@p2pdotme/sdk 1.2.19 → 1.2.21

package/dist/qr-parsers.d.cts

@@ -71,13 +71,16 @@ type ParseResult = Result<ParsedQR, QRParserError>;
  * a signed JWT whose `valor.original` field holds the amount. All other parsers
  * (UPI, QRIS, QR Ph, MercadoPago, PagoMovil, Transfermóvil) and static PIX are synchronous and
  * resolve immediately.
+ *
+ * When the country has `validateQr` (PEN, VEN, BOB), Scan & Pay must pass the
+ * same check as SELL upload — not a looser envelope.
  */
 declare function parseQR(params: ParseQRParams): Promise<ParseResult>;
 
 /**
- * Envelope check for a Pago Móvil / Suiche 7B scan: opaque `base64?…`.
- * PAY stores this whole string as the payment ID so the merchant can
- * re-encode it as a QR. Stricter SELL upload rules live in `validateVenezuelanQr`.
+ * Same envelope as SELL upload: opaque `base64?merchantId=NNNN` (blob ≥ 40).
+ * Prefer `validateVenezuelanQr` from `@p2pdotme/sdk/country`; this alias stays
+ * for `@p2pdotme/sdk/qr-parsers` callers.
  */
 declare function isPagoMovilQr(qrData: string): boolean;
 

package/dist/qr-parsers.d.ts

@@ -71,13 +71,16 @@ type ParseResult = Result<ParsedQR, QRParserError>;
  * a signed JWT whose `valor.original` field holds the amount. All other parsers
  * (UPI, QRIS, QR Ph, MercadoPago, PagoMovil, Transfermóvil) and static PIX are synchronous and
  * resolve immediately.
+ *
+ * When the country has `validateQr` (PEN, VEN, BOB), Scan & Pay must pass the
+ * same check as SELL upload — not a looser envelope.
  */
 declare function parseQR(params: ParseQRParams): Promise<ParseResult>;
 
 /**
- * Envelope check for a Pago Móvil / Suiche 7B scan: opaque `base64?…`.
- * PAY stores this whole string as the payment ID so the merchant can
- * re-encode it as a QR. Stricter SELL upload rules live in `validateVenezuelanQr`.
+ * Same envelope as SELL upload: opaque `base64?merchantId=NNNN` (blob ≥ 40).
+ * Prefer `validateVenezuelanQr` from `@p2pdotme/sdk/country`; this alias stays
+ * for `@p2pdotme/sdk/qr-parsers` callers.
  */
 declare function isPagoMovilQr(qrData: string): boolean;
 

package/dist/qr-parsers.mjs

@@ -120,6 +120,39 @@ function validateVenezuelanQr(payload) {
   if (!/^[A-Za-z0-9+/=]+$/.test(blob)) return false;
   return /(?:^|[?&])merchantId=\d{3,4}(?:&|$)/.test(trimmed.substring(qIdx));
 }
+function payQrCandidate(paymentId) {
+  const trimmed = paymentId.trim();
+  const sep = trimmed.indexOf(PACKED_PAYMENT_ID_SEP);
+  return (sep >= 0 ? trimmed.slice(0, sep) : trimmed).trim();
+}
+function isPeruvianPayQr(payload) {
+  if (!payload.startsWith("0002")) return false;
+  return payload.includes("5802PE") && payload.includes("5303604");
+}
+function isVenezuelanPayQr(payload) {
+  if (!payload || payload.includes(PACKED_PAYMENT_ID_SEP)) return false;
+  const qIdx = payload.indexOf("?");
+  if (qIdx === -1) return false;
+  const blob = payload.slice(0, qIdx);
+  return blob.length > 0 && /^[A-Za-z0-9+/=]+$/.test(blob);
+}
+function isPhilippinePayQr(payload) {
+  if (!payload.startsWith("0002")) return false;
+  return payload.includes("5802PH") && payload.includes("5303608");
+}
+function isBolivianPayQr(payload) {
+  if (!payload || payload.includes(PACKED_PAYMENT_ID_SEP)) return false;
+  if (payload.startsWith("0002") && payload.includes("5802BO") && payload.includes("5303068")) {
+    return true;
+  }
+  const sep = payload.lastIndexOf("|");
+  if (sep < 40) return false;
+  const blob = payload.slice(0, sep);
+  const tag = payload.slice(sep + 1);
+  if (blob.length % 4 !== 0) return false;
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) return false;
+  return /^[0-9A-Fa-f]{16,64}$/.test(tag);
+}
 
 // src/country/currencies/bob.ts
 var BOB_COUNTRY_OPTION = {
@@ -135,7 +168,7 @@ var BOB_COUNTRY_OPTION = {
   flag: "\u{1F1E7}\u{1F1F4}",
   flagUrl: "https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f1e7-1f1f4.png",
   phoneCode: "+591",
-  telegramSupportChannel: "https://t.me/p2pmebolivia",
+  telegramSupportChannel: "https://t.me/p2pme_bolivia_merchants",
   twitterUsername: "p2pmebolivia",
   smsCountryCodes: ["BO"],
   precision: 2,
@@ -143,7 +176,11 @@ var BOB_COUNTRY_OPTION = {
   disabled: false,
   disabledPaymentTypes: [],
   uploadPaymentQR: true,
-  validateQr: validateBolivianQr
+  validateQr: validateBolivianQr,
+  getPayQrPayload: (paymentId) => {
+    const candidate = payQrCandidate(paymentId);
+    return isBolivianPayQr(candidate) ? candidate : null;
+  }
 };
 
 // src/country/currencies/brl.ts
@@ -209,7 +246,8 @@ var CUP_COUNTRY_OPTION = {
   precision: 2,
   isAlpha: true,
   disabled: false,
-  disabledPaymentTypes: []
+  disabledPaymentTypes: [],
+  transferWarning: "CUP_BANDEC_WARNING"
 };
 
 // src/country/currencies/ecu.ts
@@ -417,6 +455,10 @@ var PEN_COUNTRY_OPTION = {
   disabledPaymentTypes: [],
   uploadPaymentQR: true,
   validateQr: validatePeruvianQr,
+  getPayQrPayload: (paymentId) => {
+    const candidate = payQrCandidate(paymentId);
+    return isPeruvianPayQr(candidate) ? candidate : null;
+  },
   hydrateFieldsFromQr: (qr) => {
     const phone = extractPeruvianPhoneFromQr(qr);
     return phone ? { phone } : {};
@@ -442,7 +484,11 @@ var PHP_COUNTRY_OPTION = {
   precision: 2,
   isAlpha: true,
   disabled: false,
-  disabledPaymentTypes: []
+  disabledPaymentTypes: [],
+  getPayQrPayload: (paymentId) => {
+    const candidate = payQrCandidate(paymentId);
+    return isPhilippinePayQr(candidate) ? candidate : null;
+  }
 };
 
 // src/country/currencies/usd.ts
@@ -489,7 +535,11 @@ var VEN_COUNTRY_OPTION = {
   disabled: false,
   disabledPaymentTypes: [],
   uploadPaymentQR: true,
-  validateQr: validateVenezuelanQr
+  validateQr: validateVenezuelanQr,
+  getPayQrPayload: (paymentId) => {
+    const candidate = payQrCandidate(paymentId);
+    return isVenezuelanPayQr(candidate) ? candidate : null;
+  }
 };
 
 // src/country/countries.ts
@@ -510,6 +560,10 @@ var COUNTRY_OPTIONS = [
   EUR_COUNTRY_OPTION,
   USD_COUNTRY_OPTION
 ];
+function getCountryOption(currency) {
+  if (!currency) return void 0;
+  return COUNTRY_OPTIONS.find((c) => c.currency === currency);
+}
 
 // src/qr-parsers/types.ts
 import { err, ok } from "neverthrow";
@@ -1035,16 +1089,16 @@ function parseNGN(qrData, sellPrice) {
 }
 
 // src/qr-parsers/parsers/pen.ts
-var PEN_TAGS = { AMOUNT: "54", CURRENCY: "53", COUNTRY: "58" };
+var PEN_TAGS = { AMOUNT: "54" };
 function parsePeru(qrData, sellPrice) {
   if (!qrData || typeof qrData !== "string" || qrData.trim().length === 0) {
     return failure("INVALID_QR", "QR data is empty or invalid");
   }
   const trimmed = qrData.trim();
-  const tags = extractTags(trimmed, [PEN_TAGS.AMOUNT, PEN_TAGS.CURRENCY, PEN_TAGS.COUNTRY]);
-  if (tags[PEN_TAGS.COUNTRY] !== "PE" || tags[PEN_TAGS.CURRENCY] !== "604") {
+  if (!validatePeruvianQr(trimmed)) {
     return failure("INVALID_QR", "Not a valid Peru Yape/Plin QR");
   }
+  const tags = extractTags(trimmed, [PEN_TAGS.AMOUNT]);
   const result = { paymentAddress: trimmed };
   const amountStr = tags[PEN_TAGS.AMOUNT];
   if (amountStr) {
@@ -1086,21 +1140,14 @@ function parseQRPh(qrData, sellPrice) {
 
 // src/qr-parsers/parsers/ven.ts
 function isPagoMovilQr(qrData) {
-  if (!qrData || typeof qrData !== "string" || qrData.trim().length === 0) {
-    return false;
-  }
-  const trimmed = qrData.trim();
-  const qIdx = trimmed.indexOf("?");
-  if (qIdx === -1) return false;
-  const payload = trimmed.substring(0, qIdx);
-  return !!payload && /^[A-Za-z0-9+/=]+$/.test(payload);
+  return validateVenezuelanQr(qrData);
 }
 function parsePagoMovil(qrData, _sellPrice) {
   if (!qrData || typeof qrData !== "string" || qrData.trim().length === 0) {
     return failure("INVALID_QR", "QR data is empty or invalid");
   }
   const trimmed = qrData.trim();
-  if (!isPagoMovilQr(trimmed)) {
+  if (!validateVenezuelanQr(trimmed)) {
     return failure("INVALID_QR", "Not a valid Venezuelan QR code");
   }
   return success({ paymentAddress: trimmed });
@@ -1112,34 +1159,52 @@ async function parseQR(params) {
   if (!qrData || typeof qrData !== "string" || qrData.trim().length === 0) {
     return failure("INVALID_QR", "QR data is empty or invalid");
   }
+  let result;
   switch (currency) {
     case CURRENCY.INR:
-      return parseUPI(qrData, sellPrice);
+      result = parseUPI(qrData, sellPrice);
+      break;
     case CURRENCY.IDR:
-      return parseQRIS(qrData, sellPrice);
+      result = parseQRIS(qrData, sellPrice);
+      break;
     case CURRENCY.BRL:
-      return parsePIX(qrData, sellPrice, { proxyUrl, orderId });
+      result = await parsePIX(qrData, sellPrice, { proxyUrl, orderId });
+      break;
     case CURRENCY.ARS:
-      return parseMercadoPago(qrData, sellPrice);
+      result = parseMercadoPago(qrData, sellPrice);
+      break;
     case CURRENCY.VEN:
-      return parsePagoMovil(qrData, sellPrice);
+      result = parsePagoMovil(qrData, sellPrice);
+      break;
     case CURRENCY.BOB:
-      return parseBolivia(qrData, sellPrice);
+      result = parseBolivia(qrData, sellPrice);
+      break;
     case CURRENCY.NGN:
-      return parseNGN(qrData, sellPrice);
+      result = parseNGN(qrData, sellPrice);
+      break;
     case CURRENCY.COP:
-      return parseCOP(qrData, sellPrice);
+      result = parseCOP(qrData, sellPrice);
+      break;
     case CURRENCY.CUP:
-      return parseTransfermovil(qrData, sellPrice);
+      result = parseTransfermovil(qrData, sellPrice);
+      break;
     case CURRENCY.ECU:
-      return parseDeUna(qrData, sellPrice);
+      result = parseDeUna(qrData, sellPrice);
+      break;
     case CURRENCY.PEN:
-      return parsePeru(qrData, sellPrice);
+      result = parsePeru(qrData, sellPrice);
+      break;
     case CURRENCY.PHP:
-      return parseQRPh(qrData, sellPrice);
+      result = parseQRPh(qrData, sellPrice);
+      break;
     default:
       return failure("INVALID_CURRENCY", `Currency "${currency}" is not supported`);
   }
+  const validateQr = getCountryOption(currency)?.validateQr;
+  if (result.isOk() && validateQr && !validateQr(qrData.trim())) {
+    return failure("INVALID_QR", "QR does not match catalog validateQr");
+  }
+  return result;
 }
 export {
   QRParserError,