@crediblemark/buayar 0.8.2 → 0.8.3

package/dist/cli/index.js

@@ -484,7 +484,7 @@ function printScaffoldSummary(result) {
 }
 
 // src/cli/index.ts
-var VERSION = "0.8.2";
+var VERSION = "0.8.3";
 function parseArgs(argv) {
   const flags = [];
   const rest = [];

package/dist/index.d.mts

@@ -1523,6 +1523,29 @@ declare function generateIpaymuSignature(method: "GET" | "POST", va: string, api
     signature: string;
     timestamp: string;
 };
+/**
+ * Normalisasi payload callback iPaymu agar identik dengan apa yang
+ * ditandatangani iPaymu (merujuk dokumentasi resmi callback):
+ * - trx_id / status_code / transaction_status_code / paid_off → Integer
+ * - is_escrow → Boolean
+ * - additional_info "[]" (string) → [] (array); tambah [] saat field tidak ada
+ * - field lain → String
+ * - field "signature" (bila ikut terkirim di body) dibuang dari perhitungan
+ */
+declare function normalizeIpaymuCallback(payload: any): Record<string, any>;
+/**
+ * Bangun string JSON yang ditandatangani iPaymu untuk verifikasi callback:
+ * - key diurutkan ascending (A-Z) dengan sort case-sensitif
+ * - forward slash di-escape menjadi "\/" sesuai standar PHP json_encode
+ */
+declare function buildIpaymuCallbackString(payload: any): string;
+/**
+ * Verifikasi signature callback iPaymu.
+ * Secret key = Nomor VA (Merchant VA) akun iPaymu; dibandingkan dengan
+ * nilai header X-Signature menggunakan perbandingan timing-safe.
+ * Tanpa header signature atau secret → INVALID.
+ */
+declare function verifyIpaymuCallbackSignature(payload: any, secretKey: string, xSignature?: string): boolean;
 /**
  * Verifikasi callback webhook dari iPaymu
  */
@@ -1870,4 +1893,4 @@ declare function safeCompare(a: string, b: string): boolean;
  */
 declare function getPaymentMethodCategory(code: string, name?: string): "Virtual Account" | "QRIS" | "E-Wallet" | "Retail / Gerai" | "Kartu Kredit" | "Paylater / Cicilan" | "Lainnya";
 
-export { AdyenClient, AdyenProvider, BasePaymentProvider, BraintreeClient, BraintreeProvider, Buayar, type BuayarConfig, CANONICAL_TO_DOKU, CANONICAL_TO_DUITKU, CANONICAL_TO_FASPAY, CANONICAL_TO_FINPAY, CANONICAL_TO_IPAYMU, CANONICAL_TO_MIDTRANS, CANONICAL_TO_NICEPAY, CANONICAL_TO_OY, CANONICAL_TO_PRISMALINK, CANONICAL_TO_STRIPE, CANONICAL_TO_XENDIT, CORE_API_METHODS, type CanonicalPaymentMethod, type CheckBalanceResult, type CheckTransactionParams, type CheckTransactionResult, CheckoutComClient, CheckoutComProvider, type CreateInvoiceParams, type CustomerDetails, DUITKU_TO_CANONICAL, type DisburseParams, type DisburseResult, DokuClient, DokuProvider, DuitkuClient, type DuitkuDisbursementParams, DuitkuProvider, type EWalletResponse, FaspayClient, FaspayProvider, FinpayClient, FinpayProvider, type GetPaymentMethodsParams, type GetPaymentMethodsResult, type InvoiceResponse, IpaymuClient, IpaymuProvider, MIDTRANS_PROBE_PAYLOADS, MIDTRANS_STATIC_METHODS, type MandiriBillInfo, MidtransClient, MidtransProvider, NicepayClient, NicepayProvider, OyClient, OyProvider, PaymentManager, type PaymentMethod, type PaymentMethodItem, type PaymentMode, PaypalClient, PaypalProvider, PayuClient, PayuProvider, PrismalinkClient, PrismalinkProvider, type ProviderCapability, type ProviderConfig, type ProviderDescriptor, ProviderRegistry, type QrisResponse, RazorpayClient, RazorpayProvider, type RefundParams, type RefundResult, SnapApiError, SnapClient, type SnapClientOptions, SquareClient, SquareProvider, StripeClient, StripeProvider, TwoCheckoutClient, TwoCheckoutProvider, type VerifyCallbackResult, type VirtualAccountResponse, XenditClient, type XenditDisbursementParams, XenditProvider, buayar, buildBraintreeBasicAuth, buildCoreChargePayload, buildDefaultDescriptors, buildPaypalBasicAuth, buildPayuBasicAuth, buildRazorpayBasicAuth, buildTwoCheckoutAuth, formatNicepayTimestamp, generateDokuHeaders, generateFaspaySignature, generateFinpaySignature, generateIpaymuSignature, generateNicepayToken, generateOyHeaders, generatePrismalinkSignature, generateSnapAsymmetricSignature, generateSnapSymmetricSignature, getDuitkuInquirySignatures, getDuitkuPaymentMethodsSignature, getDuitkuStatusSignatures, getPaymentMethodCategory, getXenditAuthHeader, hmacSha256, md5, minifyJson, parseCoreChargeResponse, paymentManager, providerRegistry, resolveConfigFromEnv, safeCompare, serializePaypalParams, serializeStripeParams, sha256, sha256Hex, sha512, snapErrorHint, snapExternalId, snapTimestamp, snapUtcTimestamp, toCanonicalPaymentMethod, toDokuPaymentMethod, toDuitkuPaymentMethod, toFaspayPaymentMethod, toFinpayPaymentMethod, toIpaymuPaymentMethod, toNicepayPaymentMethod, toOyPaymentMethod, toPrismalinkPaymentMethod, toStripePaymentMethod, toXenditPaymentMethod, verifyAdyenWebhook, verifyBraintreeWebhook, verifyCheckoutComWebhook, verifyDokuWebhookSignature, verifyDuitkuCallbackSignature, verifyFaspaySignature, verifyFinpaySignature, verifyIpaymuCallback, verifyNicepayWebhook, verifyOyWebhook, verifyPaypalWebhookSimple, verifyPayuWebhook, verifyPrismalinkSignature, verifyRazorpayWebhook, verifySnapWebhookSignature, verifySquareWebhook, verifyStripeWebhook, verifyTwoCheckoutWebhook, verifyXenditWebhookToken };
+export { AdyenClient, AdyenProvider, BasePaymentProvider, BraintreeClient, BraintreeProvider, Buayar, type BuayarConfig, CANONICAL_TO_DOKU, CANONICAL_TO_DUITKU, CANONICAL_TO_FASPAY, CANONICAL_TO_FINPAY, CANONICAL_TO_IPAYMU, CANONICAL_TO_MIDTRANS, CANONICAL_TO_NICEPAY, CANONICAL_TO_OY, CANONICAL_TO_PRISMALINK, CANONICAL_TO_STRIPE, CANONICAL_TO_XENDIT, CORE_API_METHODS, type CanonicalPaymentMethod, type CheckBalanceResult, type CheckTransactionParams, type CheckTransactionResult, CheckoutComClient, CheckoutComProvider, type CreateInvoiceParams, type CustomerDetails, DUITKU_TO_CANONICAL, type DisburseParams, type DisburseResult, DokuClient, DokuProvider, DuitkuClient, type DuitkuDisbursementParams, DuitkuProvider, type EWalletResponse, FaspayClient, FaspayProvider, FinpayClient, FinpayProvider, type GetPaymentMethodsParams, type GetPaymentMethodsResult, type InvoiceResponse, IpaymuClient, IpaymuProvider, MIDTRANS_PROBE_PAYLOADS, MIDTRANS_STATIC_METHODS, type MandiriBillInfo, MidtransClient, MidtransProvider, NicepayClient, NicepayProvider, OyClient, OyProvider, PaymentManager, type PaymentMethod, type PaymentMethodItem, type PaymentMode, PaypalClient, PaypalProvider, PayuClient, PayuProvider, PrismalinkClient, PrismalinkProvider, type ProviderCapability, type ProviderConfig, type ProviderDescriptor, ProviderRegistry, type QrisResponse, RazorpayClient, RazorpayProvider, type RefundParams, type RefundResult, SnapApiError, SnapClient, type SnapClientOptions, SquareClient, SquareProvider, StripeClient, StripeProvider, TwoCheckoutClient, TwoCheckoutProvider, type VerifyCallbackResult, type VirtualAccountResponse, XenditClient, type XenditDisbursementParams, XenditProvider, buayar, buildBraintreeBasicAuth, buildCoreChargePayload, buildDefaultDescriptors, buildIpaymuCallbackString, buildPaypalBasicAuth, buildPayuBasicAuth, buildRazorpayBasicAuth, buildTwoCheckoutAuth, formatNicepayTimestamp, generateDokuHeaders, generateFaspaySignature, generateFinpaySignature, generateIpaymuSignature, generateNicepayToken, generateOyHeaders, generatePrismalinkSignature, generateSnapAsymmetricSignature, generateSnapSymmetricSignature, getDuitkuInquirySignatures, getDuitkuPaymentMethodsSignature, getDuitkuStatusSignatures, getPaymentMethodCategory, getXenditAuthHeader, hmacSha256, md5, minifyJson, normalizeIpaymuCallback, parseCoreChargeResponse, paymentManager, providerRegistry, resolveConfigFromEnv, safeCompare, serializePaypalParams, serializeStripeParams, sha256, sha256Hex, sha512, snapErrorHint, snapExternalId, snapTimestamp, snapUtcTimestamp, toCanonicalPaymentMethod, toDokuPaymentMethod, toDuitkuPaymentMethod, toFaspayPaymentMethod, toFinpayPaymentMethod, toIpaymuPaymentMethod, toNicepayPaymentMethod, toOyPaymentMethod, toPrismalinkPaymentMethod, toStripePaymentMethod, toXenditPaymentMethod, verifyAdyenWebhook, verifyBraintreeWebhook, verifyCheckoutComWebhook, verifyDokuWebhookSignature, verifyDuitkuCallbackSignature, verifyFaspaySignature, verifyFinpaySignature, verifyIpaymuCallback, verifyIpaymuCallbackSignature, verifyNicepayWebhook, verifyOyWebhook, verifyPaypalWebhookSimple, verifyPayuWebhook, verifyPrismalinkSignature, verifyRazorpayWebhook, verifySnapWebhookSignature, verifySquareWebhook, verifyStripeWebhook, verifyTwoCheckoutWebhook, verifyXenditWebhookToken };

package/dist/index.d.ts

@@ -1523,6 +1523,29 @@ declare function generateIpaymuSignature(method: "GET" | "POST", va: string, api
     signature: string;
     timestamp: string;
 };
+/**
+ * Normalisasi payload callback iPaymu agar identik dengan apa yang
+ * ditandatangani iPaymu (merujuk dokumentasi resmi callback):
+ * - trx_id / status_code / transaction_status_code / paid_off → Integer
+ * - is_escrow → Boolean
+ * - additional_info "[]" (string) → [] (array); tambah [] saat field tidak ada
+ * - field lain → String
+ * - field "signature" (bila ikut terkirim di body) dibuang dari perhitungan
+ */
+declare function normalizeIpaymuCallback(payload: any): Record<string, any>;
+/**
+ * Bangun string JSON yang ditandatangani iPaymu untuk verifikasi callback:
+ * - key diurutkan ascending (A-Z) dengan sort case-sensitif
+ * - forward slash di-escape menjadi "\/" sesuai standar PHP json_encode
+ */
+declare function buildIpaymuCallbackString(payload: any): string;
+/**
+ * Verifikasi signature callback iPaymu.
+ * Secret key = Nomor VA (Merchant VA) akun iPaymu; dibandingkan dengan
+ * nilai header X-Signature menggunakan perbandingan timing-safe.
+ * Tanpa header signature atau secret → INVALID.
+ */
+declare function verifyIpaymuCallbackSignature(payload: any, secretKey: string, xSignature?: string): boolean;
 /**
  * Verifikasi callback webhook dari iPaymu
  */
@@ -1870,4 +1893,4 @@ declare function safeCompare(a: string, b: string): boolean;
  */
 declare function getPaymentMethodCategory(code: string, name?: string): "Virtual Account" | "QRIS" | "E-Wallet" | "Retail / Gerai" | "Kartu Kredit" | "Paylater / Cicilan" | "Lainnya";
 
-export { AdyenClient, AdyenProvider, BasePaymentProvider, BraintreeClient, BraintreeProvider, Buayar, type BuayarConfig, CANONICAL_TO_DOKU, CANONICAL_TO_DUITKU, CANONICAL_TO_FASPAY, CANONICAL_TO_FINPAY, CANONICAL_TO_IPAYMU, CANONICAL_TO_MIDTRANS, CANONICAL_TO_NICEPAY, CANONICAL_TO_OY, CANONICAL_TO_PRISMALINK, CANONICAL_TO_STRIPE, CANONICAL_TO_XENDIT, CORE_API_METHODS, type CanonicalPaymentMethod, type CheckBalanceResult, type CheckTransactionParams, type CheckTransactionResult, CheckoutComClient, CheckoutComProvider, type CreateInvoiceParams, type CustomerDetails, DUITKU_TO_CANONICAL, type DisburseParams, type DisburseResult, DokuClient, DokuProvider, DuitkuClient, type DuitkuDisbursementParams, DuitkuProvider, type EWalletResponse, FaspayClient, FaspayProvider, FinpayClient, FinpayProvider, type GetPaymentMethodsParams, type GetPaymentMethodsResult, type InvoiceResponse, IpaymuClient, IpaymuProvider, MIDTRANS_PROBE_PAYLOADS, MIDTRANS_STATIC_METHODS, type MandiriBillInfo, MidtransClient, MidtransProvider, NicepayClient, NicepayProvider, OyClient, OyProvider, PaymentManager, type PaymentMethod, type PaymentMethodItem, type PaymentMode, PaypalClient, PaypalProvider, PayuClient, PayuProvider, PrismalinkClient, PrismalinkProvider, type ProviderCapability, type ProviderConfig, type ProviderDescriptor, ProviderRegistry, type QrisResponse, RazorpayClient, RazorpayProvider, type RefundParams, type RefundResult, SnapApiError, SnapClient, type SnapClientOptions, SquareClient, SquareProvider, StripeClient, StripeProvider, TwoCheckoutClient, TwoCheckoutProvider, type VerifyCallbackResult, type VirtualAccountResponse, XenditClient, type XenditDisbursementParams, XenditProvider, buayar, buildBraintreeBasicAuth, buildCoreChargePayload, buildDefaultDescriptors, buildPaypalBasicAuth, buildPayuBasicAuth, buildRazorpayBasicAuth, buildTwoCheckoutAuth, formatNicepayTimestamp, generateDokuHeaders, generateFaspaySignature, generateFinpaySignature, generateIpaymuSignature, generateNicepayToken, generateOyHeaders, generatePrismalinkSignature, generateSnapAsymmetricSignature, generateSnapSymmetricSignature, getDuitkuInquirySignatures, getDuitkuPaymentMethodsSignature, getDuitkuStatusSignatures, getPaymentMethodCategory, getXenditAuthHeader, hmacSha256, md5, minifyJson, parseCoreChargeResponse, paymentManager, providerRegistry, resolveConfigFromEnv, safeCompare, serializePaypalParams, serializeStripeParams, sha256, sha256Hex, sha512, snapErrorHint, snapExternalId, snapTimestamp, snapUtcTimestamp, toCanonicalPaymentMethod, toDokuPaymentMethod, toDuitkuPaymentMethod, toFaspayPaymentMethod, toFinpayPaymentMethod, toIpaymuPaymentMethod, toNicepayPaymentMethod, toOyPaymentMethod, toPrismalinkPaymentMethod, toStripePaymentMethod, toXenditPaymentMethod, verifyAdyenWebhook, verifyBraintreeWebhook, verifyCheckoutComWebhook, verifyDokuWebhookSignature, verifyDuitkuCallbackSignature, verifyFaspaySignature, verifyFinpaySignature, verifyIpaymuCallback, verifyNicepayWebhook, verifyOyWebhook, verifyPaypalWebhookSimple, verifyPayuWebhook, verifyPrismalinkSignature, verifyRazorpayWebhook, verifySnapWebhookSignature, verifySquareWebhook, verifyStripeWebhook, verifyTwoCheckoutWebhook, verifyXenditWebhookToken };
+export { AdyenClient, AdyenProvider, BasePaymentProvider, BraintreeClient, BraintreeProvider, Buayar, type BuayarConfig, CANONICAL_TO_DOKU, CANONICAL_TO_DUITKU, CANONICAL_TO_FASPAY, CANONICAL_TO_FINPAY, CANONICAL_TO_IPAYMU, CANONICAL_TO_MIDTRANS, CANONICAL_TO_NICEPAY, CANONICAL_TO_OY, CANONICAL_TO_PRISMALINK, CANONICAL_TO_STRIPE, CANONICAL_TO_XENDIT, CORE_API_METHODS, type CanonicalPaymentMethod, type CheckBalanceResult, type CheckTransactionParams, type CheckTransactionResult, CheckoutComClient, CheckoutComProvider, type CreateInvoiceParams, type CustomerDetails, DUITKU_TO_CANONICAL, type DisburseParams, type DisburseResult, DokuClient, DokuProvider, DuitkuClient, type DuitkuDisbursementParams, DuitkuProvider, type EWalletResponse, FaspayClient, FaspayProvider, FinpayClient, FinpayProvider, type GetPaymentMethodsParams, type GetPaymentMethodsResult, type InvoiceResponse, IpaymuClient, IpaymuProvider, MIDTRANS_PROBE_PAYLOADS, MIDTRANS_STATIC_METHODS, type MandiriBillInfo, MidtransClient, MidtransProvider, NicepayClient, NicepayProvider, OyClient, OyProvider, PaymentManager, type PaymentMethod, type PaymentMethodItem, type PaymentMode, PaypalClient, PaypalProvider, PayuClient, PayuProvider, PrismalinkClient, PrismalinkProvider, type ProviderCapability, type ProviderConfig, type ProviderDescriptor, ProviderRegistry, type QrisResponse, RazorpayClient, RazorpayProvider, type RefundParams, type RefundResult, SnapApiError, SnapClient, type SnapClientOptions, SquareClient, SquareProvider, StripeClient, StripeProvider, TwoCheckoutClient, TwoCheckoutProvider, type VerifyCallbackResult, type VirtualAccountResponse, XenditClient, type XenditDisbursementParams, XenditProvider, buayar, buildBraintreeBasicAuth, buildCoreChargePayload, buildDefaultDescriptors, buildIpaymuCallbackString, buildPaypalBasicAuth, buildPayuBasicAuth, buildRazorpayBasicAuth, buildTwoCheckoutAuth, formatNicepayTimestamp, generateDokuHeaders, generateFaspaySignature, generateFinpaySignature, generateIpaymuSignature, generateNicepayToken, generateOyHeaders, generatePrismalinkSignature, generateSnapAsymmetricSignature, generateSnapSymmetricSignature, getDuitkuInquirySignatures, getDuitkuPaymentMethodsSignature, getDuitkuStatusSignatures, getPaymentMethodCategory, getXenditAuthHeader, hmacSha256, md5, minifyJson, normalizeIpaymuCallback, parseCoreChargeResponse, paymentManager, providerRegistry, resolveConfigFromEnv, safeCompare, serializePaypalParams, serializeStripeParams, sha256, sha256Hex, sha512, snapErrorHint, snapExternalId, snapTimestamp, snapUtcTimestamp, toCanonicalPaymentMethod, toDokuPaymentMethod, toDuitkuPaymentMethod, toFaspayPaymentMethod, toFinpayPaymentMethod, toIpaymuPaymentMethod, toNicepayPaymentMethod, toOyPaymentMethod, toPrismalinkPaymentMethod, toStripePaymentMethod, toXenditPaymentMethod, verifyAdyenWebhook, verifyBraintreeWebhook, verifyCheckoutComWebhook, verifyDokuWebhookSignature, verifyDuitkuCallbackSignature, verifyFaspaySignature, verifyFinpaySignature, verifyIpaymuCallback, verifyIpaymuCallbackSignature, verifyNicepayWebhook, verifyOyWebhook, verifyPaypalWebhookSimple, verifyPayuWebhook, verifyPrismalinkSignature, verifyRazorpayWebhook, verifySnapWebhookSignature, verifySquareWebhook, verifyStripeWebhook, verifyTwoCheckoutWebhook, verifyXenditWebhookToken };

package/dist/index.js

@@ -93,6 +93,7 @@ __export(index_exports, {
   buildBraintreeBasicAuth: () => buildBraintreeBasicAuth,
   buildCoreChargePayload: () => buildCoreChargePayload,
   buildDefaultDescriptors: () => buildDefaultDescriptors,
+  buildIpaymuCallbackString: () => buildIpaymuCallbackString,
   buildPaypalBasicAuth: () => buildPaypalBasicAuth,
   buildPayuBasicAuth: () => buildPayuBasicAuth,
   buildRazorpayBasicAuth: () => buildRazorpayBasicAuth,
@@ -115,6 +116,7 @@ __export(index_exports, {
   hmacSha256: () => hmacSha256,
   md5: () => md5,
   minifyJson: () => minifyJson,
+  normalizeIpaymuCallback: () => normalizeIpaymuCallback,
   parseCoreChargeResponse: () => parseCoreChargeResponse,
   paymentManager: () => paymentManager,
   providerRegistry: () => providerRegistry,
@@ -148,6 +150,7 @@ __export(index_exports, {
   verifyFaspaySignature: () => verifyFaspaySignature,
   verifyFinpaySignature: () => verifyFinpaySignature,
   verifyIpaymuCallback: () => verifyIpaymuCallback,
+  verifyIpaymuCallbackSignature: () => verifyIpaymuCallbackSignature,
   verifyNicepayWebhook: () => verifyNicepayWebhook,
   verifyOyWebhook: () => verifyOyWebhook,
   verifyPaypalWebhookSimple: () => verifyPaypalWebhookSimple,
@@ -1728,6 +1731,44 @@ function generateIpaymuSignature(method, va, apiKey, body) {
   const signature = hmacSha256(stringToSign, apiKey);
   return { signature, timestamp };
 }
+function normalizeIpaymuCallback(payload) {
+  const result = {};
+  for (const key of Object.keys(payload || {})) {
+    const val = payload[key];
+    if (key === "is_escrow") {
+      result[key] = val === "true" || val === "1" || val === 1 || val === true;
+    } else if (["trx_id", "status_code", "transaction_status_code", "paid_off"].includes(key)) {
+      const intVal = parseInt(String(val), 10);
+      result[key] = Number.isNaN(intVal) ? 0 : intVal;
+    } else if (key === "additional_info") {
+      result[key] = val === "[]" || val === "null" ? [] : val;
+    } else if (key === "signature") {
+      continue;
+    } else {
+      result[key] = String(val);
+    }
+  }
+  if (!Object.prototype.hasOwnProperty.call(result, "additional_info")) {
+    result.additional_info = [];
+  }
+  return result;
+}
+function buildIpaymuCallbackString(payload) {
+  const normalized = normalizeIpaymuCallback(payload);
+  const sorted = {};
+  for (const key of Object.keys(normalized).sort((a, b) => a.localeCompare(b))) {
+    sorted[key] = normalized[key];
+  }
+  let json = JSON.stringify(sorted);
+  json = json.replace(/\//g, "\\/");
+  return json;
+}
+function verifyIpaymuCallbackSignature(payload, secretKey, xSignature) {
+  if (!secretKey || !xSignature) return false;
+  const stringToSign = buildIpaymuCallbackString(payload);
+  const computed = hmacSha256(stringToSign, secretKey);
+  return safeCompare(String(xSignature).toLowerCase(), computed.toLowerCase());
+}
 function verifyIpaymuCallback(payload) {
   const status = (payload.status || "").toLowerCase();
   const statusCode = payload.status_code !== void 0 ? String(payload.status_code) : "";
@@ -1893,15 +1934,20 @@ var IpaymuProvider = class extends BasePaymentProvider {
     const { isPaid, isPending, isFailed } = verifyIpaymuCallback(body);
     const orderId = body.reference_id || body.referenceId || body.trx_id || "";
     const amount = body.amount || body.total || 0;
+    const secretKey = config.merchantCode || config.merchantId || "";
+    const headers = config.extra?.headers || {};
+    const rawSig = headers["x-signature"] ?? headers["X-Signature"] ?? "";
+    const xSignature = Array.isArray(rawSig) ? rawSig[0] : rawSig;
+    const isValid = verifyIpaymuCallbackSignature(body, secretKey, xSignature);
     return {
-      isValid: true,
+      isValid,
       provider: "ipaymu",
       orderId: String(orderId),
       amount: Number(amount) || 0,
       status: isPaid ? "paid" : isPending ? "pending" : "failed",
-      isPaid,
-      isPending,
-      isFailed,
+      isPaid: isValid && isPaid,
+      isPending: isValid && isPending,
+      isFailed: !isValid || isFailed,
       isExpired: (body.status || "").toLowerCase() === "expired",
       statusCode: String(body.status_code || body.status || ""),
       rawPayload: body
@@ -10478,6 +10524,7 @@ var buayar = new Buayar();
   buildBraintreeBasicAuth,
   buildCoreChargePayload,
   buildDefaultDescriptors,
+  buildIpaymuCallbackString,
   buildPaypalBasicAuth,
   buildPayuBasicAuth,
   buildRazorpayBasicAuth,
@@ -10500,6 +10547,7 @@ var buayar = new Buayar();
   hmacSha256,
   md5,
   minifyJson,
+  normalizeIpaymuCallback,
   parseCoreChargeResponse,
   paymentManager,
   providerRegistry,
@@ -10533,6 +10581,7 @@ var buayar = new Buayar();
   verifyFaspaySignature,
   verifyFinpaySignature,
   verifyIpaymuCallback,
+  verifyIpaymuCallbackSignature,
   verifyNicepayWebhook,
   verifyOyWebhook,
   verifyPaypalWebhookSimple,

package/dist/index.mjs

@@ -1564,6 +1564,44 @@ function generateIpaymuSignature(method, va, apiKey, body) {
   const signature = hmacSha256(stringToSign, apiKey);
   return { signature, timestamp };
 }
+function normalizeIpaymuCallback(payload) {
+  const result = {};
+  for (const key of Object.keys(payload || {})) {
+    const val = payload[key];
+    if (key === "is_escrow") {
+      result[key] = val === "true" || val === "1" || val === 1 || val === true;
+    } else if (["trx_id", "status_code", "transaction_status_code", "paid_off"].includes(key)) {
+      const intVal = parseInt(String(val), 10);
+      result[key] = Number.isNaN(intVal) ? 0 : intVal;
+    } else if (key === "additional_info") {
+      result[key] = val === "[]" || val === "null" ? [] : val;
+    } else if (key === "signature") {
+      continue;
+    } else {
+      result[key] = String(val);
+    }
+  }
+  if (!Object.prototype.hasOwnProperty.call(result, "additional_info")) {
+    result.additional_info = [];
+  }
+  return result;
+}
+function buildIpaymuCallbackString(payload) {
+  const normalized = normalizeIpaymuCallback(payload);
+  const sorted = {};
+  for (const key of Object.keys(normalized).sort((a, b) => a.localeCompare(b))) {
+    sorted[key] = normalized[key];
+  }
+  let json = JSON.stringify(sorted);
+  json = json.replace(/\//g, "\\/");
+  return json;
+}
+function verifyIpaymuCallbackSignature(payload, secretKey, xSignature) {
+  if (!secretKey || !xSignature) return false;
+  const stringToSign = buildIpaymuCallbackString(payload);
+  const computed = hmacSha256(stringToSign, secretKey);
+  return safeCompare(String(xSignature).toLowerCase(), computed.toLowerCase());
+}
 function verifyIpaymuCallback(payload) {
   const status = (payload.status || "").toLowerCase();
   const statusCode = payload.status_code !== void 0 ? String(payload.status_code) : "";
@@ -1729,15 +1767,20 @@ var IpaymuProvider = class extends BasePaymentProvider {
     const { isPaid, isPending, isFailed } = verifyIpaymuCallback(body);
     const orderId = body.reference_id || body.referenceId || body.trx_id || "";
     const amount = body.amount || body.total || 0;
+    const secretKey = config.merchantCode || config.merchantId || "";
+    const headers = config.extra?.headers || {};
+    const rawSig = headers["x-signature"] ?? headers["X-Signature"] ?? "";
+    const xSignature = Array.isArray(rawSig) ? rawSig[0] : rawSig;
+    const isValid = verifyIpaymuCallbackSignature(body, secretKey, xSignature);
     return {
-      isValid: true,
+      isValid,
       provider: "ipaymu",
       orderId: String(orderId),
       amount: Number(amount) || 0,
       status: isPaid ? "paid" : isPending ? "pending" : "failed",
-      isPaid,
-      isPending,
-      isFailed,
+      isPaid: isValid && isPaid,
+      isPending: isValid && isPending,
+      isFailed: !isValid || isFailed,
       isExpired: (body.status || "").toLowerCase() === "expired",
       statusCode: String(body.status_code || body.status || ""),
       rawPayload: body
@@ -10313,6 +10356,7 @@ export {
   buildBraintreeBasicAuth,
   buildCoreChargePayload,
   buildDefaultDescriptors,
+  buildIpaymuCallbackString,
   buildPaypalBasicAuth,
   buildPayuBasicAuth,
   buildRazorpayBasicAuth,
@@ -10335,6 +10379,7 @@ export {
   hmacSha256,
   md5,
   minifyJson,
+  normalizeIpaymuCallback,
   parseCoreChargeResponse,
   paymentManager,
   providerRegistry,
@@ -10368,6 +10413,7 @@ export {
   verifyFaspaySignature,
   verifyFinpaySignature,
   verifyIpaymuCallback,
+  verifyIpaymuCallbackSignature,
   verifyNicepayWebhook,
   verifyOyWebhook,
   verifyPaypalWebhookSimple,

package/docs/ipaymu.md

@@ -249,12 +249,17 @@ const banks = await client.getBankList();
 
 ## 9. Webhook & Verifikasi Notifikasi Callback
 
-Saat pembeli menyelesaikan pembayaran, iPaymu mengirimkan HTTP POST request ke `notifyUrl`:
+Saat pembeli menyelesaikan pembayaran, iPaymu mengirimkan HTTP POST request ke `notifyUrl`.
+Callback **harus** membawa header `X-Signature`; Buayar memverifikasinya dengan
+**HMAC-SHA256** atas payload callback yang dinormalisasi (sort kunci A–Z + escape slash)
+menggunakan **Merchant VA** sebagai secret key. Callback tanpa `X-Signature` yang sah
+akan selalu ditolak (`isValid === false`).
 
 ```typescript
-// Di handler Express.js / Next.js API route:
+// Di handler Express.js / Next.js API route + REST framework apapun (Elysia/Hono/...):
 app.post("/api/payment/webhook", (req, res) => {
-  const result = buayar.verifyCallback(req.body);
+  // Header request (termasuk `x-signature`) WAJIB diferuskan:
+  const result = buayar.verifyWebhook(req.body, req.headers);
 
   if (result.isValid && result.isPaid) {
     console.log("Pembayaran Berhasil untuk Order ID:", result.orderId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediblemark/buayar",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Unified Payment Gateway SDK for Node.js & TypeScript — 19 providers (Midtrans, Xendit, Duitku, Stripe, PayPal, Adyen, Razorpay, Square, Checkout.com, PayU, Braintree, 2Checkout, DOKU, iPaymu, PrismaLink, Faspay, Finpay, Nicepay, OY!) with zero-code switching via .env",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",