@thepayulink/server 2.2.0 → 2.2.2

package/README.md

@@ -75,6 +75,12 @@ toRupees(19950);  // 199.5
 
 ### Payouts
 
+Payouts, `balance.fetch()` and `transactions.list()` need a **live key with Payouts access**
+and an **IP allowlist** (merchant panel → API Key → *Edit access*). Otherwise the API
+answers `403 KEY_NOT_PERMITTED`, `403 IP_NOT_ALLOWED`, or `400 TEST_MODE_UNSUPPORTED` for a
+test key. Keep that key only on the server that sends payouts; use a separate Checkout key
+for orders.
+
 ```js
 const payout = await pl.payouts.create({
   amount: rupees(2500),                      // PAISE; UPI payouts must be whole rupees

package/dist/index.d.ts

@@ -172,6 +172,7 @@ export default class PayuLink {
     list(params?: ListParams & { status?: string; receipt?: string; utr?: string }): Promise<Collection<Order>>;
   };
 
+  /** Needs a live key with Payouts access, called from an IP on the key's allowlist. */
   payouts: {
     create(params: CreatePayoutParams): Promise<Payout>;
     fetch(payoutId: string): Promise<Payout>;
@@ -180,10 +181,12 @@ export default class PayuLink {
     cancel(payoutId: string, params?: { reason?: string }): Promise<Payout>;
   };
 
+  /** Needs a live key with Payouts access, called from an IP on the key's allowlist. */
   balance: {
     fetch(): Promise<Balance>;
   };
 
+  /** Needs a live key with Payouts access, called from an IP on the key's allowlist. */
   transactions: {
     /** type: comma-separated names, e.g. "payout_lock,payout_debit" */
     list(params?: ListParams & { type?: string }): Promise<Collection<Transaction>>;

package/dist/payulink-server.cjs

@@ -37,7 +37,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 var import_node_crypto = __toESM(require("node:crypto"), 1);
 var rupees = (r) => Math.round(Number(r) * 100);
-var toRupees = (paise) => Number(paise) / 100;
+var toRupees = (paise2) => Number(paise2) / 100;
 var PayuLinkError = class extends Error {
   constructor(message, { status, code, body } = {}) {
     super(message);
@@ -62,6 +62,15 @@ function safeEqual(a, b) {
   const bb = Buffer.from(String(b ?? ""));
   return ba.length === bb.length && ba.length > 0 && import_node_crypto.default.timingSafeEqual(ba, bb);
 }
+function paise(value) {
+  const n = Number(value);
+  const whole = Math.round(n);
+  if (!Number.isFinite(n) || Math.abs(n - whole) > 1e-6) {
+    throw new PayuLinkError("`amount` must be a whole number of PAISE (19950 = \u20B9199.50). Tip: use the `rupees()` helper \u2014 rupees(199.5) === 19950.");
+  }
+  if (whole < 100) throw new PayuLinkError("`amount` must be at least 100 paise (\u20B91).");
+  return whole;
+}
 var PayuLink = class {
   /**
    * @param {object} opts
@@ -161,10 +170,7 @@ var PayuLink = class {
    * backward compatibility but only affects legacy version-1 callbacks, not signed webhooks.)
    */
   _createOrder(p = {}) {
-    const amount = Math.round(Number(p.amount));
-    if (!Number.isFinite(amount) || amount < 100) {
-      throw new PayuLinkError("`amount` is required, in PAISE, and must be >= 100 (\u20B91). Tip: use the `rupees()` helper \u2014 rupees(199.5) === 19950.");
-    }
+    const amount = paise(p.amount);
     return this._request("POST", "/v1/orders", {
       body: {
         amount,
@@ -188,10 +194,7 @@ var PayuLink = class {
    * @param {string} [p.narration]
    */
   _createPayout(p = {}) {
-    const amount = Math.round(Number(p.amount));
-    if (!Number.isFinite(amount) || amount < 100) {
-      throw new PayuLinkError("`amount` is required, in PAISE, and must be >= 100 (\u20B91).");
-    }
+    const amount = paise(p.amount);
     if (p.mode !== "bank" && p.mode !== "upi") throw new PayuLinkError('`mode` must be "bank" or "upi".');
     if (!p.beneficiary) throw new PayuLinkError("`beneficiary` is required.");
     return this._request("POST", "/v1/payouts", {
@@ -289,4 +292,4 @@ var PayuLink = class {
   rupees,
   toRupees
 });
-(()=>{const ns=module.exports,C=ns.default;if(C){C.PayulinkError=ns.PayulinkError;C.Payulink=C;C.default=C;module.exports=C;}})();
+(()=>{const ns=module.exports,C=ns.default;if(C){for(const k of Object.keys(ns))if(k!=="default")C[k]=ns[k];C.PayuLink=C;C.Payulink=C;C.PayulinkError=ns.PayuLinkError;C.default=C;module.exports=C;}})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thepayulink/server",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "PayuLink server SDK — create orders and verify payments/webhooks with your key_secret.",
   "type": "module",
   "main": "./dist/payulink-server.cjs",

package/src/index.js

@@ -47,6 +47,22 @@ function safeEqual(a, b) {
   return ba.length === bb.length && ba.length > 0 && crypto.timingSafeEqual(ba, bb);
 }
 
+/**
+ * A whole number of paise, >= 100. Floating-point noise (19.99 * 100 === 1998.9999999999998)
+ * is rounded away; a real fraction (199.5) is refused rather than silently rounded, since it
+ * usually means rupees were passed where paise were expected. The API refuses it too.
+ */
+function paise(value) {
+  const n = Number(value);
+  const whole = Math.round(n);
+  if (!Number.isFinite(n) || Math.abs(n - whole) > 1e-6) {
+    throw new PayuLinkError('`amount` must be a whole number of PAISE (19950 = ₹199.50). '
+      + 'Tip: use the `rupees()` helper — rupees(199.5) === 19950.');
+  }
+  if (whole < 100) throw new PayuLinkError('`amount` must be at least 100 paise (₹1).');
+  return whole;
+}
+
 export default class PayuLink {
   /**
    * @param {object} opts
@@ -147,11 +163,7 @@ export default class PayuLink {
    * backward compatibility but only affects legacy version-1 callbacks, not signed webhooks.)
    */
   _createOrder(p = {}) {
-    const amount = Math.round(Number(p.amount));
-    if (!Number.isFinite(amount) || amount < 100) {
-      throw new PayuLinkError('`amount` is required, in PAISE, and must be >= 100 (₹1). '
-        + 'Tip: use the `rupees()` helper — rupees(199.5) === 19950.');
-    }
+    const amount = paise(p.amount);
     return this._request('POST', '/v1/orders', {
       body: {
         amount,
@@ -176,10 +188,7 @@ export default class PayuLink {
    * @param {string} [p.narration]
    */
   _createPayout(p = {}) {
-    const amount = Math.round(Number(p.amount));
-    if (!Number.isFinite(amount) || amount < 100) {
-      throw new PayuLinkError('`amount` is required, in PAISE, and must be >= 100 (₹1).');
-    }
+    const amount = paise(p.amount);
     if (p.mode !== 'bank' && p.mode !== 'upi') throw new PayuLinkError('`mode` must be "bank" or "upi".');
     if (!p.beneficiary) throw new PayuLinkError('`beneficiary` is required.');
     return this._request('POST', '/v1/payouts', {