,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE;AAC9D;AAEO,SAAS,qBAAqB,QAA4B,WAA2B;AAC1F,SAAO,WAAW,UAAU,SAAS,EAClC,OAAO,yBAAyB,MAAM,GAAG,MAAM,EAC/C,OAAO,KAAK;AACjB;AAEA,SAAS,aAAa,GAAW,GAAoB;AACnD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI;AACF,WAAO,gBAAgB,OAAO,KAAK,GAAG,KAAK,GAAG,OAAO,KAAK,GAAG,KAAK,CAAC;AAAA,EACrE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,2BACd,SACA,MACA,WACoB;AACpB,QAAM,cAAc,YAAY,SAAS,SAAS;AAClD,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,yBAAyB,mDAAmD;AAAA,MACpF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,gBAAgB,IAAI;AACnC,QAAM,WAAW,qBAAqB,QAAQ,SAAS;AACvD,MAAI,CAAC,aAAa,YAAY,YAAY,GAAG,QAAQ,GAAG;AACtD,UAAM,IAAI,yBAAyB,oDAAoD;AAAA,MACrF,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,YACP,SACA,MACoB;AACpB,QAAM,SAAS,QAAQ,IAAI,KAAK,QAAQ,KAAK,YAAY,CAAC;AAC1D,QAAM,QACJ,UACA,OAAO,QAAQ,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,YAAY,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC;AACvF,SAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC3C;;;AJnEA,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAG3B,IAAM,eAAuC;AAAA,EAC3C,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AACN;AAoCA,IAAM,eAAqC;AAAA,EACzC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,WAAW;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,YAAY,CAAC,OAAO,KAAK;AAC3B;AAcO,IAAM,mBAAN,MAAkD;AAAA,EAC9C,KAAK;AAAA,EAEL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA0B;AACpC,eAAW,OAAO,CAAC,UAAU,UAAU,WAAW,GAAY;AAC5D,UAAI,CAAC,QAAQ,GAAG,GAAG,KAAK,GAAG;AACzB,cAAM,IAAI,gBAAgB,0CAA0C,GAAG,GAAG;AAAA,MAC5E;AAAA,IACF;AACA,SAAK,UAAU,QAAQ;AACvB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ;AAC1B,SAAK,aAAa,QAAQ;AAC1B,SAAK,aAAa,QAAQ;AAC1B,SAAK,YAAY,QAAQ,YAAY;AACrC,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,SAAK,SAAS,IAAI;AAAA,MAChB,QAAQ,oBAAoB,IAAI,uBAAuB;AAAA,MACvD,KAAK;AAAA,IACP;AACA,SAAK,QAAQ,IAAI,WAAW;AAAA,MAC1B,SAAS,QAAQ,WAAW;AAAA,MAC5B;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,SAAK,YAAY,QAAQ,mBACrB,IAAI,eAAe;AAAA,MACjB,SAAS,QAAQ,mBAAmB;AAAA,MACpC;AAAA,MACA,OAAO;AAAA,MACP,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,MAAM,QAAQ,gBAAgB;AAAA,IAChC,CAAC,IACD;AAAA,EACN;AAAA,EAEA,eAAqC;AACnC,WAAO,EAAE,GAAG,cAAc,cAAc,KAAK,cAAc,OAAU;AAAA,EACvE;AAAA,EAEA,MAAM,WAAW,OAAwB,SAAqD;AAC5F,QAAI,MAAM,SAAS,aAAa,UAAa,CAAC,WAAW,MAAM,SAAS,QAAQ,GAAG;AACjF,YAAM,IAAI,gBAAgB,qBAAqB,MAAM,SAAS,QAAQ,IAAI;AAAA,QACxE,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM,SAAS;AAC5D,QAAI,OAAQ,QAAO,gBAAgB,MAAM;AAEzC,UAAM,YAAY,MAAM,eAAe,KAAK;AAC5C,UAAM,YAAY,MAAM,aAAa,KAAK;AAC1C,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,UAAU,KAAK,GAAG;AAAA,MACtB;AAAA,IACF;AAEA,UAAM,OAAOE,gBAAe;AAAA,MAC1B,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM,OAAO;AAAA,MACrB,UAAU,MAAM,OAAO;AAAA,MACvB,aAAa,MAAM,eAAe,WAAW,MAAM,SAAS;AAAA,MAC5D,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,eAAe,MAAM,SAAS;AAAA,MAC9B,kBAAkB,MAAM,SAAS;AAAA,MACjC,gBAAgB,MAAM,SAAS;AAAA,MAC/B,uBAAuB,MAAM,SAAS;AAAA,MACtC,UAAU,MAAM,WAAW,KAAK,UAAU,MAAM,QAAQ,IAAI;AAAA,IAC9D,CAAC;AAED,UAAM,MAAM,MAAM,KAAK,MAAM,SAA+B,YAAY,MAAM,SAAS,MAAM;AAC7F,QAAI,IAAI,SAAS,SAAS,CAAC,IAAI,MAAM,eAAe;AAClD,YAAM,cAAc,IAAI,MAAM,IAAI,SAAS,GAAG;AAAA,IAChD;AAEA,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,MAAmB;AAAA,MACvB,UAAU,KAAK;AAAA,MACf,IAAI,IAAI,KAAK;AAAA,MACb,WAAW,MAAM;AAAA,MACjB,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM,SAAS;AAAA,MACzB,UAAU,MAAM;AAAA,MAChB,aAAa,IAAI,KAAK;AAAA,MACtB,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,UAAM,KAAK,OAAO,SAAS,GAAG;AAC9B,WAAO,gBAAgB,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,aACJ,OACA,UACsB;AACtB,QAAI,CAAC,KAAK,WAAW;AACnB,YAAM,IAAIC;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,GAAG;AAAA,MACtB;AAAA,IACF;AACA,UAAM,WAAW,MAAM,UAAU;AACjC,QAAI,CAAC,YAAY,CAAC,WAAW,QAAQ,GAAG;AACtC,YAAM,IAAI,gBAAgB,kDAAkD;AAAA,QAC1E,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,UAAM,SAAS,aAAa,UAAU,QAAQ,CAAC;AAC/C,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,gBAAgB,8CAA8C,QAAQ,KAAK;AAAA,QACnF,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AACA,QAAI,MAAM,OAAO,SAAS,MAAM,GAAG;AACjC,YAAM,IAAI,gBAAgB,8CAA8C;AAAA,QACtE,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO,YAAY,MAAM,SAAS;AAC5D,QAAI,OAAQ,QAAO,gBAAgB,MAAM;AAEzC,UAAM,QAAQ,YAAY,MAAM,UAAU,OAAO,MAAM;AACvD,UAAM,KAAK,UAAU,WAAW;AAAA,MAC9B;AAAA,MACA;AAAA,MACA,MAAM,MAAM,UAAU,YAAY;AAAA,MAClC,SAAS,MAAM,UAAU,aAAa;AAAA,MACtC,OAAO,MAAM,UAAU,SAAS,GAAG,MAAM,SAAS;AAAA,IACpD,CAAC;AAED,UAAM,MAAM,MAAM,KAAK,UAAU,KAAK;AAAA,MACpC;AAAA,MACA;AAAA,MACA,QAAQ,MAAM,OAAO;AAAA,MACrB,uBAAuB,MAAM;AAAA,MAC7B,YAAY,MAAM,eAAe,KAAK;AAAA,IACxC,CAAC;AACD,UAAM,SAAS,YAAY,IAAI,IAAI;AACnC,QAAI,OAAO,IAAI,IAAI,MAAM,GAAG;AAC1B,YAAM,cAAc,OAAO,IAAI,IAAI,GAAG,IAAI,WAAW,mBAAmB,GAAG;AAAA,IAC7E;AAEA,UAAM,SAAS,kBAAkB,QAAQ,gBAAgB;AACzD,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,MAAmB;AAAA,MACvB,UAAU,KAAK;AAAA,MACf,IAAI,OAAO,QAAQ,kBAAkB,MAAM,SAAS;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,MAAM;AAAA,MACN,QAAQ,WAAW,YAAY,eAAe;AAAA,MAC9C,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAEA,UAAM,KAAK,OAAO,SAAS,GAAG;AAC9B,WAAO,gBAAgB,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,eAAe,KAAqB,SAAqD;AAC7F,UAAM,SACH,IAAI,YAAY,MAAM,KAAK,OAAO,YAAY,IAAI,SAAS,IAAI,YAC/D,IAAI,KAAK,MAAM,KAAK,OAAO,KAAK,IAAI,EAAE,IAAI;AAE7C,QAAI,OAAO,SAAS,kBAAkB,KAAK,WAAW;AACpD,YAAMC,OAAM,MAAM,KAAK,UAAU,MAAM,MAAM,SAAS;AACtD,YAAM,SAAS,YAAYA,KAAI,IAAI;AACnC,UAAI,CAAC,QAAQ;AACX,cAAM,IAAIC,0BAAyB,iCAAiC,EAAE,UAAU,KAAK,GAAG,CAAC;AAAA,MAC3F;AACA,YAAMC,UAAS,kBAAkB,OAAO,gBAAgB;AACxD,YAAMC,QAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,YAAMC,OAAmB;AAAA,QACvB,GAAG;AAAA,QACH,QAAQF,YAAW,YAAY,MAAM,SAASA;AAAA,QAC9C,eAAeA,YAAW,WAAW,mBAAmB,MAAM;AAAA,QAC9D,aAAaF;AAAA,QACb,WAAWG;AAAA,MACb;AACA,YAAM,KAAK,OAAO,SAASC,IAAG;AAC9B,aAAO,gBAAgBA,IAAG;AAAA,IAC5B;AAEA,UAAM,SAASN,gBAAe;AAAA,MAC5B,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,gBAAgB,IAAI,aAAa,OAAO;AAAA,MACxC,OAAO,IAAI,YAAY,SAAY,IAAI;AAAA,IACzC,CAAC;AACD,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,OAAO;AAC3C,YAAM,IAAI,gBAAgB,gDAAgD;AAAA,QACxE,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAEA,UAAM,MAAM,MAAM,KAAK,MAAM;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX;AAEA,QAAI,WAAW,GAAG,GAAG;AACnB,YAAM,cAAc,IAAI,SAAS,OAAO,QAAQ,IAAI,MAAM,IAAI,SAAS,GAAG;AAAA,IAC5E;AAEA,UAAM,SAAS,eAAe,GAAG;AACjC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,MAAmB;AAAA,MACvB,UAAU,KAAK;AAAA,MACf,IAAI,OAAO,MAAM,IAAI,MAAM,IAAI,aAAa;AAAA,MAC5C,WAAW,OAAO,aAAa,IAAI,aAAa,IAAI,MAAM;AAAA,MAC1D,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,OAAO,UAAU,aAAa,GAAG;AAAA,MACzC,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,eAAe,WAAW,WAAW,iBAAiB,GAAG,IAAI;AAAA,MAC7D,aAAa;AAAA,MACb,WAAW,OAAO,aAAa;AAAA,MAC/B,WAAW;AAAA,IACb;AAEA,UAAM,KAAK,OAAO,SAAS,GAAG;AAC9B,WAAO,gBAAgB,GAAG;AAAA,EAC5B;AAAA,EAEA,MAAM,aAAa,KAAwC;AACzD,UAAM,SAAS,2BAA2B,IAAI,SAAS,IAAI,MAAM,KAAK,UAAU;AAChF,UAAM,gBAAgB,OAAO;AAC7B,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,gBAAgB,iDAAiD;AAAA,QACzE,UAAU,KAAK;AAAA,MACjB,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,KAAK,eAAe,EAAE,WAAW,cAAc,CAAC;AAC1E,WAAO;AAAA,MACL,MAAM,0BAA0B,YAAY,MAAM;AAAA,MAClD;AAAA,MACA,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,UAAU,UAA4B;AAC7C,SAAO,SAAS,MAAM,SAAS,YAAY,GAAG,IAAI,CAAC;AACrD;AAEA,SAAS,YAAY,OAAe,QAAwB;AAC1D,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE;AACtC,SAAO,OAAO,WAAW,MAAM,IAAI,OAAO,MAAM,OAAO,MAAM,IAAI;AACnE;AAEA,SAAS,YAAY,MAAgE;AACnF,SAAO,MAAM,QAAQ,IAAI,IAAI,KAAK,CAAC,IAAI;AACzC;AAEA,SAAS,aAAa,KAAmD;AACvE,QAAM,MAAM,IAAI,MAAM;AACtB,QAAM,SAAS,OAAO,QAAQ,WAAW,OAAO,SAAS,KAAK,EAAE,IAAK,OAAO;AAC5E,QAAM,WAAW,IAAI,MAAM,aAAa,QAAQ,QAAQ;AACxD,SAAO,EAAE,QAAQ,OAAO,SAAS,MAAM,IAAI,SAAS,GAAG,SAAS;AAClE;AAEA,SAASA,gBAAkD,KAAkC;AAC3F,QAAM,MAAM,CAAC;AACb,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,UAAU,OAAW,KAAI,GAAc,IAAI;AAAA,EACjD;AACA,SAAO;AACT;","names":["MomorailError","TransactionNotFoundError","ProviderUnavailableError","ProviderUnavailableError","AuthError","ProviderUnavailableError","RateLimitError","AuthError","ProviderUnavailableError","RateLimitError","pruneUndefined","MomorailError","res","TransactionNotFoundError","status","now","txn"]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@momorail/cinetpay",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "CinetPay adapter for Momorail (collection, status check, webhook verification)",
+  "keywords": [
+    "mobile-money",
+    "payments",
+    "west-africa",
+    "africa",
+    "orange-money",
+    "mtn-momo",
+    "wave",
+    "xof",
+    "byo-keys",
+    "typescript",
+    "cinetpay",
+    "adapter"
+  ],
+  "license": "MIT",
+  "author": "Boukymen <boukymen@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Boukymen/momorail.git",
+    "directory": "packages/cinetpay"
+  },
+  "homepage": "https://github.com/Boukymen/momorail/tree/main/packages/cinetpay#readme",
+  "bugs": "https://github.com/Boukymen/momorail/issues",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@momorail/core": "0.1.0"
+  },
+  "devDependencies": {
+    "msw": "^2.7.0",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8",
+    "@momorail/conformance": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}