@crediblemark/buayar 0.3.0 → 0.3.1

package/dist/index.mjs

@@ -416,7 +416,19 @@ function hmacSha256(data, secret) {
 }
 function safeCompare(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
-  return a.toLowerCase() === b.toLowerCase();
+  if (!a && !b) return true;
+  if (!a || !b) return false;
+  const isHexA = /^[0-9a-fA-F]+$/.test(a);
+  const isHexB = /^[0-9a-fA-F]+$/.test(b);
+  let strA = a;
+  let strB = b;
+  if (isHexA && isHexB && a.length === b.length) {
+    strA = a.toLowerCase();
+    strB = b.toLowerCase();
+  }
+  const hashA = crypto.createHash("sha256").update(strA).digest();
+  const hashB = crypto.createHash("sha256").update(strB).digest();
+  return crypto.timingSafeEqual(hashA, hashB);
 }
 
 // src/providers/duitku/signature.ts
@@ -1911,7 +1923,7 @@ function getXenditAuthHeader(secretKey) {
   return `Basic ${token}`;
 }
 function verifyXenditWebhookToken(headerToken, expectedToken) {
-  if (!headerToken || !expectedToken) return true;
+  if (!headerToken || !expectedToken) return false;
   return safeCompare(headerToken, expectedToken);
 }
 
@@ -2099,8 +2111,14 @@ var XenditProvider = class extends BasePaymentProvider {
     const orderId = body.external_id || body.reference_id || body.data?.reference_id || body.id || "";
     const amount = body.paid_amount || body.amount || body.data?.amount || 0;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const webhookToken = config.extra?.webhookToken;
+    const headerToken = config.extra?.callbackToken || config.extra?.headers?.["x-callback-token"] || config.extra?.headers?.["X-Callback-Token"];
+    let isValid = true;
+    if (webhookToken || headerToken) {
+      isValid = verifyXenditWebhookToken(headerToken, webhookToken);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "xendit",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -2378,11 +2396,12 @@ function verifyDokuWebhookSignature(headers, body, clientId, secretKey, requestT
   const reqId = headers["request-id"] || headers["Request-Id"] || "";
   const reqTimestamp = headers["request-timestamp"] || headers["Request-Timestamp"] || "";
   const incomingSignature = headers["signature"] || headers["Signature"] || "";
-  if (!incomingSignature || !secretKey) return true;
+  if (!incomingSignature || !secretKey) return false;
+  const target = headers["request-target"] || headers["Request-Target"] || requestTarget;
   let component = `Client-Id:${reqClientId || clientId}
 Request-Id:${reqId}
 Request-Timestamp:${reqTimestamp}
-Request-Target:${requestTarget}`;
+Request-Target:${target}`;
   if (body) {
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const digest = crypto2.createHash("sha256").update(rawBody).digest("base64");
@@ -2606,8 +2625,16 @@ var DokuProvider = class extends BasePaymentProvider {
     const orderId = body.order?.invoice_number || body.invoice_number || body.order_id || "";
     const amount = body.order?.amount || body.amount || 0;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const secretKey = config.secretKey || config.apiKey || "";
+    const headers = config.extra?.headers || {};
+    const signature = headers["signature"] || headers["Signature"] || config.extra?.dokuSignature || config.extra?.signatureHeader;
+    const clientId = config.merchantCode || config.clientKey || "";
+    let isValid = true;
+    if (signature || headers && (headers["request-id"] || headers["Request-Id"])) {
+      isValid = verifyDokuWebhookSignature(headers, body, clientId, secretKey);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "doku",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -2864,7 +2891,7 @@ function generatePrismalinkSignature(merchantId, orderId, amount, secretKey) {
   return sha256(raw);
 }
 function verifyPrismalinkSignature(merchantId, orderId, amount, secretKey, incomingSignature) {
-  if (!incomingSignature || !secretKey) return true;
+  if (!incomingSignature || !secretKey) return false;
   const computed = generatePrismalinkSignature(merchantId, orderId, amount, secretKey);
   return safeCompare(incomingSignature, computed);
 }
@@ -3255,7 +3282,7 @@ function generateFaspaySignature(userId, password, billNo) {
   return crypto3.createHash("sha1").update(md5Hash).digest("hex");
 }
 function verifyFaspaySignature(userId, password, billNo, paymentStatusCode, incomingSignature) {
-  if (!incomingSignature || !password) return true;
+  if (!incomingSignature || !password) return false;
   const md5Hash = crypto3.createHash("md5").update(`${userId}${password}${billNo}${paymentStatusCode}`).digest("hex");
   const computed = crypto3.createHash("sha1").update(md5Hash).digest("hex");
   const simpleComputed = generateFaspaySignature(userId, password, billNo);
@@ -3676,9 +3703,9 @@ function generateFinpaySignature(merchantId, orderId, amount, merchantKey) {
   return crypto4.createHmac("sha512", merchantKey).update(data).digest("hex");
 }
 function verifyFinpaySignature(merchantId, orderId, amount, merchantKey, incomingSignature) {
-  if (!incomingSignature || !merchantKey) return true;
+  if (!incomingSignature || !merchantKey) return false;
   const computed = generateFinpaySignature(merchantId, orderId, amount, merchantKey);
-  return safeCompare(incomingSignature.toLowerCase(), computed.toLowerCase());
+  return safeCompare(incomingSignature, computed);
 }
 
 // src/providers/finpay/provider.ts
@@ -4063,9 +4090,9 @@ function generateNicepayToken(timeStamp, iMid, referenceNo, amt, merchantKey) {
   return sha256(raw);
 }
 function verifyNicepayWebhook(timeStamp, iMid, referenceNo, amt, merchantKey, incomingToken) {
-  if (!incomingToken || !merchantKey) return true;
+  if (!incomingToken || !merchantKey) return false;
   const computed = generateNicepayToken(timeStamp, iMid, referenceNo, amt, merchantKey);
-  return safeCompare(incomingToken.toLowerCase(), computed.toLowerCase());
+  return safeCompare(incomingToken, computed);
 }
 
 // src/providers/nicepay/provider.ts
@@ -4492,9 +4519,9 @@ function generateOyHeaders(username, apiKey) {
   };
 }
 function verifyOyWebhook(headers, expectedUsername) {
-  if (!expectedUsername) return true;
+  if (!expectedUsername) return false;
   const username = headers["x-oy-username"] || headers["X-Oy-Username"] || "";
-  if (!username) return true;
+  if (!username) return false;
   return safeCompare(username.toLowerCase(), expectedUsername.toLowerCase());
 }
 
@@ -4656,7 +4683,7 @@ var OyProvider = class extends BasePaymentProvider {
     }
   }
   async verifyCallback(body, config) {
-    const username = config.clientKey || config.merchantCode || config.merchantId || "";
+    const username = config.clientKey || config.merchantCode || config.merchantId || config.extra?.username || "";
     const orderId = body.partner_tx_id || body.partner_trx_id || body.trx_id || "";
     const amount = body.amount || body.settlement_amount || 0;
     const rawStatus = (body.status || body.tx_status || "").toUpperCase();
@@ -4665,8 +4692,14 @@ var OyProvider = class extends BasePaymentProvider {
     const isExpired = rawStatus === "EXPIRED";
     const isFailed = rawStatus === "FAILED" || !isPaid && !isPending && !isExpired;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const headers = config.extra?.headers || {};
+    const oyUsernameHeader = headers["x-oy-username"] || headers["X-Oy-Username"] || config.extra?.oyUsername;
+    let isValid = true;
+    if (oyUsernameHeader || username && headers && Object.keys(headers).length > 0) {
+      isValid = verifyOyWebhook(headers, username);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "oy",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -4926,13 +4959,16 @@ function serializeStripeParams(obj, prefix = "") {
 }
 function verifyStripeWebhook(rawPayload, signatureHeader, webhookSecret, toleranceSeconds = 300) {
   if (!signatureHeader || !webhookSecret) {
-    return true;
+    return false;
   }
   const items = signatureHeader.split(",");
   let timestamp = "";
   const signatures = [];
   for (const item of items) {
-    const [key, value] = item.trim().split("=");
+    const eqIdx = item.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = item.slice(0, eqIdx).trim();
+    const value = item.slice(eqIdx + 1).trim();
     if (key === "t") {
       timestamp = value;
     } else if (key === "v1") {
@@ -4942,10 +4978,18 @@ function verifyStripeWebhook(rawPayload, signatureHeader, webhookSecret, toleran
   if (!timestamp || signatures.length === 0) {
     return false;
   }
+  const tsNum = Number(timestamp);
+  if (Number.isNaN(tsNum) || tsNum <= 0) {
+    return false;
+  }
+  const nowSec = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSec - tsNum) > toleranceSeconds) {
+    return false;
+  }
   const payloadString = typeof rawPayload === "string" ? rawPayload : JSON.stringify(rawPayload);
   const signedPayload = `${timestamp}.${payloadString}`;
   const expectedSignature = hmacSha256(signedPayload, webhookSecret);
-  return signatures.some((sig) => safeCompare(sig.toLowerCase(), expectedSignature.toLowerCase()));
+  return signatures.some((sig) => safeCompare(sig, expectedSignature));
 }
 
 // src/providers/stripe/provider.ts
@@ -5571,7 +5615,8 @@ function verifyAdyenWebhook(notificationItem, hmacKey) {
     const signedData = fields.join(":");
     const keyBytes = Buffer.from(hmacKey, "hex");
     const expected = createHmac("sha256", keyBytes).update(signedData, "utf8").digest("base64");
-    return expected === notificationItem.additionalData?.hmacSignature;
+    const provided = notificationItem.additionalData?.hmacSignature || "";
+    return safeCompare(expected, provided);
   } catch {
     return false;
   }
@@ -5684,7 +5729,7 @@ var AdyenProvider = class extends BasePaymentProvider {
     const hmacKey = config.extra?.hmacKey || config.secretKey || "";
     const notificationItems = body?.notificationItems || [body];
     const item = notificationItems[0]?.NotificationRequestItem || notificationItems[0] || body;
-    const isValid = hmacKey ? verifyAdyenWebhook(item, hmacKey) : true;
+    const isValid = hmacKey ? verifyAdyenWebhook(item, hmacKey) : false;
     const eventCode = (item.eventCode || "").toUpperCase();
     const success = item.success === "true" || item.success === true;
     const orderId = item.merchantReference || item.pspReference || "";
@@ -5808,7 +5853,7 @@ function verifyCheckoutComWebhook(body, signatureHeader, secret) {
   try {
     const expected = createHmac2("sha256", secret).update(body, "utf8").digest("hex");
     const provided = signatureHeader.replace(/^sha256=/, "");
-    return expected === provided;
+    return safeCompare(expected, provided);
   } catch {
     return false;
   }
@@ -5909,7 +5954,7 @@ var CheckoutComProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyCheckoutComWebhook(rawBody, signatureHeader, webhookSecret) : true;
+    const isValid = signatureHeader ? verifyCheckoutComWebhook(rawBody, signatureHeader, webhookSecret) : false;
     const eventType = parsedBody?.type || "";
     const data = parsedBody?.data || parsedBody;
     const orderId = data?.reference || data?.metadata?.order_id || data?.id || "";
@@ -6031,7 +6076,7 @@ function verifyRazorpayWebhook(rawBody, signature, webhookSecret) {
   if (!webhookSecret || !signature || !rawBody) return false;
   try {
     const expected = createHmac3("sha256", webhookSecret).update(rawBody).digest("hex");
-    return expected === signature;
+    return safeCompare(expected, signature);
   } catch {
     return false;
   }
@@ -6140,7 +6185,7 @@ var RazorpayProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyRazorpayWebhook(rawBody, signatureHeader, webhookSecret) : true;
+    const isValid = signatureHeader ? verifyRazorpayWebhook(rawBody, signatureHeader, webhookSecret) : false;
     const eventType = parsedBody?.event || "";
     const payload = parsedBody?.payload;
     const paymentEntity = payload?.payment?.entity || payload?.payment_link?.entity || parsedBody;
@@ -6262,7 +6307,7 @@ function verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificatio
   try {
     const payload = notificationUrl + rawBody;
     const expected = createHmac4("sha256", signatureKey).update(payload).digest("base64");
-    return expected === signatureHeader;
+    return safeCompare(expected, signatureHeader);
   } catch {
     return false;
   }
@@ -6382,7 +6427,7 @@ var SquareProvider = class extends BasePaymentProvider {
     const notificationUrl = config.callbackUrl || config.extra?.notificationUrl || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificationUrl) : true;
+    const isValid = signatureHeader ? verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificationUrl) : false;
     const eventType = parsedBody?.type || "";
     const data = parsedBody?.data?.object || parsedBody?.data || parsedBody;
     const payment = data?.payment || data;
@@ -6512,12 +6557,13 @@ function verifyPayuWebhook(rawBody, signatureHeader, md5Key) {
     }
     const providedSig = parts["signature"];
     const algorithm = (parts["algorithm"] || "MD5").toUpperCase();
+    if (!providedSig) return false;
     if (algorithm === "MD5") {
       const expected = createHash("md5").update(rawBody + md5Key).digest("hex");
-      return expected === providedSig;
+      return safeCompare(expected, providedSig);
     } else if (algorithm === "SHA-256") {
       const expected = createHash("sha256").update(rawBody + md5Key).digest("hex");
-      return expected === providedSig;
+      return safeCompare(expected, providedSig);
     }
     return false;
   } catch {
@@ -6655,7 +6701,7 @@ var PayuProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyPayuWebhook(rawBody, signatureHeader, md5Key) : true;
+    const isValid = signatureHeader ? verifyPayuWebhook(rawBody, signatureHeader, md5Key) : false;
     const order = parsedBody?.order || parsedBody;
     const orderId = order.extOrderId || order.orderId || "";
     const amount = Number(order.totalAmount || 0);
@@ -6802,7 +6848,7 @@ function verifyBraintreeWebhook(btSignature, btPayload, privateKey) {
     const payload = Buffer.from(btPayload, "base64").toString("utf8");
     const secretHash = createHash2("sha1").update(privateKey).digest("hex");
     const expected = createHmac6("sha1", secretHash).update(payload).digest("hex");
-    return expected === providedHmac;
+    return safeCompare(expected, providedHmac);
   } catch {
     return false;
   }
@@ -6908,7 +6954,7 @@ var BraintreeProvider = class extends BasePaymentProvider {
     const privateKey = config.apiKey || config.secretKey || "";
     const btSignature = config.extra?.btSignature || "";
     const btPayload = config.extra?.btPayload || "";
-    const isValid = btSignature && btPayload ? verifyBraintreeWebhook(btSignature, btPayload, privateKey) : true;
+    const isValid = btSignature && btPayload ? verifyBraintreeWebhook(btSignature, btPayload, privateKey) : false;
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
     const subject = parsedBody?.subject || parsedBody;
     const transaction = subject?.transaction || subject?.disbursement || parsedBody;
@@ -7040,8 +7086,8 @@ function verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, prov
   if (!secretWord || !providedHash) return false;
   try {
     const raw = secretWord + saleId + productId + invoiceId;
-    const expected = createHash3("md5").update(raw).digest("hex").toUpperCase();
-    return expected === (providedHash || "").toUpperCase();
+    const expected = createHash3("md5").update(raw).digest("hex");
+    return safeCompare(expected, providedHash);
   } catch {
     return false;
   }
@@ -7140,7 +7186,7 @@ var TwoCheckoutProvider = class extends BasePaymentProvider {
     const productId = parsedBody?.IPN_PID?.[0] || parsedBody?.product_id || "";
     const invoiceId = parsedBody?.IPN_PNAME?.[0] || parsedBody?.invoice_id || "";
     const providedHash = parsedBody?.HASH || parsedBody?.hash || "";
-    const isValid = secretWord ? verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, providedHash) : true;
+    const isValid = secretWord ? verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, providedHash) : false;
     const orderId = parsedBody?.REFNOEXT || parsedBody?.ext_ref_no || parsedBody?.SALE_ID || "";
     const amount = Math.round(Number(parsedBody?.IPN_TOTAL_GENERAL || parsedBody?.total || 0) * 100);
     const statusRaw = (parsedBody?.ORDERSTATUS || parsedBody?.order_status || "").toUpperCase();
@@ -8830,7 +8876,7 @@ function resolveConfigFromEnv(customConfig) {
     merchantCode = merchantCode || env.IPAYMU_VA || env.IPAYMU_MERCHANT_CODE || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
   } else if (provider === "doku") {
     merchantCode = merchantCode || env.DOKU_CLIENT_ID || env.DOKU_MERCHANT_ID || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
-    clientKey = clientKey || env.DOKU_CLIENT_ID || env.BUAYAR_CLIENT_KEY;
+    clientKey = clientKey || customConfig?.merchantCode || env.DOKU_CLIENT_ID || env.BUAYAR_CLIENT_KEY;
   } else if (provider === "prismalink") {
     merchantCode = merchantCode || env.PRISMALINK_MERCHANT_ID || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
     merchantId = merchantId || env.PRISMALINK_MERCHANT_ID || env.BUAYAR_MERCHANT_ID;
@@ -8846,7 +8892,7 @@ function resolveConfigFromEnv(customConfig) {
     merchantId = merchantId || env.NICEPAY_IMID || env.BUAYAR_MERCHANT_ID;
   } else if (provider === "oy" || provider === "oyindonesia") {
     merchantCode = merchantCode || env.OY_USERNAME || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
-    clientKey = clientKey || env.OY_USERNAME || env.BUAYAR_CLIENT_KEY;
+    clientKey = clientKey || customConfig?.merchantCode || env.OY_USERNAME || env.BUAYAR_CLIENT_KEY;
   } else if (provider === "stripe") {
     clientKey = clientKey || env.STRIPE_PUBLIC_KEY || env.STRIPE_PUBLISHABLE_KEY || env.BUAYAR_CLIENT_KEY || env.BUAYAR_PUBLIC_KEY;
     merchantCode = merchantCode || clientKey || "stripe";
@@ -8882,12 +8928,12 @@ function resolveConfigFromEnv(customConfig) {
   const projectId = customConfig?.projectId || env.BUAYAR_PROJECT_ID || env.PG_PROJECT_ID || env.PROJECT_ID || env.SQUARE_LOCATION_ID;
   const publicKey = customConfig?.publicKey || env.BUAYAR_PUBLIC_KEY || env.PG_PUBLIC_KEY || env.PUBLIC_KEY || env.STRIPE_PUBLIC_KEY || env.STRIPE_PUBLISHABLE_KEY || env.CHECKOUTCOM_PUBLIC_KEY;
   const privateKey = customConfig?.privateKey || env.BUAYAR_PRIVATE_KEY || env.PG_PRIVATE_KEY || env.PRIVATE_KEY || env.BRAINTREE_PRIVATE_KEY;
-  const secretKey = customConfig?.secretKey || env.BUAYAR_SECRET_KEY || env.PG_SECRET_KEY || env.SECRET_KEY || env.XENDIT_SECRET_KEY || env.DOKU_SECRET_KEY || env.PRISMALINK_SECRET_KEY || env.FASPAY_PASSWORD || env.FINPAY_MERCHANT_KEY || env.NICEPAY_KEY || env.OY_API_KEY || env.STRIPE_SECRET_KEY || env.PAYPAL_CLIENT_SECRET || env.CHECKOUTCOM_SECRET_KEY || env.RAZORPAY_KEY_SECRET || env.SQUARE_ACCESS_TOKEN || env.BRAINTREE_PRIVATE_KEY || env.TWOCHECKOUT_SECRET_KEY;
+  const secretKey = customConfig?.secretKey || customConfig?.apiKey || customConfig?.serverKey || env.BUAYAR_SECRET_KEY || env.PG_SECRET_KEY || env.SECRET_KEY || env.XENDIT_SECRET_KEY || env.DOKU_SECRET_KEY || env.PRISMALINK_SECRET_KEY || env.FASPAY_PASSWORD || env.FINPAY_MERCHANT_KEY || env.NICEPAY_KEY || env.OY_API_KEY || env.STRIPE_SECRET_KEY || env.PAYPAL_CLIENT_SECRET || env.CHECKOUTCOM_SECRET_KEY || env.RAZORPAY_KEY_SECRET || env.SQUARE_ACCESS_TOKEN || env.BRAINTREE_PRIVATE_KEY || env.TWOCHECKOUT_SECRET_KEY;
   const callbackUrl = customConfig?.callbackUrl || env.BUAYAR_CALLBACK_URL || env.PG_CALLBACK_URL || env.PAYMENT_CALLBACK_URL;
   const returnUrl = customConfig?.returnUrl || env.BUAYAR_RETURN_URL || env.PG_RETURN_URL || env.PAYMENT_RETURN_URL;
   const extra = {
     webhookToken: env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
-    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
+    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
     merchantName: env.FASPAY_MERCHANT_NAME || env.BUAYAR_MERCHANT_NAME,
     userId: env.FASPAY_USER_ID,
     iMid: env.NICEPAY_IMID,
@@ -8993,38 +9039,46 @@ var Buayar = class {
   async verifyWebhook(payload, headers, configOverride) {
     const mergedConfig = { ...this.config, ...configOverride };
     if (headers) {
+      if (!mergedConfig.extra) mergedConfig.extra = {};
+      mergedConfig.extra.headers = headers;
       const stripeSig = headers["stripe-signature"] || headers["Stripe-Signature"];
       if (stripeSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(stripeSig) ? stripeSig[0] : stripeSig;
       }
       const ckoSig = headers["cko-signature"] || headers["Cko-Signature"];
       if (ckoSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(ckoSig) ? ckoSig[0] : ckoSig;
       }
       const rzpSig = headers["x-razorpay-signature"] || headers["X-Razorpay-Signature"];
       if (rzpSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(rzpSig) ? rzpSig[0] : rzpSig;
       }
       const squareSig = headers["x-square-hmacsha256-signature"] || headers["x-square-signature"];
       if (squareSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(squareSig) ? squareSig[0] : squareSig;
       }
       const payuSig = headers["openpayu-signature"] || headers["OpenPayU-Signature"];
       if (payuSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(payuSig) ? payuSig[0] : payuSig;
       }
       const btSig = headers["bt_signature"];
       const btPayload = headers["bt_payload"];
       if (btSig && btPayload) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.btSignature = Array.isArray(btSig) ? btSig[0] : btSig;
         mergedConfig.extra.btPayload = Array.isArray(btPayload) ? btPayload[0] : btPayload;
       }
+      const xenditToken = headers["x-callback-token"] || headers["X-Callback-Token"];
+      if (xenditToken) {
+        mergedConfig.extra.callbackToken = Array.isArray(xenditToken) ? xenditToken[0] : xenditToken;
+      }
+      const dokuSig = headers["signature"] || headers["Signature"];
+      if (dokuSig) {
+        mergedConfig.extra.dokuSignature = Array.isArray(dokuSig) ? dokuSig[0] : dokuSig;
+      }
+      const oyUser = headers["x-oy-username"] || headers["X-Oy-Username"];
+      if (oyUser) {
+        mergedConfig.extra.oyUsername = Array.isArray(oyUser) ? oyUser[0] : oyUser;
+      }
     }
     let providerName = configOverride?.provider || this.provider;
     if (payload) {
@@ -9058,8 +9112,6 @@ var Buayar = class {
         providerName = "adyen";
       } else if (payload.type && payload.data?._links && (payload.type.startsWith("payment_") || payload.type.startsWith("refund_"))) {
         providerName = "checkoutcom";
-      } else if (payload.event && payload.payload?.payment?.entity) {
-        providerName = "razorpay";
       } else if (payload.type && payload.data?.object?.status && payload.merchant_id) {
         providerName = "square";
       } else if (payload.order && payload.order?.status && payload.order?.extOrderId) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@crediblemark/buayar",
-  "version": "0.3.0",
-  "description": "Unified Payment Gateway SDK for Node.js and TypeScript supporting multiple providers",
+  "version": "0.3.1",
+  "description": "Unified Payment Gateway SDK for Node.js & TypeScript — 19 providers (Midtrans, Xendit, Duitku, Stripe, PayPal, Adyen, Razorpay, Square, Checkout.com, PayU, Braintree, 2Checkout, DOKU, iPaymu, PrismaLink, Faspay, Finpay, Nicepay, OY!) with zero-code switching via .env",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
@@ -13,11 +13,51 @@
     },
     "./package.json": "./package.json"
   },
+  "keywords": [
+    "payment-gateway",
+    "payment",
+    "sdk",
+    "unified-payment",
+    "midtrans",
+    "xendit",
+    "duitku",
+    "stripe",
+    "paypal",
+    "adyen",
+    "razorpay",
+    "square",
+    "checkout.com",
+    "payu",
+    "braintree",
+    "2checkout",
+    "doku",
+    "ipaymu",
+    "prismalink",
+    "faspay",
+    "finpay",
+    "nicepay",
+    "oy-indonesia",
+    "virtual-account",
+    "qris",
+    "ewallet",
+    "webhook",
+    "typescript",
+    "nodejs",
+    "indonesia",
+    "payment-indonesia",
+    "zero-code",
+    "pg-switcher",
+    "buayar"
+  ],
   "files": [
     "dist",
     "package.json",
     "README.md"
   ],
+  "homepage": "https://github.com/crediblemark-official/Buayar#readme",
+  "bugs": {
+    "url": "https://github.com/crediblemark-official/Buayar/issues"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/crediblemark-official/Buayar.git"
@@ -37,3 +77,4 @@
     "typescript": "^5.9.3"
   }
 }
+