@sakeetech/medusa-payment-viva 0.2.2

package/dist/config.d.ts

@@ -0,0 +1,158 @@
+/**
+ * config.ts — env parsing and runtime validation for medusa-payment-viva.
+ *
+ * Reads environment variables and returns a strongly-typed `VivaPluginConfig`
+ * discriminated union, branching on `mode: 'merchant' | 'isv'`.
+ *
+ * Plan reference: docs/plans/multi-mode-v0.md §5 (config shape), §9.1 (env vars).
+ *
+ * Back-compat (one minor — 0.2.x):
+ * - `VIVA_ISV_CLIENT_ID` / `VIVA_ISV_CLIENT_SECRET` are accepted as aliases
+ *   for `VIVA_CLIENT_ID` / `VIVA_CLIENT_SECRET`, with a deprecation warning.
+ *   Removal in 0.3.0.
+ *
+ * Auto-detect:
+ * - If `VIVA_MODE` is unset and any `VIVA_RESELLER_*` is set, mode defaults
+ *   to `'isv'`. Otherwise mode defaults to `'merchant'`.
+ *
+ * Pure function; accepts env as a parameter for testability.
+ * No Zod — manual validation per plan P13.
+ *
+ * @see references/viva-docs/md/isv-credentials.txt:107 (credential types)
+ * @see references/viva-docs/md/oauth2-authentication.txt:119 (client_id, client_secret)
+ * @see references/viva-docs/md/payment-isv-api.txt:1 (reseller credentials)
+ */
+import type { RedisLockClient } from '@sakeetech/viva-payments-core/auth';
+import type { VivaEnvironment } from '@sakeetech/viva-payments-core/types';
+export type VivaMode = 'merchant' | 'isv';
+export type VivaRefundStrategy = 'auto' | 'fast' | 'standard';
+/**
+ * Fields shared by both modes.
+ *
+ * Field name rationale:
+ * - `clientId` / `clientSecret` — mode-agnostic; the OAuth2 client_credentials
+ *   pair works for both merchant and ISV modes.
+ * - `legacyMerchantId` / `legacyApiKey` — Basic-auth pair against the legacy
+ *   host. Required in both modes for Standard refund and IsvSources (merchant
+ *   variant). Probe-verified 2026-04-25: POST /checkout/v2/transactions/{id}
+ *   returns 405, only the legacy host works for refunds.
+ */
+export interface VivaCommonConfig {
+    /**
+     * Viva API environment.
+     * @see references/viva-docs/md/oauth2-authentication.txt:145
+     */
+    environment: VivaEnvironment;
+    /**
+     * OAuth2 client_credentials — mode-agnostic.
+     * Renamed from `isvClientId`/`isvClientSecret` in 0.2.0.
+     * @see references/viva-docs/md/oauth2-authentication.txt:119
+     */
+    clientId: string;
+    clientSecret: string;
+    /**
+     * Legacy Basic-auth credentials. REQUIRED in both modes for Standard refund.
+     *
+     * Probe-verified 2026-04-25 (F1): POST /checkout/v2/transactions/{id} returns
+     * 405; only POST /api/transactions/{id} on the legacy host works.
+     *
+     * @see references/viva-docs/md/merchant-id-and-api-key.txt:1
+     * @see references/viva-docs/md/tut-create-recurring-payment.txt:288
+     */
+    legacyMerchantId: string;
+    legacyApiKey: string;
+    /**
+     * Webhook verification key (GET challenge-response).
+     * @see references/viva-docs/md/isv-credentials.txt:107
+     */
+    webhookVerificationKey: string;
+    /**
+     * Refund strategy. Defaults to `'auto'`.
+     *
+     * 'auto'     — pick fast or standard based on transaction state.
+     * 'fast'     — POST /api/transactions/refund (fast/OAuth2 path).
+     * 'standard' — POST /api/transactions/{id} (legacy Basic auth).
+     */
+    refundStrategy?: VivaRefundStrategy;
+    /**
+     * Optional Redis lock client for multi-worker token-refresh coordination
+     * (plan P11).
+     */
+    redis?: RedisLockClient;
+    /**
+     * Optional OpenTelemetry-compatible observability hook (plan P16).
+     */
+    observability?: {
+        onSpan?: (name: string, fn: () => Promise<unknown>) => Promise<unknown>;
+    };
+    /**
+     * Whether to process Sale Transactions HMAC webhook events.
+     * v1 default: false (HMAC dropped per amendment A8). Reserved for v1.1.
+     */
+    enableSaleTransactionsWebhook?: boolean;
+    /**
+     * Admin token for guarding internal endpoints (/viva/internal/*).
+     * Read from VIVA_ADMIN_TOKEN. Optional — when absent, internal endpoints
+     * return 401 with reason='admin-token-not-configured'.
+     */
+    adminToken?: string;
+}
+/**
+ * Merchant-mode config. Used when the plugin acts on behalf of a single
+ * direct Viva merchant account (no reseller hierarchy).
+ */
+export interface VivaMerchantConfig extends VivaCommonConfig {
+    mode: 'merchant';
+    /**
+     * Optional Smart Checkout sourceCode. Defaults to `'Default'` when unset.
+     *
+     * @see references/viva-docs/md/payment-source-for-isv.txt:101
+     */
+    sourceCode?: string;
+}
+/**
+ * ISV-mode config. Used when the plugin acts on behalf of merchants under
+ * an ISV partner agreement.
+ */
+export interface VivaIsvConfig extends VivaCommonConfig {
+    mode: 'isv';
+    /**
+     * Reseller Basic-auth — required only when the plugin will call
+     * POST /api/sources (IsvSources). All three fields are all-or-nothing.
+     *
+     * @see references/viva-docs/md/payment-isv-api.txt:1
+     */
+    reseller?: {
+        resellerId: string;
+        merchantId: string;
+        resellerApiKey: string;
+    };
+}
+export type VivaPluginConfig = VivaMerchantConfig | VivaIsvConfig;
+/** Test-only: reset the once-per-process flag. */
+export declare function _resetConfigStartupNoticeForTesting(): void;
+/**
+ * Parses the plugin configuration from environment variables.
+ *
+ * Required (both modes):
+ *   - VIVA_CLIENT_ID            (alias: VIVA_ISV_CLIENT_ID — deprecated)
+ *   - VIVA_CLIENT_SECRET        (alias: VIVA_ISV_CLIENT_SECRET — deprecated)
+ *   - VIVA_WEBHOOK_VERIFICATION_KEY
+ *   - VIVA_MERCHANT_ID          (legacy Basic auth)
+ *   - VIVA_API_KEY              (legacy Basic auth)
+ *
+ * Optional:
+ *   - VIVA_MODE                 ('merchant' | 'isv'; default 'merchant',
+ *                                auto-detected as 'isv' when VIVA_RESELLER_* set)
+ *   - VIVA_ENVIRONMENT          ('demo' | 'production'; default 'demo')
+ *   - VIVA_REFUND_STRATEGY      ('auto' | 'fast' | 'standard'; default 'auto')
+ *   - VIVA_SOURCE_CODE          (merchant mode only; default 'Default')
+ *   - VIVA_RESELLER_ID,
+ *     VIVA_RESELLER_MERCHANT_ID,
+ *     VIVA_RESELLER_API_KEY     (ISV mode only; all-or-nothing)
+ *   - VIVA_ADMIN_TOKEN
+ *
+ * @throws VivaValidationError with field-level messages for missing values.
+ */
+export declare function loadConfigFromEnv(env?: NodeJS.ProcessEnv): VivaPluginConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAM3E,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1C,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,WAAW,EAAE,eAAe,CAAC;IAE7B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IAExB;;OAEG;IACH,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACzE,CAAC;IAEF;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IAExC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,IAAI,EAAE,KAAK,CAAC;IACZ;;;;;OAKG;IACH,QAAQ,CAAC,EAAE;QACT,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,GAAG,aAAa,CAAC;AASlE,kDAAkD;AAClD,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,gBAAgB,CAiNlB"}

package/dist/config.js

@@ -0,0 +1,236 @@
+"use strict";
+/**
+ * config.ts — env parsing and runtime validation for medusa-payment-viva.
+ *
+ * Reads environment variables and returns a strongly-typed `VivaPluginConfig`
+ * discriminated union, branching on `mode: 'merchant' | 'isv'`.
+ *
+ * Plan reference: docs/plans/multi-mode-v0.md §5 (config shape), §9.1 (env vars).
+ *
+ * Back-compat (one minor — 0.2.x):
+ * - `VIVA_ISV_CLIENT_ID` / `VIVA_ISV_CLIENT_SECRET` are accepted as aliases
+ *   for `VIVA_CLIENT_ID` / `VIVA_CLIENT_SECRET`, with a deprecation warning.
+ *   Removal in 0.3.0.
+ *
+ * Auto-detect:
+ * - If `VIVA_MODE` is unset and any `VIVA_RESELLER_*` is set, mode defaults
+ *   to `'isv'`. Otherwise mode defaults to `'merchant'`.
+ *
+ * Pure function; accepts env as a parameter for testability.
+ * No Zod — manual validation per plan P13.
+ *
+ * @see references/viva-docs/md/isv-credentials.txt:107 (credential types)
+ * @see references/viva-docs/md/oauth2-authentication.txt:119 (client_id, client_secret)
+ * @see references/viva-docs/md/payment-isv-api.txt:1 (reseller credentials)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._resetConfigStartupNoticeForTesting = _resetConfigStartupNoticeForTesting;
+exports.loadConfigFromEnv = loadConfigFromEnv;
+const errors_1 = require("@sakeetech/viva-payments-core/errors");
+// ---------------------------------------------------------------------------
+// Module-local startup state — used to ensure the "defaulting to merchant
+// mode" notice fires at most once per process.
+// ---------------------------------------------------------------------------
+let _defaultModeNoticeShown = false;
+/** Test-only: reset the once-per-process flag. */
+function _resetConfigStartupNoticeForTesting() {
+    _defaultModeNoticeShown = false;
+}
+// ---------------------------------------------------------------------------
+// Loader
+// ---------------------------------------------------------------------------
+/**
+ * Parses the plugin configuration from environment variables.
+ *
+ * Required (both modes):
+ *   - VIVA_CLIENT_ID            (alias: VIVA_ISV_CLIENT_ID — deprecated)
+ *   - VIVA_CLIENT_SECRET        (alias: VIVA_ISV_CLIENT_SECRET — deprecated)
+ *   - VIVA_WEBHOOK_VERIFICATION_KEY
+ *   - VIVA_MERCHANT_ID          (legacy Basic auth)
+ *   - VIVA_API_KEY              (legacy Basic auth)
+ *
+ * Optional:
+ *   - VIVA_MODE                 ('merchant' | 'isv'; default 'merchant',
+ *                                auto-detected as 'isv' when VIVA_RESELLER_* set)
+ *   - VIVA_ENVIRONMENT          ('demo' | 'production'; default 'demo')
+ *   - VIVA_REFUND_STRATEGY      ('auto' | 'fast' | 'standard'; default 'auto')
+ *   - VIVA_SOURCE_CODE          (merchant mode only; default 'Default')
+ *   - VIVA_RESELLER_ID,
+ *     VIVA_RESELLER_MERCHANT_ID,
+ *     VIVA_RESELLER_API_KEY     (ISV mode only; all-or-nothing)
+ *   - VIVA_ADMIN_TOKEN
+ *
+ * @throws VivaValidationError with field-level messages for missing values.
+ */
+function loadConfigFromEnv(env = process.env) {
+    const errors = [];
+    // -------------------------------------------------------------------------
+    // VIVA_MODE — discriminator, with auto-detect + default-warning.
+    // -------------------------------------------------------------------------
+    const rawMode = env['VIVA_MODE'];
+    const resellerIdRaw = env['VIVA_RESELLER_ID'];
+    const resellerMerchantIdRaw = env['VIVA_RESELLER_MERCHANT_ID'];
+    const resellerApiKeyRaw = env['VIVA_RESELLER_API_KEY'];
+    const anyResellerSet = Boolean(resellerIdRaw || resellerMerchantIdRaw || resellerApiKeyRaw);
+    let mode;
+    if (rawMode === undefined || rawMode === '') {
+        mode = anyResellerSet ? 'isv' : 'merchant';
+        if (!_defaultModeNoticeShown) {
+            _defaultModeNoticeShown = true;
+            console.warn(`[viva] VIVA_MODE is unset — defaulting to '${mode}' mode` +
+                (anyResellerSet
+                    ? ' (auto-detected from VIVA_RESELLER_*).'
+                    : '. Set VIVA_MODE=isv if running under an ISV partner.'));
+        }
+    }
+    else if (rawMode === 'merchant' || rawMode === 'isv') {
+        mode = rawMode;
+    }
+    else {
+        errors.push(`VIVA_MODE must be 'merchant' or 'isv', got '${rawMode}'`);
+        mode = 'merchant'; // placeholder; we'll throw before using it
+    }
+    // -------------------------------------------------------------------------
+    // VIVA_ENVIRONMENT
+    // -------------------------------------------------------------------------
+    const rawEnv = env['VIVA_ENVIRONMENT'] ?? 'demo';
+    if (rawEnv !== 'demo' && rawEnv !== 'production') {
+        errors.push(`VIVA_ENVIRONMENT must be 'demo' or 'production', got '${rawEnv}'`);
+    }
+    const environment = rawEnv;
+    // -------------------------------------------------------------------------
+    // OAuth2 client_credentials (with one-minor back-compat aliases).
+    // -------------------------------------------------------------------------
+    let clientId = env['VIVA_CLIENT_ID'];
+    if (!clientId && env['VIVA_ISV_CLIENT_ID']) {
+        clientId = env['VIVA_ISV_CLIENT_ID'];
+        console.warn('[viva] VIVA_ISV_CLIENT_ID is deprecated, rename to VIVA_CLIENT_ID. ' +
+            'Removal in 0.3.0.');
+    }
+    if (!clientId) {
+        errors.push('VIVA_CLIENT_ID is required');
+    }
+    let clientSecret = env['VIVA_CLIENT_SECRET'];
+    if (!clientSecret && env['VIVA_ISV_CLIENT_SECRET']) {
+        clientSecret = env['VIVA_ISV_CLIENT_SECRET'];
+        console.warn('[viva] VIVA_ISV_CLIENT_SECRET is deprecated, rename to VIVA_CLIENT_SECRET. ' +
+            'Removal in 0.3.0.');
+    }
+    if (!clientSecret) {
+        errors.push('VIVA_CLIENT_SECRET is required');
+    }
+    const webhookVerificationKey = env['VIVA_WEBHOOK_VERIFICATION_KEY'];
+    if (!webhookVerificationKey) {
+        errors.push('VIVA_WEBHOOK_VERIFICATION_KEY is required');
+    }
+    // -------------------------------------------------------------------------
+    // Legacy Basic-auth credentials — required in both modes for Standard refund.
+    // -------------------------------------------------------------------------
+    const legacyMerchantId = env['VIVA_MERCHANT_ID'];
+    if (!legacyMerchantId) {
+        errors.push('VIVA_MERCHANT_ID is required — needed for refundPayment (Viva legacy Basic-auth API). ' +
+            'Probe-verified 2026-04-25: POST /checkout/v2/transactions/{id} returns 405; ' +
+            'only POST /api/transactions/{id} on the legacy host works.');
+    }
+    const legacyApiKey = env['VIVA_API_KEY'];
+    if (!legacyApiKey) {
+        errors.push('VIVA_API_KEY is required — needed for refundPayment (Viva legacy Basic-auth API). ' +
+            'Pair with VIVA_MERCHANT_ID to authenticate refund calls.');
+    }
+    // -------------------------------------------------------------------------
+    // VIVA_REFUND_STRATEGY (default 'auto').
+    // -------------------------------------------------------------------------
+    const rawRefundStrategy = env['VIVA_REFUND_STRATEGY'];
+    let refundStrategy = 'auto';
+    if (rawRefundStrategy !== undefined && rawRefundStrategy !== '') {
+        if (rawRefundStrategy === 'auto' ||
+            rawRefundStrategy === 'fast' ||
+            rawRefundStrategy === 'standard') {
+            refundStrategy = rawRefundStrategy;
+        }
+        else {
+            errors.push(`VIVA_REFUND_STRATEGY must be 'auto', 'fast', or 'standard', got '${rawRefundStrategy}'`);
+        }
+    }
+    // -------------------------------------------------------------------------
+    // Reseller credentials (ISV-only, all-or-nothing).
+    // -------------------------------------------------------------------------
+    const resellerSetCount = [
+        resellerIdRaw,
+        resellerMerchantIdRaw,
+        resellerApiKeyRaw,
+    ].filter(Boolean).length;
+    if (mode === 'merchant' && resellerSetCount > 0) {
+        // Don't throw — warn and ignore. Reseller fields are unused in merchant mode.
+        console.warn('[viva] VIVA_RESELLER_* env vars are set but VIVA_MODE=merchant. ' +
+            'These values are ignored in merchant mode.');
+    }
+    if (mode === 'isv' && resellerSetCount > 0 && resellerSetCount < 3) {
+        const missing = [];
+        if (!resellerIdRaw)
+            missing.push('VIVA_RESELLER_ID');
+        if (!resellerMerchantIdRaw)
+            missing.push('VIVA_RESELLER_MERCHANT_ID');
+        if (!resellerApiKeyRaw)
+            missing.push('VIVA_RESELLER_API_KEY');
+        errors.push(`Reseller credentials are partially set. Missing: ${missing.join(', ')}. ` +
+            `Either set all three (VIVA_RESELLER_ID, VIVA_RESELLER_MERCHANT_ID, VIVA_RESELLER_API_KEY) or none.`);
+    }
+    // -------------------------------------------------------------------------
+    // Throw aggregated validation errors before constructing the config object.
+    // -------------------------------------------------------------------------
+    if (errors.length > 0) {
+        throw new errors_1.VivaValidationError({
+            message: `Invalid Viva plugin configuration:\n  ${errors.join('\n  ')}`,
+        });
+    }
+    // -------------------------------------------------------------------------
+    // VIVA_ADMIN_TOKEN — warn in production if missing.
+    // -------------------------------------------------------------------------
+    const adminToken = env['VIVA_ADMIN_TOKEN'];
+    if (!adminToken && environment === 'production') {
+        console.warn('[viva] VIVA_ADMIN_TOKEN is not set. Internal endpoints (/viva/internal/*) will return 401.');
+    }
+    // -------------------------------------------------------------------------
+    // Compose common fields.
+    // -------------------------------------------------------------------------
+    const common = {
+        environment,
+        clientId: clientId,
+        clientSecret: clientSecret,
+        legacyMerchantId: legacyMerchantId,
+        legacyApiKey: legacyApiKey,
+        webhookVerificationKey: webhookVerificationKey,
+        refundStrategy,
+        ...(adminToken !== undefined ? { adminToken } : {}),
+    };
+    // -------------------------------------------------------------------------
+    // Branch on mode.
+    // -------------------------------------------------------------------------
+    if (mode === 'merchant') {
+        const sourceCode = env['VIVA_SOURCE_CODE'];
+        const merchantConfig = {
+            ...common,
+            mode: 'merchant',
+            ...(sourceCode !== undefined && sourceCode !== ''
+                ? { sourceCode }
+                : {}),
+        };
+        return merchantConfig;
+    }
+    // mode === 'isv'
+    const reseller = resellerSetCount === 3
+        ? {
+            resellerId: resellerIdRaw,
+            merchantId: resellerMerchantIdRaw,
+            resellerApiKey: resellerApiKeyRaw,
+        }
+        : undefined;
+    const isvConfig = {
+        ...common,
+        mode: 'isv',
+        ...(reseller !== undefined ? { reseller } : {}),
+    };
+    return isvConfig;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAyIH,kFAEC;AA6BD,8CAmNC;AAzXD,iEAA2E;AA+H3E,8EAA8E;AAC9E,0EAA0E;AAC1E,+CAA+C;AAC/C,8EAA8E;AAE9E,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC,kDAAkD;AAClD,SAAgB,mCAAmC;IACjD,uBAAuB,GAAG,KAAK,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,iBAAiB,CAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,4EAA4E;IAC5E,iEAAiE;IACjE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,qBAAqB,GAAG,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,OAAO,CAC5B,aAAa,IAAI,qBAAqB,IAAI,iBAAiB,CAC5D,CAAC;IAEF,IAAI,IAAc,CAAC;IACnB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,8CAA8C,IAAI,QAAQ;gBACxD,CAAC,cAAc;oBACb,CAAC,CAAC,wCAAwC;oBAC1C,CAAC,CAAC,sDAAsD,CAAC,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,+CAA+C,OAAO,GAAG,CAC1D,CAAC;QACF,IAAI,GAAG,UAAU,CAAC,CAAC,2CAA2C;IAChE,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC;IACjD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CACT,yDAAyD,MAAM,GAAG,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAyB,CAAC;IAE9C,4EAA4E;IAC5E,kEAAkE;IAClE,4EAA4E;IAC5E,IAAI,QAAQ,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CACV,qEAAqE;YACnE,mBAAmB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,YAAY,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACnD,YAAY,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CACV,6EAA6E;YAC3E,mBAAmB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,sBAAsB,GAAG,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACpE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CACT,wFAAwF;YACtF,8EAA8E;YAC9E,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CACT,oFAAoF;YAClF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,yCAAyC;IACzC,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,cAAc,GAAuB,MAAM,CAAC;IAChD,IAAI,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,KAAK,EAAE,EAAE,CAAC;QAChE,IACE,iBAAiB,KAAK,MAAM;YAC5B,iBAAiB,KAAK,MAAM;YAC5B,iBAAiB,KAAK,UAAU,EAChC,CAAC;YACD,cAAc,GAAG,iBAAiB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,oEAAoE,iBAAiB,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,mDAAmD;IACnD,4EAA4E;IAC5E,MAAM,gBAAgB,GAAG;QACvB,aAAa;QACb,qBAAqB;QACrB,iBAAiB;KAClB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAEzB,IAAI,IAAI,KAAK,UAAU,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QAChD,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,kEAAkE;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,KAAK,IAAI,gBAAgB,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACrD,IAAI,CAAC,qBAAqB;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACtE,IAAI,CAAC,iBAAiB;YAAE,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CACT,oDAAoD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACxE,oGAAoG,CACvG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,4BAAmB,CAAC;YAC5B,OAAO,EAAE,yCAAyC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,oDAAoD;IACpD,4EAA4E;IAC5E,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CACV,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAC5E,MAAM,MAAM,GAAqB;QAC/B,WAAW;QACX,QAAQ,EAAE,QAAS;QACnB,YAAY,EAAE,YAAa;QAC3B,gBAAgB,EAAE,gBAAiB;QACnC,YAAY,EAAE,YAAa;QAC3B,sBAAsB,EAAE,sBAAuB;QAC/C,cAAc;QACd,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;IAEF,4EAA4E;IAC5E,kBAAkB;IAClB,4EAA4E;IAC5E,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAuB;YACzC,GAAG,MAAM;YACT,IAAI,EAAE,UAAU;YAChB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;gBAC/C,CAAC,CAAC,EAAE,UAAU,EAAE;gBAChB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,iBAAiB;IACjB,MAAM,QAAQ,GACZ,gBAAgB,KAAK,CAAC;QACpB,CAAC,CAAC;YACE,UAAU,EAAE,aAAc;YAC1B,UAAU,EAAE,qBAAsB;YAClC,cAAc,EAAE,iBAAkB;SACnC;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,SAAS,GAAkB;QAC/B,GAAG,MAAM;QACT,IAAI,EAAE,KAAK;QACX,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * medusa-payment-viva
+ *
+ * Medusa v2 payment provider module for Viva Wallet under the ISV partner
+ * program. Wraps `viva-payments-core` and adapts it to Medusa's
+ * AbstractPaymentProvider interface.
+ *
+ * @see references/viva-docs/md/payment-isv-api.txt:1 (ISV API)
+ * @see references/viva-docs/md/isv-partner-program.txt:61 (ISV overview)
+ */
+export { VivaPaymentProvider } from './service.js';
+export type { VivaPaymentProviderOptions } from './service.js';
+export { loadConfigFromEnv } from './config.js';
+export type { VivaPluginConfig } from './config.js';
+export { DefaultTenantResolver, assertSingleTenantCart } from './resolvers/tenant-resolver.js';
+export type { TenantResolver, CartLike } from './resolvers/tenant-resolver.js';
+export { buildAuthStrategies } from './resolvers/auth-strategy-factory.js';
+export type { AuthStrategySet } from './resolvers/auth-strategy-factory.js';
+export { default as providerExport } from './providers/payment-provider.js';
+export declare const VERSION = "0.0.0";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAE5E,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,29 @@
+"use strict";
+/**
+ * medusa-payment-viva
+ *
+ * Medusa v2 payment provider module for Viva Wallet under the ISV partner
+ * program. Wraps `viva-payments-core` and adapts it to Medusa's
+ * AbstractPaymentProvider interface.
+ *
+ * @see references/viva-docs/md/payment-isv-api.txt:1 (ISV API)
+ * @see references/viva-docs/md/isv-partner-program.txt:61 (ISV overview)
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = exports.providerExport = exports.buildAuthStrategies = exports.assertSingleTenantCart = exports.DefaultTenantResolver = exports.loadConfigFromEnv = exports.VivaPaymentProvider = void 0;
+var service_js_1 = require("./service.js");
+Object.defineProperty(exports, "VivaPaymentProvider", { enumerable: true, get: function () { return service_js_1.VivaPaymentProvider; } });
+var config_js_1 = require("./config.js");
+Object.defineProperty(exports, "loadConfigFromEnv", { enumerable: true, get: function () { return config_js_1.loadConfigFromEnv; } });
+var tenant_resolver_js_1 = require("./resolvers/tenant-resolver.js");
+Object.defineProperty(exports, "DefaultTenantResolver", { enumerable: true, get: function () { return tenant_resolver_js_1.DefaultTenantResolver; } });
+Object.defineProperty(exports, "assertSingleTenantCart", { enumerable: true, get: function () { return tenant_resolver_js_1.assertSingleTenantCart; } });
+var auth_strategy_factory_js_1 = require("./resolvers/auth-strategy-factory.js");
+Object.defineProperty(exports, "buildAuthStrategies", { enumerable: true, get: function () { return auth_strategy_factory_js_1.buildAuthStrategies; } });
+var payment_provider_js_1 = require("./providers/payment-provider.js");
+Object.defineProperty(exports, "providerExport", { enumerable: true, get: function () { return __importDefault(payment_provider_js_1).default; } });
+exports.VERSION = '0.0.0';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;AAEH,2CAAmD;AAA1C,iHAAA,mBAAmB,OAAA;AAG5B,yCAAgD;AAAvC,8GAAA,iBAAiB,OAAA;AAG1B,qEAA+F;AAAtF,2HAAA,qBAAqB,OAAA;AAAE,4HAAA,sBAAsB,OAAA;AAGtD,iFAA2E;AAAlE,+HAAA,mBAAmB,OAAA;AAG5B,uEAA4E;AAAnE,sIAAA,OAAO,OAAkB;AAErB,QAAA,OAAO,GAAG,OAAO,CAAC"}

package/dist/loaders/viva-oauth2-strategy.d.ts

@@ -0,0 +1,26 @@
+/**
+ * loaders/viva-oauth2-strategy.ts — registers the OAuth2 strategy singleton.
+ *
+ * Medusa v2 plugin loaders receive the global container and can register
+ * additional dependencies. This loader builds the primary
+ * OAuth2ClientCredentialsStrategy once from env config and registers it under
+ * the key `vivaOAuth2Strategy` so that route handlers (e.g. auth-status) can
+ * resolve the same stateful instance that the payment provider uses.
+ *
+ * Registration key: `vivaOAuth2Strategy`
+ *
+ * @see references/viva-docs/md/isv-partner-program.txt:61 (P16 health endpoints)
+ */
+import type { MedusaContainer } from '@medusajs/framework/types';
+export declare const VIVA_OAUTH2_STRATEGY_KEY = "vivaOAuth2Strategy";
+/**
+ * Medusa v2 plugin loader.
+ * Called once at startup with the global container.
+ * Registers the OAuth2 strategy singleton under `vivaOAuth2Strategy`.
+ *
+ * If config env vars are missing (e.g. in test environments that don't set
+ * them), the registration is skipped silently — route handlers must handle
+ * the absent-key case.
+ */
+export default function vivaOAuth2StrategyLoader(container: MedusaContainer): void;
+//# sourceMappingURL=viva-oauth2-strategy.d.ts.map

package/dist/loaders/viva-oauth2-strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viva-oauth2-strategy.d.ts","sourceRoot":"","sources":["../../src/loaders/viva-oauth2-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAIjE,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAC9C,SAAS,EAAE,eAAe,GACzB,IAAI,CA4BN"}

package/dist/loaders/viva-oauth2-strategy.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * loaders/viva-oauth2-strategy.ts — registers the OAuth2 strategy singleton.
+ *
+ * Medusa v2 plugin loaders receive the global container and can register
+ * additional dependencies. This loader builds the primary
+ * OAuth2ClientCredentialsStrategy once from env config and registers it under
+ * the key `vivaOAuth2Strategy` so that route handlers (e.g. auth-status) can
+ * resolve the same stateful instance that the payment provider uses.
+ *
+ * Registration key: `vivaOAuth2Strategy`
+ *
+ * @see references/viva-docs/md/isv-partner-program.txt:61 (P16 health endpoints)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VIVA_OAUTH2_STRATEGY_KEY = void 0;
+exports.default = vivaOAuth2StrategyLoader;
+const auth_1 = require("@sakeetech/viva-payments-core/auth");
+const config_js_1 = require("../config.js");
+exports.VIVA_OAUTH2_STRATEGY_KEY = 'vivaOAuth2Strategy';
+/**
+ * Medusa v2 plugin loader.
+ * Called once at startup with the global container.
+ * Registers the OAuth2 strategy singleton under `vivaOAuth2Strategy`.
+ *
+ * If config env vars are missing (e.g. in test environments that don't set
+ * them), the registration is skipped silently — route handlers must handle
+ * the absent-key case.
+ */
+function vivaOAuth2StrategyLoader(container) {
+    try {
+        const config = (0, config_js_1.loadConfigFromEnv)(process.env);
+        const cache = new auth_1.InMemoryTokenCache();
+        const mutex = new auth_1.AsyncMutex();
+        const strategy = new auth_1.OAuth2ClientCredentialsStrategy({
+            environment: config.environment,
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            cache,
+            mutex,
+            ...(config.redis !== undefined ? { redisLock: config.redis } : {}),
+        });
+        // Register the singleton using the Awilix NameAndRegistrationPair form.
+        // `asValue` shape: { resolve: () => T, lifetime: 'SINGLETON' }.
+        // Cast through unknown to satisfy the strict MedusaContainer overload.
+        container.register({
+            [exports.VIVA_OAUTH2_STRATEGY_KEY]: {
+                resolve: () => strategy,
+                lifetime: 'SINGLETON',
+            },
+        });
+    }
+    catch {
+        // Config not available (e.g. in test or CI without env vars).
+        // The route falls back gracefully.
+    }
+}
+//# sourceMappingURL=viva-oauth2-strategy.js.map

package/dist/loaders/viva-oauth2-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viva-oauth2-strategy.js","sourceRoot":"","sources":["../../src/loaders/viva-oauth2-strategy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAiBH,2CA8BC;AA5CD,6DAAqH;AACrH,4CAAiD;AAEpC,QAAA,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;;;;;GAQG;AACH,SAAwB,wBAAwB,CAC9C,SAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,6BAAiB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,yBAAkB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,iBAAU,EAAE,CAAC;QAE/B,MAAM,QAAQ,GAAG,IAAI,sCAA+B,CAAC;YACnD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK;YACL,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QAEH,wEAAwE;QACxE,gEAAgE;QAChE,uEAAuE;QACtE,SAAS,CAAC,QAAoD,CAAC;YAC9D,CAAC,gCAAwB,CAAC,EAAE;gBAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ;gBACvB,QAAQ,EAAE,WAAW;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,mCAAmC;IACrC,CAAC;AACH,CAAC"}

package/dist/migrations/Migration_20260425000001_init_viva_payments.d.ts

@@ -0,0 +1,19 @@
+import { Migration } from "@medusajs/framework/mikro-orm/migrations";
+/**
+ * S7 — initial migration: creates all three plugin-owned tables atomically.
+ *
+ * up()   — CREATE TABLE IF NOT EXISTS + indexes (idempotent).
+ * down() — Attempts COPY of viva_webhook_event raw_payload to /tmp before drop
+ *          for forensic preservation per plan line 205.
+ *          NOTE: COPY TO file requires the postgres superuser role. If the
+ *          migration runner connects as a non-superuser, this COPY will fail.
+ *          In that case, wrap the COPY in a DO block that catches the error and
+ *          logs a notice — data preservation is best-effort in non-superuser
+ *          deployments. Operators should take a pg_dump backup before running
+ *          down() in production.
+ */
+export declare class Migration_20260425000001_init_viva_payments extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=Migration_20260425000001_init_viva_payments.d.ts.map

package/dist/migrations/Migration_20260425000001_init_viva_payments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Migration_20260425000001_init_viva_payments.d.ts","sourceRoot":"","sources":["../../src/migrations/Migration_20260425000001_init_viva_payments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,0CAA0C,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,qBAAa,2CAA4C,SAAQ,SAAS;IACzD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IA6GnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAsBrC"}