@crediblemark/buayar 0.8.5 → 0.8.7

package/dist/index.js

@@ -46,6 +46,7 @@ __export(index_exports, {
   CANONICAL_TO_OY: () => CANONICAL_TO_OY,
   CANONICAL_TO_PRISMALINK: () => CANONICAL_TO_PRISMALINK,
   CANONICAL_TO_STRIPE: () => CANONICAL_TO_STRIPE,
+  CANONICAL_TO_SUMOPOD: () => CANONICAL_TO_SUMOPOD,
   CANONICAL_TO_XENDIT: () => CANONICAL_TO_XENDIT,
   CORE_API_METHODS: () => CORE_API_METHODS,
   CheckoutComClient: () => CheckoutComClient,
@@ -79,12 +80,15 @@ __export(index_exports, {
   ProviderRegistry: () => ProviderRegistry,
   RazorpayClient: () => RazorpayClient,
   RazorpayProvider: () => RazorpayProvider,
+  SUMOPOD_TO_CANONICAL: () => SUMOPOD_TO_CANONICAL,
   SnapApiError: () => SnapApiError,
   SnapClient: () => SnapClient,
   SquareClient: () => SquareClient,
   SquareProvider: () => SquareProvider,
   StripeClient: () => StripeClient,
   StripeProvider: () => StripeProvider,
+  SumopodClient: () => SumopodClient,
+  SumopodProvider: () => SumopodProvider,
   TwoCheckoutClient: () => TwoCheckoutClient,
   TwoCheckoutProvider: () => TwoCheckoutProvider,
   XenditClient: () => XenditClient,
@@ -144,6 +148,7 @@ __export(index_exports, {
   toOyPaymentMethod: () => toOyPaymentMethod,
   toPrismalinkPaymentMethod: () => toPrismalinkPaymentMethod,
   toStripePaymentMethod: () => toStripePaymentMethod,
+  toSumopodPaymentMethod: () => toSumopodPaymentMethod,
   toXenditPaymentMethod: () => toXenditPaymentMethod,
   verifyAdyenWebhook: () => verifyAdyenWebhook,
   verifyBraintreeWebhook: () => verifyBraintreeWebhook,
@@ -163,6 +168,8 @@ __export(index_exports, {
   verifySnapWebhookSignature: () => verifySnapWebhookSignature,
   verifySquareWebhook: () => verifySquareWebhook,
   verifyStripeWebhook: () => verifyStripeWebhook,
+  verifySumopodSvixSignature: () => verifySumopodSvixSignature,
+  verifySumopodToken: () => verifySumopodToken,
   verifyTwoCheckoutWebhook: () => verifyTwoCheckoutWebhook,
   verifyXenditWebhookToken: () => verifyXenditWebhookToken
 });
@@ -461,6 +468,8 @@ var CANONICAL_TO_OY = {
 var CANONICAL_TO_STRIPE = {
   credit_card: "card",
   qris: "qris",
+  QRIS_SUMOPOD: "qris",
+  qris_sumopod: "qris",
   gopay_qris: "qris",
   shopeepay_qris: "qris",
   bca_va: "customer_balance",
@@ -567,6 +576,25 @@ function toStripePaymentMethod(code) {
   }
   return lower;
 }
+var CANONICAL_TO_SUMOPOD = {
+  qris: "QRIS",
+  gopay_qris: "QRIS",
+  shopeepay_qris: "QRIS",
+  nobu_qris: "QRIS",
+  qris_sumopod: "QRIS"
+};
+var SUMOPOD_TO_CANONICAL = {
+  QRIS: "qris",
+  qris: "qris"
+};
+function toSumopodPaymentMethod(code) {
+  if (!code) return void 0;
+  const lower = code.toLowerCase().trim();
+  if (CANONICAL_TO_SUMOPOD[lower]) {
+    return CANONICAL_TO_SUMOPOD[lower];
+  }
+  return code;
+}
 function toCanonicalPaymentMethod(provider, code) {
   if (!code) return "";
   const upper = code.toUpperCase().trim();
@@ -574,7 +602,10 @@ function toCanonicalPaymentMethod(provider, code) {
   if (provider.toLowerCase() === "duitku" && DUITKU_TO_CANONICAL[upper]) {
     return DUITKU_TO_CANONICAL[upper];
   }
-  if (CANONICAL_TO_MIDTRANS[lower] || CANONICAL_TO_DUITKU[lower] || CANONICAL_TO_IPAYMU[lower] || CANONICAL_TO_XENDIT[lower] || CANONICAL_TO_DOKU[lower] || CANONICAL_TO_PRISMALINK[lower] || CANONICAL_TO_FASPAY[lower] || CANONICAL_TO_FINPAY[lower] || CANONICAL_TO_NICEPAY[lower] || CANONICAL_TO_OY[lower] || CANONICAL_TO_STRIPE[lower]) {
+  if (provider.toLowerCase() === "sumopod" && SUMOPOD_TO_CANONICAL[upper]) {
+    return SUMOPOD_TO_CANONICAL[upper];
+  }
+  if (CANONICAL_TO_MIDTRANS[lower] || CANONICAL_TO_DUITKU[lower] || CANONICAL_TO_IPAYMU[lower] || CANONICAL_TO_XENDIT[lower] || CANONICAL_TO_DOKU[lower] || CANONICAL_TO_PRISMALINK[lower] || CANONICAL_TO_FASPAY[lower] || CANONICAL_TO_FINPAY[lower] || CANONICAL_TO_NICEPAY[lower] || CANONICAL_TO_OY[lower] || CANONICAL_TO_STRIPE[lower] || CANONICAL_TO_SUMOPOD[lower]) {
     return lower;
   }
   return lower;
@@ -1808,7 +1839,7 @@ var IpaymuProvider = class extends BasePaymentProvider {
       payload = {
         name: customer.name,
         email: customer.email,
-        phone: customer.phone || "081234567890",
+        ...customer.phone ? { phone: customer.phone } : {},
         amount: integerAmount,
         notifyUrl,
         expired: 24,
@@ -1839,7 +1870,7 @@ var IpaymuProvider = class extends BasePaymentProvider {
         referenceId: orderId,
         buyerName: customer.name,
         buyerEmail: customer.email,
-        buyerPhone: customer.phone || "081234567890",
+        ...customer.phone ? { buyerPhone: customer.phone } : {},
         ...feeDirection ? { feeDirection } : {},
         ...escrow !== void 0 ? { escrow } : {},
         ...subAccount ? { account: subAccount } : {},
@@ -2069,6 +2100,28 @@ var IpaymuProvider = class extends BasePaymentProvider {
       };
     }
   }
+  async probePaymentMethods(config) {
+    try {
+      const res = await this.getPaymentMethods({ amount: 1e4 }, config);
+      if (res.success && res.methods) {
+        return {
+          success: true,
+          enabled: res.methods.map((m) => m.paymentMethod)
+        };
+      }
+      return {
+        success: false,
+        enabled: [],
+        error: res.error || "Failed to probe iPaymu payment methods"
+      };
+    } catch (e) {
+      return {
+        success: false,
+        enabled: [],
+        error: e.message || "Failed to probe iPaymu payment methods"
+      };
+    }
+  }
   async checkTransaction(params, config) {
     const { merchantOrderId } = params;
     const va = config.merchantCode || config.merchantId || "";
@@ -2356,8 +2409,8 @@ var XenditProvider = class extends BasePaymentProvider {
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
     const webhookToken = config.extra?.webhookToken;
     const headerToken = config.extra?.callbackToken || config.extra?.headers?.["x-callback-token"] || config.extra?.headers?.["X-Callback-Token"];
-    let isValid = true;
-    if (webhookToken || headerToken) {
+    let isValid = false;
+    if (webhookToken && headerToken) {
       isValid = verifyXenditWebhookToken(headerToken, webhookToken);
     }
     return {
@@ -2505,6 +2558,75 @@ var XenditProvider = class extends BasePaymentProvider {
         category: "Paylater / Cicilan"
       }
     ];
+    const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
+    if (apiKey) {
+      try {
+        const authHeader = getXenditAuthHeader(apiKey);
+        const response = await fetch(`${this.getBaseUrl()}/payment_channels`, {
+          method: "GET",
+          headers: {
+            "Authorization": authHeader,
+            "Content-Type": "application/json"
+          }
+        });
+        if (response.ok) {
+          const channels = await response.json();
+          if (Array.isArray(channels) && channels.length > 0) {
+            const dynamicMethods = [];
+            for (const ch of channels) {
+              if (ch.status && ch.status !== "ACTIVE") continue;
+              const codeLower = (ch.channel_code || "").toLowerCase();
+              let canonicalCode = codeLower;
+              let category = "Virtual Account";
+              if (ch.type === "BANK_TRANSFER" || codeLower.endsWith("_va") || ["bca", "bni", "bri", "mandiri", "permata", "cimb", "bsi"].includes(codeLower)) {
+                canonicalCode = codeLower.endsWith("_va") ? codeLower : `${codeLower}_va`;
+                category = "Virtual Account";
+              } else if (ch.type === "EWALLET" || ["ovo", "dana", "linkaja", "shopeepay", "gopay"].includes(codeLower)) {
+                canonicalCode = codeLower;
+                category = "E-Wallet";
+              } else if (ch.type === "QR_CODE" || codeLower === "qris") {
+                canonicalCode = "qris";
+                category = "QRIS";
+              } else if (ch.type === "RETAIL_OUTLET" || ["alfamart", "indomaret"].includes(codeLower)) {
+                canonicalCode = codeLower;
+                category = "Retail / Gerai";
+              } else if (ch.type === "CARD") {
+                canonicalCode = "credit_card";
+                category = "Kartu Kredit";
+              } else if (ch.type === "PAYLATER" || ["kredivo", "akulaku", "indodana"].includes(codeLower)) {
+                canonicalCode = codeLower;
+                category = "Paylater / Cicilan";
+              }
+              dynamicMethods.push({
+                paymentMethod: canonicalCode,
+                code: ch.channel_code || canonicalCode,
+                paymentName: ch.display_name || ch.name || ch.channel_code,
+                paymentImage: `https://xendit.co/icons/${codeLower}.png`,
+                totalFee: ch.fee ? `${ch.fee}` : "",
+                category,
+                coming_soon: false,
+                extra: ch
+              });
+            }
+            if (dynamicMethods.length > 0) {
+              const categories2 = {};
+              for (const item of dynamicMethods) {
+                if (!categories2[item.category]) categories2[item.category] = [];
+                categories2[item.category].push(item);
+              }
+              return {
+                success: true,
+                provider: "xendit",
+                methods: dynamicMethods,
+                categories: categories2,
+                rawResponse: channels
+              };
+            }
+          }
+        }
+      } catch (e) {
+      }
+    }
     const categories = {};
     for (const item of staticMethods) {
       if (!categories[item.category]) {
@@ -2520,6 +2642,28 @@ var XenditProvider = class extends BasePaymentProvider {
       rawResponse: staticMethods
     };
   }
+  async probePaymentMethods(config) {
+    try {
+      const res = await this.getPaymentMethods({ amount: 1e4 }, config);
+      if (res.success && res.methods) {
+        return {
+          success: true,
+          enabled: res.methods.map((m) => m.paymentMethod)
+        };
+      }
+      return {
+        success: false,
+        enabled: [],
+        error: res.error || "Failed to probe Xendit payment methods"
+      };
+    } catch (e) {
+      return {
+        success: false,
+        enabled: [],
+        error: e.message || "Failed to probe Xendit payment methods"
+      };
+    }
+  }
   async checkTransaction(params, config) {
     const { merchantOrderId } = params;
     const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
@@ -3316,7 +3460,7 @@ var DokuProvider = class extends BasePaymentProvider {
     const secretKey = config.secretKey || config.apiKey || "";
     const signature = headers["signature"] || headers["Signature"] || config.extra?.dokuSignature || config.extra?.signatureHeader;
     const clientId = config.merchantCode || config.clientKey || "";
-    let isValid = true;
+    let isValid = false;
     if (signature || headers && (headers["request-id"] || headers["Request-Id"])) {
       isValid = verifyDokuWebhookSignature(headers, body, clientId, secretKey);
     }
@@ -3341,7 +3485,7 @@ var DokuProvider = class extends BasePaymentProvider {
   verifySnapCallback(body, config, headers) {
     const clientSecret = config.apiKey || config.serverKey || config.secretKey || "";
     const endpointUrl = config.extra?.notificationPath || headers["x-path"] || config.extra?.headers?.["request-target"] || "/api/payment/webhook";
-    let isValid = true;
+    let isValid = false;
     const incomingSig = headers["x-signature"] || headers["X-SIGNATURE"] || headers["signature"] || headers["Signature"] || "";
     if (incomingSig && clientSecret) {
       isValid = verifySnapWebhookSignature(headers, body, clientSecret, endpointUrl);
@@ -8074,6 +8218,285 @@ var TwoCheckoutProvider = class extends BasePaymentProvider {
   }
 };
 
+// src/providers/sumopod/signature.ts
+var import_crypto32 = __toESM(require("crypto"));
+function verifySumopodSvixSignature(secret, svixId, svixTimestamp, svixSignature, rawBody, toleranceSeconds = 300) {
+  if (!secret || !svixId || !svixTimestamp || !svixSignature || rawBody === void 0 || rawBody === null) {
+    return false;
+  }
+  if (toleranceSeconds > 0) {
+    const timestampSec = Number(svixTimestamp);
+    if (isNaN(timestampSec)) {
+      return false;
+    }
+    const currentSec = Math.floor(Date.now() / 1e3);
+    if (Math.abs(currentSec - timestampSec) > toleranceSeconds) {
+      return false;
+    }
+  }
+  try {
+    const cleanSecret = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+    const secretBytes = Buffer.from(cleanSecret, "base64");
+    const signedContent = `${svixId}.${svixTimestamp}.${rawBody}`;
+    const expectedSignature = import_crypto32.default.createHmac("sha256", secretBytes).update(signedContent).digest("base64");
+    const signatures = svixSignature.split(" ").map((s) => s.includes(",") ? s.split(",")[1] : s).filter(Boolean);
+    return signatures.some((sig) => safeCompare(sig, expectedSignature));
+  } catch {
+    return false;
+  }
+}
+function verifySumopodToken(expectedToken, receivedToken) {
+  if (!expectedToken || !receivedToken) return false;
+  return safeCompare(expectedToken.trim(), receivedToken.trim());
+}
+
+// src/providers/sumopod/provider.ts
+var SumopodProvider = class extends BasePaymentProvider {
+  name = "sumopod";
+  getBaseUrl(config) {
+    if (config?.customBaseUrl) return config.customBaseUrl;
+    if (config?.sandbox) return "https://api-pay-sandbox.sumopod.com";
+    return "https://api-pay.sumopod.com";
+  }
+  async createInvoice(params, config) {
+    const { orderId, amount, returnUrl } = params;
+    const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
+    const baseUrl = this.getBaseUrl(config);
+    const integerAmount = Math.round(amount);
+    const payload = {
+      order_id: orderId,
+      amount: integerAmount,
+      currency: (params.currency || "IDR").toUpperCase(),
+      expires_in_hours: params.providerParams?.expires_in_hours ?? 24,
+      ...returnUrl || config.returnUrl ? { success_return_url: returnUrl || config.returnUrl } : {},
+      ...params.providerParams?.cancel_return_url || config.returnUrl || returnUrl ? { cancel_return_url: params.providerParams?.cancel_return_url || config.returnUrl || returnUrl } : {},
+      payment_method_type_code: "QRIS",
+      ...params.providerParams
+    };
+    try {
+      const response = await fetch(`${baseUrl}/api/v1/payments`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json",
+          "X-Api-Key": apiKey
+        },
+        body: JSON.stringify(payload)
+      });
+      const text = await response.text();
+      let data = null;
+      try {
+        data = JSON.parse(text);
+      } catch {
+      }
+      if (!response.ok || !data || data.error) {
+        return {
+          success: false,
+          provider: "sumopod",
+          orderId,
+          amount: integerAmount,
+          rawResponse: data,
+          error: data?.message || data?.error || `HTTP error! Status: ${response.status} - ${text}`
+        };
+      }
+      const isQris = data.payment_channel_used?.toLowerCase()?.includes("qris") || data.payment_code_type === "QRIS" || data.payment_code_type === "QR_TEXT" || !data.payment_code_type;
+      const isVa = data.payment_code_type === "ACCOUNT_NUMBER";
+      return {
+        success: true,
+        provider: "sumopod",
+        orderId: data.order_id || orderId,
+        amount: data.amount ? Number(data.amount) : integerAmount,
+        reference: data.payment_id,
+        paymentUrl: data.payment_link_url,
+        paymentCode: data.payment_code,
+        qrString: isQris ? data.payment_code || data.payment_link_url : void 0,
+        qrCodeUrl: data.payment_code_type === "QR_IMAGE" ? data.payment_code : void 0,
+        vaNumber: isVa ? data.payment_code : void 0,
+        vaBank: isVa ? data.payment_channel_used?.split(".")[0]?.toLowerCase() : void 0,
+        expiresAt: data.expires_at ? new Date(data.expires_at) : void 0,
+        mode: isQris ? "qris" : isVa ? "va" : "checkout",
+        rawResponse: data
+      };
+    } catch (e) {
+      return {
+        success: false,
+        provider: "sumopod",
+        orderId,
+        amount: integerAmount,
+        rawResponse: null,
+        error: e.message || "Failed to make request to SumoPod API"
+      };
+    }
+  }
+  async verifyCallback(body, config) {
+    const rawBody = typeof body === "string" ? body : JSON.stringify(body);
+    let parsedBody;
+    try {
+      parsedBody = typeof body === "string" ? JSON.parse(body) : body;
+    } catch {
+      parsedBody = {};
+    }
+    const headers = config.extra?.headers || {};
+    const getHeader = (name) => {
+      const lower = name.toLowerCase();
+      for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === lower) {
+          const val = headers[k];
+          return Array.isArray(val) ? val[0] : val;
+        }
+      }
+      return void 0;
+    };
+    const svixId = getHeader("svix-id") || config.extra?.svixId;
+    const svixTimestamp = getHeader("svix-timestamp") || config.extra?.svixTimestamp;
+    const svixSignature = getHeader("svix-signature") || config.extra?.svixSignature || config.extra?.signatureHeader;
+    const receivedToken = getHeader("x-webhook-token") || config.extra?.webhookTokenHeader;
+    const webhookSecret = config.extra?.webhookSecret || config.secretKey || "";
+    const webhookToken = config.extra?.webhookToken || config.extra?.callbackToken || "";
+    let isValid = false;
+    if (svixId && svixTimestamp && svixSignature && webhookSecret) {
+      isValid = verifySumopodSvixSignature(webhookSecret, svixId, svixTimestamp, svixSignature, rawBody);
+    } else if (receivedToken && webhookToken) {
+      isValid = verifySumopodToken(webhookToken, receivedToken);
+    } else if (!webhookSecret && !webhookToken) {
+      isValid = true;
+    }
+    const eventType = parsedBody?.event_type || "";
+    const data = parsedBody?.data || parsedBody;
+    const orderId = String(data?.order_id || "");
+    const amount = Number(data?.amount || 0);
+    const statusRaw = (data?.status || "").toLowerCase();
+    const isPaid = eventType === "payment.completed" || statusRaw === "completed";
+    const isFailed = eventType === "payment.failed" || statusRaw === "failed";
+    const isExpired = eventType === "payment.expired" || statusRaw === "expired";
+    const isPending = !isPaid && !isFailed && !isExpired;
+    const status = isPaid ? "paid" : isExpired ? "expired" : isFailed ? "failed" : "pending";
+    return {
+      isValid,
+      provider: "sumopod",
+      orderId,
+      amount,
+      status,
+      isPaid,
+      isPending,
+      isFailed,
+      isExpired,
+      statusCode: eventType || statusRaw,
+      transactionTime: data?.completed_at ? new Date(data.completed_at) : void 0,
+      rawPayload: parsedBody
+    };
+  }
+  async getPaymentMethods(params, config) {
+    const amount = params?.amount || 1e4;
+    const percentFee = Math.round(amount * 7e-3);
+    const flatFee = 300;
+    const totalFeeNum = percentFee + flatFee;
+    const methods = [
+      {
+        paymentMethod: "qris",
+        code: "QRIS",
+        paymentName: "QRIS",
+        paymentImage: "https://upload.wikimedia.org/wikipedia/commons/a/a2/Logo_QRIS.svg",
+        totalFee: "0.7% + Rp 300",
+        category: "QRIS",
+        feeDetail: {
+          percent: 0.7,
+          flat: 300,
+          totalFee: totalFeeNum
+        }
+      }
+    ];
+    const categories = {
+      QRIS: methods
+    };
+    return {
+      success: true,
+      provider: "sumopod",
+      methods,
+      categories,
+      rawResponse: methods
+    };
+  }
+  async checkTransaction(params, config) {
+    const { merchantOrderId } = params;
+    const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
+    const baseUrl = this.getBaseUrl(config);
+    try {
+      const response = await fetch(`${baseUrl}/api/v1/payments/${encodeURIComponent(merchantOrderId)}`, {
+        method: "GET",
+        headers: {
+          "Accept": "application/json",
+          "X-Api-Key": apiKey
+        }
+      });
+      const text = await response.text();
+      let data = null;
+      try {
+        data = JSON.parse(text);
+      } catch {
+      }
+      if (!response.ok || !data || data.error) {
+        return {
+          success: false,
+          provider: "sumopod",
+          orderId: merchantOrderId,
+          reference: merchantOrderId,
+          amount: 0,
+          statusCode: response.status.toString(),
+          status: "failed",
+          isPaid: false,
+          isPending: false,
+          isFailed: true,
+          isExpired: false,
+          statusMessage: data?.message || data?.error || `HTTP error! Status: ${response.status}`,
+          error: data?.message || data?.error,
+          rawResponse: data
+        };
+      }
+      const statusRaw = (data.status || "").toLowerCase();
+      const isPaid = statusRaw === "completed" || statusRaw === "paid";
+      const isFailed = statusRaw === "failed";
+      const isExpired = statusRaw === "expired";
+      const isPending = !isPaid && !isFailed && !isExpired;
+      const status = isPaid ? "paid" : isExpired ? "expired" : isFailed ? "failed" : "pending";
+      return {
+        success: true,
+        provider: "sumopod",
+        orderId: data.order_id || merchantOrderId,
+        reference: data.payment_id || merchantOrderId,
+        amount: Number(data.amount || 0),
+        statusCode: statusRaw,
+        status,
+        isPaid,
+        isPending,
+        isFailed,
+        isExpired,
+        statusMessage: statusRaw,
+        paymentType: data.payment_method || "qris",
+        transactionTime: data.completed_at ? new Date(data.completed_at) : void 0,
+        rawResponse: data
+      };
+    } catch (e) {
+      return {
+        success: false,
+        provider: "sumopod",
+        orderId: merchantOrderId,
+        reference: merchantOrderId,
+        amount: 0,
+        statusCode: "ERROR",
+        status: "failed",
+        isPaid: false,
+        isPending: false,
+        isFailed: true,
+        isExpired: false,
+        statusMessage: e.message,
+        error: e.message,
+        rawResponse: null
+      };
+    }
+  }
+};
+
 // src/clients/duitku.ts
 var DuitkuClient = class {
   merchantCode;
@@ -9497,6 +9920,63 @@ var TwoCheckoutClient = class {
   }
 };
 
+// src/clients/sumopod.ts
+var SumopodClient = class {
+  apiKey;
+  baseUrl;
+  constructor(config) {
+    this.apiKey = config.apiKey || config.secretKey || config.serverKey || "";
+    this.baseUrl = config.customBaseUrl || (config.sandbox ? "https://api-pay-sandbox.sumopod.com" : "https://api-pay.sumopod.com");
+  }
+  /**
+   * HTTP request helper dengan header autentikasi X-Api-Key SumoPod
+   */
+  async request(method, endpoint, body) {
+    const url = endpoint.startsWith("http") ? endpoint : `${this.baseUrl}${endpoint}`;
+    const headers = {
+      "Content-Type": "application/json",
+      "Accept": "application/json",
+      "X-Api-Key": this.apiKey
+    };
+    const fetchOptions = {
+      method,
+      headers
+    };
+    if (method === "POST" && body) {
+      fetchOptions.body = JSON.stringify(body);
+    }
+    const response = await fetch(url, fetchOptions);
+    const text = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(text);
+    } catch {
+    }
+    if (!response.ok) {
+      throw new Error(
+        data?.message || data?.error || `HTTP error! Status: ${response.status} - ${text}`
+      );
+    }
+    return data;
+  }
+  /**
+   * Buat payment link / sesi pembayaran baru di SumoPod
+   */
+  async createPayment(params) {
+    return this.request("POST", "/api/v1/payments", {
+      currency: "IDR",
+      payment_method_type_code: "QRIS",
+      ...params
+    });
+  }
+  /**
+   * Ambil detail status pembayaran berdasarkan ID pembayaran
+   */
+  async getPayment(paymentId) {
+    return this.request("GET", `/api/v1/payments/${encodeURIComponent(paymentId)}`);
+  }
+};
+
 // src/core/manager.ts
 var PaymentManager = class {
   providers = /* @__PURE__ */ new Map();
@@ -9520,6 +10000,7 @@ var PaymentManager = class {
     this.registerProvider(new PayuProvider());
     this.registerProvider(new BraintreeProvider());
     this.registerProvider(new TwoCheckoutProvider());
+    this.registerProvider(new SumopodProvider());
   }
   registerProvider(provider) {
     this.providers.set(provider.name.toLowerCase(), provider);
@@ -9647,6 +10128,12 @@ var PaymentManager = class {
   getTwoCheckoutClient(config) {
     return new TwoCheckoutClient(config);
   }
+  getSumopodProvider() {
+    return this.getProvider("sumopod");
+  }
+  getSumopodClient(config) {
+    return new SumopodClient(config);
+  }
   // ─── Unified Operations ──────────────────────────────────────────────────
   async createInvoice(providerName, params, config) {
     const provider = this.getProvider(providerName);
@@ -9669,6 +10156,18 @@ var PaymentManager = class {
     if (provider.probePaymentMethods) {
       return provider.probePaymentMethods(config);
     }
+    try {
+      if (typeof provider.getPaymentMethods === "function") {
+        const res = await provider.getPaymentMethods({ amount: 1e4 }, config);
+        if (res && res.success && Array.isArray(res.methods) && res.methods.length > 0) {
+          return {
+            success: true,
+            enabled: res.methods.map((m) => m.paymentMethod)
+          };
+        }
+      }
+    } catch (e) {
+    }
     return { success: false, enabled: [], error: `Provider '${providerName}' does not support payment methods probing` };
   }
   // ─── Unified Advanced Operations (Refund / Balance / Disburse) ─────────────
@@ -9918,7 +10417,7 @@ function buildPaymentMethodDescriptor(pm, _providerName) {
     badge: feeDisplay ? `${badge} \u2022 Fee ${feeDisplay}` : badge,
     image: pm.paymentImage || void 0,
     category,
-    coming_soon: false,
+    coming_soon: pm.coming_soon ?? false,
     totalFee: feeDisplay || void 0
   };
 }
@@ -9968,10 +10467,28 @@ var ProviderRegistry = class {
     return ties.length === 1 ? top.name : void 0;
   }
   /**
-   * Autodetect provider dari struktur payload webhook.
+   * Autodetect provider dari struktur payload webhook dan header.
    * Mengembalikan nama provider jika dikenali, else undefined.
    */
-  detectFromWebhook(payload) {
+  detectFromWebhook(payload, headers) {
+    if (headers) {
+      const h = {};
+      for (const k of Object.keys(headers)) {
+        h[k.toLowerCase()] = headers[k];
+      }
+      if (h["stripe-signature"]) return "stripe";
+      if (h["x-callback-token"]) return "xendit";
+      if (h["x-razorpay-signature"]) return "razorpay";
+      if (h["cko-signature"]) return "checkoutcom";
+      if (h["openpayu-signature"]) return "payu";
+      if (h["x-square-hmacsha256-signature"] || h["x-square-signature"]) return "square";
+      if (h["bt_signature"]) return "braintree";
+      if (h["x-oy-username"]) return "oy";
+      if (h["signature"] && (h["client-id"] || h["request-id"])) return "doku";
+      if (h["x-signature"] && (payload?.trx_id || payload?.via || payload?.sid)) return "ipaymu";
+      if (h["svix-signature"] || h["svix-id"]) return "sumopod";
+      if (h["x-webhook-token"]) return "sumopod";
+    }
     if (!payload) return void 0;
     const p = payload;
     if (p.signature_key && p.transaction_status) return "midtrans";
@@ -9985,7 +10502,10 @@ var ProviderRegistry = class {
     if (p.merchant_id && p.order_id && p.signature) return "prismalink";
     if (p.object === "event" || p.type && p.data?.object && p.api_version) return "stripe";
     if (p.event && p.payload?.payment?.entity) return "razorpay";
-    if (p.external_id || p.event?.startsWith("payment.") || p.event?.startsWith("qr.") || p.data?.reference_id) return "xendit";
+    if (p.event_type && p.data?.payment_id) return "sumopod";
+    if (p.external_id && (p.status || p.paid_amount || p.payment_method || p.payment_channel || p.id) || p.event?.startsWith("payment.") || p.event?.startsWith("qr.") || p.data?.reference_id) {
+      return "xendit";
+    }
     if (p.event_type && p.resource && (p.event_type.startsWith("PAYMENT.") || p.event_type.startsWith("CHECKOUT.ORDER."))) return "paypal";
     if (p.notificationItems || p.merchantAccountCode && p.pspReference && p.eventCode) return "adyen";
     if (p.type && p.data?._links && (p.type.startsWith("payment_") || p.type.startsWith("refund_"))) return "checkoutcom";
@@ -10015,7 +10535,8 @@ var ENV_KEYS = {
   square: ["SQUARE_ACCESS_TOKEN", "SQUARE_LOCATION_ID", "SQUARE_WEBHOOK_SIGNATURE_KEY"],
   payu: ["PAYU_POS_ID", "PAYU_MD5_KEY"],
   braintree: ["BRAINTREE_MERCHANT_ID", "BRAINTREE_PUBLIC_KEY", "BRAINTREE_PRIVATE_KEY"],
-  twocheckout: ["TWOCHECKOUT_MERCHANT_CODE", "TWOCHECKOUT_SECRET_KEY", "TWOCHECKOUT_SECRET_WORD"]
+  twocheckout: ["TWOCHECKOUT_MERCHANT_CODE", "TWOCHECKOUT_SECRET_KEY", "TWOCHECKOUT_SECRET_WORD"],
+  sumopod: ["SUMOPOD_API_KEY", "SUMOPOD_WEBHOOK_SECRET"]
 };
 var WORKING_METHODS = {
   midtrans: Object.keys(CANONICAL_TO_MIDTRANS),
@@ -10029,6 +10550,7 @@ var WORKING_METHODS = {
   nicepay: Object.keys(CANONICAL_TO_NICEPAY),
   oy: Object.keys(CANONICAL_TO_OY),
   stripe: Object.keys(CANONICAL_TO_STRIPE),
+  sumopod: Object.keys(CANONICAL_TO_SUMOPOD),
   paypal: ["credit_card", "paylater", "paypal", "bank_transfer"],
   adyen: ["credit_card", "paypal", "qris", "apple_pay", "google_pay", "klarna", "sepa"],
   checkoutcom: ["credit_card", "paypal", "apple_pay", "google_pay", "klarna", "sofort", "bank_transfer"],
@@ -10057,7 +10579,8 @@ var OPERATIONS = {
   square: { refund: true, checkBalance: true, disburse: false },
   payu: { refund: true, checkBalance: false, disburse: false },
   braintree: { refund: true, checkBalance: false, disburse: false },
-  twocheckout: { refund: true, checkBalance: false, disburse: false }
+  twocheckout: { refund: true, checkBalance: false, disburse: false },
+  sumopod: { refund: false, checkBalance: false, disburse: false }
 };
 function buildDefaultDescriptors() {
   return Object.keys(ENV_KEYS).map((name) => ({
@@ -10174,9 +10697,13 @@ var SPECIFIC = {
     apiKey: ["TWOCHECKOUT_SECRET_KEY"],
     merchantCode: ["TWOCHECKOUT_MERCHANT_CODE"],
     merchantId: ["TWOCHECKOUT_MERCHANT_CODE"]
+  },
+  sumopod: {
+    apiKey: ["SUMOPOD_API_KEY", "SUMOPOD_PRODUCTION_API_KEY", "SUMOPOD_SANDBOX_API_KEY"]
   }
 };
 function firstDefined(env, keys) {
+  if (!keys) return void 0;
   for (const k of keys) {
     const v = env[k];
     if (typeof v === "string" && v.trim().length > 0) return v.trim();
@@ -10205,7 +10732,8 @@ function resolveSandbox(env, provider) {
     payu: ["PAYU_SANDBOX"],
     braintree: ["BRAINTREE_SANDBOX"],
     twocheckout: ["TWOCHECKOUT_SANDBOX"],
-    xendit: ["XENDIT_SANDBOX"]
+    xendit: ["XENDIT_SANDBOX"],
+    sumopod: ["SUMOPOD_SANDBOX"]
   };
   const specific = firstDefined(env, specificMap[provider]);
   if (specific !== void 0) {
@@ -10237,8 +10765,8 @@ function resolveConfigFromEnv(customConfig) {
   const publicKey = customConfig?.publicKey || firstDefined(env, ["BUAYAR_PUBLIC_KEY", "PG_PUBLIC_KEY", "PUBLIC_KEY"]) || cfg.clientKey;
   const privateKey = customConfig?.privateKey || firstDefined(env, ["BUAYAR_PRIVATE_KEY", "PG_PRIVATE_KEY", "PRIVATE_KEY"]) || (provider === "braintree" ? cfg.apiKey : void 0);
   const extra = {
-    webhookToken: env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
-    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
+    webhookToken: (env.SUMOPOD_SANDBOX === "true" ? env.SUMOPOD_SANDBOX_WEBHOOK_TOKEN : env.SUMOPOD_PRODUCTION_WEBHOOK_TOKEN) || env.SUMOPOD_WEBHOOK_TOKEN || env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
+    webhookSecret: (env.SUMOPOD_SANDBOX === "true" ? env.SUMOPOD_SANDBOX_WEBHOOK_SECRET : env.SUMOPOD_PRODUCTION_WEBHOOK_SECRET) || env.SUMOPOD_WEBHOOK_SECRET || env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
     merchantName: env.FASPAY_MERCHANT_NAME || env.BUAYAR_MERCHANT_NAME,
     userId: env.FASPAY_USER_ID,
     iMid: env.NICEPAY_IMID,
@@ -10339,10 +10867,10 @@ var Buayar = class {
     return { methods: desc.methods, operations: desc.operations };
   }
   /**
-   * Deteksi nama provider dari struktur payload webhook.
+   * Deteksi nama provider dari struktur payload webhook dan opsional headers.
    */
-  detectProviderFromPayload(payload) {
-    return this.registry.detectFromWebhook(payload);
+  detectProviderFromPayload(payload, headers) {
+    return this.registry.detectFromWebhook(payload, headers);
   }
   /**
    * Deteksi nama provider aktif dari variabel lingkungan (kredensial yang terisi).
@@ -10470,15 +10998,48 @@ var Buayar = class {
       if (oyUser) {
         mergedConfig.extra.oyUsername = Array.isArray(oyUser) ? oyUser[0] : oyUser;
       }
+      const svixId = headers["svix-id"] || headers["Svix-Id"];
+      const svixTimestamp = headers["svix-timestamp"] || headers["Svix-Timestamp"];
+      const svixSignature = headers["svix-signature"] || headers["Svix-Signature"];
+      const sumopodToken = headers["x-webhook-token"] || headers["X-Webhook-Token"];
+      if (svixId) mergedConfig.extra.svixId = Array.isArray(svixId) ? svixId[0] : svixId;
+      if (svixTimestamp) mergedConfig.extra.svixTimestamp = Array.isArray(svixTimestamp) ? svixTimestamp[0] : svixTimestamp;
+      if (svixSignature) mergedConfig.extra.svixSignature = Array.isArray(svixSignature) ? svixSignature[0] : svixSignature;
+      if (sumopodToken) mergedConfig.extra.webhookTokenHeader = Array.isArray(sumopodToken) ? sumopodToken[0] : sumopodToken;
+    }
+    let providerName = configOverride?.provider !== void 0 ? configOverride.provider : this.provider;
+    if (!providerName) {
+      const detected = this.registry.detectFromWebhook(payload, headers);
+      if (detected) providerName = detected;
+    }
+    if (!providerName) {
+      return {
+        isValid: false,
+        isPaid: false,
+        isPending: false,
+        isFailed: true,
+        isExpired: false,
+        status: "failed",
+        orderId: "",
+        amount: 0,
+        provider: "unknown",
+        error: "Unable to detect payment provider for webhook. Please specify provider in configuration or override.",
+        rawPayload: payload
+      };
     }
-    let providerName = configOverride?.provider || this.provider;
-    const detected = this.registry.detectFromWebhook(payload);
-    if (detected) providerName = detected;
     return this.manager.verifyCallback(providerName, payload, mergedConfig);
   }
   async handleWebhook(payload, headers, configOverride) {
     return this.verifyWebhook(payload, headers, configOverride);
   }
+  /**
+   * Probe payment methods yang benar-benar aktif di akun merchant gateway.
+   */
+  async probePaymentMethods(configOverride) {
+    const mergedConfig = { ...this.config, ...configOverride };
+    const providerName = configOverride?.provider || this.provider;
+    return this.manager.probePaymentMethods(providerName, mergedConfig);
+  }
   /**
    * Unified Refund — berlaku untuk semua provider yang mendukung refund.
    * Provider tanpa fitur refund mengembalikan `{ supported: false }`, bukan error.
@@ -10565,6 +11126,9 @@ var Buayar = class {
   getTwoCheckoutClient(configOverride) {
     return new TwoCheckoutClient({ ...this.config, ...configOverride });
   }
+  getSumopodClient(configOverride) {
+    return new SumopodClient({ ...this.config, ...configOverride });
+  }
 };
 var buayar = new Buayar();
 // Annotate the CommonJS export names for ESM import in node:
@@ -10585,6 +11149,7 @@ var buayar = new Buayar();
   CANONICAL_TO_OY,
   CANONICAL_TO_PRISMALINK,
   CANONICAL_TO_STRIPE,
+  CANONICAL_TO_SUMOPOD,
   CANONICAL_TO_XENDIT,
   CORE_API_METHODS,
   CheckoutComClient,
@@ -10618,12 +11183,15 @@ var buayar = new Buayar();
   ProviderRegistry,
   RazorpayClient,
   RazorpayProvider,
+  SUMOPOD_TO_CANONICAL,
   SnapApiError,
   SnapClient,
   SquareClient,
   SquareProvider,
   StripeClient,
   StripeProvider,
+  SumopodClient,
+  SumopodProvider,
   TwoCheckoutClient,
   TwoCheckoutProvider,
   XenditClient,
@@ -10683,6 +11251,7 @@ var buayar = new Buayar();
   toOyPaymentMethod,
   toPrismalinkPaymentMethod,
   toStripePaymentMethod,
+  toSumopodPaymentMethod,
   toXenditPaymentMethod,
   verifyAdyenWebhook,
   verifyBraintreeWebhook,
@@ -10702,6 +11271,8 @@ var buayar = new Buayar();
   verifySnapWebhookSignature,
   verifySquareWebhook,
   verifyStripeWebhook,
+  verifySumopodSvixSignature,
+  verifySumopodToken,
   verifyTwoCheckoutWebhook,
   verifyXenditWebhookToken
 });