@crediblemark/buayar 0.5.1 → 0.6.1

package/dist/index.mjs

@@ -2413,12 +2413,221 @@ Digest:${digest}`;
   return safeCompare(incomingSignature, expectedSignature);
 }
 
+// src/providers/doku/snap.ts
+import crypto3 from "crypto";
+function snapTimestamp(date = /* @__PURE__ */ new Date()) {
+  const wib = new Date(date.getTime() + 7 * 60 * 60 * 1e3);
+  return wib.toISOString().slice(0, 19) + "+07:00";
+}
+function snapUtcTimestamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().slice(0, 19) + "Z";
+}
+function minifyJson(obj) {
+  return JSON.stringify(obj);
+}
+function sha256Hex(body) {
+  const raw = typeof body === "string" ? body : minifyJson(body);
+  return crypto3.createHash("sha256").update(raw).digest("hex").toLowerCase();
+}
+function generateSnapSymmetricSignature(clientSecret, method, endpointUrl, accessToken, body, timestamp) {
+  const hash = sha256Hex(body);
+  const stringToSign = `${method}:${endpointUrl}:${accessToken}:${hash}:${timestamp}`;
+  return crypto3.createHmac("sha512", clientSecret).update(stringToSign).digest("base64");
+}
+function generateSnapAsymmetricSignature(privateKey, clientId, timestamp) {
+  const stringToSign = `${clientId}|${timestamp}`;
+  const key = crypto3.createPrivateKey(normalizePem(privateKey));
+  return crypto3.sign("RSA-SHA256", Buffer.from(stringToSign, "utf8"), key).toString("base64");
+}
+function normalizePem(key) {
+  const trimmed = key.trim();
+  if (trimmed.includes("-----BEGIN")) {
+    return trimmed;
+  }
+  return [
+    "-----BEGIN PRIVATE KEY-----",
+    trimmed.replace(/\s+/g, "").match(/.{1,64}/g)?.join("\n") || trimmed,
+    "-----END PRIVATE KEY-----"
+  ].join("\n");
+}
+function snapExternalId(prefix = "") {
+  return `${prefix}${Date.now()}${Math.floor(Math.random() * 1e3)}`;
+}
+function verifySnapWebhookSignature(headers, body, clientSecret, endpointUrl = "/api/payment/webhook") {
+  if (!clientSecret) return false;
+  const incoming = headers["x-signature"] || headers["X-SIGNATURE"] || headers["signature"] || headers["Signature"] || "";
+  if (!incoming) return false;
+  const timestamp = headers["x-timestamp"] || headers["X-TIMESTAMP"] || headers["timestamp"] || headers["Timestamp"] || snapTimestamp();
+  const computed = generateSnapSymmetricSignature(
+    clientSecret,
+    "POST",
+    endpointUrl,
+    "",
+    body,
+    timestamp
+  );
+  return safeCompare(incoming, computed);
+}
+
+// src/clients/snap.ts
+var SnapClient = class {
+  options;
+  token = null;
+  tokenExpiry = 0;
+  constructor(options) {
+    this.options = {
+      clientId: options.clientId || options.merchantCode || "",
+      clientSecret: options.clientSecret || options.apiKey || options.serverKey || options.secretKey || "",
+      privateKey: options.privateKey,
+      sandbox: !!options.sandbox,
+      merchantId: options.merchantId,
+      terminalId: options.terminalId,
+      partnerServiceId: options.partnerServiceId,
+      channelId: options.channelId || "H2H"
+    };
+  }
+  get baseUrl() {
+    return this.options.sandbox ? "https://api-sandbox.doku.com" : "https://api.doku.com";
+  }
+  get isConfigured() {
+    return Boolean(this.options.clientId && this.options.clientSecret);
+  }
+  /**
+   * Get (cached) B2B access token. Mints a new one when expired.
+   */
+  async getAccessToken() {
+    const now = Date.now();
+    if (this.token && now < this.tokenExpiry) {
+      return this.token;
+    }
+    const { clientId, clientSecret, privateKey } = this.options;
+    if (!privateKey) {
+      throw new Error("DOKU SNAP: RSA privateKey required to obtain B2B access token");
+    }
+    const endpoint = "/authorization/v1/access-token/b2b";
+    const timestamp = snapUtcTimestamp();
+    const signature = generateSnapAsymmetricSignature(privateKey, clientId, timestamp);
+    const response = await fetch(this.baseUrl + endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-CLIENT-KEY": clientId,
+        "X-TIMESTAMP": timestamp,
+        "X-SIGNATURE": signature
+      },
+      body: JSON.stringify({ grantType: "client_credentials" })
+    });
+    const text = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(text);
+    } catch {
+    }
+    if (!response.ok || !data?.accessToken) {
+      throw new Error(data?.responseMessage || data?.message || `DOKU SNAP get-token failed: HTTP ${response.status} - ${text}`);
+    }
+    if (!clientSecret) {
+    }
+    this.token = data.accessToken;
+    const expiresIn = Number(data.expiresIn || 900);
+    this.tokenExpiry = now + (expiresIn - 30) * 1e3;
+    return this.token;
+  }
+  clearToken() {
+    this.token = null;
+    this.tokenExpiry = 0;
+  }
+  /**
+   * Perform a signed SNAP transaction request.
+   * @param method        GET/POST
+   * @param endpoint      request-target path (e.g. /virtual-accounts/...)
+   * @param body          request body (object)
+   * @param opts          extra headers (X-DEVICE-ID, X-IP-ADDRESS, etc.)
+   */
+  async request(method, endpoint, body, opts = {}) {
+    const { clientId, clientSecret, channelId } = this.options;
+    if (!clientSecret) {
+      throw new Error("DOKU SNAP: clientSecret (Secret Key) required for transaction signing");
+    }
+    const accessToken = await this.getAccessToken();
+    const timestamp = snapTimestamp();
+    const externalId = opts.externalId || snapExternalId();
+    const payload = body === void 0 ? "" : body;
+    const signature = generateSnapSymmetricSignature(
+      clientSecret,
+      method,
+      endpoint,
+      accessToken,
+      payload,
+      timestamp
+    );
+    const headers = {
+      "Content-Type": "application/json",
+      "X-PARTNER-ID": clientId,
+      "X-EXTERNAL-ID": externalId,
+      "X-TIMESTAMP": timestamp,
+      "X-SIGNATURE": signature,
+      "CHANNEL-ID": channelId || "H2H",
+      "Authorization": `Bearer ${accessToken}`,
+      ...opts.deviceId ? { "X-DEVICE-ID": opts.deviceId } : {},
+      ...opts.ipAddress ? { "X-IP-ADDRESS": opts.ipAddress } : {},
+      ...opts.extraHeaders || {}
+    };
+    const response = await fetch(this.baseUrl + endpoint, {
+      method,
+      headers,
+      body: method === "POST" && body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    const text = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(text);
+    } catch {
+    }
+    if (!response.ok) {
+      const err = data?.responseMessage || data?.error?.message || data?.message || `HTTP ${response.status}`;
+      throw new Error(`${err}${data?.responseCode ? ` (${data.responseCode})` : ""}`);
+    }
+    return data;
+  }
+};
+
 // src/providers/doku/provider.ts
 var DokuProvider = class extends BasePaymentProvider {
   name = "doku";
   getBaseUrl(sandbox) {
     return sandbox ? "https://api-sandbox.doku.com" : "https://api.doku.com";
   }
+  /**
+   * DETEKSI mode integrasi DOKU:
+   * - SNAP  : kredensial baru (Client ID `doku_...` + Secret Key `SK-...`) + opsional RSA privateKey
+   *           untuk Get Token B2B. Diaktifkan via extra.snap / extra.dokuMode="snap" / doku_ prefix.
+   * - Legacy: Jokul v2 (Client-Id + Signature HMAC-SHA256), default jika bukan SNAP.
+   */
+  isSnap(config) {
+    if (config.extra?.snap === true || config.extra?.snap === "true") return true;
+    if (config.extra?.dokuMode === "snap") return true;
+    const clientId = String(config.merchantCode || config.merchantId || config.clientKey || "").trim().toLowerCase();
+    return /^doku[_:-]/.test(clientId);
+  }
+  buildSnap(config) {
+    const clientId = config.merchantCode || config.merchantId || config.clientKey || "";
+    const clientSecret = config.apiKey || config.serverKey || config.secretKey || "";
+    return new SnapClient({
+      clientId,
+      clientSecret,
+      privateKey: config.privateKey,
+      sandbox: !!config.sandbox,
+      merchantId: config.extra?.merchantId || config.projectId || "",
+      terminalId: config.extra?.terminalId || "",
+      partnerServiceId: config.extra?.partnerServiceId || "",
+      channelId: config.extra?.channelId || "H2H"
+    });
+  }
+  /** Helper: jumlah integer → format SNAP 2-desimal (".00"). */
+  snapAmount(amount, currency = "IDR") {
+    return { value: amount.toFixed(2), currency };
+  }
   async createInvoice(params, config) {
     const { orderId, amount, productDetails, customer, returnUrl } = params;
     const clientId = config.merchantCode || config.merchantId || config.clientKey || "";
@@ -2429,6 +2638,9 @@ var DokuProvider = class extends BasePaymentProvider {
     const isDirect = !!dokuMethod;
     const baseUrl = this.getBaseUrl(sandbox);
     try {
+      if (this.isSnap(config)) {
+        return await this.createSnapInvoice(params, config, baseUrl);
+      }
       if (isDirect) {
         const endpoint = dokuMethod.endpoint;
         const url = `${baseUrl}${endpoint}`;
@@ -2616,7 +2828,178 @@ var DokuProvider = class extends BasePaymentProvider {
       };
     }
   }
+  /**
+   * DOKU SNAP: buat transaksi (Create VA / Generate QRIS / e-Wallet Payment).
+   * Autentikasi via B2B token + symmetric HMAC-SHA512 signature.
+   */
+  async createSnapInvoice(params, config, baseUrl) {
+    const { orderId, amount, productDetails, customer, returnUrl } = params;
+    const snap = this.buildSnap(config);
+    const integerAmount = Math.round(amount);
+    const method = String(params.paymentMethod || "").toLowerCase();
+    const bankMap = {
+      bca: "VIRTUAL_ACCOUNT_BCA",
+      mandiri: "VIRTUAL_ACCOUNT_BANK_MANDIRI",
+      bri: "VIRTUAL_ACCOUNT_BRI",
+      bni: "VIRTUAL_ACCOUNT_BNI",
+      permata: "VIRTUAL_ACCOUNT_BANK_PERMATA",
+      cimb: "VIRTUAL_ACCOUNT_BANK_CIMB",
+      danamon: "VIRTUAL_ACCOUNT_BANK_DANAMON",
+      bsi: "VIRTUAL_ACCOUNT_BANK_SYARIAH_MANDIRI",
+      sinarmas: "VIRTUAL_ACCOUNT_SINARMAS",
+      bjb: "VIRTUAL_ACCOUNT_BANK_BJB",
+      btn: "VIRTUAL_ACCOUNT_BTN",
+      bnc: "VIRTUAL_ACCOUNT_BNC"
+    };
+    const isVa = method.includes("_va");
+    const isQris = method === "qris" || method.includes("qris");
+    try {
+      if (isVa) {
+        return await this.snapCreateVA(params, config, snap, baseUrl, bankMap);
+      }
+      if (isQris) {
+        return await this.snapGenerateQRIS(params, config, snap, baseUrl);
+      }
+      return await this.snapEWalletPayment(params, config, snap, baseUrl);
+    } catch (e) {
+      return {
+        success: false,
+        provider: "doku",
+        orderId,
+        amount: integerAmount,
+        rawResponse: null,
+        error: e.message || "Failed to make SNAP request to DOKU API"
+      };
+    }
+  }
+  /** Create Virtual Account (SNAP) — DOKU Generate Payment Code. */
+  async snapCreateVA(params, config, snap, baseUrl, bankMap) {
+    const { orderId, amount, productDetails, customer } = params;
+    const method = String(params.paymentMethod || "").toLowerCase();
+    const bankKey = method.replace(/_va$/, "");
+    const channel = config.extra?.vaChannel || bankMap[bankKey] || `VIRTUAL_ACCOUNT_${bankKey.toUpperCase()}`;
+    const partnerServiceId = (config.extra?.partnerServiceId || "").replace(/\s/g, "");
+    const customerNo = (config.extra?.customerNo || "").slice(0, 20) || String(Date.now()).slice(-12);
+    const virtualAccountNo = (partnerServiceId + customerNo).slice(0, 28);
+    const reusable = config.extra?.reusableStatus === true;
+    const currency = params.currency || "IDR";
+    const body = {
+      partnerServiceId,
+      customerNo,
+      virtualAccountNo,
+      virtualAccountName: customer.name || "Customer",
+      virtualAccountEmail: customer.email,
+      virtualAccountPhone: customer.phone,
+      trxId: orderId,
+      totalAmount: this.snapAmount(amount, currency),
+      virtualAccountTrxType: "C",
+      additionalInfo: {
+        channel,
+        virtualAccountConfig: { reusableStatus: reusable }
+      }
+    };
+    if (params.providerParams) {
+      Object.assign(body.additionalInfo.virtualAccountConfig, params.providerParams);
+    }
+    if (config.extra?.expiredDate) body.expiredDate = config.extra.expiredDate;
+    const endpoint = "/virtual-accounts/bi-snap-va/v1.1/transfer-va/create-va";
+    const data = await snap.request("POST", endpoint, body);
+    const vaData = data.virtualAccountData || {};
+    return {
+      success: true,
+      provider: "doku",
+      orderId: vaData.trxId || orderId,
+      amount: Number(vaData.totalAmount?.value || amount) || Math.round(amount),
+      reference: vaData.virtualAccountNo || orderId,
+      vaNumber: vaData.virtualAccountNo,
+      vaBank: bankKey.toUpperCase(),
+      paymentUrl: vaData.additionalInfo?.howToPayPage,
+      expiresAt: vaData.expiredDate ? new Date(vaData.expiredDate) : void 0,
+      rawResponse: data
+    };
+  }
+  /** Generate QRIS (SNAP) — dynamic QRIS MPM. */
+  async snapGenerateQRIS(params, config, snap, baseUrl) {
+    const { orderId, amount } = params;
+    const currency = params.currency || "IDR";
+    const merchantId = config.extra?.merchantId || config.projectId || "";
+    const terminalId = config.extra?.terminalId || "0001";
+    const body = {
+      partnerReferenceNo: orderId,
+      amount: this.snapAmount(amount, currency),
+      merchantId,
+      terminalId,
+      validityPeriod: config.extra?.validityPeriod || new Date(Date.now() + 3600 * 1e3).toISOString(),
+      additionalInfo: {
+        postalCode: config.extra?.postalCode || "10110",
+        feeType: 1
+      }
+    };
+    if (params.providerParams) {
+      Object.assign(body.additionalInfo, params.providerParams);
+    }
+    const endpoint = "/snap-adapter/b2b/v1.0/qr/qr-mpm-generate";
+    const data = await snap.request("POST", endpoint, body);
+    return {
+      success: true,
+      provider: "doku",
+      orderId: data.partnerReferenceNo || orderId,
+      amount: Number(data.amount?.value || amount) || Math.round(amount),
+      reference: data.referenceNo || orderId,
+      qrString: data.qrContent,
+      rawResponse: data
+    };
+  }
+  /** e-Wallet payment (SNAP) — DANA / OVO / ShopeePay via payment-host-to-host. */
+  async snapEWalletPayment(params, config, snap, baseUrl) {
+    const { orderId, amount } = params;
+    const method = String(params.paymentMethod || "").toLowerCase();
+    const currency = params.currency || "IDR";
+    const returnUrl = params.returnUrl || config.returnUrl || "";
+    const channelMap = {
+      dana: "EMONEY_DANA_SNAP",
+      ovo: "EMONEY_OVO_SNAP",
+      shopeepay: "EMONEY_SHOPEEPAY_SNAP"
+    };
+    const channel = config.extra?.ewalletChannel || channelMap[method] || `EMONEY_${method.toUpperCase()}_SNAP`;
+    const body = {
+      partnerReferenceNo: orderId,
+      amount: this.snapAmount(amount, currency),
+      pointOfInitiation: "pc",
+      urlParam: {
+        url: returnUrl || "https://example.com/return",
+        type: "PAY_RETURN",
+        isDeepLink: "N"
+      },
+      additionalInfo: {
+        channel,
+        orderTitle: params.productDetails || `Pembayaran ${orderId}`,
+        supportDeepLinkCheckoutUrl: "false"
+      }
+    };
+    if (params.providerParams) {
+      Object.assign(body.additionalInfo, params.providerParams);
+    }
+    const endpoint = "/direct-debit/core/v1/debit/payment-host-to-host";
+    const data = await snap.request("POST", endpoint, body, {
+      deviceId: config.extra?.deviceId,
+      ipAddress: config.extra?.ipAddress
+    });
+    return {
+      success: true,
+      provider: "doku",
+      orderId: data.partnerReferenceNo || orderId,
+      amount: Number(data.amount?.value || amount) || Math.round(amount),
+      reference: data.partnerReferenceNo || orderId,
+      paymentUrl: data.webRedirectUrl || data.paymentUrl,
+      rawResponse: data
+    };
+  }
   async verifyCallback(body, config) {
+    const headers = config.extra?.headers || {};
+    if (this.isSnap(config)) {
+      return this.verifySnapCallback(body, config, headers);
+    }
     const rawStatus = (body.transaction?.status || body.status || "").toUpperCase();
     const isPaid = rawStatus === "SUCCESS" || rawStatus === "PAID" || rawStatus === "SETTLED";
     const isPending = rawStatus === "PENDING";
@@ -2626,7 +3009,6 @@ var DokuProvider = class extends BasePaymentProvider {
     const amount = body.order?.amount || body.amount || 0;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
     const secretKey = config.secretKey || config.apiKey || "";
-    const headers = config.extra?.headers || {};
     const signature = headers["signature"] || headers["Signature"] || config.extra?.dokuSignature || config.extra?.signatureHeader;
     const clientId = config.merchantCode || config.clientKey || "";
     let isValid = true;
@@ -2647,6 +3029,40 @@ var DokuProvider = class extends BasePaymentProvider {
       rawPayload: body
     };
   }
+  /**
+   * Verifikasi webhook / notifikasi DOKU SNAP.
+   * Signature dibangun dengan symmetric HMAC-SHA512 (AccessToken kosong).
+   */
+  verifySnapCallback(body, config, headers) {
+    const clientSecret = config.apiKey || config.serverKey || config.secretKey || "";
+    const endpointUrl = config.extra?.notificationPath || headers["x-path"] || config.extra?.headers?.["request-target"] || "/api/payment/webhook";
+    let isValid = true;
+    const incomingSig = headers["x-signature"] || headers["X-SIGNATURE"] || headers["signature"] || headers["Signature"] || "";
+    if (incomingSig && clientSecret) {
+      isValid = verifySnapWebhookSignature(headers, body, clientSecret, endpointUrl);
+    }
+    const explicitStatus = String(body.transactionStatus || body.status || body.latestTransactionStatus || "").toUpperCase();
+    const isPaid = explicitStatus === "SUCCESS" || explicitStatus === "PAID" || explicitStatus === "SETTLED" || explicitStatus === "00" || !explicitStatus && Boolean(body.paidAmount?.value ?? body.totalAmount?.value);
+    const isPending = explicitStatus === "PENDING" || explicitStatus === "11" || explicitStatus === "ONGOING";
+    const isFailed = explicitStatus === "FAILED" || explicitStatus === "DECLINED" || Boolean(explicitStatus) && !isPaid && !isPending && explicitStatus !== "00";
+    const isExpired = explicitStatus === "EXPIRED";
+    const orderId = body.trxId || body.partnerReferenceNo || body.originalPartnerReferenceNo || body.order?.invoice_number || body.invoice_number || body.order_id || "";
+    const paidValue = body.paidAmount?.value ?? body.totalAmount?.value ?? body.amount?.value ?? body.amount ?? 0;
+    const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    return {
+      isValid,
+      provider: "doku",
+      orderId: String(orderId),
+      amount: Number(paidValue) || 0,
+      status,
+      isPaid,
+      isPending,
+      isFailed,
+      isExpired,
+      statusCode: explicitStatus || "SUCCESS",
+      rawPayload: body
+    };
+  }
   async getPaymentMethods(params, config) {
     const staticMethods = [
       {
@@ -2806,6 +3222,9 @@ var DokuProvider = class extends BasePaymentProvider {
     const clientId = config.merchantCode || config.merchantId || config.clientKey || "";
     const secretKey = config.apiKey || config.serverKey || config.secretKey || "";
     const sandbox = !!config.sandbox;
+    if (this.isSnap(config)) {
+      return this.snapCheckTransaction(params, config, clientId);
+    }
     const endpoint = `/orders/v1/status/${merchantOrderId}`;
     const url = `${this.getBaseUrl(sandbox)}${endpoint}`;
     const headers = generateDokuHeaders(clientId, secretKey, endpoint);
@@ -2883,6 +3302,58 @@ var DokuProvider = class extends BasePaymentProvider {
       };
     }
   }
+  /** Cek status transaksi SNAP (menggunakan Query QRIS bila ref berasal dari QRIS). */
+  async snapCheckTransaction(params, config, clientId) {
+    const { merchantOrderId } = params;
+    const snap = this.buildSnap(config);
+    try {
+      const body = {
+        originalPartnerReferenceNo: merchantOrderId,
+        serviceCode: "47",
+        merchantId: config.extra?.merchantId || config.projectId || ""
+      };
+      const data = await snap.request("POST", "/snap-adapter/b2b/v1.0/qr/qr-mpm-query", body);
+      const txStatus = String(data.latestTransactionStatus || "").toUpperCase();
+      const isPaid = txStatus === "SUCCESS" || txStatus === "00" || txStatus === "PAID" || txStatus === "SETTLED";
+      const isPending = txStatus === "PENDING" || txStatus === "ONGOING" || txStatus === "11";
+      const isExpired = txStatus === "EXPIRED";
+      const isFailed = txStatus === "FAILED" || txStatus === "DECLINED" || Boolean(txStatus) && !isPaid && !isPending && !isExpired;
+      const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+      return {
+        success: true,
+        provider: "doku",
+        orderId: data.originalPartnerReferenceNo || merchantOrderId,
+        reference: data.originalReferenceNo || "",
+        amount: Number(data.amount?.value || 0),
+        statusCode: txStatus || String(data.responseCode || ""),
+        status,
+        isPaid,
+        isPending,
+        isFailed,
+        isExpired,
+        statusMessage: txStatus || data.responseMessage || "",
+        paymentType: "QRIS",
+        rawResponse: data
+      };
+    } catch (e) {
+      return {
+        success: false,
+        provider: "doku",
+        orderId: merchantOrderId,
+        reference: "",
+        amount: 0,
+        statusCode: "ERROR",
+        status: "failed",
+        isPaid: false,
+        isPending: false,
+        isFailed: true,
+        isExpired: false,
+        statusMessage: e.message || "Failed to check SNAP transaction status",
+        error: e.message || "Failed to check SNAP transaction status",
+        rawResponse: null
+      };
+    }
+  }
 };
 
 // src/providers/prismalink/signature.ts
@@ -3276,15 +3747,15 @@ var PrismalinkProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/faspay/signature.ts
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 function generateFaspaySignature(userId, password, billNo) {
-  const md5Hash = crypto3.createHash("md5").update(`${userId}${password}${billNo}`).digest("hex");
-  return crypto3.createHash("sha1").update(md5Hash).digest("hex");
+  const md5Hash = crypto4.createHash("md5").update(`${userId}${password}${billNo}`).digest("hex");
+  return crypto4.createHash("sha1").update(md5Hash).digest("hex");
 }
 function verifyFaspaySignature(userId, password, billNo, paymentStatusCode, incomingSignature) {
   if (!incomingSignature || !password) return false;
-  const md5Hash = crypto3.createHash("md5").update(`${userId}${password}${billNo}${paymentStatusCode}`).digest("hex");
-  const computed = crypto3.createHash("sha1").update(md5Hash).digest("hex");
+  const md5Hash = crypto4.createHash("md5").update(`${userId}${password}${billNo}${paymentStatusCode}`).digest("hex");
+  const computed = crypto4.createHash("sha1").update(md5Hash).digest("hex");
   const simpleComputed = generateFaspaySignature(userId, password, billNo);
   return safeCompare(incomingSignature, computed) || safeCompare(incomingSignature, simpleComputed);
 }
@@ -3697,10 +4168,10 @@ var FaspayProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/finpay/signature.ts
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 function generateFinpaySignature(merchantId, orderId, amount, merchantKey) {
   const data = `${merchantId}%${orderId}%${Math.round(amount)}%${merchantKey}`;
-  return crypto4.createHmac("sha512", merchantKey).update(data).digest("hex");
+  return crypto5.createHmac("sha512", merchantKey).update(data).digest("hex");
 }
 function verifyFinpaySignature(merchantId, orderId, amount, merchantKey, incomingSignature) {
   if (!incomingSignature || !merchantKey) return false;
@@ -9442,6 +9913,7 @@ export {
   PrismalinkProvider,
   RazorpayClient,
   RazorpayProvider,
+  SnapClient,
   SquareClient,
   SquareProvider,
   StripeClient,
@@ -9465,6 +9937,8 @@ export {
   generateNicepayToken,
   generateOyHeaders,
   generatePrismalinkSignature,
+  generateSnapAsymmetricSignature,
+  generateSnapSymmetricSignature,
   getDuitkuInquirySignatures,
   getDuitkuPaymentMethodsSignature,
   getDuitkuStatusSignatures,
@@ -9472,6 +9946,7 @@ export {
   getXenditAuthHeader,
   hmacSha256,
   md5,
+  minifyJson,
   parseCoreChargeResponse,
   paymentManager,
   resolveConfigFromEnv,
@@ -9479,7 +9954,11 @@ export {
   serializePaypalParams,
   serializeStripeParams,
   sha256,
+  sha256Hex,
   sha512,
+  snapExternalId,
+  snapTimestamp,
+  snapUtcTimestamp,
   toCanonicalPaymentMethod,
   toDokuPaymentMethod,
   toDuitkuPaymentMethod,
@@ -9505,6 +9984,7 @@ export {
   verifyPayuWebhook,
   verifyPrismalinkSignature,
   verifyRazorpayWebhook,
+  verifySnapWebhookSignature,
   verifySquareWebhook,
   verifyStripeWebhook,
   verifyTwoCheckoutWebhook,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediblemark/buayar",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Unified Payment Gateway SDK for Node.js & TypeScript — 19 providers (Midtrans, Xendit, Duitku, Stripe, PayPal, Adyen, Razorpay, Square, Checkout.com, PayU, Braintree, 2Checkout, DOKU, iPaymu, PrismaLink, Faspay, Finpay, Nicepay, OY!) with zero-code switching via .env",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",