feat: ( payment ) create payment microservice

packages/payment-providers/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@edr/payment-providers",
+  "version": "0.0.0",
+  "private": true,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -w -p tsconfig.json",
+    "type-check": "tsc --noEmit",
+    "lint": "eslint src"
+  },
+  "peerDependencies": {
+    "@nestjs/axios": "^4.0.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/config": "^4.0.0",
+    "axios": "^1.7.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0"
+  },
+  "dependencies": {
+    "@edr/types": "workspace:*"
+  },
+  "devDependencies": {
+    "@edr/eslint-config": "workspace:*",
+    "@edr/tsconfig": "workspace:*",
+    "@nestjs/axios": "^4.0.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/config": "^4.0.0",
+    "@types/node": "^20.14.0",
+    "axios": "^1.7.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "typescript": "^5.5.4"
+  }
+}

packages/payment-providers/src/index.ts

@@ -0,0 +1,50 @@
+// Re-export the shared, ORM-agnostic payment contract from @edr/types so consumers can
+// import enums, interfaces, and providers from a single entry point.
+export {
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+export type {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ClientAction,
+  PaymentPlatform,
+} from '@edr/types';
+
+// Providers
+export { TelebirrProvider } from './providers/telebirr/telebirr.provider';
+export { CbeBirrProvider } from './providers/cbe-birr/cbe-birr.provider';
+export { EBirrProvider } from './providers/ebirr/ebirr.provider';
+export { CardProvider } from './providers/card/card.provider';
+export { WaafiProvider } from './providers/waafi/waafi.provider';
+
+// Telebirr crypto + types (exported for apps that build/verify signatures directly)
+export {
+  buildCanonicalString,
+  signRequestObject,
+  verifyRequestObject,
+  signString,
+  verifySignature,
+  createTimestamp,
+  createNonceStr,
+  createMerchantOrderId,
+} from './providers/telebirr/telebirr.crypto';
+export type {
+  FabricTokenResponse,
+  CreateOrderRequest,
+  CreateOrderResponse,
+  QueryOrderResponse,
+  TelebirrTradeStatus,
+} from './providers/telebirr/telebirr.types';
+
+// Webhook payload types
+export type { TelebirrWebhookPayload } from './webhooks/telebirr-webhook.types';
+export type { CbeBirrWebhookPayload } from './webhooks/cbe-birr-webhook.types';
+export type { EBirrWebhookPayload } from './webhooks/ebirr-webhook.types';
+export type { CardWebhookPayload } from './webhooks/card-webhook.types';
+export type { WaafiWebhookPayload } from './webhooks/waafi-webhook.types';
+
+// DI token for injecting all providers as an array (future multi-provider wiring)
+export const PAYMENT_PROVIDERS = Symbol('PAYMENT_PROVIDERS');

packages/payment-providers/src/providers/card/card.provider.ts

@@ -0,0 +1,219 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+
+interface CardInitiateRequest {
+  amount: number;
+  currency: string;
+  description: string;
+  metadata: {
+    merchantOrderId: string;
+    orderRef: string;
+  };
+  return_url: string;
+  webhook_url: string;
+}
+
+interface CardInitiateResponse {
+  id: string;
+  status: string;
+  client_secret: string;
+  checkout_url: string;
+  expires_at: number;
+}
+
+interface CardQueryResponse {
+  id: string;
+  status: string;
+  amount: number;
+  currency: string;
+  transaction_id?: string;
+  paid_at?: number;
+  failure_code?: string;
+  failure_message?: string;
+}
+
+@Injectable()
+export class CardProvider implements PaymentProvider {
+  readonly method = ProviderMethod.CARD;
+  private readonly logger = new Logger(CardProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = input.amountMinor / 100;
+
+    const requestBody: CardInitiateRequest = {
+      amount,
+      currency: input.currency,
+      description: `EDR ${input.orderRef}`,
+      metadata: {
+        merchantOrderId: input.merchantOrderId,
+        orderRef: input.orderRef,
+      },
+      return_url: this.returnUrl,
+      webhook_url: this.webhookUrl,
+    };
+
+    const response = await this.postJson<CardInitiateResponse>(
+      `${this.baseUrl}/v1/payment_intents`,
+      requestBody,
+    );
+
+    if (!response.id) {
+      throw new Error(`Card gateway initiate failed: ${JSON.stringify(response)}`);
+    }
+
+    const expiresAt = new Date(response.expires_at * 1000);
+
+    return {
+      providerOrderId: response.id,
+      clientAction: { type: 'REDIRECT', url: response.checkout_url },
+      expiresAt,
+      rawInitiation: {
+        request: requestBody,
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    // For card payments, we need to find the payment intent by metadata
+    // In a real implementation, we'd store the provider order ID and use it directly
+    const response = await this.getJson<CardQueryResponse>(
+      `${this.baseUrl}/v1/payment_intents/search?metadata[merchantOrderId]=${merchantOrderId}`,
+    );
+
+    const mapped = this.mapStatus(response.status);
+
+    return {
+      status: mapped,
+      providerTxnId: response.transaction_id,
+      failureCode: response.failure_code,
+      failureMessage: response.failure_message,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>, signature: string): boolean {
+    const payloadString = JSON.stringify(payload);
+    const expectedSignature = crypto
+      .createHmac('sha256', this.webhookSecret)
+      .update(payloadString)
+      .digest('hex');
+
+    try {
+      return crypto.timingSafeEqual(
+        Buffer.from(signature),
+        Buffer.from(expectedSignature),
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  mapWebhookStatus(status: string): ProviderPaymentStatus {
+    return this.mapStatus(status);
+  }
+
+  private mapStatus(status: string): ProviderPaymentStatus {
+    switch (status?.toLowerCase()) {
+      case 'succeeded':
+      case 'paid':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'failed':
+      case 'canceled':
+      case 'expired':
+        return ProviderPaymentStatus.FAILED;
+      case 'requires_payment_method':
+      case 'requires_confirmation':
+      case 'requires_action':
+        return ProviderPaymentStatus.REQUIRES_ACTION;
+      case 'processing':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${this.apiKey}`,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`Card Gateway POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Card Gateway POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`Card Gateway POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private async getJson<T>(url: string): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.get<T>(url, config));
+      this.logger.debug(`Card Gateway GET ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Card Gateway GET ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`Card Gateway GET ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('card.baseUrl') ?? '';
+  }
+  private get apiKey(): string {
+    return this.config.get<string>('card.apiKey') ?? '';
+  }
+  private get webhookSecret(): string {
+    return this.config.get<string>('card.webhookSecret') ?? '';
+  }
+  private get webhookUrl(): string {
+    return this.config.get<string>('card.webhookUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('card.returnUrl') ?? '';
+  }
+}

packages/payment-providers/src/providers/cbe-birr/cbe-birr.provider.ts

@@ -0,0 +1,216 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+
+interface CbeBirrInitiateRequest {
+  merchantId: string;
+  merchantOrderId: string;
+  amount: string;
+  currency: string;
+  description: string;
+  returnUrl: string;
+  notifyUrl: string;
+  timestamp: string;
+  signature: string;
+}
+
+interface CbeBirrInitiateResponse {
+  success: boolean;
+  orderId: string;
+  paymentUrl: string;
+  expiresIn: number;
+}
+
+interface CbeBirrQueryResponse {
+  success: boolean;
+  orderId: string;
+  status: string;
+  transactionId?: string;
+  amount?: string;
+  paidAt?: string;
+}
+
+@Injectable()
+export class CbeBirrProvider implements PaymentProvider {
+  readonly method = ProviderMethod.CBE_BIRR;
+  private readonly logger = new Logger(CbeBirrProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = (input.amountMinor / 100).toFixed(2);
+    const timestamp = new Date().toISOString();
+
+    const requestBody: CbeBirrInitiateRequest = {
+      merchantId: this.merchantId,
+      merchantOrderId: input.merchantOrderId,
+      amount,
+      currency: input.currency,
+      description: `EDR ${input.orderRef}`,
+      returnUrl: this.returnUrl,
+      notifyUrl: this.notifyUrl,
+      timestamp,
+      signature: this.signRequest({
+        merchantId: this.merchantId,
+        merchantOrderId: input.merchantOrderId,
+        amount,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<CbeBirrInitiateResponse>(
+      `${this.baseUrl}/api/v1/payment/initiate`,
+      requestBody,
+    );
+
+    if (!response.success || !response.orderId) {
+      throw new Error(`CBE Birr initiate failed: ${JSON.stringify(response)}`);
+    }
+
+    const expiresAt = new Date(Date.now() + response.expiresIn * 1000);
+
+    return {
+      providerOrderId: response.orderId,
+      clientAction: { type: 'REDIRECT', url: response.paymentUrl },
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const timestamp = new Date().toISOString();
+    const signature = this.signRequest({
+      merchantId: this.merchantId,
+      merchantOrderId,
+      timestamp,
+    });
+
+    const response = await this.postJson<CbeBirrQueryResponse>(
+      `${this.baseUrl}/api/v1/payment/query`,
+      {
+        merchantId: this.merchantId,
+        merchantOrderId,
+        timestamp,
+        signature,
+      },
+    );
+
+    const mapped = this.mapStatus(response.status);
+
+    return {
+      status: mapped,
+      providerTxnId: response.transactionId,
+      failureCode: mapped === ProviderPaymentStatus.FAILED ? response.status : undefined,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    const { signature, ...data } = payload;
+    if (!signature || typeof signature !== 'string') return false;
+
+    const expectedSignature = this.signRequest(data);
+    return crypto.timingSafeEqual(
+      Buffer.from(signature),
+      Buffer.from(expectedSignature),
+    );
+  }
+
+  mapWebhookStatus(status: string): ProviderPaymentStatus {
+    return this.mapStatus(status);
+  }
+
+  private mapStatus(status: string): ProviderPaymentStatus {
+    switch (status?.toUpperCase()) {
+      case 'SUCCESS':
+      case 'COMPLETED':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'FAILED':
+      case 'REJECTED':
+      case 'EXPIRED':
+        return ProviderPaymentStatus.FAILED;
+      case 'PENDING':
+        return ProviderPaymentStatus.REQUIRES_ACTION;
+      case 'PROCESSING':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  private signRequest(data: Record<string, unknown>): string {
+    const sortedKeys = Object.keys(data).sort();
+    const signString = sortedKeys
+      .map((key) => `${key}=${data[key]}`)
+      .join('&');
+
+    return crypto
+      .createHmac('sha256', this.secretKey)
+      .update(signString)
+      .digest('hex');
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+        'X-Merchant-Id': this.merchantId,
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`CBE Birr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `CBE Birr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`CBE Birr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: CbeBirrInitiateRequest): Record<string, unknown> {
+    const { signature: _signature, ...rest } = body;
+    return rest;
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('cbe.baseUrl') ?? '';
+  }
+  private get merchantId(): string {
+    return this.config.get<string>('cbe.merchantId') ?? '';
+  }
+  private get secretKey(): string {
+    return this.config.get<string>('cbe.secretKey') ?? '';
+  }
+  private get notifyUrl(): string {
+    return this.config.get<string>('cbe.notifyUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('cbe.returnUrl') ?? '';
+  }
+}

packages/payment-providers/src/providers/ebirr/ebirr.provider.ts

@@ -0,0 +1,229 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as crypto from 'node:crypto';
+
+interface EBirrInitiateRequest {
+  merchantCode: string;
+  orderNo: string;
+  amount: number;
+  currency: string;
+  subject: string;
+  body: string;
+  notifyUrl: string;
+  returnUrl: string;
+  timestamp: number;
+  sign: string;
+}
+
+interface EBirrInitiateResponse {
+  code: string;
+  message: string;
+  data?: {
+    orderNo: string;
+    payUrl: string;
+    expireTime: number;
+  };
+}
+
+interface EBirrQueryResponse {
+  code: string;
+  message: string;
+  data?: {
+    orderNo: string;
+    tradeStatus: string;
+    tradeNo?: string;
+    totalAmount?: number;
+    payTime?: number;
+  };
+}
+
+@Injectable()
+export class EBirrProvider implements PaymentProvider {
+  readonly method = ProviderMethod.EBIRR;
+  private readonly logger = new Logger(EBirrProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const amount = input.amountMinor / 100;
+    const timestamp = Date.now();
+
+    const requestBody: EBirrInitiateRequest = {
+      merchantCode: this.merchantCode,
+      orderNo: input.merchantOrderId,
+      amount,
+      currency: input.currency,
+      subject: `EDR Ticket`,
+      body: `Order ${input.orderRef}`,
+      notifyUrl: this.notifyUrl,
+      returnUrl: this.returnUrl,
+      timestamp,
+      sign: this.signRequest({
+        merchantCode: this.merchantCode,
+        orderNo: input.merchantOrderId,
+        amount,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<EBirrInitiateResponse>(
+      `${this.baseUrl}/gateway/api/pay/create`,
+      requestBody,
+    );
+
+    if (response.code !== '0000' || !response.data?.orderNo) {
+      throw new Error(`eBirr initiate failed: ${response.message}`);
+    }
+
+    const expiresAt = new Date(response.data.expireTime);
+
+    return {
+      providerOrderId: response.data.orderNo,
+      clientAction: { type: 'REDIRECT', url: response.data.payUrl },
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const timestamp = Date.now();
+    const requestBody = {
+      merchantCode: this.merchantCode,
+      orderNo: merchantOrderId,
+      timestamp,
+      sign: this.signRequest({
+        merchantCode: this.merchantCode,
+        orderNo: merchantOrderId,
+        timestamp,
+      }),
+    };
+
+    const response = await this.postJson<EBirrQueryResponse>(
+      `${this.baseUrl}/gateway/api/pay/query`,
+      requestBody,
+    );
+
+    if (response.code !== '0000' || !response.data) {
+      throw new Error(`eBirr query failed: ${response.message}`);
+    }
+
+    const mapped = this.mapStatus(response.data.tradeStatus);
+
+    return {
+      status: mapped,
+      providerTxnId: response.data.tradeNo,
+      failureCode: mapped === ProviderPaymentStatus.FAILED ? response.data.tradeStatus : undefined,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    const { sign, ...data } = payload;
+    if (!sign || typeof sign !== 'string') return false;
+
+    const expectedSign = this.signRequest(data);
+    return crypto.timingSafeEqual(
+      Buffer.from(sign),
+      Buffer.from(expectedSign),
+    );
+  }
+
+  mapWebhookStatus(tradeStatus: string): ProviderPaymentStatus {
+    return this.mapStatus(tradeStatus);
+  }
+
+  private mapStatus(tradeStatus: string): ProviderPaymentStatus {
+    switch (tradeStatus?.toUpperCase()) {
+      case 'TRADE_SUCCESS':
+      case 'SUCCESS':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'TRADE_CLOSED':
+      case 'TRADE_FAILED':
+      case 'FAILED':
+        return ProviderPaymentStatus.FAILED;
+      case 'WAIT_BUYER_PAY':
+      case 'PENDING':
+        return ProviderPaymentStatus.REQUIRES_ACTION;
+      case 'PROCESSING':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  private signRequest(data: Record<string, unknown>): string {
+    const sortedKeys = Object.keys(data).sort();
+    const signString = sortedKeys
+      .map((key) => `${key}=${data[key]}`)
+      .join('&') + `&key=${this.secretKey}`;
+
+    return crypto
+      .createHash('md5')
+      .update(signString)
+      .digest('hex')
+      .toUpperCase();
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      timeout: 10_000,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`eBirr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `eBirr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)}`,
+        );
+      } else {
+        this.logger.error(`eBirr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: EBirrInitiateRequest): Record<string, unknown> {
+    const { sign: _sign, ...rest } = body;
+    return rest;
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('ebirr.baseUrl') ?? '';
+  }
+  private get merchantCode(): string {
+    return this.config.get<string>('ebirr.merchantCode') ?? '';
+  }
+  private get secretKey(): string {
+    return this.config.get<string>('ebirr.secretKey') ?? '';
+  }
+  private get notifyUrl(): string {
+    return this.config.get<string>('ebirr.notifyUrl') ?? '';
+  }
+  private get returnUrl(): string {
+    return this.config.get<string>('ebirr.returnUrl') ?? '';
+  }
+}

packages/payment-providers/src/providers/telebirr/telebirr.crypto.ts

@@ -0,0 +1,98 @@
+import * as crypto from 'crypto';
+
+const EXCLUDE_FIELDS = new Set([
+  'sign',
+  'sign_type',
+  'header',
+  'refund_info',
+  'openType',
+  'raw_request',
+  'biz_content',
+]);
+
+const NONCE_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+
+export function buildCanonicalString(requestObject: Record<string, unknown>): string {
+  const fieldMap: Record<string, unknown> = {};
+
+  for (const key of Object.keys(requestObject)) {
+    if (EXCLUDE_FIELDS.has(key)) continue;
+    fieldMap[key] = requestObject[key];
+  }
+
+  const biz = requestObject['biz_content'];
+  if (biz && typeof biz === 'object') {
+    for (const key of Object.keys(biz as Record<string, unknown>)) {
+      if (EXCLUDE_FIELDS.has(key)) continue;
+      fieldMap[key] = (biz as Record<string, unknown>)[key];
+    }
+  }
+
+  return Object.keys(fieldMap)
+    .sort()
+    .map((k) => `${k}=${fieldMap[k]}`)
+    .join('&');
+}
+
+export function signRequestObject(
+  requestObject: Record<string, unknown>,
+  privateKey: string,
+): string {
+  return signString(buildCanonicalString(requestObject), privateKey);
+}
+
+export function verifyRequestObject(
+  requestObject: Record<string, unknown>,
+  publicKey: string,
+): boolean {
+  const signature = requestObject['sign'];
+  if (typeof signature !== 'string' || signature.length === 0) return false;
+  return verifySignature(buildCanonicalString(requestObject), signature, publicKey);
+}
+
+export function signString(text: string, privateKey: string): string {
+  const signature = crypto.sign('sha256', Buffer.from(text), {
+    key: privateKey,
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+    saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
+  });
+  return signature.toString('base64');
+}
+
+export function verifySignature(
+  text: string,
+  signatureBase64: string,
+  publicKey: string,
+): boolean {
+  try {
+    return crypto.verify(
+      'sha256',
+      Buffer.from(text),
+      {
+        key: publicKey,
+        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
+      },
+      Buffer.from(signatureBase64, 'base64'),
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function createTimestamp(): string {
+  return Math.round(Date.now() / 1000).toString();
+}
+
+export function createNonceStr(length = 32): string {
+  const bytes = crypto.randomBytes(length);
+  let out = '';
+  for (let i = 0; i < length; i++) {
+    out += NONCE_CHARS[bytes[i] % NONCE_CHARS.length];
+  }
+  return out;
+}
+
+export function createMerchantOrderId(): string {
+  return `${Date.now()}${crypto.randomBytes(4).toString('hex')}`;
+}

packages/payment-providers/src/providers/telebirr/telebirr.provider.ts

@@ -0,0 +1,301 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+import * as https from 'node:https';
+import {
+  createNonceStr,
+  createTimestamp,
+  signRequestObject,
+  verifyRequestObject,
+} from './telebirr.crypto';
+import {
+  CreateOrderRequest,
+  CreateOrderResponse,
+  FabricTokenResponse,
+  QueryOrderResponse,
+} from './telebirr.types';
+
+const TELEBIRR_HTTP_TIMEOUT_MS = 10_000;
+
+@Injectable()
+export class TelebirrProvider implements PaymentProvider {
+  readonly method = ProviderMethod.TELEBIRR;
+  private readonly logger = new Logger(TelebirrProvider.name);
+  private readonly httpsAgent: https.Agent;
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {
+    const insecure = this.config.get<boolean>('telebirr.insecureTls');
+    if (insecure) {
+      this.logger.warn('TELEBIRR_INSECURE_TLS=true — TLS verification disabled for Telebirr calls. DEV ONLY.');
+    }
+    this.httpsAgent = new https.Agent({
+      rejectUnauthorized: !insecure,
+      secureProtocol: 'TLSv1_2_method',
+    });
+  }
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const fabricToken = await this.applyFabricToken();
+    const requestBody = this.buildCreateOrderRequest(input);
+    const response = await this.requestCreateOrder(fabricToken, requestBody);
+
+    const prepayId = response.biz_content?.prepay_id;
+    if (!prepayId) {
+      throw new Error(
+        `Telebirr createOrder returned no prepay_id: ${JSON.stringify(response)}`,
+      );
+    }
+
+    const expiresAt = this.computeExpiresAt(requestBody.biz_content.timeout_express);
+    const platform = input.platform ?? 'web';
+    const clientAction =
+      platform === 'mobile'
+        ? {
+            type: 'LAUNCH_APP' as const,
+            appId: this.merchantAppId,
+            receiveCode: response.biz_content?.receiveCode,
+            shortCode: this.merchantCode,
+          }
+        : { type: 'REDIRECT' as const, url: this.buildCheckoutUrl(prepayId) };
+
+    return {
+      providerOrderId: prepayId,
+      clientAction,
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const fabricToken = await this.applyFabricToken();
+    const requestBody = this.buildQueryOrderRequest(merchantOrderId);
+    const response = await this.postJson<QueryOrderResponse>(
+      `${this.baseUrl}/payment/v1/merchant/queryOrder`,
+      requestBody,
+      {
+        'Content-Type': 'application/json',
+        'X-APP-Key': this.fabricAppId,
+        Authorization: fabricToken,
+      },
+    );
+
+    const tradeStatus = response.biz_content?.trade_status;
+    const providerTxnId =
+      response.biz_content?.trans_id ?? response.biz_content?.payment_order_id;
+    const mapped = this.mapTradeStatus(tradeStatus);
+
+    return {
+      status: mapped,
+      providerTxnId,
+      failureCode:
+        mapped === ProviderPaymentStatus.FAILED && tradeStatus ? tradeStatus : undefined,
+      rawResponse: response as Record<string, unknown>,
+    };
+  }
+
+  mapTradeStatus(tradeStatus: string | undefined): ProviderPaymentStatus {
+    switch (tradeStatus) {
+      case 'PAY_SUCCESS':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'PAY_FAILED':
+      case 'ORDER_CLOSED':
+        return ProviderPaymentStatus.FAILED;
+      case 'WAIT_PAY':
+        return ProviderPaymentStatus.REQUIRES_ACTION;
+      case 'PAYING':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  mapWebhookTradeStatus(tradeStatus: string | undefined): ProviderPaymentStatus {
+    switch (tradeStatus) {
+      case 'Completed':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'Failure':
+      case 'Expired':
+        return ProviderPaymentStatus.FAILED;
+      case 'Paying':
+      case 'Pending':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    if (!this.publicKey) {
+      this.logger.error('TELEBIRR_PUBLIC_KEY not configured; rejecting all webhooks');
+      return false;
+    }
+    return verifyRequestObject(payload, this.publicKey);
+  }
+
+  private async applyFabricToken(): Promise<string> {
+    const response = await this.postJson<FabricTokenResponse>(
+      `${this.baseUrl}/payment/v1/token`,
+      { appSecret: this.appSecret },
+      {
+        'Content-Type': 'application/json',
+        'X-APP-Key': this.fabricAppId,
+      },
+    );
+    if (!response?.token) {
+      throw new Error(`Telebirr token request failed: ${JSON.stringify(response)}`);
+    }
+    return response.token;
+  }
+
+  private async requestCreateOrder(
+    fabricToken: string,
+    body: CreateOrderRequest,
+  ): Promise<CreateOrderResponse> {
+    return this.postJson<CreateOrderResponse>(
+      `${this.baseUrl}/payment/v1/inapp/createOrder`,
+      body,
+      {
+        'Content-Type': 'application/json',
+        'X-APP-Key': this.fabricAppId,
+        Authorization: fabricToken,
+      },
+    );
+  }
+
+  private buildCreateOrderRequest(input: ProviderInitiationInput): CreateOrderRequest {
+    const totalAmount = String(input.amountMinor / 100);
+    const req = {
+      timestamp: createTimestamp(),
+      nonce_str: createNonceStr(),
+      method: 'payment.preorder' as const,
+      version: '1.0' as const,
+      biz_content: {
+        notify_url: this.notifyUrl,
+        appid: this.merchantAppId,
+        merch_code: this.merchantCode,
+        merch_order_id: input.merchantOrderId,
+        trade_type: 'Checkout' as const,
+        title: `EDR ${input.orderRef}`,
+        total_amount: totalAmount,
+        trans_currency: input.currency,
+        timeout_express: this.timeoutExpress,
+      },
+    };
+    const sign = signRequestObject(req as unknown as Record<string, unknown>, this.privateKey);
+    return { ...req, sign, sign_type: 'SHA256WithRSA' };
+  }
+
+  private buildQueryOrderRequest(merchantOrderId: string): Record<string, unknown> {
+    const req = {
+      timestamp: createTimestamp(),
+      nonce_str: createNonceStr(),
+      method: 'payment.queryorder',
+      version: '1.0',
+      biz_content: {
+        appid: this.merchantAppId,
+        merch_code: this.merchantCode,
+        merch_order_id: merchantOrderId,
+      },
+    };
+    const sign = signRequestObject(req as Record<string, unknown>, this.privateKey);
+    return { ...req, sign, sign_type: 'SHA256WithRSA' };
+  }
+
+  private buildCheckoutUrl(prepayId: string): string {
+    const map: Record<string, string> = {
+      appid: this.merchantAppId,
+      merch_code: this.merchantCode,
+      nonce_str: createNonceStr(),
+      prepay_id: prepayId,
+      timestamp: createTimestamp(),
+    };
+    const sign = signRequestObject(map, this.privateKey);
+    const rawRequest = [
+      `appid=${map.appid}`,
+      `merch_code=${map.merch_code}`,
+      `nonce_str=${map.nonce_str}`,
+      `prepay_id=${map.prepay_id}`,
+      `timestamp=${map.timestamp}`,
+      'sign_type=SHA256WithRSA',
+      `sign=${sign}`,
+      'version=1.0',
+      'trade_type=Checkout',
+    ].join('&');
+    return `${this.webBaseUrl}${rawRequest}`;
+  }
+
+  private computeExpiresAt(timeoutExpress: string): Date {
+    const match = /^(\d+)([smhd])$/.exec(timeoutExpress);
+    const minutes = match ? this.toMinutes(parseInt(match[1], 10), match[2]) : 15;
+    return new Date(Date.now() + minutes * 60_000);
+  }
+
+  private toMinutes(n: number, unit: string): number {
+    switch (unit) {
+      case 's': return Math.max(1, Math.round(n / 60));
+      case 'm': return n;
+      case 'h': return n * 60;
+      case 'd': return n * 60 * 24;
+      default: return 15;
+    }
+  }
+
+  private async postJson<T>(
+    url: string,
+    body: unknown,
+    headers: Record<string, string>,
+  ): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers,
+      timeout: TELEBIRR_HTTP_TIMEOUT_MS,
+      httpsAgent: this.httpsAgent,
+    };
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(`Telebirr POST ${url} status=${res.status} latency=${Date.now() - started}ms`);
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Telebirr POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)} code=${err.code} message=${err.message}`,
+        );
+      } else {
+        this.logger.error(`Telebirr POST ${url} threw: ${err instanceof Error ? err.message : err}`);
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: CreateOrderRequest): Record<string, unknown> {
+    const { sign: _sign, ...rest } = body;
+    return rest;
+  }
+
+  private get baseUrl(): string { return this.config.get<string>('telebirr.baseUrl') ?? ''; }
+  private get webBaseUrl(): string { return this.config.get<string>('telebirr.webBaseUrl') ?? ''; }
+  private get fabricAppId(): string { return this.config.get<string>('telebirr.fabricAppId') ?? ''; }
+  private get appSecret(): string { return this.config.get<string>('telebirr.appSecret') ?? ''; }
+  private get merchantAppId(): string { return this.config.get<string>('telebirr.merchantAppId') ?? ''; }
+  private get merchantCode(): string { return this.config.get<string>('telebirr.merchantCode') ?? ''; }
+  private get notifyUrl(): string { return this.config.get<string>('telebirr.notifyUrl') ?? ''; }
+  private get timeoutExpress(): string { return this.config.get<string>('telebirr.timeoutExpress') ?? '15m'; }
+  private get privateKey(): string { return this.config.get<string>('telebirr.privateKey') ?? ''; }
+  private get publicKey(): string { return this.config.get<string>('telebirr.publicKey') ?? ''; }
+}

packages/payment-providers/src/providers/telebirr/telebirr.types.ts

@@ -0,0 +1,69 @@
+export interface FabricTokenResponse {
+  token: string;
+  expires_in?: number | string;
+}
+
+export interface CreateOrderBizContent {
+  notify_url: string;
+  appid: string;
+  merch_code: string;
+  merch_order_id: string;
+  trade_type: 'Checkout' | 'InApp' | 'MiniApp';
+  title: string;
+  total_amount: string;
+  trans_currency: string;
+  timeout_express: string;
+}
+
+export interface CreateOrderRequest {
+  timestamp: string;
+  nonce_str: string;
+  method: 'payment.preorder';
+  version: '1.0';
+  biz_content: CreateOrderBizContent;
+  sign: string;
+  sign_type: 'SHA256WithRSA';
+}
+
+export interface CreateOrderResponse {
+  code?: string;
+  msg?: string;
+  biz_content?: {
+    prepay_id?: string;
+    receiveCode?: string;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}
+
+export type TelebirrTradeStatus =
+  | 'PAY_SUCCESS'
+  | 'PAY_FAILED'
+  | 'WAIT_PAY'
+  | 'ORDER_CLOSED'
+  | 'PAYING'
+  | 'ACCEPTED'
+  | 'REFUNDING'
+  | 'REFUND_SUCCESS'
+  | 'REFUND_FAILED';
+
+export interface QueryOrderResponse {
+  result?: 'SUCCESS' | 'FAIL';
+  code?: string;
+  msg?: string;
+  nonce_str?: string;
+  sign?: string;
+  sign_type?: string;
+  biz_content?: {
+    merch_order_id?: string;
+    order_status?: string;
+    trade_status?: TelebirrTradeStatus | string;
+    payment_order_id?: string;
+    trans_id?: string;
+    trans_time?: string;
+    trans_currency?: string;
+    total_amount?: string;
+    [key: string]: unknown;
+  };
+  [key: string]: unknown;
+}

packages/payment-providers/src/providers/waafi/waafi.provider.ts

@@ -0,0 +1,275 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { HttpService } from '@nestjs/axios';
+import {
+  PaymentProvider,
+  ProviderInitiationInput,
+  ProviderInitiationResult,
+  ProviderStatus,
+  ProviderPaymentStatus,
+  ProviderMethod,
+} from '@edr/types';
+import { AxiosError, AxiosRequestConfig } from 'axios';
+import { firstValueFrom } from 'rxjs';
+
+const WAAFI_HTTP_TIMEOUT_MS = 10_000;
+
+interface WaafiInitiateRequest {
+  schemaVersion: string;
+  requestId: string;
+  timestamp: string;
+  channelName: string;
+  serviceName: string;
+  serviceParams: {
+    merchantUid: string;
+    apiUserId: string;
+    apiKey: string;
+    paymentMethod: string;
+    payerInfo: {
+      accountNo: string;
+    };
+    transactionInfo: {
+      referenceId: string;
+      invoiceId: string;
+      amount: number;
+      currency: string;
+      description: string;
+    };
+  };
+}
+
+interface WaafiInitiateResponse {
+  responseCode: string;
+  responseMsg: string;
+  params?: {
+    state: string;
+    referenceId: string;
+    transactionId: string;
+    checkoutUrl?: string;
+  };
+}
+
+interface WaafiQueryRequest {
+  schemaVersion: string;
+  requestId: string;
+  timestamp: string;
+  channelName: string;
+  serviceName: string;
+  serviceParams: {
+    merchantUid: string;
+    apiUserId: string;
+    apiKey: string;
+    transactionId?: string;
+    referenceId?: string;
+  };
+}
+
+interface WaafiQueryResponse {
+  responseCode: string;
+  responseMsg: string;
+  params?: {
+    state: string;
+    referenceId: string;
+    transactionId: string;
+    amount: number;
+    currency: string;
+    paidAmount?: number;
+  };
+}
+
+@Injectable()
+export class WaafiProvider implements PaymentProvider {
+  readonly method = ProviderMethod.WAAFI;
+  private readonly logger = new Logger(WaafiProvider.name);
+
+  constructor(
+    private readonly config: ConfigService,
+    private readonly http: HttpService,
+  ) {}
+
+  async initiate(input: ProviderInitiationInput): Promise<ProviderInitiationResult> {
+    const requestBody = this.buildInitiateRequest(input);
+    const response = await this.postJson<WaafiInitiateResponse>(
+      `${this.baseUrl}/asm`,
+      requestBody,
+    );
+
+    if (response.responseCode !== '2001') {
+      throw new Error(
+        `Waafi initiate failed: ${response.responseCode} - ${response.responseMsg}`,
+      );
+    }
+
+    const transactionId = response.params?.transactionId;
+    const checkoutUrl = response.params?.checkoutUrl || `${this.baseUrl}/checkout?ref=${transactionId}`;
+
+    if (!transactionId) {
+      throw new Error(`Waafi returned no transactionId: ${JSON.stringify(response)}`);
+    }
+
+    const expiresAt = new Date(Date.now() + 15 * 60_000); // 15 minutes
+
+    return {
+      providerOrderId: transactionId,
+      clientAction: { type: 'REDIRECT', url: checkoutUrl },
+      expiresAt,
+      rawInitiation: {
+        request: this.sanitize(requestBody),
+        response,
+      },
+    };
+  }
+
+  async queryStatus(merchantOrderId: string): Promise<ProviderStatus> {
+    const requestBody = this.buildQueryRequest(merchantOrderId);
+    const response = await this.postJson<WaafiQueryResponse>(
+      `${this.baseUrl}/asm`,
+      requestBody,
+    );
+
+    const state = response.params?.state;
+    const transactionId = response.params?.transactionId;
+    const mapped = this.mapState(state);
+
+    return {
+      status: mapped,
+      providerTxnId: transactionId,
+      failureCode: mapped === ProviderPaymentStatus.FAILED && state ? state : undefined,
+      rawResponse: response as unknown as Record<string, unknown>,
+    };
+  }
+
+  mapState(state: string | undefined): ProviderPaymentStatus {
+    switch (state) {
+      case 'APPROVED':
+      case 'SUCCESS':
+        return ProviderPaymentStatus.SUCCEEDED;
+      case 'FAILED':
+      case 'DECLINED':
+      case 'CANCELLED':
+      case 'EXPIRED':
+        return ProviderPaymentStatus.FAILED;
+      case 'PENDING':
+      case 'INITIATED':
+        return ProviderPaymentStatus.REQUIRES_ACTION;
+      case 'PROCESSING':
+        return ProviderPaymentStatus.PROCESSING;
+      default:
+        return ProviderPaymentStatus.PROCESSING;
+    }
+  }
+
+  verifyWebhookSignature(payload: Record<string, unknown>): boolean {
+    // Waafi webhook signature verification
+    // Implementation depends on Waafi's webhook signature mechanism
+    const signature = payload.signature as string;
+    const apiKey = this.apiKey;
+
+    if (!signature || !apiKey) {
+      this.logger.error('Waafi webhook missing signature or API key not configured');
+      return false;
+    }
+
+    // TODO: Implement actual signature verification based on Waafi documentation
+    // For now, basic validation
+    return signature.length > 0;
+  }
+
+  private buildInitiateRequest(input: ProviderInitiationInput): WaafiInitiateRequest {
+    const amount = input.amountMinor / 100; // Convert minor units to major
+
+    return {
+      schemaVersion: '1.0',
+      requestId: this.generateRequestId(),
+      timestamp: new Date().toISOString(),
+      channelName: 'WEB',
+      serviceName: 'API_PURCHASE',
+      serviceParams: {
+        merchantUid: this.merchantUid,
+        apiUserId: this.apiUserId,
+        apiKey: this.apiKey,
+        paymentMethod: 'MWALLET_ACCOUNT',
+        payerInfo: {
+          accountNo: 'CUSTOMER', // Customer enters their number on Waafi page
+        },
+        transactionInfo: {
+          referenceId: input.merchantOrderId,
+          invoiceId: input.orderRef,
+          amount,
+          currency: input.currency === 'ETB' ? 'DJF' : input.currency, // Convert ETB to DJF
+          description: `EDR ${input.orderRef}`,
+        },
+      },
+    };
+  }
+
+  private buildQueryRequest(merchantOrderId: string): WaafiQueryRequest {
+    return {
+      schemaVersion: '1.0',
+      requestId: this.generateRequestId(),
+      timestamp: new Date().toISOString(),
+      channelName: 'WEB',
+      serviceName: 'API_QUERY',
+      serviceParams: {
+        merchantUid: this.merchantUid,
+        apiUserId: this.apiUserId,
+        apiKey: this.apiKey,
+        referenceId: merchantOrderId,
+      },
+    };
+  }
+
+  private generateRequestId(): string {
+    return `EDR-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
+  }
+
+  private async postJson<T>(url: string, body: unknown): Promise<T> {
+    const config: AxiosRequestConfig = {
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      timeout: WAAFI_HTTP_TIMEOUT_MS,
+    };
+
+    const started = Date.now();
+    try {
+      const res = await firstValueFrom(this.http.post<T>(url, body, config));
+      this.logger.debug(
+        `Waafi POST ${url} status=${res.status} latency=${Date.now() - started}ms`,
+      );
+      return res.data;
+    } catch (err) {
+      if (err instanceof AxiosError) {
+        this.logger.error(
+          `Waafi POST ${url} failed: status=${err.response?.status} body=${JSON.stringify(err.response?.data)} code=${err.code} message=${err.message}`,
+        );
+      } else {
+        this.logger.error(
+          `Waafi POST ${url} threw: ${err instanceof Error ? err.message : err}`,
+        );
+      }
+      throw err;
+    }
+  }
+
+  private sanitize(body: WaafiInitiateRequest): Record<string, unknown> {
+    const sanitized = { ...body };
+    if (sanitized.serviceParams?.apiKey) {
+      sanitized.serviceParams.apiKey = '***REDACTED***';
+    }
+    return sanitized as unknown as Record<string, unknown>;
+  }
+
+  private get baseUrl(): string {
+    return this.config.get<string>('waafi.baseUrl') ?? 'https://api.waafipay.net';
+  }
+  private get merchantUid(): string {
+    return this.config.get<string>('waafi.merchantUid') ?? '';
+  }
+  private get apiUserId(): string {
+    return this.config.get<string>('waafi.apiUserId') ?? '';
+  }
+  private get apiKey(): string {
+    return this.config.get<string>('waafi.apiKey') ?? '';
+  }
+}

packages/payment-providers/src/utils/merchant-order-id.ts

@@ -0,0 +1 @@
+export { createMerchantOrderId } from '../providers/telebirr/telebirr.crypto';

packages/payment-providers/src/webhooks/card-webhook.types.ts

@@ -0,0 +1,22 @@
+export interface CardWebhookPayload {
+  id: string;
+  type: string;
+  data: {
+    object: {
+      id: string;
+      status: string;
+      amount: number;
+      currency: string;
+      metadata: {
+        merchantOrderId: string;
+        orderRef?: string;
+        [key: string]: unknown;
+      };
+      transaction_id?: string;
+      paid_at?: number;
+      failure_code?: string;
+      failure_message?: string;
+    };
+  };
+  created: number;
+}

packages/payment-providers/src/webhooks/cbe-birr-webhook.types.ts

@@ -0,0 +1,12 @@
+export interface CbeBirrWebhookPayload {
+  merchantId: string;
+  merchantOrderId: string;
+  orderId: string;
+  status: string;
+  transactionId?: string;
+  amount?: string;
+  currency?: string;
+  paidAt?: string;
+  signature: string;
+  [key: string]: unknown;
+}

packages/payment-providers/src/webhooks/ebirr-webhook.types.ts

@@ -0,0 +1,12 @@
+export interface EBirrWebhookPayload {
+  merchantCode: string;
+  orderNo: string;
+  tradeStatus: string;
+  tradeNo?: string;
+  totalAmount?: number;
+  currency?: string;
+  payTime?: number;
+  timestamp: number;
+  sign: string;
+  [key: string]: unknown;
+}

packages/payment-providers/src/webhooks/telebirr-webhook.types.ts

@@ -0,0 +1,13 @@
+export interface TelebirrWebhookPayload {
+  merch_order_id: string;
+  payment_order_id: string;
+  trade_status: string;
+  trans_id?: string;
+  total_amount?: string;
+  trans_currency?: string;
+  notify_time?: string;
+  trans_end_time?: string;
+  sign: string;
+  sign_type?: string;
+  [key: string]: unknown;
+}

packages/payment-providers/src/webhooks/waafi-webhook.types.ts

@@ -0,0 +1,15 @@
+export interface WaafiWebhookPayload {
+  schemaVersion: string;
+  requestId: string;
+  timestamp: string;
+  eventType: string;
+  params: {
+    state: string;
+    referenceId: string;
+    transactionId: string;
+    amount: number;
+    currency: string;
+    description?: string;
+  };
+  signature?: string;
+}

packages/payment-providers/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "@edr/tsconfig/nestjs.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true,
+    "declarationMap": true
+  },
+  "include": ["src"]
+}