build on versionname change

This reverts commit f02b05b180.

.gitea/workflows/auto-tag.yml

@@ -24,20 +24,11 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "version_code=$VERSION_CODE" >> $GITHUB_OUTPUT
 
-          BEFORE="${{ github.event.before }}"
-          if [ -z "$BEFORE" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
-            BEFORE="HEAD~1"
-          fi
-          PREV_VERSION_CODE=$(git show "${BEFORE}:app/build.gradle.kts" 2>/dev/null | grep 'versionCode = ' | sed 's/.*versionCode = \([0-9]*\).*/\1/')
-
-          if [ "$VERSION_CODE" = "$PREV_VERSION_CODE" ]; then
-            echo "versionCode unchanged (${VERSION_CODE}), skipping"
+          if git tag -l | grep -q "^v${VERSION}$"; then
+            echo "Tag v${VERSION} already exists, skipping"
             echo "should_release=false" >> $GITHUB_OUTPUT
-          elif git tag -l | grep -q "^v${VERSION}$"; then
-            echo "versionCode changed (${PREV_VERSION_CODE} -> ${VERSION_CODE}) but tag v${VERSION} already exists; bump versionName"
-            exit 1
           else
-            echo "New versionCode detected: ${PREV_VERSION_CODE} -> ${VERSION_CODE} (v${VERSION})"
+            echo "New version detected: v${VERSION}"
             echo "should_release=true" >> $GITHUB_OUTPUT
           fi
 

.gitignore

@@ -18,6 +18,8 @@ docs/bmlapi/tmp
 docs/fahipayapi/tmp
 docs/mfaisaapi/tmp
 docs/dhiraaguapi/tmp
+docs/ooredooapi/tmp
+docs/ooredooapi/tmp
 tmp
 app/key.jks
 .kotlin/*

app/build.gradle.kts

@@ -21,8 +21,8 @@ android {
         applicationId = "sh.sar.basedbank"
         minSdk = 26
         targetSdk = 36
-        versionCode = 34
-        versionName = "1.0.33"
+        versionCode = 35
+        versionName = "1.0.34"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 

app/src/main/java/sh/sar/basedbank/api/bml/BmlMerchantCardPayClient.kt

@@ -34,10 +34,12 @@ import android.util.Base64
  *  4. The 3-D Secure challenge on BML's Wibmo ACS: the render page auto-posts the `creq`, we pick
  *     the "Authenticator" channel and submit the BML token's TOTP. The ACS then auto-posts the
  *     result to the Mastercard gateway, which posts it back to BML's `mpgsNotification`.
- *  5. Poll next-action until TRANSACTION_CONFIRMED.
+ *  5. Poll next-action until TRANSACTION_CONFIRMED. A decline after 3-D Secure (e.g. insufficient
+ *     funds) doesn't show up there: it's a new `paymentErrorHistory` entry on the transaction,
+ *     checked alongside.
  *  6. Return to the merchant: `GET <txn>?wait=1` redirects to the merchant's `redirectUrl` with a
- *     signed `state=CONFIRMED` — the browser's last hop, and how some merchants (Dhiraagu) learn
- *     they were paid. Without it the card is charged but the merchant never delivers.
+ *     signed `state=CONFIRMED` — the browser's last hop, and how merchants (Dhiraagu, Ooredoo)
+ *     learn they were paid. Without it the card is charged but the merchant never delivers.
  *
  * Every call blocks, so run it on an IO thread. Use one instance per payment — it keeps the ACS
  * session cookies.
@@ -90,7 +92,10 @@ class BmlMerchantCardPayClient {
         val pk = page.pomeloKey ?: return Result.Failure("This merchant doesn't accept card payments")
         val txnId = page.transactionId
 
-        runCatching { BmlMerchantTxnClient().announceBrowser(txnId) }
+        val txnClient = BmlMerchantTxnClient()
+        val browserId = runCatching { txnClient.announceBrowser(txnId) }.getOrNull()
+        // Earlier attempts' declines are already in the history; only newer ones are ours
+        val priorErrors = browserId?.let { id -> runCatching { txnClient.paymentErrors(txnId, id).size }.getOrNull() }
 
         // 1-2. Credentials, then tokenise the card with Pomelo
         val creds = getJson("$API_BASE/public-client/credentials/$txnId", pk)
@@ -154,6 +159,11 @@ class BmlMerchantCardPayClient {
                 "TRANSACTION_CONFIRMED" -> return confirmed(txnId)
                 "TRANSACTION_FAILED" -> return Result.Failure("The bank declined the payment")
             }
+            if (browserId != null && priorErrors != null) {
+                runCatching { txnClient.paymentErrors(txnId, browserId) }.getOrNull()
+                    ?.drop(priorErrors)?.lastOrNull()
+                    ?.let { return Result.Failure(it.message.ifBlank { "The bank declined the payment" }) }
+            }
             Thread.sleep(POLL_MS / 2)
         }
         return Result.Failure("Payment status unknown — check with the merchant before retrying")
@@ -165,25 +175,37 @@ class BmlMerchantCardPayClient {
     /**
      * What the browser does once the payment page sees the confirmation: loads `<txn>?wait=1`,
      * which 302s to the merchant's `redirectUrl` (`…?transactionId=<id>&state=CONFIRMED&signature=…`)
-     * and on to its receipt page. Follows the redirects and retries a couple of times; true when
-     * the chain ended on a 2xx page.
+     * and on to its receipt page. Some merchants' callback page instead auto-submits a form on
+     * load (Ooredoo's posts the result on to its own site), so those forms are submitted too.
+     * Retries a couple of times; true when the chain ended on a 2xx page.
      */
     private fun returnToMerchant(txnId: String): Boolean {
         repeat(RETURN_ATTEMPTS) { attempt ->
             if (attempt > 0) Thread.sleep(RETURN_RETRY_MS)
             val ok = runCatching {
-                client.newCall(Request.Builder()
-                    .url("$PAGE_ORIGIN/$txnId?wait=1")
-                    .header("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
-                    .header("Accept-Language", "en-US,en;q=0.9")
-                    .build()
-                ).execute().use { it.isSuccessful }
+                var request = browserNav(Request.Builder().url("$PAGE_ORIGIN/$txnId?wait=1"))
+                for (hop in 0..MAX_AUTO_SUBMITS) {
+                    val (code, html, url) = client.newCall(request).execute().use {
+                        Triple(it.code, it.body?.string().orEmpty(), it.request.url.toString())
+                    }
+                    if (code !in 200..299) return@runCatching false
+                    // A page that only exists to post itself onward, like the ACS's own hops
+                    if (hop == MAX_AUTO_SUBMITS || !AUTO_SUBMIT.containsMatchIn(html)) return@runCatching true
+                    val form = AcsForm.parse(html, url) ?: return@runCatching true
+                    request = browserNav(form.toRequest().newBuilder())
+                }
+                true
             }.getOrDefault(false)
             if (ok) return true
         }
         return false
     }
 
+    private fun browserNav(builder: Request.Builder): Request = builder
+        .header("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+        .header("Accept-Language", "en-US,en;q=0.9")
+        .build()
+
     /** Drives the ACS challenge. Returns null on success, or a Failure to stop the payment. */
     private fun runThreeDs(threeDsUrl: String, otp: (Boolean) -> String): Result? {
         // render-tds: an auto-submitting form (with an explicit action) that posts the creq to the
@@ -206,6 +228,8 @@ class BmlMerchantCardPayClient {
         }
 
         // OTP entry. Submit the token code; if it expired, ask for a fresh one once and retry.
+        // A rejected code comes back as the OTP page again with "The OTP code you entered is
+        // incorrect Please try again."
         var retry = false
         for (attempt in 0..1) {
             form = AcsForm.parse(html, acsUrl) ?: break
@@ -213,9 +237,10 @@ class BmlMerchantCardPayClient {
             form.fields["otpValue"] = otp(retry)
             form.fields["formReqType"] = "SUBMIT"
             html = execText(form.toRequest())
-            if (!html.contains("incorrect", true) && !html.contains("expired", true)) break
+            if (!otpRejected(html)) break
             retry = true
         }
+        if (otpRejected(html)) return Result.Failure("The bank rejected the BML token code. Check the phone's clock and try again.")
         // On success the ACS returns an auto-posting form to the gateway; follow it (and the
         // gateway's own auto-post back to BML) so the verdict is recorded before we poll.
         repeat(3) {
@@ -226,6 +251,9 @@ class BmlMerchantCardPayClient {
         return null
     }
 
+    private fun otpRejected(html: String) = html.contains("name=\"otpValue\"") &&
+        (html.contains("incorrect", true) || html.contains("expired", true))
+
     // ── next-action helpers ──────────────────────────────────────────────────
 
     private fun nextAction(pk: String, body: JSONObject): JSONObject =
@@ -329,5 +357,9 @@ class BmlMerchantCardPayClient {
         private const val MAX_POLLS = 10
         private const val RETURN_ATTEMPTS = 3
         private const val RETURN_RETRY_MS = 2_000L
+        /** Auto-submitting merchant pages followed on the way back; Ooredoo has one. */
+        private const val MAX_AUTO_SUBMITS = 2
+        /** `<body onload="document.forms['x'].submit()">` and the like. */
+        private val AUTO_SUBMIT = Regex("""onload\s*=\s*("[^"]*|'[^']*)\.submit\(\)""", RegexOption.IGNORE_CASE)
     }
 }

app/src/main/java/sh/sar/basedbank/api/bml/BmlMerchantTxnClient.kt

@@ -113,12 +113,36 @@ class BmlMerchantTxnClient {
         return txn.vendorQrCode() ?: throw Exception("Transaction has no QR")
     }
 
-    /** The PATCHes the page sends on load: register this "browser" and clear any FX selection. */
-    fun announceBrowser(transactionId: String) {
-        patch(transactionId, JSONObject().put("activeBrowserId", "${transactionId}_${System.currentTimeMillis()}"))
+    /**
+     * The PATCHes the page sends on load: register this "browser" and clear any FX selection.
+     * Returns the browser id, for [paymentErrors].
+     */
+    fun announceBrowser(transactionId: String): String {
+        val browserId = "${transactionId}_${System.currentTimeMillis()}"
+        patch(transactionId, JSONObject().put("activeBrowserId", browserId))
         patch(transactionId, JSONObject().put("fx", "reset"))
+        return browserId
     }
 
+    /**
+     * The transaction's failed payment attempts, oldest first, read with the page's load PATCH
+     * as [browserId]. A declined card (e.g. `INSUFFICIENT_FUNDS`) lands here while the
+     * transaction stays payable — `state` doesn't change, `hasError` turns true.
+     */
+    fun paymentErrors(transactionId: String, browserId: String): List<PaymentError> {
+        val history = patch(transactionId, JSONObject().put("activeBrowserId", browserId))
+            .optJSONArray("paymentErrorHistory") ?: return emptyList()
+        return (0 until history.length()).mapNotNull { history.optJSONObject(it) }.map {
+            PaymentError(
+                code = it.optString("code"),
+                message = it.optString("customerVisibleDescription").ifBlank { it.optString("reason") }
+            )
+        }
+    }
+
+    /** One entry of `paymentErrorHistory`: the gateway's code and the wording BML shows for it. */
+    data class PaymentError(val code: String, val message: String)
+
     private fun patch(transactionId: String, body: JSONObject): JSONObject {
         val request = Request.Builder()
             .url("$API_BASE/transactions/$transactionId")

app/src/main/java/sh/sar/basedbank/api/ooredoo/OoredooPaymentClient.kt

@@ -0,0 +1,90 @@
+package sh.sar.basedbank.api.ooredoo
+
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONObject
+import sh.sar.basedbank.api.models.BankServerException
+import java.math.BigDecimal
+import java.math.RoundingMode
+import java.util.Locale
+import java.util.concurrent.TimeUnit
+
+/**
+ * Ooredoo prepaid recharge (Raastas) and bill payment through the ooredoo.mv Quick Pay pages,
+ * paid by card on BML's merchant gateway. Ooredoo only creates the order; the money moves on the
+ * BML Merchant Services transaction it hands back, which is paid like any card-only BML merchant
+ * link. See `docs/ooredooapi/02-raastas.md` and `docs/ooredooapi/03-bill-pay.md`.
+ *
+ * Every call blocks, so run it on an IO thread.
+ */
+class OoredooPaymentClient {
+
+    private val client = OkHttpClient.Builder()
+        .connectTimeout(30, TimeUnit.SECONDS)
+        .readTimeout(30, TimeUnit.SECONDS)
+        .build()
+
+    /**
+     * Creates the recharge order for [number] (7 digits) and the BML transaction paying for it.
+     * [amount] is what the number is credited, in whole MVR; the card pays [charged], which is
+     * that plus GST. Returns the 24-hex BML transaction id. Throws with Ooredoo's wording when
+     * the order is refused.
+     */
+    fun createRaastasTransaction(number: String, amount: Int, charged: BigDecimal): String =
+        createOrder(number, charged, amount.toString(), transType = "recharge", serviceType = "prepaid")
+
+    /**
+     * Creates the bill payment order for postpaid [number] (7 digits) and the BML transaction
+     * paying for it. [amount] is MVR, up to 2 decimal places; no GST. Returns the 24-hex BML
+     * transaction id. Throws with Ooredoo's wording when the order is refused.
+     */
+    fun createBillPayTransaction(number: String, amount: BigDecimal): String =
+        createOrder(number, amount, money(amount), transType = "billpay", serviceType = "Mobile")
+
+    /** `POST PaymentGateway/bml` — one call makes the order and its BML transaction. */
+    private fun createOrder(
+        number: String, charged: BigDecimal, amountWithoutGst: String, transType: String, serviceType: String,
+    ): String {
+        val msisdn = "960$number"
+        val body = JSONObject()
+            .put("msisdn", msisdn)
+            .put("purchaseAmount", money(charged))
+            .put("amountWithoutGst", amountWithoutGst)
+            .put("receiverMsisdn", msisdn)
+            .put("transType", transType)
+            .put("serviceType", serviceType)
+            .put("serviceTypeDisplayName", "Mobile")
+        val text = client.newCall(
+            Request.Builder().url("$BASE/ooredoo-prod/PaymentGateway/bml")
+                .post(body.toString().toRequestBody(JSON))
+                .header("User-Agent", UA)
+                .header("Accept", "application/json")
+                .header("Origin", BASE)
+                .build()
+        ).execute().use { r ->
+            if (r.code in 500..599) throw BankServerException("Ooredoo")
+            r.body?.string().orEmpty()
+        }
+        val obj = try { JSONObject(text) } catch (_: Exception) {
+            throw Exception("Unexpected response from Ooredoo")
+        }
+        if (obj.optString("status") != "OK" || obj.optString("code") != "2000") {
+            throw Exception(obj.optString("msg").ifBlank { "Ooredoo refused the payment" })
+        }
+        val data = obj.optJSONObject("data") ?: throw Exception("Ooredoo didn't create the order")
+        return TXN_URL.find(data.optString("bmlUrl"))?.groupValues?.get(1)
+            ?: throw Exception("BML didn't create the transaction")
+    }
+
+    private fun money(amount: BigDecimal) =
+        String.format(Locale.US, "%.2f", amount.setScale(2, RoundingMode.HALF_UP))
+
+    companion object {
+        private const val BASE = "https://www.ooredoo.mv"
+        private const val UA = "Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Firefox/150.0"
+        private val JSON = "application/json".toMediaType()
+        private val TXN_URL = Regex("""transaction\.merchants\.bankofmaldives\.com\.mv/([0-9a-fA-F]{24})""")
+    }
+}

app/src/main/java/sh/sar/basedbank/ui/home/TransferFragment.kt

@@ -52,6 +52,7 @@ import sh.sar.basedbank.databinding.ItemPickerSectionHeaderBinding
 import sh.sar.basedbank.databinding.ItemTransferTypeBinding
 import sh.sar.basedbank.ui.home.transfer.BmlTransferHandler
 import sh.sar.basedbank.ui.home.transfer.BmlVerifiedCards
+import sh.sar.basedbank.ui.home.transfer.CardPayoutService
 import sh.sar.basedbank.ui.home.transfer.CardPayoutTransferHandler
 import sh.sar.basedbank.ui.home.transfer.CarrierLookup
 import sh.sar.basedbank.ui.home.transfer.FahipayService
@@ -407,7 +408,7 @@ class TransferFragment : Fragment() {
                 return@setFragmentResultListener
             }
             val label     = bundle.getString(ContactPickerSheetFragment.KEY_LABEL) ?: ""
-            if (applyFahipayContact(accountNumber, bundle.getString(ContactPickerSheetFragment.KEY_CATEGORY), label)) {
+            if (applyServiceContact(accountNumber, bundle.getString(ContactPickerSheetFragment.KEY_CATEGORY), label)) {
                 return@setFragmentResultListener
             }
             val subtitle  = bundle.getString(ContactPickerSheetFragment.KEY_SUBTITLE) ?: accountNumber
@@ -453,7 +454,7 @@ class TransferFragment : Fragment() {
         // Pre-select contact if navigated from contacts page or QR scan
         arguments?.getString(ARG_ACCOUNT)?.let { account ->
             val name = arguments?.getString(ARG_NAME) ?: account
-            if (applyFahipayContact(account, arguments?.getString(ARG_CONTACT_CATEGORY), name)) return@let
+            if (applyServiceContact(account, arguments?.getString(ARG_CONTACT_CATEGORY), name)) return@let
             prefillToDirectly(
                 accountNumber = account,
                 displayName   = name,
@@ -1125,7 +1126,7 @@ class TransferFragment : Fragment() {
 
         binding.etTo.setOnItemClickListener { _, _, position, _ ->
             val contact = adapter.getContact(position) ?: return@setOnItemClickListener
-            if (applyFahipayContact(contact.benefAccount, contact.benefCategoryId, contact.benefNickName)) {
+            if (applyServiceContact(contact.benefAccount, contact.benefCategoryId, contact.benefNickName)) {
                 return@setOnItemClickListener
             }
             prefillToDirectly(
@@ -1141,15 +1142,27 @@ class TransferFragment : Fragment() {
     }
 
     /**
-     * A saved Fahipay favourite: its list ([categoryId]) already says which service pays it, so
-     * that service is applied as the only transfer type, with no carrier lookup. That switches
-     * the source to the Fahipay wallet and brings in the service's amount rules, the same as a
-     * searched number. Returns false, doing nothing, when [categoryId] isn't a Fahipay list.
+     * A saved Fahipay favourite, or a recent paid with a Fahipay or card service: its category
+     * ([categoryId]) already says which service pays it, so that service is applied as the only
+     * transfer type, with no carrier lookup. That switches the source to the Fahipay wallet or
+     * the default card and brings in the service's amount rules, the same as a searched number.
+     * Returns false, doing nothing, when [categoryId] isn't one of those.
      */
-    private fun applyFahipayContact(number: String, categoryId: String?, name: String): Boolean {
-        val service = FahipayService.fromContactCategory(categoryId) ?: return false
+    private fun applyServiceContact(number: String, categoryId: String?, name: String): Boolean {
+        val ownerName = name.takeIf { it.isNotBlank() && it != number }
+        val type = FahipayService.fromContactCategory(categoryId)?.let { TransferType.Fahipay(it, ownerName) }
+            ?: CardPayoutService.fromContactCategory(categoryId)?.let { service ->
+                // The cards that could pay it then may not be payable now
+                val cards = cardPayoutHandler().payableCards()
+                if (cards.isEmpty()) {
+                    Toast.makeText(requireContext(), R.string.bml_card_pay_no_verified, Toast.LENGTH_LONG).show()
+                    return true
+                }
+                TransferType.Card(service, ownerName, cards)
+            }
+            ?: return false
         clearRecipient()
-        offerTransferTypes(number, listOf(TransferType.Fahipay(service, name.takeIf { it.isNotBlank() && it != number })))
+        offerTransferTypes(number, listOf(type))
         return true
     }
 

app/src/main/java/sh/sar/basedbank/ui/home/transfer/BmlTransferHandler.kt

@@ -550,7 +550,14 @@ class BmlTransferHandler(
         fragment.viewLifecycleOwner.lifecycleScope.launch {
             val result = withContext(Dispatchers.IO) {
                 runCatching {
-                    BmlMerchantCardPayClient().pay(page, card) { _ -> Totp.generate(otpSeed) }
+                    BmlMerchantCardPayClient().pay(page, card) { retry ->
+                        // A code about to roll over can expire before the ACS checks it, and a
+                        // retry in the same window would resend the rejected code: wait for the
+                        // next window in both cases. Runs on IO.
+                        val left = TOTP_WINDOW_MS - System.currentTimeMillis() % TOTP_WINDOW_MS
+                        if (retry || left < TOTP_MIN_LEFT_MS) Thread.sleep(left + 500)
+                        Totp.generate(otpSeed)
+                    }
                 }.getOrElse {
                     BmlMerchantCardPayClient.Result.Failure(it.message ?: "Payment failed")
                 }
@@ -957,4 +964,11 @@ class BmlTransferHandler(
     }
 
     private fun isCard(account: BankAccount) = BmlVerifiedCards.isCard(account)
+
+    private companion object {
+        /** The BML token's TOTP window. */
+        const val TOTP_WINDOW_MS = 30_000L
+        /** Don't send a card payment's 3-D Secure code with less than this left in its window. */
+        const val TOTP_MIN_LEFT_MS = 5_000L
+    }
 }

app/src/main/java/sh/sar/basedbank/ui/home/transfer/CardPayoutTransferHandler.kt

@@ -10,6 +10,8 @@ import sh.sar.basedbank.R
 import sh.sar.basedbank.api.bml.BmlMerchantTxnClient
 import sh.sar.basedbank.api.dhiraagu.DhiraaguClient
 import sh.sar.basedbank.api.dhiraagu.DhiraaguPaymentClient
+import sh.sar.basedbank.api.fahipay.OoredooClient
+import sh.sar.basedbank.api.ooredoo.OoredooPaymentClient
 import sh.sar.basedbank.databinding.FragmentTransferBinding
 import sh.sar.basedbank.ui.home.HomeViewModel
 import sh.sar.basedbank.ui.home.TransferFragment
@@ -20,8 +22,8 @@ import java.math.RoundingMode
  * A carrier service a verified BML card can pay, through the carrier's own website and its BML
  * merchant gateway. The limits are the carrier website's, not Fahipay's.
  *
- * Only Dhiraagu so far. Add the others as constants once their send path lands; the exhaustive
- * `when`s over this enum point at every site that needs updating.
+ * Add new services as constants; the exhaustive `when`s over this enum point at every site that
+ * needs updating.
  */
 enum class CardPayoutService(
     override val label: String,
@@ -31,16 +33,37 @@ enum class CardPayoutService(
     override val maxAmount: Int?,
     override val decimalsAllowed: Boolean,
     override val gstPercent: Int?,
+    /**
+     * Tags the recents paid with this service (`RecentPick.contactCategory`), so picking one
+     * again pays the same way. Not a real contact list: card payouts have no favourites.
+     */
+    val contactCategory: String,
+    override val gstAdded: Boolean = false,
 ) : PayoutService {
     DHIRAAGU_RELOAD("Dhiraagu Reload", "Dhiraagu · Reload", R.drawable.dhiraagu_logo,
-        minAmount = 20, maxAmount = 1000, decimalsAllowed = false, gstPercent = 8) {
+        minAmount = 20, maxAmount = 1000, decimalsAllowed = false, gstPercent = 8,
+        contactCategory = "CARD_DHIRAAGU_RELOAD") {
         // Dhiraagu rounds the GST to 2 places and credits the rest
         override fun creditedAfterGst(amount: BigDecimal): BigDecimal =
             amount - DhiraaguPaymentClient.gstOf(amount.setScale(0, RoundingMode.DOWN).toInt())
     },
     // Easy Pay sets no limits of its own: any amount with up to 2 decimals, no GST
     DHIRAAGU_BILL("Dhiraagu Bill Pay", "Dhiraagu · Bill Pay", R.drawable.dhiraagu_logo,
-        minAmount = 1, maxAmount = null, decimalsAllowed = true, gstPercent = null);
+        minAmount = 1, maxAmount = null, decimalsAllowed = true, gstPercent = null,
+        contactCategory = "CARD_DHIRAAGU_BILL"),
+    // Ooredoo credits the whole amount and charges the card 8% GST on top
+    OOREDOO_RAASTAS("Raastas", "Ooredoo · Raastas", R.drawable.ooredoo_logo,
+        minAmount = 20, maxAmount = null, decimalsAllowed = false, gstPercent = 8,
+        contactCategory = "CARD_RAASTAS", gstAdded = true),
+    OOREDOO_BILL("Ooredoo Bill Pay", "Ooredoo · Bill Pay", R.drawable.ooredoo_logo,
+        minAmount = 10, maxAmount = null, decimalsAllowed = true, gstPercent = null,
+        contactCategory = "CARD_OOREDOO_BILL");
+
+    companion object {
+        /** The service a recent was paid with, from its [contactCategory], or null when it isn't one. */
+        fun fromContactCategory(categoryId: String?): CardPayoutService? =
+            entries.firstOrNull { it.contactCategory == categoryId }
+    }
 }
 
 /**
@@ -86,6 +109,12 @@ class CardPayoutTransferHandler(
                 DhiraaguClient.CustType.BILL_PAY -> add(CardPayoutService.DHIRAAGU_BILL)
                 DhiraaguClient.CustType.UNSUPPORTED -> {}
             }
+            if (result.ooredoo == OoredooClient.CustType.PRE || result.ooredoo == OoredooClient.CustType.HYBRID) {
+                add(CardPayoutService.OOREDOO_RAASTAS)
+            }
+            if (result.ooredoo == OoredooClient.CustType.POST || result.ooredoo == OoredooClient.CustType.HYBRID) {
+                add(CardPayoutService.OOREDOO_BILL)
+            }
         }.map { TransferType.Card(it, result.ownerName, cards) }
     }
 
@@ -122,7 +151,8 @@ class CardPayoutTransferHandler(
             displayName   = displayName,
             subtitle      = "${type.label} · $number",
             colorHex      = "#E4002B",
-            imageHash     = null
+            imageHash     = null,
+            contactCategory = type.service.contactCategory
         )
         fragment.focusAmount()
     }
@@ -143,6 +173,7 @@ class CardPayoutTransferHandler(
         val number = viewModel.transferDraft.transferTypeNumber
         val amount = binding.etAmount.text?.toString()?.trim()?.toBigDecimalOrNull()
         if (number.isBlank() || amount == null || amount.signum() <= 0 || amountProblem != null) return
+        val charged = svc.chargedWithGst(amount)
 
         // Creating the order takes a few round trips; show the payment's processing box meanwhile
         val processing = fragment.showProcessingDialog(ctx.getString(R.string.transfer))
@@ -154,6 +185,10 @@ class CardPayoutTransferHandler(
                             DhiraaguPaymentClient().createReloadTransaction(number, amount.intValueExact())
                         CardPayoutService.DHIRAAGU_BILL ->
                             DhiraaguPaymentClient().createBillPayTransaction(number, amount)
+                        CardPayoutService.OOREDOO_RAASTAS ->
+                            OoredooPaymentClient().createRaastasTransaction(number, amount.intValueExact(), charged)
+                        CardPayoutService.OOREDOO_BILL ->
+                            OoredooPaymentClient().createBillPayTransaction(number, amount)
                     }
                     BmlMerchantTxnClient().fetchPayPage(txnId)
                 }
@@ -164,8 +199,8 @@ class CardPayoutTransferHandler(
                 when {
                     !it.supportsCard ->
                         Toast.makeText(ctx, R.string.transfer_bml_txn_lookup_failed, Toast.LENGTH_LONG).show()
-                    // The carrier's order must be for exactly what was typed
-                    it.amount.toBigDecimal().compareTo(amount) != 0 ->
+                    // The carrier's order must be for exactly what was typed (plus GST, if added)
+                    it.amount.toBigDecimal().compareTo(charged) != 0 ->
                         Toast.makeText(ctx, R.string.transfer_bml_txn_lookup_failed, Toast.LENGTH_LONG).show()
                     else -> bmlHandler().confirmCardMerchant(it, src)
                 }

app/src/main/java/sh/sar/basedbank/ui/home/transfer/PayoutService.kt

@@ -25,17 +25,33 @@ interface PayoutService {
     val maxAmount: Int?
     /** Whether the amount may have a fractional part (up to 2 decimal places). */
     val decimalsAllowed: Boolean
-    /** GST the carrier takes out of the amount before crediting it, in percent, or null for none. */
+    /** GST the carrier charges, in percent, or null for none. [gstAdded] says how. */
     val gstPercent: Int?
+    /**
+     * False (the usual): GST comes out of the amount, so the number is credited less
+     * ([creditedAfterGst]). True: the number is credited the whole amount and GST is charged on
+     * top of it ([chargedWithGst]).
+     */
+    val gstAdded: Boolean get() = false
 
     /**
      * What the number is credited for a GST-inclusive [amount]: amount / (1 + rate), rounded
-     * down. Null when the service charges no GST.
+     * down. Null when the service charges no GST, or adds it on top.
      */
     fun creditedAfterGst(amount: BigDecimal): BigDecimal? {
         val gst = gstPercent ?: return null
+        if (gstAdded) return null
         return amount.divide(BigDecimal.ONE + BigDecimal(gst).movePointLeft(2), 2, RoundingMode.DOWN)
     }
+
+    /**
+     * What is paid for [amount]: amount + round2(amount × rate) when GST is added on top,
+     * otherwise [amount] itself.
+     */
+    fun chargedWithGst(amount: BigDecimal): BigDecimal {
+        val gst = gstPercent?.takeIf { gstAdded } ?: return amount
+        return amount + (amount * BigDecimal(gst).movePointLeft(2)).setScale(2, RoundingMode.HALF_UP)
+    }
 }
 
 /**
@@ -81,11 +97,18 @@ class PayoutAmountField(
         binding.tilAmount.helperText = if (problem == null) gstNote(svc) else null
     }
 
-    /** What the recipient is credited once GST comes out, for services that charge it. */
+    /**
+     * For services that charge GST: what the recipient is credited once it comes out, or what
+     * is paid once it's added on top.
+     */
     fun gstNote(svc: PayoutService): String? {
         val gst = svc.gstPercent ?: return null
         val ctx = context()
         val amount = binding.etAmount.text?.toString()?.trim()?.toBigDecimalOrNull()
+        if (svc.gstAdded) {
+            if (amount == null || amount.signum() <= 0) return ctx.getString(R.string.transfer_gst_added_hint, gst)
+            return ctx.getString(R.string.transfer_gst_added_pay, "%,.2f".format(svc.chargedWithGst(amount)), gst)
+        }
         if (amount == null || amount.signum() <= 0) return ctx.getString(R.string.transfer_fahipay_gst_hint, gst)
         val credited = svc.creditedAfterGst(amount) ?: return null
         return ctx.getString(R.string.transfer_fahipay_gst_receive, "%,.2f".format(credited), gst)

app/src/main/res/values-b+dv/strings.xml

@@ -1,149 +1,431 @@
-<?xml version="1.0" encoding="utf-8"?>
 <resources>
     <string name="app_name">ތިޖޫރީ</string>
 
     <!-- Onboarding -->
-    <string name="onboarding_supported_services">ހިދުމަތްތައް</string>
-    <string name="select_language">ބަސް ހިޔާލު ކުރޭ</string>
-    <string name="onboarding_title_1">ތިޔަ ބޭންކްތައް، އެއް އެޕެއްގައި</string>
-    <string name="onboarding_desc_1">ތިޖޫރީ ގެ ސަބަބުން ތިޔަ ދިވެހި ބޭންކު އެކައުންޓްތައް، ހަމައެއް ތަނަކުން ބެލޭ. ބެލެންސް ބެލޭ، ތަފާތު ތަންތަން ބެލޭ — ތަފާތު އެޕްތަކަށް ބަދަލު ނުވެ.</string>
-    <string name="onboarding_title_2">އިތުރު ބޭންކްތައް ހިމެނެނީ</string>
-    <string name="onboarding_desc_2">އިތުރު ބޭންކްތަކަށް ސަޕޯޓް ލިބޭ ގޮތަށް ތައްޔާރުވަމުން ދަނީ. ދިވެހިރާއްޖޭގެ ބޭންކްތަކަށް ސަޕޯޓް ފަހި ވަމުން ދިޔަ ވަރަކަށް ހިމަނެމުން ދޭ.</string>
-    <string name="onboarding_title_3">ފެށޭ ގޮތަށް ތައްޔާރު</string>
-    <string name="onboarding_desc_3">ތިޔަ ބޭންކު ކްރެޑެންޝަލް ޖެހި، ތިޔަ އެކައުންޓްތައް ބަލާ. ތިޔަ ޑޭޓާ ހިފެހެއްޓޭ ތަނަކީ ހަމައެކަނި ތިޔަ ފޯނު.\n\nDhiraagu އާއި Ooredoo ގެ API ބޭނުންކޮށްގެން ފޯން ނަންބަރުގެ ތަފްސީލު ބެލޭ.\n\nމި އެޕް ތިޔައާ ބެހޭ ތަފްސީލެއް ނެހެދޭ، ޑިވެލޮޕަރަށް ވެސް ނުފޮނުވާ. ހުރިހާ ޑޭޓާ ހިފެހެއްޓޭ ތަނަކީ ހަމައެކަނި ތިޔަ ފޯނު.</string>
-    <string name="coming_soon">ފަހުން ލިބޭ</string>
-    <string name="next">ދެން</string>
-    <string name="get_started">ފަށާ</string>
+    <string name="onboarding_supported_services">ޚިދުމަތްތައް</string>
+    <string name="select_language">ބަސް އިޚްތިޔާރުކުރޭ</string>
+    <string name="onboarding_title_1">ހުރިހާ ބޭންކެއް އެއް އެޕަކުން</string>
+    <string name="onboarding_desc_1">ރާއްޖޭގެ ބޭންކުތަކުގައިވާ ތިޔަބޭފުޅާގެ އެކައުންޓްތައް އެއްތަނަކުން ބަލާލެވޭ. އެކި އެޕްތަކަށް ވަންނަންނުޖެހި ބެލެންސް ބެލުމާއި އެކައުންޓްތަކުގެ މަޢުލޫމާތު ފަސޭހަކަމާއެކު ބަލާލެވޭ.</string>
+    <string name="onboarding_title_2">އިތުރު ބޭންކުތައް ވަރަށް އަވަހަށް</string>
+    <string name="onboarding_desc_2">އިތުރު ބޭންކުތަކުގެ ޚިދުމަތްތައް މި އެޕަށް އިތުރުކުރުމުގެ މަސައްކަތް ދަނީ ކުރެވެމުންނެވެ.</string>
+    <string name="onboarding_title_3">ސަމާލުކަމަށް</string>
+    <string name="onboarding_desc_3">ތިޖޫރީ އަކީ އެއްވެސް ބޭންކަކާ ނުވަތަ މާލީ އިދާރާއަކާ ގުޅުމެއްނެތި އަމިއްލައަށް އުފައްދާފައިވާ އެޕެކެވެ.\n\nމި އެޕް މަސައްކަތްކުރަނީ ތިޔަބޭފުޅާގެ އިންޓަނެޓް ބޭންކިންގ މަޢުލޫމާތު ބޭނުންކޮށްގެން ސީދާ ބޭންކުގެ އޭޕީއައިތަކާ ގުޅިގެންނެވެ. ބޭންކުތަކުގެ ސިސްޓަމްތަކަށް އަންނަ ބަދަލަކުން އެޕްގެ މަސައްކަތަށް ބުރޫއަރާފާނެއެވެ.\n\nފޯނު ނަންބަރުގެ މަޢުލޫމާތު ހޯދުމަށް ދިރާގާއި އުރީދޫގެ އޭޕީއައި ބޭނުންކުރެވެއެވެ.\n\nމި އެޕުން ތިޔަބޭފުޅާގެ އެއްވެސް އަމިއްލަ މަޢުލޫމާތެއް ނުވަތަ އެޕް ބޭނުންކުރާ ގޮތުގެ މަޢުލޫމާތެއް އެއްނުކުރާނެއެވެ. ހުރިހާ މަޢުލޫމާތެއް ރައްކާކުރެވޭނީ ހަމައެކަނި ތިޔަބޭފުޅާގެ ފޯނުގައެވެ.\n\nކުރިއަށް ވަޑައިގަތުމުން އަންނަނިވި ކަންކަމަށް އެއްބަސްވެވޭނެއެވެ:\n\n• ޚިދުމަތަށް މެދުކެނޑުމެއް ނުވަތަ މައްސަލައެއް ދިމާވެދާނެކަން\n• ބޭންކުން ތިޔަބޭފުޅާގެ އެކައުންޓަށް ފިޔަވަޅެއް އަޅާފާނެކަން\n• އެޕް ބޭނުންކުރުމުން ދިމާވެދާނެ އެއްވެސް ގެއްލުމަކަށް ޑިވެލޮޕަރު ޒިންމާނުވާނެކަން\n• މި އެޕް ބޭނުންކުރަނީ އަމިއްލަ ޒިންމާގައިކަން</string>
+    <string name="coming_soon">ވަރަށް އަވަހަށް އަންނީ</string>
+    <string name="next">ކުރިއަށް</string>
+    <string name="get_started">ފަށަމާ</string>
 
     <!-- Login -->
-    <string name="select_bank">ބޭންކެއް ހިޔާރު ކުރޭ</string>
-    <string name="select_bank_desc">ލޮގިން ވާ ބޭންކު ހިޔާރު ކުރޭ.</string>
-    <string name="mib_name">Maldives Islamic Bank</string>
-    <string name="mib_desc">ފައިސާނެޓް މޯބައިލް ބޭންކިން</string>
-    <string name="bml_name">Bank of Maldives</string>
-    <string name="bml_desc">BML އިންޓަނެޓް ބޭންކިން</string>
-    <string name="sign_in">ލޮގިން ވޭ</string>
-    <string name="sign_in_desc">Maldives Islamic Bank ގެ ކްރެޑެންޝަލް ދިވޭ.</string>
-    <string name="username">ޔޫޒަރ ނޭމް</string>
+    <string name="select_bank">ބޭންކު އިޚްތިޔާރުކުރޭ</string>
+    <string name="select_bank_desc">ލޮގިންވާން ބޭނުންވާ ބޭންކު ނަގާ</string>
+    <string name="mib_name">މޯލްޑިވްސް އިސްލާމިކް ބޭންކް</string>
+    <string name="mib_desc">ފައިސާނެޓް މޮބައިލް ބޭންކިންގ</string>
+    <string name="bml_name">ބޭންކް އޮފް މޯލްޑިވްސް</string>
+    <string name="bml_desc">ބީއެމްއެލް އިންޓަނެޓް ބޭންކިންގ</string>
+    <string name="fahipay_name">ފަހިޕޭ</string>
+    <string name="fahipay_desc">ޑިޖިޓަލް ވޮލެޓް</string>
+    <string name="fahipay_sign_in_desc">އައިޑީ ކާޑު ނަންބަރާއި ޕާސްވޯޑް ޖަހާ</string>
+    <string name="fahipay_id_card">އައިޑީ ކާޑު ނަންބަރު</string>
+    <string name="fahipay_totp_code">އޮތެންޓިކޭޓަރ ކޯޑު (6 ނަންބަރު)</string>
+    <string name="fahipay_totp_hint">އޮތެންޓިކޭޓަރ އެޕުން ލިބޭ ކޯޑު ޖަހާ</string>
+    <string name="fahipay_verify">ޔަގީން</string>
+    <string name="ooredoo_name">އޯރިޑޫ އެމް-ފައިސާ</string>
+    <string name="ooredoo_desc">މޮބައިލް ވޮލެޓް</string>
+    <string name="ooredoo_sign_in_desc">މޮބައިލް ނަންބަރާއި 4 އަދަދުގެ އެމް-ޕިން ޖަހާ</string>
+    <string name="ooredoo_phone">މޮބައިލް ނަންބަރު</string>
+    <string name="ooredoo_pin">އެމް-ޕިން</string>
+    <string name="sign_in">ލޮގިން</string>
+    <string name="sign_in_desc">އެމްއައިބީ އިންޓަނެޓް ބޭންކިންގ މަޢުލޫމާތު ޖަހާ</string>
+    <string name="bml_sign_in_desc">ބީއެމްއެލް އިންޓަނެޓް ބޭންކިންގ މަޢުލޫމާތު ޖަހާ</string>
+    <string name="username">ޔޫސަރނޭމް</string>
     <string name="password">ޕާސްވޯޑް</string>
-    <string name="otp_seed">OTP ސީޑް (TOTP ސިއްރު)</string>
-    <string name="otp_seed_hint">ތިޔަ އޮތެންޓިކޭޓަ ދިން Base32 ސިއްރު</string>
+    <string name="otp_seed">އޯޓީޕީ ސީޑް (ޓީއޯޓީޕީ ސީކްރެޓް)</string>
+    <string name="otp_seed_hint">އޮތެންޓިކޭޓަރ ސެޓަޕުން ލިބުނު ސީކްރެޓް ކޯޑު</string>
+    <string name="scan_otp_qr">އޯޓީޕީ ކިއުއާރު ސުކޭންކޮއްލާ</string>
     <string name="login">ލޮގިން</string>
 
     <!-- Lock screen -->
     <string name="unlock_app">ތިޖޫރީ ހުޅުވާ</string>
-    <string name="unlock_pin_subtitle">PIN ޖަހާ</string>
-    <string name="unlock_pattern_subtitle">ހުޅުވާ ޕެޓަން ކަހާ</string>
-    <string name="use_biometrics">ބަޔޮމެޓްރިކް ބޭނުން ކުރޭ</string>
-    <string name="biometric_prompt_subtitle">ފިންގަޕްރިންޓް ނުވަތަ މޫނު ބޭނުން ކޮށްގެން ހުޅުވާ</string>
-    <string name="biometric_negative_btn">PIN / ޕެޓަން ބޭނުން ކުރޭ</string>
-    <string name="unlock_failed">ދިމައެއް ނުވި — އަލުން ކަނޑޭ</string>
-    <string name="unlock_attempts_remaining">ދިމައެއް ނުވި — %d ފަހަރު ބާކީ</string>
-    <string name="unlock_locked_out">ވަރަށް ގިނަ ފަހަރު ނުކުރިހުރި. %d ސިކުންތު ފަހުން ލޮކް ހިލޭ.</string>
+    <string name="unlock_pin_subtitle">ޕިން ނަންބަރު ޖަހާ</string>
+    <string name="unlock_pattern_subtitle">ޕެޓަރން ކުރަހާ</string>
+    <string name="use_biometrics">ބަޔޯމެޓްރިކްސް ބޭނުންކުރޭ</string>
+    <string name="biometric_prompt_subtitle">އިނގިލީގެ ނިޝާން ނުވަތަ ފޭސް އައިޑީ ބޭނުންކުރޭ</string>
+    <string name="biometric_negative_btn">ޕިން / ޕެޓަން ބޭނުންކުރޭ</string>
+    <string name="unlock_failed">ނުބައި - އަލުން މަސައްކަތްކޮއްލާ</string>
+    <string name="unlock_attempts_remaining">ނުބައި - ބާކީ %d ފުރުޞަތު</string>
+    <string name="unlock_locked_out">ގިނަފަހަރު ނުބައިކޮށް ޖެހުމުން ބްލޮކްވެއްޖެ. %d ސިކުންތު ފަހުން އަލުން މަސައްކަތްކޮއްލާ.</string>
 
     <!-- Security setup -->
-    <string name="security_setup">އެޕް ރައްކާތެރި ކުރޭ</string>
-    <string name="security_setup_desc">ތިޖޫރީ ހުޅުވަން ބޭނުންވާ ގޮތެއް ހިޔާރު ކުރޭ.</string>
-    <string name="method_pin">PIN ކޯޑް</string>
-    <string name="method_pin_desc">4–8 ރިޔަލެއްގެ ނަންބަރު PIN</string>
-    <string name="method_pattern">ޕެޓަން ކަހާ</string>
-    <string name="method_pattern_desc">4 ނުވަތަ އެއަށްވުރެ ގިނަ ތިކި ގުޅުވާ</string>
-    <string name="enter_pin">PIN ޖަހާ</string>
-    <string name="confirm_pin">PIN ކަށަވަރު ކުރޭ</string>
-    <string name="pin_min_digits">މަދުވެގެން 4 ރިޔަލ، ގިނަވެގެން 8</string>
-    <string name="pin_no_match">PIN ދިމައެއް ނުވި — އަލުން ކަނޑޭ</string>
-    <string name="draw_pattern">ޕެޓަން ކަހާ</string>
-    <string name="confirm_pattern">ޕެޓަން ކަށަވަރު ކުރޭ</string>
-    <string name="pattern_min_dots">މަދުވެގެން 4 ތިކި ގުޅުވާ</string>
-    <string name="pattern_draw_again">އެ ޕެޓަން އަލުން ކަހާ</string>
-    <string name="pattern_no_match">ޕެޓަން ދިމައެއް ނުވި — އަލުން ކަހާ</string>
-    <string name="biometric_title">ބަޔޮމެޓްރިކް ބޭނުން ކުރަންތަ؟</string>
-    <string name="biometric_desc">ފިންގަޕްރިންޓް ނުވަތަ މޫނު ބޭނުން ކޮށްގެން ހުޅުވޭ.</string>
-    <string name="biometric_security_note">ބަޔޮމެޓްރިކް ފަސޭހަ ނަމަވެސް PIN ނުވަތަ ޕެޓަނަށްވުރެ ތަންކޮޅެއް ކަށަވަރެއް ނޫން. ރައްކާތެރިކަން ބޭނުން ނަމަ PIN ނުވަތަ ޕެޓަން ހިޔާރު ކުރޭ.</string>
-    <string name="enable_biometrics">ބަޔޮމެޓްރިކް ހިންގާ</string>
-    <string name="skip_biometrics">ސްކިޕް — PIN/ޕެޓަން ބޭނުން ކުރޭ</string>
+    <string name="security_setup">އެޕް ރައްކާތެރިކުރޭ</string>
+    <string name="security_setup_desc">އެޕް ތަޅުލުމަށް ބޭނުންކުރާނެ ގޮތެއް އިޚްތިޔާރުކުރޭ.</string>
+    <string name="security_already_configured">އެޕް ލޮކް ކުރެވިފައި</string>
+    <string name="security_already_configured_desc">އެޕް ތަޅުލާނެ ގޮތް ވަނީ ސެޓްކުރެވިފައި.</string>
+
+    <string name="method_pin">ޕިން ކޯޑު</string>
+    <string name="method_pin_desc">4 އާއި 8 އަދަދާ ދެމެދުގެ ނަންބަރެއް</string>
+    <string name="method_pattern">ޕެޓަރން</string>
+    <string name="method_pattern_desc">މަދުވެގެން 4 ތިކި ގުޅުވައިގެން ޕެޓަރން ކުރަހާ</string>
+    <string name="enter_pin">ޕިން ކޯޑެއް ޚިޔާރުކުރޭ</string>
+    <string name="confirm_pin">ޕިން ކޯޑު ޔަގީންކުރޭ</string>
+    <string name="pin_min_digits">މަދުވެގެން 4 އަދަދު، ގިނަވެގެން 8 އަދަދު</string>
+    <string name="pin_no_match">ޕިން ކޯޑު ދިމައެއްނުވޭ - އަލުން ޖަހާ</string>
+    <string name="draw_pattern">ޕެޓަރންއެއް ކުރަހާ</string>
+    <string name="confirm_pattern">ޕެޓަރން ޔަގީންކުރޭ</string>
+    <string name="pattern_min_dots">މަދުވެގެން 4 ތިކި ގުޅުވާލާ</string>
+    <string name="pattern_draw_again">އަލުން އެ ޕެޓަން ކުރަހާ</string>
+    <string name="pattern_no_match">ޕެޓަން ދިމައެއްނުވޭ - އަލުން ކުރަހާ</string>
+    <string name="biometric_title">ބަޔޯމެޓްރިކްސް ބޭނުންކުރަންތޯ؟</string>
+    <string name="biometric_desc">ޕިން ނުވަތަ ޕެޓަންގެ ބަދަލުގައި އިނގިލީގެ ނިޝާން ނުވަތަ ފޭސް އައިޑީއިން އެޕް ހުޅުވާލެވޭނެ.</string>
+    <string name="biometric_security_note">ބަޔޯމެޓްރިކްސްއަކީ ފަސޭހަ ގޮތެއް ނަމަވެސް، އެންމެ ރައްކާތެރި ގޮތަކީ ޕިން ނުވަތަ ޕެޓަން ބޭނުންކުރުން.</string>
+    <string name="enable_biometrics">ބަޔޯމެޓްރިކްސް އޮންކުރޭ</string>
+    <string name="skip_biometrics">ބޭނުމެއްނޫން - ހަމައެކަނި ޕިން/ޕެޓަން</string>
     <string name="back">ފަހަތަށް</string>
 
     <!-- Navigation -->
-    <string name="nav_dashboard">ޑޭޝްބޯޑް</string>
-    <string name="nav_add_account">އެކައުންޓް އިތުރު ކުރޭ</string>
+    <string name="nav_dashboard">ޑޭޝްބޯޑު</string>
+    <string name="nav_add_account">އެކައުންޓެއް އިތުރުކުރޭ</string>
     <string name="nav_accounts">އެކައުންޓްތައް</string>
     <string name="nav_contacts">ކޮންޓެކްޓްތައް</string>
-    <string name="nav_activities">ހަރަކާތްތައް</string>
-    <string name="nav_transfer_history">ޓްރާންސެކްޝަން ތާރީހް</string>
-    <string name="nav_finances">ފައިނޭންސް</string>
-    <string name="nav_pay_with_card">ކާޑްތައް</string>
-    <string name="nav_desc_pay_with_card">ކާޑް މެނޭޖްކޮށް ފައިސާ ދައްކާ</string>
-    <string name="nav_settings">ސެޓިންގ</string>
-    <string name="nav_desc_accounts">ހުރިހާ ބޭންކް އެކައުންޓްތައް ބަލާ</string>
-    <string name="nav_desc_contacts">ޓްރާންސްފަ ކޮންޓެކްޓްތައް މެނޭޖް ކުރޭ</string>
-    <string name="nav_desc_transfer">ކޮންޓެކްޓަކަށް ފައިސާ ފޮނުވާ</string>
-    <string name="nav_desc_pay_mv_qr">PayMV QR ކޯޑް ސްކޭން ނުވަތަ ތައްޔާރު ކުރޭ</string>
-    <string name="nav_desc_activities">ފަހުގެ ޓްރާންސްފަތައް ބަލާ</string>
-    <string name="nav_desc_transfer_history">އެކައުންޓް ތަކުގެ ޓްރާންސެކްޝަން ތާރީހް</string>
-    <string name="nav_desc_finances">ލޯން އަދި ފައިނޭންސިންގ</string>
-    <string name="nav_desc_otp">OTP ކޯޑް ތައްޔާރު ކުރޭ</string>
-    <string name="nav_desc_settings">އެޕްލިކޭޝަންގެ ތަރުތީބު</string>
+    <string name="nav_activities">އެންމެ ފަހުގެ މުޢާމަލާތްތައް</string>
+    <string name="nav_transfer_history">ހިސްޓްރީ</string>
+    <string name="nav_finances">ފައިނޭންސިންގ</string>
+    <string name="nav_card_settings">ކާޑު ސެޓިންގްސް</string>
+    <string name="nav_otp">އޯޓީޕީ ކޯޑު</string>
+    <string name="nav_settings">ސެޓިންގްސް</string>
+    <string name="nav_more">އިތުރު</string>
+    <string name="nav_desc_accounts">ހުރިހާ އެކައުންޓެއްގެ މަޢުލޫމާތު</string>
+    <string name="nav_desc_contacts">ފައިސާ ފޮނުވާ ކޮންޓެކްޓްތައް</string>
+    <string name="nav_desc_transfer">ފައިސާ ފޮނުއްވުމަށް</string>
+    <string name="nav_desc_pay_mv_qr">ޕޭއެމްވީ ކިއުއާރު ހެދުމަށް ނުވަތަ ސުކޭން ކުރުމަށް</string>
+    <string name="nav_desc_activities">އެންމެ ފަހުން ފޮނުވި ފައިސާގެ ތަފްޞީލު</string>
+    <string name="nav_desc_transfer_history">އެކައުންޓްތަކުގެ ފުރިހަމަ ހިސްޓްރީ</string>
+    <string name="nav_desc_finances">ލޯނާއި ފައިނޭންސިންގ މަޢުލޫމާތު</string>
+    <string name="nav_desc_pay_with_card">ކާޑުތައް ބަލަހައްޓުމާއި ކާޑުން ފައިސާ ދެއްކުން</string>
+    <string name="nav_desc_otp">އޮތެންޓިކޭޝަނަށް އޯޓީޕީ ކޯޑު ހޯދުން</string>
+    <string name="nav_desc_settings">އެޕްގެ ސެޓިންގްސް ބަދަލުކުރުމަށް</string>
     <string name="nav_open_drawer">ނެވިގޭޝަން ހުޅުވާ</string>
     <string name="nav_close_drawer">ނެވިގޭޝަން ލައްޕާ</string>
-    <string name="work_in_progress">ތައްޔާރުވަމުން ދަނީ</string>
-    <string name="mib_qr_nfc_not_supported">Skill issue on MIB side, Not supported</string>
+    <string name="work_in_progress">މަސައްކަތް ކުރިއަށްދަނީ</string>
+    <string name="press_back_to_exit">އެޕުން ނުކުންނެވުމަށް އަނެއްކާވެސް ފަހަތަށް އޮބާލާ</string>
 
     <!-- Dashboard -->
-    <string name="dashboard_quick_actions">ހަލުވި ހަރަކާތްތައް</string>
-    <string name="balance_mvr">ޖުމްލަ MVR</string>
-    <string name="balance_usd">ޖުމްލަ USD</string>
-    <string name="card_support_wip">ކާޑް ސަޕޯޓް</string>
-    <string name="transfer">ޓްރާންސްފަ</string>
-    <string name="pay_mv_qr">PayMV QR</string>
+    <string name="dashboard_pending_finances">ނުދައްކާ ހުރި ފައިނޭންސް</string>
+    <string name="dashboard_quick_actions">އަވަސް ޚިދުމަތްތައް</string>
+    <string name="balance_mvr">ޖުމްލަ ދިވެހި ރުފިޔާ</string>
+    <string name="balance_usd">ޖުމްލަ ޔޫއެސް ޑޮލަރު</string>
+    <string name="balance_mvr_credit">ލިބެންހުރި ކްރެޑިޓް (ރުފިޔާ)</string>
+    <string name="balance_usd_credit">ލިބެންހުރި ކްރެޑިޓް (ޑޮލަރު)</string>
+    <string name="card_support_wip">ކާޑުގެ ޚިދުމަތް</string>
+    <string name="transfer">ޓްރާންސްފަރ</string>
+    <string name="pay_mv_qr">ޕޭއެމްވީ ކިއުއާރު</string>
+
+    <!-- PayMV QR Generator -->
+    <string name="paymvqr_select_account">އެކައުންޓް ނަގާ</string>
+    <string name="paymvqr_amount_hint">އަދަދު (ބޭނުންނަމަ)</string>
+    <string name="paymvqr_share">ޙިއްޞާކޮއްލާ</string>
+    <string name="paymvqr_save_image">ފޮޓޯ ސޭވްކޮއްލާ</string>
+    <string name="paymvqr_saved">ކިއުއާރު ފޮޓޯ ގެލަރީއަށް ސޭވްކުރެވިއްޖެ</string>
+    <string name="paymvqr_save_failed">ފޮޓޯ ސޭވެއް ނުކުރެވުނު</string>
+    <string name="paymvqr_include_phone">ފޯނު ނަންބަރު ހިމަނާ</string>
+    <string name="paymvqr_reference_hint">ރެފަރެންސް (ބޭނުންނަމަ)</string>
+
+    <!-- Toolbar -->
+    <string name="action_lock">އެޕް ތަޅުލާ</string>
+    <string name="action_hide_amounts">މަޢުލޫމާތު ފޮރުވާ</string>
+    <string name="action_show_amounts">މަޢުލޫމާތު ދައްކާ</string>
+    <string name="autolock_warning_title">އެޕް ތަޅުލެވެނީ</string>
+    <string name="autolock_warning_message">%d ސިކުންތު ތެރޭގައި ތަޅުލެވޭނެ</string>
+    <string name="autolock_stay">ނުތަޅުލާ މަޑުކުރޭ</string>
+    <string name="autolock_lock_now">މިހާރު ތަޅުލާ</string>
 
     <!-- Settings -->
-    <string name="settings_bottom_bar_shortcuts">ތިރި ބާ ޝޯޓްކަޓްތައް</string>
-    <string name="settings_bottom_bar_select">ބަޓަން ހިޔާރު ކުރޭ</string>
-    <string name="settings_bottom_bar_slot_1">ތަން 1</string>
-    <string name="settings_bottom_bar_slot_2">ތަން 2</string>
-    <string name="settings_bottom_bar_slot_3">ތަން 3</string>
+    <string name="settings_security">ރައްކާތެރިކަން</string>
+    <string name="settings_change_lock">ޕިން / ޕެޓަން ބަދަލުކުރުމަށް</string>
+    <string name="settings_biometrics">ބަޔޯމެޓްރިކްސް ބޭނުންކުރުމަށް</string>
+    <string name="settings_biometrics_unavailable">މި ފޯނުގައި ބަޔޯމެޓްރިކްސް ސެޓްއަޕްކޮށްފައެއް ނެތް</string>
+    <string name="settings_biometrics_unlock">އެޕް ހުޅުވުމަށް</string>
+    <string name="settings_biometrics_transfer">ފައިސާ ފޮނުވުން ކަށަވަރުކުރުމަށް</string>
+    <string name="biometric_transfer_title">ޓްރާންސްފަރ ކަށަވަރުކުރުމަށް</string>
+    <string name="settings_autolock">އަމިއްލައަށް ތަޅުލެވުން</string>
+    <string name="autolock_off">އަމިއްލައަށް ތަޅެއްނުލެވޭނެ</string>
+    <string name="autolock_30s">30 ސިކުންތު</string>
+    <string name="autolock_1m">1 މިނެޓު</string>
+    <string name="autolock_3m">3 މިނެޓު</string>
+    <string name="autolock_5m">5 މިނެޓު</string>
     <string name="theme">ތީމް</string>
-    <string name="theme_system">ސިސްޓަމް</string>
-    <string name="theme_light">ލައިޓް</string>
-    <string name="theme_dark">ޑާކް</string>
+    <string name="theme_system">ފޯނުގެ ސެޓިންގްސްއާ އެއްގޮތަށް</string>
+    <string name="theme_light">އަލި</string>
+    <string name="theme_dark">އަނދިރި</string>
+    <string name="settings_pitch_black">ގަދަ އަނދިރި (އޯލެޑް)</string>
+    <string name="settings_accent_color">މައި ކުލަ</string>
+    <string name="settings_receipts">ރަސީދު</string>
+    <string name="settings_always_fullscreen_receipt">މުޅި ސްކްރީނުން ރަސީދު ދައްކާ</string>
+    <string name="accent_blue">ނޫ</string>
+    <string name="accent_orange">ރަތް</string>
+    <string name="accent_green">ފެހި</string>
+    <string name="accent_custom">ބޭނުން ކުލައެއް</string>
+    <string name="accent_custom_pick">ބޭނުން ކުލައެއް އިޚްތިޔާރުކުރޭ</string>
+    <string name="accent_custom_hint">#RRGGBB ކުލައިގެ ކޯޑު</string>
+    <string name="accent_invalid_color">ނުބައި ކުލަ ކޯޑެއް - ރަނގަޅު ކޯޑެއް ޖަހާ</string>
     <string name="language">ބަސް</string>
     <string name="lang_english">English</string>
     <string name="lang_dhivehi">ދިވެހި</string>
-    <string name="settings_privacy">ޕްރައިވެސީ</string>
-    <string name="settings_auto_unlock_pin">ރަނގަޅު ޕިން އެޅުމުން ހުޅުވޭ</string>
-    <string name="settings_auto_unlock_pin_desc">ޕިންގެ ދިގުމިނާ އެއްވަރަށް ޑިޖިޓް ލިޔުމުން ހުޅުވިދާ</string>
-    <string name="settings_block_screenshots">ސްކްރީންޝޮޓް ބްލޮކްކުރޭ</string>
-    <string name="settings_block_screenshots_desc">ރިސެންޓްސް ސްކްރީނުންނާއި ސްކްރީން ކެޕްޗާ ހުއްޓުވައިދޭ</string>
+    <string name="settings_privacy">ޕްރައިވަސީ</string>
+    <string name="settings_hide_amounts">ފައިސާގެ އަދަދުތައް ނިވާކުރުން</string>
+    <string name="settings_hide_amounts_desc">އެޕްގެ ހުރިހާ ތަނަކުން އެކައުންޓް ބެލެންސާއި ފައިސާގެ އަދަދުތައް ނިވާކޮށްދޭނެ</string>
+    <string name="settings_auto_unlock_pin">ރަނގަޅު ޕިން ޖެހުމުން އަމިއްލައަށް ހުޅުވޭ</string>
+    <string name="settings_auto_unlock_pin_desc">ޕިން ކޯޑު ހަމަވުމާއެކު އަމިއްލައަށް އެޕް ހުޅުވޭނެ</string>
+    <string name="settings_block_screenshots">ސުކްރީންޝޮޓް ނެގުން ހުއްޓުވާ</string>
+    <string name="settings_block_screenshots_desc">އެޕްގެ ސުކްރީންޝޯޓް ނެގުމާއި ރީސެންޓްސްއިން ފެނުން ހުއްޓުވޭނެ</string>
     <string name="settings_cache">ކޭޝް</string>
-    <string name="settings_clear_cache">ކޭޝް ސާފުކުރޭ</string>
+    <string name="settings_clear_cache">ކޭޝް ސާފުކޮއްލާ</string>
     <string name="settings_cache_cleared">ކޭޝް ސާފުކުރެވިއްޖެ</string>
+    <string name="settings_navigation">ނެވިގޭޝަން</string>
+    <string name="settings_nav_drawer">ސައިޑް މެނޫ</string>
+    <string name="settings_nav_bottom">ތިރި މެނޫ</string>
+    <string name="settings_nav_circular">ބުރު މެނޫ</string>
+    <string name="settings_appearance">ފެންނަ ގޮތް</string>
+    <string name="settings_circular_shortcuts">ބުރު މެނޫ ޝޯޓްކަޓް</string>
+    <string name="settings_bottom_bar_shortcuts">ތިރި މެނޫ ޝޯޓްކަޓް</string>
+    <string name="settings_bottom_bar_show_labels">ތިރި މެނޫގެ ނަންތައް އަބަދުވެސް ދައްކާ</string>
+    <string name="settings_bottom_bar_select">ފިއްތައް އިޚްތިޔާރުކުރޭ</string>
+    <string name="settings_bottom_bar_slot_1">ޖާގަ 1</string>
+    <string name="settings_bottom_bar_slot_2">ޖާގަ 2</string>
+    <string name="settings_bottom_bar_slot_3">ޖާގަ 3</string>
+    <string name="settings_privacy_security">ޕްރައިވަސީ އާއި ރައްކާތެރިކަން</string>
+    <string name="settings_storage">ސްޓޯރޭޖް</string>
     <string name="settings_logins">ލޮގިންތައް</string>
-    <string name="settings_desc_logins">ބޭންކް ލޮގިންތައް މެނޭޖް ކުރޭ</string>
-    <string name="settings_desc_appearance">ތީމް، ބަސް، އަދި ދައްކުވާ ގޮތް</string>
-    <string name="settings_desc_privacy_security">އެޕް ލޮކް، ޕިން، އަދި ސަލާމަތީ ސެޓިންގ</string>
-    <string name="settings_desc_storage">ކޭޝް ޑޭޓާ އަދި ސްޓޯރޭޖް</string>
+    <string name="settings_desc_logins">ބޭންކު އެކައުންޓްތަކުގެ ލޮގިން މެނޭޖްކުރުމަށް</string>
+    <string name="settings_desc_appearance">ތީމް، ބަސް، އަދި ފެންނަ ގޮތުގެ ސެޓިންގްސް</string>
+    <string name="settings_desc_privacy_security">އެޕް ލޮކް، ޕިން، އަދި ރައްކާތެރިކަމުގެ ސެޓިންގްސް</string>
+    <string name="settings_desc_storage">ކޭޝް ކުރެވިފައިވާ މަޢުލޫމާތާއި ސްޓޯރޭޖް މެނޭޖްކުރުމަށް</string>
+    <string name="settings_notifications">ނޯޓިފިކޭޝަން</string>
+    <string name="settings_desc_notifications">އަލަށް ހިނގާ ފައިސާގެ މުޢާމަލާތްތަކުގެ ނޯޓިފިކޭޝަން</string>
+    <string name="settings_notif_section">ބެކްގްރައުންޑް ޗެކް</string>
+    <string name="settings_notif_enable">ބެކްގްރައުންޑް ނޯޓިފިކޭޝަން އޮންކުރޭ</string>
+    <string name="settings_notif_enable_desc">އާ މުޢާމަލާތްތައް ހިނގުމުން ވަގުތުން ނޯޓިފިކޭޝަން ލިބޭނެ</string>
+    <string name="settings_notif_description">އެޕް ބެކްގްރައުންޑްގައި ހިނގަމުންދާނެއެވެ. އަދި އާ މުޢާމަލާތެއް ހިނގައިފިނަމަ ނޮޓިފިކޭޝަން ފޮނުވާނެއެވެ. މިކަން ހިނގާއިރު ސްޓޭޓަސް ބާގައި ނޯޓިފިކޭޝަނެއް އިންނާނެއެވެ.</string>
+    <string name="settings_notif_open_system">ނޯޓިފިކޭޝަން ސެޓިންގްސް</string>
+    <string name="settings_notif_channels_desc">އަޑާއި ނޯޓިފިކޭޝަން ސެޓިންގްސް ބަދަލުކުރުމަށް</string>
+    <string name="notif_service_title">ތިޖޫރީ</string>
+    <string name="notif_service_desc">އާ މުޢާމަލާތްތައް ޗެކްކުރެވެނީ...</string>
+    <string name="notif_channel_service">ބެކްގްރައުންޑް ޚިދުމަތް</string>
+    <string name="settings_about">އެޕާ ބެހޭ</string>
+    <string name="settings_desc_about">އެޕްގެ މަޢުލޫމާތާއި، ވާޝަން، އަދި ގާނޫނީ</string>
+    <string name="about_version">ވާޝަން %s</string>
+    <string name="about_short_desc">ތިޖޫރީ އަކީ ރާއްޖޭގެ ބޭންކިންގ ޚިދުމަތްތަކަށް ޚާއްޞަކޮށްގެން ތައްޔާރުކުރެވިފައިވާ އެންޑްރޮއިޑް އެޕެއް.</string>
+    <string name="about_terms">ޚިދުމަތުގެ އުޞޫލުތައް</string>
+    <string name="about_donate_title">އެޕް ކުރިއެރުވުމަށް އެހީތެރިވެދެއްވާ</string>
+    <string name="about_donate_desc">މި އެޕަކީ ތިޔަބޭފުޅާއަށް ފައިދާހުރި އެޕެއްނަމަ، އެޕް އިތުރަށް ތަރައްޤީކުރުމަށް ކުޑަ އެހީއެއް ވެދެއްވާ.</string>
+    <string name="about_donate_mvr">ދިވެހި ރުފިޔާއިން އެހީވުމަށް</string>
+    <string name="about_donate_usd">ޑޮލަރުން އެހީވުމަށް</string>
+    <string name="about_legal">ތިޖޫރީ އަކީ އެއްވެސް ބޭންކަކާ ނުވަތަ މާލީ އިދާރާއަކާ ގުޅުމެއްނެތި އަމިއްލައަށް އުފައްދާފައިވާ އެޕެކެވެ.\n\nމި އެޕް މަސައްކަތްކުރަނީ ތިޔަބޭފުޅާގެ އިންޓަނެޓް ބޭންކިންގ މަޢުލޫމާތު ބޭނުންކޮށްގެން ސީދާ ބޭންކުގެ އޭޕީއައިތަކާ ގުޅިގެންނެވެ. ބޭންކުތަކުގެ ސިސްޓަމްތަކަށް އަންނަ ބަދަލަކުން އެޕްގެ މަސައްކަތަށް ބުރޫއަރާފާނެއެވެ.\n\nފޯނު ނަންބަރުގެ މަޢުލޫމާތު ހޯދުމަށް ދިރާގާއި އޯރިޑޫގެ އޭޕީއައި ބޭނުންކުރެވެއެވެ.\n\nމި އެޕުން ތިޔަބޭފުޅާގެ އެއްވެސް އަމިއްލަ މަޢުލޫމާތެއް ނުވަތަ އެޕް ބޭނުންކުރާ ގޮތުގެ މަޢުލޫމާތެއް އެއްނުކުރާނެއެވެ. ހުރިހާ މަޢުލޫމާތެއް ރައްކާކުރެވޭނީ ހަމައެކަނި ތިޔަބޭފުޅާގެ ފޯނުގައެވެ.</string>
     <string name="settings_logout">ލޮގްއައުޓް</string>
-    <string name="settings_logout_confirm_title">%s އިން ލޮގްއައުޓް ވަންތަ؟</string>
-    <string name="settings_logout_confirm_message">ހުރިހާ ކޭޝް ޑޭޓާ ސާފުވެ، ބާކީ ހުރި އެކައުންޓްތައް އަލުން ލޯޑްވާނެ.</string>
+    <string name="settings_logout_confirm_title">%s އިން ލޮގްއައުޓްވާންވީތޯ؟</string>
+    <string name="settings_logout_confirm_message">ރައްކާކުރެވިފައިވާ ހުރިހާ މަޢުލޫމާތެއް ފުހެވި، ބާކީ ހުރި އެކައުންޓްތައް ރީފްރެޝްކުރެވޭނެ.</string>
     <string name="login_detail_name">ނަން</string>
-    <string name="login_detail_username">ޔޫޒަރ ނޭމް</string>
+    <string name="login_detail_username">ޔޫސަރނޭމް</string>
     <string name="login_detail_email">އީމެއިލް</string>
-    <string name="login_detail_mobile">މޮބައިލް</string>
-    <string name="login_detail_customer_id">ކަސްޓަމަ ID</string>
-    <string name="login_detail_id_card">ID ކާޑް</string>
+    <string name="login_detail_mobile">މޮބައިލް ނަންބަރު</string>
+    <string name="login_detail_customer_id">ކަސްޓަމަރ އައިޑީ</string>
+    <string name="login_detail_id_card">އައިޑީ ކާޑު</string>
     <string name="login_detail_profiles">ޕްރޮފައިލްތައް</string>
-    <string name="close">ބަންދު</string>
+    <string name="profile_image_title">ޕްރޮފައިލް ފޮޓޯ</string>
+    <string name="profile_image_select">ފޮޓޯ އިޚްތިޔާރުކުރޭ</string>
+    <string name="profile_image_camera">ކެމެރާއިން ފޮޓޯއެއް ނަގާ</string>
+    <string name="profile_image_remove">ފުހެލާ</string>
+    <string name="profile_image_uploading">ފޮޓޯ އަޕްލޯޑުކުރެވެނީ…</string>
+    <string name="profile_image_upload_failed">ފޮޓޯ އަޕްލޯޑެއް ނުކުރެވުނު</string>
+    <string name="profile_image_deleting">ފޮޓޯ ފުހެލެވެނީ…</string>
+    <string name="close">ލައްޕާ</string>
+    <string name="save">ސޭވްކުރޭ</string>
     <string name="cancel">ކެންސަލް</string>
+    <string name="verify">ޔަގީން</string>
 
-    <string name="settings_bottom_bar_show_labels">ބޮޓަމް ބާ ލޭބަލް އަބަދުވެސް ދެއްކުން</string>
+    <!-- BML business OTP -->
+    <string name="bml_business_otp_sent">%s މެދުވެރިކޮށް އޯޓީޕީ ފޮނުވިއްޖެ</string>
 
     <!-- Home -->
+    <string name="transfer_same_account">މިއީ ފައިސާ ފޮނުވާ އެކައުންޓް</string>
     <string name="accounts">އެކައުންޓްތައް</string>
-    <string name="available_balance">ލިބެން ހުރި ބެލެންސް</string>
+    <string name="cards">ކާޑުތައް</string>
+    <string name="available_balance">ބޭނުންކުރެވެން ހުރި ބެލެންސް</string>
+    <string name="account_blocked_label">%1$s ހިފެހެއްޓިފައި</string>
+    <string name="dashboard_blocked_mvr">ހިފެހެއްޓިފައިވާ ރުފިޔާ</string>
+    <string name="dashboard_blocked_usd">ހިފެހެއްޓިފައިވާ ޑޮލަރު</string>
+    <string name="dashboard_overdue">މުއްދަތު ހަމަވެފައިވާ ފައިނޭންސް</string>
+
+    <!-- Transfer -->
+    <string name="transfer_tab_quick">އަވަސް ޓްރާންސްފަރ</string>
+    <string name="transfer_tab_contacts">ކޮންޓެކްޓްތައް</string>
+    <string name="transfer_from">ފައިސާ ފޮނުވާ އެކައުންޓް</string>
+    <string name="transfer_to">އެކައުންޓް ނަންބަރު ނުވަތަ ފަވާރާ އައިޑީ</string>
+    <string name="transfer_label_from">ފޮނުވާ އެކައުންޓް</string>
+    <string name="transfer_label_to">ލިބޭ އެކައުންޓް</string>
+    <string name="transfer_select_service">ޚިދުމަތް އިޚްތިޔާރުކުރޭ</string>
+    <string name="transfer_fahipay_phone_only">ފަހިޕޭއިން ފައިސާ ފޮނުވޭނީ 7 އަދަދުގެ ފޯނު ނަންބަރަކަށް</string>
+    <string name="transfer_my_accounts">އަމިއްލަ އެކައުންޓްތައް</string>
+    <string name="transfer_same_as_from">މިއީ ފައިސާ ފޮނުވާ އެކައުންޓް</string>
+    <string name="transfer_lookup_account">އެކައުންޓް ހޯދާ</string>
+    <string name="transfer_clear_recipient">ލިބޭ ފަރާތް ފުހެލާ</string>
+    <string name="transfer_pick_contact">ކޮންޓެކްޓެއް ނަގާ</string>
+    <string name="transfer_scan_qr">ކިއުއާރުން ފައިސާ ދެއްކުމަށް</string>
+    <string name="qr_pick_image">ފޮޓޯއެއް ނަގާ</string>
+    <string name="transfer_qr_invalid">މި ކިއުއާރު ކޯޑު ބޭނުމެއް ނުކުރެވޭނެ</string>
+    <string name="card_qr_paymv_unsupported">ކާޑުން ޕޭއެމްވީ ކިއުއާރަށް ފައިސާއެއް ނުދެއްކޭނެ - ޓްރާންސްފަރއަށް ބަދަލުކުރެވެނީ</string>
+    <string name="qr_camera_permission_title">ކެމެރާގެ ހުއްދަ ބޭނުންވޭ</string>
+    <string name="qr_camera_permission_message">ކިއުއާރު ސުކޭންކުރުމަށް ކެމެރާގެ ހުއްދަ ބޭނުންވެއެވެ. ސެޓިންގްސްއިން ހުއްދަ ދެއްވާ.</string>
+    <string name="camera_permission_profile_message">ފޮޓޯ ނެގުމަށް ކެމެރާގެ ހުއްދަ ބޭނުންވެއެވެ. ސެޓިންގްސްއިން ހުއްދަ ދެއްވާ.</string>
+    <string name="go_to_settings">ސެޓިންގްސްއަށް ދޭ</string>
+    <string name="transfer_select_source_first">ފުރަތަމަ ފައިސާ ފޮނުވާ އެކައުންޓް ނަގާ</string>
+    <string name="transfer_no_from_account">ފުރަތަމަ ފައިސާ ފޮނުވާނެ އެކައުންޓެއް އިޚްތިޔާރުކުރޭ</string>
+    <string name="transfer_enter_account_first">ފުރަތަމަ އެކައުންޓް ނަންބަރު ޖަހާ</string>
+    <string name="transfer_account_not_found">އެކައުންޓެއް ނުފެނުނު</string>
+    <string name="transfer_session_unavailable">ސެޝަން މުއްދަތު ހަމަވެއްޖެ - އަލުން ލޮގިންވެވަޑައިގަންނަވާ</string>
+    <string name="transfer_amount">އަދަދު</string>
+    <string name="transfer_remarks">ތަފްޞީލު / ރިމާކްސް</string>
+    <string name="transfer_confirm">ޔަގީން</string>
+    <string name="transfer_success">ފައިސާ ފޮނުވިއްޖެ</string>
+    <string name="transfer_bml_contact_required_title">ކޮންޓެކްޓް ސޭވްކޮއްލާ</string>
+    <string name="transfer_bml_contact_required_msg">ލިބޭ ފަރާތުގެ އެކައުންޓް ކަރަންސީ ކަށަވަރެއް ނުކުރެވުނެވެ.\n\nމި ފަރާތް ކޮންޓެކްޓެއްގެ ގޮތުގައި ސޭވްކޮށް، ރަނގަޅު ކަރަންސީ އިޚްތިޔާރުކުރުމަށްފަހު އަލުން މަސައްކަތްކޮއްލާ.</string>
+    <string name="transfer_bml_contact_required_msg_bml_limit">ބީއެމްއެލް ނޫން އެކައުންޓަކަށް ޑޮލަރު ފޮނުވޭނީ އެ ފަރާތެއް ކޮންޓެކްޓެއްގެ ގޮތުގައި ސޭވްކުރުމަށްފަހުގައެވެ.\n\nމި ފަރާތް ކޮންޓެކްޓެއްގެ ގޮތުގައި ސޭވްކުރުމަށްފަހު އަލުން މަސައްކަތްކޮއްލާ.</string>
+    <string name="transfer_missing_internal_id">އެކައުންޓް މަޢުލޫމާތު ފުރިހަމައެއް ނޫން - އަލުން ލޮގިންވެވަޑައިގަންނަވާ.</string>
+    <string name="transfer_verify_payment">ފައިސާ ދެއްކުން ކަށަވަރުކޮއްލާ</string>
+    <string name="transfer_send_otp_via">ކޯޑު ފޮނުވާނެ ގޮތް</string>
+    <string name="transfer_otp_code_hint">ކަށަވަރުކުރާ ކޯޑު</string>
+
+    <!-- BML QR Pay -->
+    <string name="bml_qr_looking_up">ވިޔަފާރީގެ މަޢުލޫމާތު ހޯދެނީ…</string>
+    <string name="bml_qr_lookup_failed">ވިޔަފާރީގެ މަޢުލޫމާތު ލިބޭގޮތެއް ނުވި</string>
+    <string name="transfer_bml_txn_lookup_failed">މި ޓްރާންސެކްޝަން އައިޑީގެ މަޢުލޫމާތު ލިބޭގޮތެއް ނުވި</string>
+    <string name="bml_card_pay_no_verified">ކަށަވަރުކުރެވިފައިވާ ކާޑެއް ނެތް. ފުރަތަމަ ކާޑު މެނޭޖްކުރާ ބައިން ބީއެމްއެލް ކާޑެއް ކަށަވަރުކޮއްލާ.</string>
+    <string name="bml_card_pay_already_paid">މި ފައިސާ ދައްކާ ނިމިފައި</string>
+    <string name="bml_qr_payment_success">ފައިސާ ދެއްކިއްޖެ</string>
+    <string name="bml_qr_select_account">ފައިސާ ދައްކާނެ ބީއެމްއެލް އެކައުންޓެއް އިޚްތިޔާރުކުރޭ</string>
+
+    <!-- Accounts -->
+    <string name="accounts_empty">އެކައުންޓެއް ނުފެނުނު</string>
+
+    <!-- Contacts -->
+    <string name="contacts_empty">ކޮންޓެކްޓެއް ނުފެނުނު</string>
+    <string name="contacts_search_hint">ކޮންޓެކްޓް ހޯދާ</string>
+    <string name="contacts_tab_recents">އެންމެ ފަސް</string>
+    <string name="recents_remove">ލިސްޓުން އުނިކުރޭ</string>
+    <string name="contacts_tab_all">ހުރިހާ</string>
+
+    <!-- Add Contact -->
+    <string name="contact_add">ކޮންޓެކްޓެއް އިތުރުކުރޭ</string>
+    <string name="contact_save_to">އެކައުންޓް ސޭވްކުރޭ</string>
+    <string name="contact_alias">ނަން / ވަނަން</string>
+    <string name="contact_currency">ކަރަންސީ</string>
+    <string name="contact_group">ގްރޫޕް</string>
+    <string name="contact_no_group">ގްރޫޕެއް ނެތި</string>
+    <string name="contact_save">ކޮންޓެކްޓް ސޭވްކުރޭ</string>
+    <string name="contact_image">ފޮޓޯ އަޕްލޯޑުކޮއްލާ</string>
+    <string name="contact_saved">ކޮންޓެކްޓް ސޭވްކުރެވިއްޖެ</string>
+    <string name="contact_save_failed">ކޮންޓެކްޓް ސޭވްއެއް ނުކުރެވުނު</string>
+    <string name="contact_no_session">ބޭންކް ސެޝަނެއް ނެތް</string>
+    <string name="contact_lookup_failed">އެކައުންޓެއް ނުފެނުނު</string>
+    <string name="contact_select_destination">ފުރަތަމަ ފައިސާ ލިބޭނެ އެކައުންޓް ނަގާ</string>
+    <string name="contact_already_exists">މި ކޮންޓެކްޓް ސޭވް ވެފައެބައިން: %s</string>
+    <string name="contact_own_account">އަމިއްލަ އެކައުންޓެއް ކޮންޓެކްޓެއްގެ ގޮތުގައި ސޭވްއެއް ނުކުރެވޭނެ</string>
+
+    <!-- Contact expand/delete -->
+    <string name="contact_edit">އުނިއިތުރުގެނޭ</string>
+    <string name="contact_delete">ފުހެލާ</string>
+    <string name="contact_delete_title">ކޮންޓެކްޓް ފުހެލުން</string>
+    <string name="contact_delete_message">%s ކޮންޓެކްޓް ލިސްޓުން ފުހެލަންވީތޯ؟</string>
+    <string name="contact_deleted">ކޮންޓެކްޓް ފުހެލެވިއްޖެ</string>
+    <string name="contact_delete_failed">ކޮންޓެކްޓް ފުހެއެއް ނުލެވުނު</string>
+    <string name="contact_account_number">އެކައުންޓް ނަންބަރު</string>
+    <string name="contact_account_name">އެކައުންޓް ނަން</string>
+    <string name="contact_bank">ބޭންކު</string>
+    <string name="contact_qr">ކިއުއާރު</string>
+    <string name="contact_delete_warning">މި ކަން ނިމުމައްފަހު ބަދަލެއް ނުކުރެވޭނެ.</string>
+    <string name="contact_copy_account">އެކައުންޓް ނަންބަރު ކޮޕީކުރޭ</string>
+    <string name="contact_share_account">އެކައުންޓް މަޢުލޫމާތު ޙިއްޞާކުރޭ</string>
+    <string name="contact_account_copied">އެކައުންޓް ނަންބަރު ކޮޕީކުރެވިއްޖެ</string>
+
+    <!-- Financing -->
+    <string name="financing_empty">ފައިނޭންސިންގއެއް ނެތް</string>
+    <string name="financing_total">ޖުމްލަ</string>
+    <string name="financing_paid">ދައްކާފައި</string>
+    <string name="financing_unpaid">ނުދައްކާ</string>
+    <string name="financing_deal_date">ފެށުނު ތާރީޚު</string>
+    <string name="financing_installment">މަހުން މަހަށް ދައްކަންޖެހޭ</string>
+    <string name="financing_num_installments">ޖުމްލަ އިންސްޓޯލްމަންޓް</string>
+    <string name="financing_last_paid_date">އެންމެ ފަހުން ފައިސާ ދެއްކި ތާރީޚު</string>
+    <string name="financing_last_pay_amount">އެންމެ ފަހުން ދެއްކި އަދަދު</string>
+    <string name="financing_overdue">މުއްދަތު ހަމަވެފައި</string>
+    <string name="financing_completion_done">ފުރިހަމައަށް ދައްކާ ނިމިފައި</string>
+    <string name="financing_deal_no_fmt">ޑީލް #%s</string>
+    <string name="financing_completion_fmt">ނިމޭނީ %s</string>
+
+    <!-- BML Loans -->
+    <string name="loan_outstanding">ނުދައްކާ ބާކީ</string>
+    <string name="loan_monthly_repayment">މަހުން މަހަށް ދައްކަންޖެހޭ</string>
+    <string name="loan_interest_rate">އިންޓްރެސްޓް ރޭޓް</string>
+    <string name="loan_start_date">ފެށުނު ތާރީޚު</string>
+    <string name="loan_end_date">ނިމޭ ތާރީޚު</string>
+    <string name="loan_overdue_payments">މުއްދަތު ހަމަވެ ނުދައްކާ ހުރި</string>
+    <string name="loan_rate_fmt">%.2f%%</string>
+
+    <!-- Cards -->
+    <string name="nav_pay_with_card">ކާޑުތައް</string>
+    <string name="card_pay_qr">ކިއުއާރުން ފައިސާ ދެއްކުމަށް</string>
+    <string name="card_pay_nfc">ޖައްސާލައިގެން ފައިސާ ދެއްކުމަށް</string>
+    <string name="mib_qr_nfc_not_supported">އެމްއައިބީން މި ޚިދުމަތެއް ނުލިބޭ</string>
+    <string name="nfc_unsupported_title">މި ޚިދުމަތް ނުލިބޭ</string>
+    <string name="nfc_unsupported_message">މި ފޯނުން ޖައްސާލައިގެން ފައިސާ ދެއްކުމުގެ ޚިދުމަތެއް ނުލިބޭ.</string>
+    <string name="nfc_disabled_title">އެންއެފްސީ ނިއްވާލެވިފައި</string>
+    <string name="nfc_disabled_message">ޖައްސާލައިގެން ފައިސާ ދެއްކުމަށް އެންއެފްސީ އޮންކުރޭ.</string>
+    <string name="nfc_open_settings">އެންއެފްސީ ސެޓިންގްސް</string>
+    <string name="nfc_not_default_title">މައި އެޕްގެ ގޮތުގައި ހަމަޖަހާ</string>
+    <string name="nfc_not_default_message">ޖައްސާލައިގެން ފައިސާ ދެއްކުމަށް %1$s މައި އެޕްގެ ގޮތުގައި ހަމަޖަހާ.</string>
+    <string name="nfc_payment_open_settings">ޕޭމަންޓް ސެޓިންގްސް</string>
+    <string name="card_manage">ކާޑު މެނޭޖްކުރުން</string>
+    <string name="card_set_as_default">މައި ކާޑުގެ ގޮތުގައި ހަމަޖައްސާ</string>
+    <string name="card_hide_from_dashboard">ޑޭޝްބޯޑުން ފޮރުވާ</string>
+    <string name="card_action_change_pin">ޕިން ބަދަލުކުރޭ</string>
+    <string name="card_action_freeze">ފްރީޒްކުރޭ</string>
+    <string name="card_action_unfreeze">އަންފްރީޒްކުރޭ</string>
+    <string name="card_action_block">ބްލޮކްކުރޭ</string>
+    <string name="card_action_verify">ކަށަވަރުކުރޭ</string>
+    <string name="card_action_verified">ކަށަވަރުކުރެވިފައި</string>
+    <string name="card_verify_already">ކާޑު ވަނީ ކަށަވަރުކުރެވިފައި. ބަދަލުކުރުމަށް އޮއްބައިގެން ހިފަހައްޓަވާ.</string>
+    <string name="card_verify_title">ކާޑު ކަށަވަރުކުރޭ</string>
+    <string name="card_verify_tap">ކަށަވަރުކުރުމަށް ކާޑު ޖައްސާލާ</string>
+    <string name="card_verify_reading">ކާޑު ކިޔަނީ… މަޑުކޮށްލައްވާ</string>
+    <string name="card_verify_matched">ކާޑު ދިމާވެއްޖެ</string>
+    <string name="card_verify_read_failed">ކާޑު ކިޔައެއް ނުގަނެވުނު، އަލުން މަސައްކަތްކޮއްލާ</string>
+    <string name="card_verify_mismatch">ނިމޭ %1$s ކާޑާ ދިމައެއްނުވޭ</string>
+    <string name="card_verify_cancel">ކެންސަލް</string>
+    <string name="card_verify_manual">އަމިއްލައަށް މަޢުލޫމާތު ޖަހާ</string>
+    <string name="card_verify_manual_title">ކާޑުގެ މަޢުލޫމާތު ޖަހާ</string>
+    <string name="card_verify_nfc_disabled_message">ކާޑު ޖައްސާލައިގެން ކަށަވަރުކުރުމަށް އެންއެފްސީ އޮންކުރޭ. ނުވަތަ އަމިއްލައަށް މަޢުލޫމާތު ޖަހާ.</string>
+    <string name="card_verify_cvv_title">ނިމޭ %1$s ކާޑު</string>
+    <string name="card_verify_cvv_hint">ސީވީވީ (CVV)</string>
+    <string name="card_verify_cvv_invalid">3 ނުވަތަ 4 އަދަދުގެ ސީވީވީ ޖަހާ</string>
+    <string name="card_verify_confirm">ކަށަވަރުކޮއްލާ</string>
+    <string name="card_verify_name_hint">ކާޑުގައިވާ ނަން</string>
+    <string name="card_verify_number_hint">ކާޑު ނަންބަރު</string>
+    <string name="card_verify_expiry_hint">މުއްދަތު ހަމަވާ ތާރީޚު (މަސް/އަހަރު)</string>
+    <string name="card_verify_number_invalid">ރަނގަޅު ކާޑު ނަންބަރެއް ޖަހާ</string>
+    <string name="card_verify_number_mismatch">ނަންބަރު ނިމެންވާނީ %1$s އިން</string>
+    <string name="card_verify_expiry_invalid">ރަނގަޅު ތާރީޚެއް ޖަހާ (މިސާލަކަށް: 08/29)</string>
+    <string name="card_verify_success">ކާޑު ކަށަވަރުކުރެވިއްޖެ</string>
+    <string name="card_freeze_confirm_title">ކާޑު ފްރީޒްކުރަންވީތޯ؟</string>
+    <string name="card_freeze_confirm_message">މިކަމުގެ ސަބަބުން ކާޑުގެ ބޭނުން ވަގުތީގޮތުން މެދުކެނޑޭނެއެވެ. ބޭނުންވާ ކޮންމެ ވަގުތަކު އަލުން އަންފްރީޒް ކުރެވޭނެއެވެ.</string>
+    <string name="card_unfreeze_confirm_title">ކާޑު އަންފްރީޒްކުރަންވީތޯ؟</string>
+    <string name="card_unfreeze_confirm_message">މިކަމުގެ ސަބަބުން ކާޑު އަލުން ބޭނުންކުރެވޭނެއެވެ.</string>
+    <string name="card_freeze_success">ކާޑު ފްރީޒްކުރެވިއްޖެ</string>
+    <string name="card_unfreeze_success">ކާޑު އަންފްރީޒްކުރެވިއްޖެ</string>
+    <string name="card_freeze_failed">ކާޑުގެ ހާލަތު ބަދަލެއް ނުކުރެވުނު</string>
+    <string name="card_freeze_comments_hint">ސަބަބު (ބޭނުންނަމަ)</string>
+    <string name="card_status_temp_blocked">ވަގުތީގޮތުން ބްލޮކްކުރެވިފައި</string>
+    <string name="cards_empty">ކާޑެއް ނުފެނުނު</string>
 
     <!-- Connectivity banner -->
-    <string name="connectivity_no_internet">އިންޓަނެޓް ބައްލަވާ، ދެން ތިޖޫރީ ލޯޑް ކުރޭ</string>
-    <string name="connectivity_server_error">%s އާ ގުޅުމުގައި މައްސަލައެއް</string>
-    <string name="drag_to_reorder">ދަމާ ތަރުތީބު ބަދަލުކުރޭ</string>
-</resources>
+    <string name="connectivity_no_internet">އިންޓަނެޓް ޗެކްކުރެއްވުމަށްފަހު އަލުން ތިޖޫރީ ރީލޯޑްކޮއްލާ</string>
+    <string name="connectivity_server_error">%s އާ ގުޅުމުގައި މައްސަލައެއް އުޅޭ</string>
+    <string name="drag_to_reorder">ތަރުތީބު ބަދަލުކުރުމަށް ދަމާލާ</string>
+</resources>

app/src/main/res/values/strings.xml

@@ -269,6 +269,8 @@
     <string name="transfer_fahipay_amount_max">Maximum is MVR %1$s</string>
     <string name="transfer_fahipay_gst_hint">%1$d%% GST is deducted from this amount</string>
     <string name="transfer_fahipay_gst_receive">Recipient receives MVR %1$s after %2$d%% GST</string>
+    <string name="transfer_gst_added_hint">%1$d%% GST is charged on top of this amount</string>
+    <string name="transfer_gst_added_pay">You pay MVR %1$s with %2$d%% GST</string>
     <string name="transfer_fahipay_phone_only">Fahipay transfers require a 7-digit phone number</string>
     <string name="transfer_my_accounts">My Accounts</string>
     <string name="transfer_same_as_from">This is the same account as the sender</string>

docs/README.md

@@ -18,4 +18,4 @@
 | [mibapi/](mibapi/README.md) | MIB Faisanet — Blowfish-encrypted API + WebView session, accounts, transfers, contacts |
 | [fahipayapi/](fahipayapi/README.md) | Fahipay digital wallet — login, balance, history, contacts |
 | [dhiraaguapi/](dhiraaguapi/README.md) | Dhiraagu Easy Pay / Easy TopUp — number lookup, reload and bill pay by BML card |
-| [ooredooapi/](ooredooapi/README.md) | Ooredoo Quick Pay — number validation for Raastas / bill pay |
+| [ooredooapi/](ooredooapi/README.md) | Ooredoo Quick Pay — number validation, Raastas and bill pay by BML card |

docs/bmlapi/16-card-payment.md

@@ -205,8 +205,10 @@ no `action`; their JavaScript posts back to the **same creq URL**. So the creq U
    `destValue=token`, `selectChannel=token`, `authMethod=OOB`, `otpDest=`, `formReqType=SUBMIT`
    (keep the hidden `creq` / `otpChannels`).
 3. **POST channel** → the **OTP entry** page (`otpValue` input). Submit `otpValue=<BML token TOTP>`,
-   `formReqType=SUBMIT`. A wrong/expired code re-renders the OTP page with text containing
-   *"incorrect"* / *"expired"* — regenerate the TOTP and retry once.
+   `formReqType=SUBMIT`. A wrong/expired code re-renders the OTP page (still with `otpValue`) and
+   *"The OTP code you entered is incorrect Please try again."* — wait for the next TOTP window,
+   regenerate and retry once. Rejected twice, the payment stops ("The bank rejected the BML token
+   code"). The app also never sends a code with under 5 s left in its window.
 4. On success the ACS returns a form auto-posting **`cres`** to the Mastercard gateway; the gateway
    returns a form auto-posting the result (`order.id`, `result=SUCCESS`, …) to
    **`transactions/mpgsNotification/<id>`**. Follow both so the verdict is recorded.
@@ -225,6 +227,23 @@ Poll `next-action` until the recorded verdict surfaces:
 | `TRANSACTION_CONFIRMED` | Success |
 | `TRANSACTION_FAILED` | Declined |
 
+**A decline after 3-D Secure doesn't arrive this way.** In the Ooredoo capture, the card passed
+3-D Secure (`mpgsNotification` got `result=SUCCESS`, `gatewayRecommendation=PROCEED`) and was then
+declined for insufficient funds. The browser's `?wait=1` went to `?error=1` instead of the
+merchant, and the transaction stayed payable: `state` still `QR_CODE_GENERATED`, `hasError: true`,
+`allowRetry: true`, and a new `paymentErrorHistory` entry:
+
+```json
+{"date":"…","vendor":"mpgs","code":"INSUFFICIENT_FUNDS",
+ "reason":"Transaction declined due to insufficient funds",
+ "customerVisibleDescription":"Insufficient funds. Please use another card or payment method."}
+```
+
+The same link was then paid successfully after topping up the card. So while polling,
+`BmlMerchantCardPayClient` also reads the transaction (the load PATCH,
+`BmlMerchantTxnClient.paymentErrors`) and stops with `customerVisibleDescription` as soon as an
+entry newer than the ones there before the attempt shows up.
+
 ## 7. Return to the merchant
 
 The `mpgsNotification` response is a page whose script sends the browser to
@@ -240,13 +259,21 @@ GET transaction…/<id>?wait=1
 
 (FahiPay's is `fahipay.mv/api/bml/gateway/callback/?…state=CONFIRMED`.)
 
+Ooredoo's callback isn't a redirect: `my.ooredoo.mv/bml/response_new.php?…state=CONFIRMED` is a
+200 page whose `<body onload="document.forms['wtmpay'].submit()">` posts the result
+(`order_id`, `bml_transaction_id`, `bml_response=CONFIRMED`, `payment_status=success`, …) on to
+`www.ooredoo.mv/ooredoo-prod/PaymentGateway/redirect/bml`, which lands on
+`/payment-status?order_id=…&status=1`. `returnToMerchant` submits such auto-posting forms too
+(up to 2).
+
 **This hop is required.** It's how at least Dhiraagu learns it was paid: a test reload that
 stopped at `TRANSACTION_CONFIRMED` charged the card but never topped up, and opening the
 `?wait=1` URL in a browser afterwards delivered it. The signature is generated by BML, so the
 hop can be replayed later from the transaction id alone.
 
 `BmlMerchantCardPayClient` does it after every confirmed payment (`returnToMerchant`): a browser
-UA GET that follows the redirects, up to 3 tries, success = the chain ends on a 2xx page. The
+UA GET that follows the redirects and auto-submitted forms, up to 3 tries, success = the chain
+ends on a 2xx page. The
 merchant host may be behind Cloudflare: plain `curl` got a 403 on `dhiraagu.com.mv`, okhttp got
 through.
 

docs/ooredooapi/01-number-validation.md

@@ -129,4 +129,4 @@ Always fall back to the other provider's lookup if this API returns `custType: n
 
 ---
 
-[← README](README.md)
+[← README](README.md) · [Raastas →](02-raastas.md)

docs/ooredooapi/02-raastas.md

@@ -0,0 +1,107 @@
+# Raastas (Quick Pay recharge, paid by BML card)
+
+Recharge an Ooredoo prepaid number through the ooredoo.mv **Quick Pay** page. Ooredoo creates the
+order and hands back a **BML Merchant Services transaction**, which is paid like any card-only
+BML merchant link ([BML API → Merchant Card Payment](../bmlapi/16-card-payment.md)).
+
+Reconstructed from `docs/ooredooapi/tmp/ooredoo_raastas_bml_card.har` (a Firefox HAR, which also
+holds a rejected OTP and an insufficient-funds decline on the same transaction).
+
+---
+
+## Flow overview
+
+```
+GET  /ooredoo-prod/QuickPayPackage/v1/numberTypeValidation?…   → custType PRE (Number Validation)
+POST /ooredoo-prod/PaymentGateway/bml                          → orderID, bmlUrl  ──┐
+                                                                                    │
+        ── from here: the BML card-only merchant flow ──                            │
+GET  transaction.merchants…/<id>  ←──────────────────────────────────────────────────┘
+… Pomelo tokenise, next-action, Wibmo 3-D Secure, MPGS …  → TRANSACTION_CONFIRMED
+GET  transaction.merchants…/<id>?wait=1   → 302 my.ooredoo.mv/bml/response_new.php?…state=CONFIRMED
+     (200, auto-submits)                  → POST www.ooredoo.mv/ooredoo-prod/PaymentGateway/redirect/bml
+                                          → /payment-status?order_id=<orderID>&statusDesc=sucess&status=1
+```
+
+Unlike Dhiraagu, there's no nonce or cart: one POST makes the order and the BML transaction.
+
+---
+
+## 1. Order
+
+`POST https://www.ooredoo.mv/ooredoo-prod/PaymentGateway/bml`
+
+| Header | Value |
+|---|---|
+| `Content-Type` | `application/json` |
+| `Accept` | `application/json` |
+| `Origin` | `https://www.ooredoo.mv` |
+
+```json
+{"msisdn":"9609XXXXXX","purchaseAmount":"21.60","amountWithoutGst":"20",
+ "receiverMsisdn":"9609XXXXXX","transType":"recharge","serviceType":"prepaid",
+ "serviceTypeDisplayName":"Mobile"}
+```
+```json
+{"status":"OK","msg":"Successfully generated order id","code":"2000",
+ "data":{"orderID":"36447930","purchaseAmount":"2160","hashSignature":"…",
+         "shortUrl":"https://pay.bml.com.mv/7A86qLZ1QV",
+         "bmlUrl":"https://transaction.merchants.bankofmaldives.com.mv/6ac009f7bd9b264b80ba6abf", …}}
+```
+
+The 24-hex id at the end of `bmlUrl` is the transaction (`shortUrl` 301s to the same page). The
+page is card-only, no BML Pay. The transaction's `localId` is the MSISDN, `customerReference` the
+order id, and it expires after 7 days.
+
+### GST
+
+**Added on top**, not taken out: the number is credited `amountWithoutGst` and the card pays
+`purchaseAmount = amount + toFixed2(amount × 8 / 100)` (MVR 20 → 21.60). The page's payment
+method list gives `gstPercent: 8` for BML. This is the opposite of Raastas through Fahipay, where
+GST comes out of the amount.
+
+### Limits
+
+Whole MVR, minimum **20** (before GST, so the card pays at least 21.60). The maximum isn't known;
+the capture starts on the payment page.
+
+---
+
+## 2. Return to Ooredoo
+
+`?wait=1` 302s to `https://my.ooredoo.mv/bml/response_new.php?transactionId=<id>&state=CONFIRMED&signature=<hash>`.
+That page is a 200 that auto-submits:
+
+```html
+<body onload="document.forms['wtmpay'].submit()">
+<form method="POST" action="https://www.ooredoo.mv/ooredoo-prod/PaymentGateway/redirect/bml" name="wtmpay">
+  order_id=36447930  amount=21.60000000  msisdn=9609XXXXXX  transtype=2
+  bml_transaction_id=<id>  bml_hash=<hash>  bml_response=CONFIRMED
+  error_code=0  payment_status=success  ptype=bml
+```
+
+which ends on `https://www.ooredoo.mv/payment-status?order_id=36447930&statusDesc=sucess&status=1`
+(the receipt: `totalAmount 21.6`, `amountWithoutGst 20`, `gstAmt 1.6`). The card flow submits the
+form, see [BML API → Return to the merchant](../bmlapi/16-card-payment.md#7-return-to-the-merchant).
+
+A declined attempt sends `?wait=1` to `transaction…/<id>?error=1` instead, and the same
+transaction can be paid again.
+
+---
+
+## Cloudflare
+
+`ooredoo.mv` and `my.ooredoo.mv` are behind Cloudflare. The capture carries a `cf_clearance`
+cookie; okhttp from the phone gets through without one, as with
+[Number Validation](01-number-validation.md).
+
+---
+
+&nbsp;
+
+---
+
+**Related:** [Number Validation](01-number-validation.md) · [BML Merchant Card Payment](../bmlapi/16-card-payment.md) ·
+App side: [Transfer Flows](../thijooree/20-transfer-flows.md#carrier-services-by-bml-card)
+
+[← Number Validation](01-number-validation.md) · [Bill Pay →](03-bill-pay.md)

docs/ooredooapi/03-bill-pay.md

@@ -0,0 +1,65 @@
+# Bill Pay (Quick Pay, paid by BML card)
+
+Pay an Ooredoo postpaid bill through the ooredoo.mv **Quick Pay** bill-pay page. It is the same
+single order call as [Raastas](02-raastas.md) with a different `transType` / `serviceType`, and
+no GST. From the order on, it's the BML card-only merchant flow and the same return to Ooredoo.
+
+Reconstructed from `docs/ooredooapi/tmp/ooredoo_billpay_bml_card.har` (a Firefox HAR).
+
+---
+
+## Flow overview
+
+```
+GET  /bill-pay
+GET  /ooredoo-prod/QuickPayPackage/v1/numberTypeValidation?…   → custType POST (Number Validation)
+POST /ooredoo-prod/PaymentGateway/bml                          → orderID, bmlUrl
+        ── BML card-only merchant flow ──                       → TRANSACTION_CONFIRMED
+GET  transaction.merchants…/<id>?wait=1   → 302 my.ooredoo.mv/bml/response_new.php?…state=CONFIRMED
+     (200, auto-submits, transtype=1)     → POST www.ooredoo.mv/ooredoo-prod/PaymentGateway/redirect/bml
+                                          → /payment-status?statusDesc=sucess&status=1&order_id=<orderID>
+```
+
+The page doesn't look up the outstanding bill: the amount is whatever is typed.
+
+---
+
+## Order
+
+`POST https://www.ooredoo.mv/ooredoo-prod/PaymentGateway/bml`, headers as in
+[Raastas → Order](02-raastas.md#1-order).
+
+```json
+{"msisdn":"9609XXXXXX","purchaseAmount":"10.01","amountWithoutGst":"10.01",
+ "receiverMsisdn":"9609XXXXXX","transType":"billpay","serviceType":"Mobile",
+ "serviceTypeDisplayName":"Mobile"}
+```
+```json
+{"status":"OK","msg":"Successfully generated order id","code":"2000",
+ "data":{"orderID":"36447962","purchaseAmount":"1001","shortUrl":"https://pay.bml.com.mv/…",
+         "bmlUrl":"https://transaction.merchants.bankofmaldives.com.mv/6ac011e099f9d890856e2d33", …}}
+```
+
+| | Raastas | Bill Pay |
+|---|---|---|
+| `transType` | `recharge` | `billpay` |
+| `serviceType` | `prepaid` | `Mobile` |
+| `amountWithoutGst` | amount credited | = `purchaseAmount` |
+| GST | 8% added on top | none |
+| Return form `transtype` | `2` | `1` |
+
+### Limits
+
+Minimum **MVR 10**, decimals allowed (up to 2 places). The maximum isn't known.
+
+---
+
+&nbsp;
+
+---
+
+**Related:** [Number Validation](01-number-validation.md) · [Raastas](02-raastas.md) ·
+[BML Merchant Card Payment](../bmlapi/16-card-payment.md) ·
+App side: [Transfer Flows](../thijooree/20-transfer-flows.md#carrier-services-by-bml-card)
+
+[← Raastas](02-raastas.md)

docs/ooredooapi/README.md

@@ -81,6 +81,8 @@ The API expects the full MSISDN including country code `960` (e.g. `9609654321`)
 | # | File | Description |
 |---|---|---|
 | 1 | [Number Validation](01-number-validation.md) | Validate an Ooredoo number and determine account type |
+| 2 | [Raastas](02-raastas.md) | Quick Pay recharge order → BML merchant transaction, paid by card |
+| 3 | [Bill Pay](03-bill-pay.md) | Quick Pay bill payment order → BML merchant transaction, paid by card |
 
 ---
 

docs/thijooree/07-transfer.md

@@ -77,7 +77,7 @@ A phone number searched with no source yet (or from a BML card that can pay by c
 |---|---|---|
 | Favara Transfer | bank account behind the number | MIB or BML account |
 | Fahipay service | Raastas, Ooredoo Bill Pay, Dhiraagu Reload, Dhiraagu Bill Pay | Fahipay wallet |
-| Card service | Dhiraagu Reload, Dhiraagu Bill Pay (BML badge) | Verified BML card |
+| Card service | Dhiraagu Reload, Dhiraagu Bill Pay, Raastas, Ooredoo Bill Pay (BML badge) | Verified BML card |
 
 One option is applied straight away; with more, a picker opens and Send stays disabled until one is chosen. Picking a type also picks a source that can pay it. Fahipay and card services clear and disable the Remarks field and apply their own amount rules (minimum, maximum, whole amounts, 8% GST note). Details: [Transfer Flows → Transfer Type picker](20-transfer-flows.md#transfer-type-picker).
 
@@ -122,11 +122,11 @@ When the source is a BML USD account and the destination is a MIB account but no
 
 See [Transfer Flows → Fahipay source](20-transfer-flows.md#fahipay-source).
 
-### Carrier Service by BML Card (Dhiraagu Reload / Bill Pay)
+### Carrier Service by BML Card (Dhiraagu Reload / Bill Pay, Ooredoo Raastas / Bill Pay)
 
-1. Checks the amount against Dhiraagu's rules (reload: MVR 20–1000, whole amounts, 8% GST included; bill pay: from MVR 1, up to 2 decimals, no GST)
-2. A "Processing..." dialog shows while Dhiraagu creates the order and its BML merchant transaction ([Dhiraagu API → Reload](../dhiraaguapi/02-reload.md), [→ Bill Pay](../dhiraaguapi/03-bill-pay.md))
-3. From there it is the card-only merchant flow: the same confirm dialog and warning, biometric gate, card + 3-D Secure payment, and the return to Dhiraagu (`?wait=1`) that tops the number up or posts the bill payment
+1. Checks the amount against the carrier's rules (Dhiraagu reload: MVR 20–1000, whole amounts, 8% GST included; Dhiraagu bill pay: from MVR 1, up to 2 decimals, no GST; Raastas: from MVR 20, whole amounts, 8% GST added on top; Ooredoo bill pay: from MVR 10, up to 2 decimals, no GST)
+2. A "Processing..." dialog shows while the carrier creates the order and its BML merchant transaction ([Dhiraagu API → Reload](../dhiraaguapi/02-reload.md), [→ Bill Pay](../dhiraaguapi/03-bill-pay.md), [Ooredoo API → Raastas](../ooredooapi/02-raastas.md), [→ Bill Pay](../ooredooapi/03-bill-pay.md))
+3. From there it is the card-only merchant flow: the same confirm dialog and warning, biometric gate, card + 3-D Secure payment, and the return to the carrier (`?wait=1`) that tops the number up or posts the bill payment. A decline (e.g. insufficient funds) or a rejected token code ends it with the bank's message
 4. On success, the result shows inside the dialog; if Dhiraagu couldn't be notified, a toast gives the BML transaction id
 
 See [Transfer Flows → Carrier services by BML card](20-transfer-flows.md#carrier-services-by-bml-card).

docs/thijooree/20-transfer-flows.md

@@ -105,7 +105,7 @@ Each Fahipay favourites list is one payout service (`FahipayService.contactCateg
 | `FAHIPAY_OOREDOO_BILL` | Ooredoo Bill Pay |
 | `FAHIPAY_DHIRAAGU_BILL` | Dhiraagu Bill Pay |
 
-So picking a favourite skips the carrier lookup and the picker. That service is offered as the only transfer type, so it's picked straight away (`TransferFragment.applyFahipayContact`). As with a searched number, that switches the source to the Fahipay wallet and applies the service's amount rules. This happens wherever a favourite is picked:
+So picking a favourite skips the carrier lookup and the picker. That service is offered as the only transfer type, so it's picked straight away (`TransferFragment.applyServiceContact`). As with a searched number, that switches the source to the Fahipay wallet and applies the service's amount rules. This happens wherever a favourite is picked:
 
 - the contact picker sheet (the row's category goes back as `ContactPickerSheetFragment.KEY_CATEGORY`)
 - the "To" field's search-as-you-type dropdown
@@ -151,8 +151,8 @@ None of the Fahipay services take a reference. Picking one clears the Reference
 ### Carrier services by BML card
 
 A carrier service can also be paid with a verified BML card, through the carrier's own website
-and its BML merchant gateway, instead of the Fahipay wallet. Only **Dhiraagu Reload** and
-**Dhiraagu Bill Pay** so far (`CardPayoutService`, `ui/home/transfer/CardPayoutTransferHandler.kt`).
+and its BML merchant gateway, instead of the Fahipay wallet: **Dhiraagu Reload**, **Dhiraagu
+Bill Pay**, **Ooredoo Raastas** and **Ooredoo Bill Pay** (`CardPayoutService`, `ui/home/transfer/CardPayoutTransferHandler.kt`).
 
 **Which cards.** A card qualifies when it's verified and its BML login has an OTP seed, the same
 rule as card-only merchant links (`BmlVerifiedCards`, see
@@ -166,6 +166,8 @@ drops the pick, like any other source that can't pay the picked type.
 |---|---|
 | Dhiraagu `RELOAD` | Dhiraagu Reload |
 | Dhiraagu `BILL_PAY` | Dhiraagu Bill Pay |
+| Ooredoo `PRE` or `HYBRID` | Raastas |
+| Ooredoo `POST` or `HYBRID` | Ooredoo Bill Pay |
 
 **Amount rules.** The carrier website's, not Fahipay's. They're checked the same way, through
 the shared `PayoutAmountField`:
@@ -174,17 +176,34 @@ the shared `PayoutAmountField`:
 |---|---|---|---|---|
 | Dhiraagu Reload | 20 | 1,000 | no | 8%, included (credit = amount − round2(amount × 0.08 / 1.08)) |
 | Dhiraagu Bill Pay | 1 | none | up to 2 places | none |
+| Raastas | 20 | none | no | 8%, **added** (charged = amount + round2(amount × 0.08)) |
+| Ooredoo Bill Pay | 10 | none | up to 2 places | none |
 
-Easy Pay itself sets no minimum or maximum; the MVR 1 floor is Thijooree's.
+Easy Pay itself sets no minimum or maximum; the MVR 1 floor is Thijooree's. The Ooredoo maximums
+aren't known.
+
+Raastas by card is the one service where GST is added on top (`PayoutService.gstAdded`): the
+number is credited what's typed, the card pays more, and the note under the amount says what's
+paid ("You pay MVR 21.60 with 8% GST"). The order check in step 2 below compares against
+`chargedWithGst`.
 
 **Reference.** None. The field is cleared and disabled, as for the Fahipay services.
 
+**Recents.** As with Fahipay services, the recent is saved with the service's category
+(`CardPayoutService.contactCategory`: `CARD_DHIRAAGU_RELOAD`, `CARD_DHIRAAGU_BILL`,
+`CARD_RAASTAS`, `CARD_OOREDOO_BILL`). Picking it again applies that service with no lookup, so
+the default card (or another payable card) is selected rather than the default account
+(`TransferFragment.applyServiceContact`). With no payable card left, it toasts and stops. A number
+keeps one recent, so paying it another way replaces the category.
+
 **Sending.** The only part that differs from paying a card-only BML merchant link is where the
 BML transaction comes from:
 
 1. `CardPayoutTransferHandler.submit()` has the carrier create it for the number and amount
-   (`DhiraaguPaymentClient.createReloadTransaction` / `createBillPayTransaction`, see
-   [Dhiraagu API → Reload](../dhiraaguapi/02-reload.md) and [→ Bill Pay](../dhiraaguapi/03-bill-pay.md)).
+   (`DhiraaguPaymentClient.createReloadTransaction` / `createBillPayTransaction`,
+   `OoredooPaymentClient.createRaastasTransaction` / `createBillPayTransaction`, see
+   [Dhiraagu API → Reload](../dhiraaguapi/02-reload.md), [→ Bill Pay](../dhiraaguapi/03-bill-pay.md)
+   and [Ooredoo API → Raastas](../ooredooapi/02-raastas.md), [→ Bill Pay](../ooredooapi/03-bill-pay.md)).
    Bill pay looks the number up again first, for the billing account the order is made out to.
    That takes a few round trips, so the payment's "Processing..." box shows meanwhile
    (`TransferFragment.showProcessingDialog`) and closes before the confirm dialog opens.
@@ -265,7 +284,7 @@ Source: Fahipay
 Transfer type: Card (verified BML card)
 
 └── Carrier creates a BML merchant transaction → card-only merchant flow
-    DHIRAAGU_RELOAD, DHIRAAGU_BILL
+    DHIRAAGU_RELOAD, DHIRAAGU_BILL, OOREDOO_RAASTAS, OOREDOO_BILL
 ```
 
 ---

docs/thijooree/29-card-verification-and-merchant-card-pay.md

@@ -9,7 +9,7 @@ Two linked features:
    whose merchant has **no BML Pay** is paid with a verified card via the Pomelo + 3-D Secure flow
    ([BML API → Merchant Card Payment](../bmlapi/16-card-payment.md)). The same flow pays
    [carrier services by BML card](20-transfer-flows.md#carrier-services-by-bml-card) (Dhiraagu
-   Reload and Bill Pay), once the carrier has created the transaction.
+   Reload and Bill Pay, Ooredoo Raastas and Bill Pay), once the carrier has created the transaction.
 
 > ⚠️ The merchant card flow is scraped browser/ACS traffic, not a stable API. Storing the CVV is a
 > security/PCI liability. See the API doc's

fastlane/metadata/android/en-US/changelogs/35.txt

@@ -0,0 +1,11 @@
+- updated dhivehi transaltions (thank you @quillfires)
+- improved fahipay support
+- new UI to select transfer type (Favara, Reload, Raastas, Billpay)
+- Ooredoo Raastas via Fahipay
+- Ooredo Billpay via Fahipay
+- Dhiraagu reload via Fahipay
+- Dhiraagu billpay via Fahipay
+- Ooredoo Raastas via BML verified cards
+- Ooredoo Billpay via BML verified cards
+- Dhiraagu Reload via BML verifed cards
+- Dhiraagu billpay via BML verified cards