@crediblemark/buayar 0.8.6 → 0.8.7

package/dist/index.mjs

@@ -291,6 +291,8 @@ var CANONICAL_TO_OY = {
 var CANONICAL_TO_STRIPE = {
   credit_card: "card",
   qris: "qris",
+  QRIS_SUMOPOD: "qris",
+  qris_sumopod: "qris",
   gopay_qris: "qris",
   shopeepay_qris: "qris",
   bca_va: "customer_balance",
@@ -397,6 +399,25 @@ function toStripePaymentMethod(code) {
   }
   return lower;
 }
+var CANONICAL_TO_SUMOPOD = {
+  qris: "QRIS",
+  gopay_qris: "QRIS",
+  shopeepay_qris: "QRIS",
+  nobu_qris: "QRIS",
+  qris_sumopod: "QRIS"
+};
+var SUMOPOD_TO_CANONICAL = {
+  QRIS: "qris",
+  qris: "qris"
+};
+function toSumopodPaymentMethod(code) {
+  if (!code) return void 0;
+  const lower = code.toLowerCase().trim();
+  if (CANONICAL_TO_SUMOPOD[lower]) {
+    return CANONICAL_TO_SUMOPOD[lower];
+  }
+  return code;
+}
 function toCanonicalPaymentMethod(provider, code) {
   if (!code) return "";
   const upper = code.toUpperCase().trim();
@@ -404,7 +425,10 @@ function toCanonicalPaymentMethod(provider, code) {
   if (provider.toLowerCase() === "duitku" && DUITKU_TO_CANONICAL[upper]) {
     return DUITKU_TO_CANONICAL[upper];
   }
-  if (CANONICAL_TO_MIDTRANS[lower] || CANONICAL_TO_DUITKU[lower] || CANONICAL_TO_IPAYMU[lower] || CANONICAL_TO_XENDIT[lower] || CANONICAL_TO_DOKU[lower] || CANONICAL_TO_PRISMALINK[lower] || CANONICAL_TO_FASPAY[lower] || CANONICAL_TO_FINPAY[lower] || CANONICAL_TO_NICEPAY[lower] || CANONICAL_TO_OY[lower] || CANONICAL_TO_STRIPE[lower]) {
+  if (provider.toLowerCase() === "sumopod" && SUMOPOD_TO_CANONICAL[upper]) {
+    return SUMOPOD_TO_CANONICAL[upper];
+  }
+  if (CANONICAL_TO_MIDTRANS[lower] || CANONICAL_TO_DUITKU[lower] || CANONICAL_TO_IPAYMU[lower] || CANONICAL_TO_XENDIT[lower] || CANONICAL_TO_DOKU[lower] || CANONICAL_TO_PRISMALINK[lower] || CANONICAL_TO_FASPAY[lower] || CANONICAL_TO_FINPAY[lower] || CANONICAL_TO_NICEPAY[lower] || CANONICAL_TO_OY[lower] || CANONICAL_TO_STRIPE[lower] || CANONICAL_TO_SUMOPOD[lower]) {
     return lower;
   }
   return lower;
@@ -8017,6 +8041,285 @@ var TwoCheckoutProvider = class extends BasePaymentProvider {
   }
 };
 
+// src/providers/sumopod/signature.ts
+import crypto6 from "crypto";
+function verifySumopodSvixSignature(secret, svixId, svixTimestamp, svixSignature, rawBody, toleranceSeconds = 300) {
+  if (!secret || !svixId || !svixTimestamp || !svixSignature || rawBody === void 0 || rawBody === null) {
+    return false;
+  }
+  if (toleranceSeconds > 0) {
+    const timestampSec = Number(svixTimestamp);
+    if (isNaN(timestampSec)) {
+      return false;
+    }
+    const currentSec = Math.floor(Date.now() / 1e3);
+    if (Math.abs(currentSec - timestampSec) > toleranceSeconds) {
+      return false;
+    }
+  }
+  try {
+    const cleanSecret = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+    const secretBytes = Buffer.from(cleanSecret, "base64");
+    const signedContent = `${svixId}.${svixTimestamp}.${rawBody}`;
+    const expectedSignature = crypto6.createHmac("sha256", secretBytes).update(signedContent).digest("base64");
+    const signatures = svixSignature.split(" ").map((s) => s.includes(",") ? s.split(",")[1] : s).filter(Boolean);
+    return signatures.some((sig) => safeCompare(sig, expectedSignature));
+  } catch {
+    return false;
+  }
+}
+function verifySumopodToken(expectedToken, receivedToken) {
+  if (!expectedToken || !receivedToken) return false;
+  return safeCompare(expectedToken.trim(), receivedToken.trim());
+}
+
+// src/providers/sumopod/provider.ts
+var SumopodProvider = class extends BasePaymentProvider {
+  name = "sumopod";
+  getBaseUrl(config) {
+    if (config?.customBaseUrl) return config.customBaseUrl;
+    if (config?.sandbox) return "https://api-pay-sandbox.sumopod.com";
+    return "https://api-pay.sumopod.com";
+  }
+  async createInvoice(params, config) {
+    const { orderId, amount, returnUrl } = params;
+    const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
+    const baseUrl = this.getBaseUrl(config);
+    const integerAmount = Math.round(amount);
+    const payload = {
+      order_id: orderId,
+      amount: integerAmount,
+      currency: (params.currency || "IDR").toUpperCase(),
+      expires_in_hours: params.providerParams?.expires_in_hours ?? 24,
+      ...returnUrl || config.returnUrl ? { success_return_url: returnUrl || config.returnUrl } : {},
+      ...params.providerParams?.cancel_return_url || config.returnUrl || returnUrl ? { cancel_return_url: params.providerParams?.cancel_return_url || config.returnUrl || returnUrl } : {},
+      payment_method_type_code: "QRIS",
+      ...params.providerParams
+    };
+    try {
+      const response = await fetch(`${baseUrl}/api/v1/payments`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json",
+          "X-Api-Key": apiKey
+        },
+        body: JSON.stringify(payload)
+      });
+      const text = await response.text();
+      let data = null;
+      try {
+        data = JSON.parse(text);
+      } catch {
+      }
+      if (!response.ok || !data || data.error) {
+        return {
+          success: false,
+          provider: "sumopod",
+          orderId,
+          amount: integerAmount,
+          rawResponse: data,
+          error: data?.message || data?.error || `HTTP error! Status: ${response.status} - ${text}`
+        };
+      }
+      const isQris = data.payment_channel_used?.toLowerCase()?.includes("qris") || data.payment_code_type === "QRIS" || data.payment_code_type === "QR_TEXT" || !data.payment_code_type;
+      const isVa = data.payment_code_type === "ACCOUNT_NUMBER";
+      return {
+        success: true,
+        provider: "sumopod",
+        orderId: data.order_id || orderId,
+        amount: data.amount ? Number(data.amount) : integerAmount,
+        reference: data.payment_id,
+        paymentUrl: data.payment_link_url,
+        paymentCode: data.payment_code,
+        qrString: isQris ? data.payment_code || data.payment_link_url : void 0,
+        qrCodeUrl: data.payment_code_type === "QR_IMAGE" ? data.payment_code : void 0,
+        vaNumber: isVa ? data.payment_code : void 0,
+        vaBank: isVa ? data.payment_channel_used?.split(".")[0]?.toLowerCase() : void 0,
+        expiresAt: data.expires_at ? new Date(data.expires_at) : void 0,
+        mode: isQris ? "qris" : isVa ? "va" : "checkout",
+        rawResponse: data
+      };
+    } catch (e) {
+      return {
+        success: false,
+        provider: "sumopod",
+        orderId,
+        amount: integerAmount,
+        rawResponse: null,
+        error: e.message || "Failed to make request to SumoPod API"
+      };
+    }
+  }
+  async verifyCallback(body, config) {
+    const rawBody = typeof body === "string" ? body : JSON.stringify(body);
+    let parsedBody;
+    try {
+      parsedBody = typeof body === "string" ? JSON.parse(body) : body;
+    } catch {
+      parsedBody = {};
+    }
+    const headers = config.extra?.headers || {};
+    const getHeader = (name) => {
+      const lower = name.toLowerCase();
+      for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === lower) {
+          const val = headers[k];
+          return Array.isArray(val) ? val[0] : val;
+        }
+      }
+      return void 0;
+    };
+    const svixId = getHeader("svix-id") || config.extra?.svixId;
+    const svixTimestamp = getHeader("svix-timestamp") || config.extra?.svixTimestamp;
+    const svixSignature = getHeader("svix-signature") || config.extra?.svixSignature || config.extra?.signatureHeader;
+    const receivedToken = getHeader("x-webhook-token") || config.extra?.webhookTokenHeader;
+    const webhookSecret = config.extra?.webhookSecret || config.secretKey || "";
+    const webhookToken = config.extra?.webhookToken || config.extra?.callbackToken || "";
+    let isValid = false;
+    if (svixId && svixTimestamp && svixSignature && webhookSecret) {
+      isValid = verifySumopodSvixSignature(webhookSecret, svixId, svixTimestamp, svixSignature, rawBody);
+    } else if (receivedToken && webhookToken) {
+      isValid = verifySumopodToken(webhookToken, receivedToken);
+    } else if (!webhookSecret && !webhookToken) {
+      isValid = true;
+    }
+    const eventType = parsedBody?.event_type || "";
+    const data = parsedBody?.data || parsedBody;
+    const orderId = String(data?.order_id || "");
+    const amount = Number(data?.amount || 0);
+    const statusRaw = (data?.status || "").toLowerCase();
+    const isPaid = eventType === "payment.completed" || statusRaw === "completed";
+    const isFailed = eventType === "payment.failed" || statusRaw === "failed";
+    const isExpired = eventType === "payment.expired" || statusRaw === "expired";
+    const isPending = !isPaid && !isFailed && !isExpired;
+    const status = isPaid ? "paid" : isExpired ? "expired" : isFailed ? "failed" : "pending";
+    return {
+      isValid,
+      provider: "sumopod",
+      orderId,
+      amount,
+      status,
+      isPaid,
+      isPending,
+      isFailed,
+      isExpired,
+      statusCode: eventType || statusRaw,
+      transactionTime: data?.completed_at ? new Date(data.completed_at) : void 0,
+      rawPayload: parsedBody
+    };
+  }
+  async getPaymentMethods(params, config) {
+    const amount = params?.amount || 1e4;
+    const percentFee = Math.round(amount * 7e-3);
+    const flatFee = 300;
+    const totalFeeNum = percentFee + flatFee;
+    const methods = [
+      {
+        paymentMethod: "qris",
+        code: "QRIS",
+        paymentName: "QRIS",
+        paymentImage: "https://upload.wikimedia.org/wikipedia/commons/a/a2/Logo_QRIS.svg",
+        totalFee: "0.7% + Rp 300",
+        category: "QRIS",
+        feeDetail: {
+          percent: 0.7,
+          flat: 300,
+          totalFee: totalFeeNum
+        }
+      }
+    ];
+    const categories = {
+      QRIS: methods
+    };
+    return {
+      success: true,
+      provider: "sumopod",
+      methods,
+      categories,
+      rawResponse: methods
+    };
+  }
+  async checkTransaction(params, config) {
+    const { merchantOrderId } = params;
+    const apiKey = config.apiKey || config.serverKey || config.secretKey || "";
+    const baseUrl = this.getBaseUrl(config);
+    try {
+      const response = await fetch(`${baseUrl}/api/v1/payments/${encodeURIComponent(merchantOrderId)}`, {
+        method: "GET",
+        headers: {
+          "Accept": "application/json",
+          "X-Api-Key": apiKey
+        }
+      });
+      const text = await response.text();
+      let data = null;
+      try {
+        data = JSON.parse(text);
+      } catch {
+      }
+      if (!response.ok || !data || data.error) {
+        return {
+          success: false,
+          provider: "sumopod",
+          orderId: merchantOrderId,
+          reference: merchantOrderId,
+          amount: 0,
+          statusCode: response.status.toString(),
+          status: "failed",
+          isPaid: false,
+          isPending: false,
+          isFailed: true,
+          isExpired: false,
+          statusMessage: data?.message || data?.error || `HTTP error! Status: ${response.status}`,
+          error: data?.message || data?.error,
+          rawResponse: data
+        };
+      }
+      const statusRaw = (data.status || "").toLowerCase();
+      const isPaid = statusRaw === "completed" || statusRaw === "paid";
+      const isFailed = statusRaw === "failed";
+      const isExpired = statusRaw === "expired";
+      const isPending = !isPaid && !isFailed && !isExpired;
+      const status = isPaid ? "paid" : isExpired ? "expired" : isFailed ? "failed" : "pending";
+      return {
+        success: true,
+        provider: "sumopod",
+        orderId: data.order_id || merchantOrderId,
+        reference: data.payment_id || merchantOrderId,
+        amount: Number(data.amount || 0),
+        statusCode: statusRaw,
+        status,
+        isPaid,
+        isPending,
+        isFailed,
+        isExpired,
+        statusMessage: statusRaw,
+        paymentType: data.payment_method || "qris",
+        transactionTime: data.completed_at ? new Date(data.completed_at) : void 0,
+        rawResponse: data
+      };
+    } catch (e) {
+      return {
+        success: false,
+        provider: "sumopod",
+        orderId: merchantOrderId,
+        reference: merchantOrderId,
+        amount: 0,
+        statusCode: "ERROR",
+        status: "failed",
+        isPaid: false,
+        isPending: false,
+        isFailed: true,
+        isExpired: false,
+        statusMessage: e.message,
+        error: e.message,
+        rawResponse: null
+      };
+    }
+  }
+};
+
 // src/clients/duitku.ts
 var DuitkuClient = class {
   merchantCode;
@@ -9440,6 +9743,63 @@ var TwoCheckoutClient = class {
   }
 };
 
+// src/clients/sumopod.ts
+var SumopodClient = class {
+  apiKey;
+  baseUrl;
+  constructor(config) {
+    this.apiKey = config.apiKey || config.secretKey || config.serverKey || "";
+    this.baseUrl = config.customBaseUrl || (config.sandbox ? "https://api-pay-sandbox.sumopod.com" : "https://api-pay.sumopod.com");
+  }
+  /**
+   * HTTP request helper dengan header autentikasi X-Api-Key SumoPod
+   */
+  async request(method, endpoint, body) {
+    const url = endpoint.startsWith("http") ? endpoint : `${this.baseUrl}${endpoint}`;
+    const headers = {
+      "Content-Type": "application/json",
+      "Accept": "application/json",
+      "X-Api-Key": this.apiKey
+    };
+    const fetchOptions = {
+      method,
+      headers
+    };
+    if (method === "POST" && body) {
+      fetchOptions.body = JSON.stringify(body);
+    }
+    const response = await fetch(url, fetchOptions);
+    const text = await response.text();
+    let data = null;
+    try {
+      data = JSON.parse(text);
+    } catch {
+    }
+    if (!response.ok) {
+      throw new Error(
+        data?.message || data?.error || `HTTP error! Status: ${response.status} - ${text}`
+      );
+    }
+    return data;
+  }
+  /**
+   * Buat payment link / sesi pembayaran baru di SumoPod
+   */
+  async createPayment(params) {
+    return this.request("POST", "/api/v1/payments", {
+      currency: "IDR",
+      payment_method_type_code: "QRIS",
+      ...params
+    });
+  }
+  /**
+   * Ambil detail status pembayaran berdasarkan ID pembayaran
+   */
+  async getPayment(paymentId) {
+    return this.request("GET", `/api/v1/payments/${encodeURIComponent(paymentId)}`);
+  }
+};
+
 // src/core/manager.ts
 var PaymentManager = class {
   providers = /* @__PURE__ */ new Map();
@@ -9463,6 +9823,7 @@ var PaymentManager = class {
     this.registerProvider(new PayuProvider());
     this.registerProvider(new BraintreeProvider());
     this.registerProvider(new TwoCheckoutProvider());
+    this.registerProvider(new SumopodProvider());
   }
   registerProvider(provider) {
     this.providers.set(provider.name.toLowerCase(), provider);
@@ -9590,6 +9951,12 @@ var PaymentManager = class {
   getTwoCheckoutClient(config) {
     return new TwoCheckoutClient(config);
   }
+  getSumopodProvider() {
+    return this.getProvider("sumopod");
+  }
+  getSumopodClient(config) {
+    return new SumopodClient(config);
+  }
   // ─── Unified Operations ──────────────────────────────────────────────────
   async createInvoice(providerName, params, config) {
     const provider = this.getProvider(providerName);
@@ -9942,6 +10309,8 @@ var ProviderRegistry = class {
       if (h["x-oy-username"]) return "oy";
       if (h["signature"] && (h["client-id"] || h["request-id"])) return "doku";
       if (h["x-signature"] && (payload?.trx_id || payload?.via || payload?.sid)) return "ipaymu";
+      if (h["svix-signature"] || h["svix-id"]) return "sumopod";
+      if (h["x-webhook-token"]) return "sumopod";
     }
     if (!payload) return void 0;
     const p = payload;
@@ -9956,6 +10325,7 @@ var ProviderRegistry = class {
     if (p.merchant_id && p.order_id && p.signature) return "prismalink";
     if (p.object === "event" || p.type && p.data?.object && p.api_version) return "stripe";
     if (p.event && p.payload?.payment?.entity) return "razorpay";
+    if (p.event_type && p.data?.payment_id) return "sumopod";
     if (p.external_id && (p.status || p.paid_amount || p.payment_method || p.payment_channel || p.id) || p.event?.startsWith("payment.") || p.event?.startsWith("qr.") || p.data?.reference_id) {
       return "xendit";
     }
@@ -9988,7 +10358,8 @@ var ENV_KEYS = {
   square: ["SQUARE_ACCESS_TOKEN", "SQUARE_LOCATION_ID", "SQUARE_WEBHOOK_SIGNATURE_KEY"],
   payu: ["PAYU_POS_ID", "PAYU_MD5_KEY"],
   braintree: ["BRAINTREE_MERCHANT_ID", "BRAINTREE_PUBLIC_KEY", "BRAINTREE_PRIVATE_KEY"],
-  twocheckout: ["TWOCHECKOUT_MERCHANT_CODE", "TWOCHECKOUT_SECRET_KEY", "TWOCHECKOUT_SECRET_WORD"]
+  twocheckout: ["TWOCHECKOUT_MERCHANT_CODE", "TWOCHECKOUT_SECRET_KEY", "TWOCHECKOUT_SECRET_WORD"],
+  sumopod: ["SUMOPOD_API_KEY", "SUMOPOD_WEBHOOK_SECRET"]
 };
 var WORKING_METHODS = {
   midtrans: Object.keys(CANONICAL_TO_MIDTRANS),
@@ -10002,6 +10373,7 @@ var WORKING_METHODS = {
   nicepay: Object.keys(CANONICAL_TO_NICEPAY),
   oy: Object.keys(CANONICAL_TO_OY),
   stripe: Object.keys(CANONICAL_TO_STRIPE),
+  sumopod: Object.keys(CANONICAL_TO_SUMOPOD),
   paypal: ["credit_card", "paylater", "paypal", "bank_transfer"],
   adyen: ["credit_card", "paypal", "qris", "apple_pay", "google_pay", "klarna", "sepa"],
   checkoutcom: ["credit_card", "paypal", "apple_pay", "google_pay", "klarna", "sofort", "bank_transfer"],
@@ -10030,7 +10402,8 @@ var OPERATIONS = {
   square: { refund: true, checkBalance: true, disburse: false },
   payu: { refund: true, checkBalance: false, disburse: false },
   braintree: { refund: true, checkBalance: false, disburse: false },
-  twocheckout: { refund: true, checkBalance: false, disburse: false }
+  twocheckout: { refund: true, checkBalance: false, disburse: false },
+  sumopod: { refund: false, checkBalance: false, disburse: false }
 };
 function buildDefaultDescriptors() {
   return Object.keys(ENV_KEYS).map((name) => ({
@@ -10147,9 +10520,13 @@ var SPECIFIC = {
     apiKey: ["TWOCHECKOUT_SECRET_KEY"],
     merchantCode: ["TWOCHECKOUT_MERCHANT_CODE"],
     merchantId: ["TWOCHECKOUT_MERCHANT_CODE"]
+  },
+  sumopod: {
+    apiKey: ["SUMOPOD_API_KEY", "SUMOPOD_PRODUCTION_API_KEY", "SUMOPOD_SANDBOX_API_KEY"]
   }
 };
 function firstDefined(env, keys) {
+  if (!keys) return void 0;
   for (const k of keys) {
     const v = env[k];
     if (typeof v === "string" && v.trim().length > 0) return v.trim();
@@ -10178,7 +10555,8 @@ function resolveSandbox(env, provider) {
     payu: ["PAYU_SANDBOX"],
     braintree: ["BRAINTREE_SANDBOX"],
     twocheckout: ["TWOCHECKOUT_SANDBOX"],
-    xendit: ["XENDIT_SANDBOX"]
+    xendit: ["XENDIT_SANDBOX"],
+    sumopod: ["SUMOPOD_SANDBOX"]
   };
   const specific = firstDefined(env, specificMap[provider]);
   if (specific !== void 0) {
@@ -10210,8 +10588,8 @@ function resolveConfigFromEnv(customConfig) {
   const publicKey = customConfig?.publicKey || firstDefined(env, ["BUAYAR_PUBLIC_KEY", "PG_PUBLIC_KEY", "PUBLIC_KEY"]) || cfg.clientKey;
   const privateKey = customConfig?.privateKey || firstDefined(env, ["BUAYAR_PRIVATE_KEY", "PG_PRIVATE_KEY", "PRIVATE_KEY"]) || (provider === "braintree" ? cfg.apiKey : void 0);
   const extra = {
-    webhookToken: env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
-    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
+    webhookToken: (env.SUMOPOD_SANDBOX === "true" ? env.SUMOPOD_SANDBOX_WEBHOOK_TOKEN : env.SUMOPOD_PRODUCTION_WEBHOOK_TOKEN) || env.SUMOPOD_WEBHOOK_TOKEN || env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
+    webhookSecret: (env.SUMOPOD_SANDBOX === "true" ? env.SUMOPOD_SANDBOX_WEBHOOK_SECRET : env.SUMOPOD_PRODUCTION_WEBHOOK_SECRET) || env.SUMOPOD_WEBHOOK_SECRET || env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
     merchantName: env.FASPAY_MERCHANT_NAME || env.BUAYAR_MERCHANT_NAME,
     userId: env.FASPAY_USER_ID,
     iMid: env.NICEPAY_IMID,
@@ -10443,6 +10821,14 @@ var Buayar = class {
       if (oyUser) {
         mergedConfig.extra.oyUsername = Array.isArray(oyUser) ? oyUser[0] : oyUser;
       }
+      const svixId = headers["svix-id"] || headers["Svix-Id"];
+      const svixTimestamp = headers["svix-timestamp"] || headers["Svix-Timestamp"];
+      const svixSignature = headers["svix-signature"] || headers["Svix-Signature"];
+      const sumopodToken = headers["x-webhook-token"] || headers["X-Webhook-Token"];
+      if (svixId) mergedConfig.extra.svixId = Array.isArray(svixId) ? svixId[0] : svixId;
+      if (svixTimestamp) mergedConfig.extra.svixTimestamp = Array.isArray(svixTimestamp) ? svixTimestamp[0] : svixTimestamp;
+      if (svixSignature) mergedConfig.extra.svixSignature = Array.isArray(svixSignature) ? svixSignature[0] : svixSignature;
+      if (sumopodToken) mergedConfig.extra.webhookTokenHeader = Array.isArray(sumopodToken) ? sumopodToken[0] : sumopodToken;
     }
     let providerName = configOverride?.provider !== void 0 ? configOverride.provider : this.provider;
     if (!providerName) {
@@ -10563,6 +10949,9 @@ var Buayar = class {
   getTwoCheckoutClient(configOverride) {
     return new TwoCheckoutClient({ ...this.config, ...configOverride });
   }
+  getSumopodClient(configOverride) {
+    return new SumopodClient({ ...this.config, ...configOverride });
+  }
 };
 var buayar = new Buayar();
 export {
@@ -10582,6 +10971,7 @@ export {
   CANONICAL_TO_OY,
   CANONICAL_TO_PRISMALINK,
   CANONICAL_TO_STRIPE,
+  CANONICAL_TO_SUMOPOD,
   CANONICAL_TO_XENDIT,
   CORE_API_METHODS,
   CheckoutComClient,
@@ -10615,12 +11005,15 @@ export {
   ProviderRegistry,
   RazorpayClient,
   RazorpayProvider,
+  SUMOPOD_TO_CANONICAL,
   SnapApiError,
   SnapClient,
   SquareClient,
   SquareProvider,
   StripeClient,
   StripeProvider,
+  SumopodClient,
+  SumopodProvider,
   TwoCheckoutClient,
   TwoCheckoutProvider,
   XenditClient,
@@ -10680,6 +11073,7 @@ export {
   toOyPaymentMethod,
   toPrismalinkPaymentMethod,
   toStripePaymentMethod,
+  toSumopodPaymentMethod,
   toXenditPaymentMethod,
   verifyAdyenWebhook,
   verifyBraintreeWebhook,
@@ -10699,6 +11093,8 @@ export {
   verifySnapWebhookSignature,
   verifySquareWebhook,
   verifyStripeWebhook,
+  verifySumopodSvixSignature,
+  verifySumopodToken,
   verifyTwoCheckoutWebhook,
   verifyXenditWebhookToken
 };

package/docs/guide.md

@@ -1,6 +1,6 @@
 # 💳 Panduan Unified `@crediblemark/buayar`
 
-Panduan ini adalah **satu-satunya** panduan yang Anda butuhkan untuk mengintegrasikan **semua** payment gateway yang didukung Buayar (19 provider: 10 Indonesia + 9 Internasional). Anda **tidak perlu** membaca dokumentasi masing-masing PG — kode yang Anda tulis **identik** untuk semua provider.
+Panduan ini adalah **satu-satunya** panduan yang Anda butuhkan untuk mengintegrasikan **semua** payment gateway yang didukung Buayar (20 provider: 11 Indonesia + 9 Internasional). Anda **tidak perlu** membaca dokumentasi masing-masing PG — kode yang Anda tulis **identik** untuk semua provider.
 
 > 🎯 **Prinsip "mata tertutup":** Anda 100% tidak tahu (dan tidak perlu tahu) provider mana yang sedang aktif. Yang Anda tahu hanya: "Buaya mendukung PG A, PG B, PG C". Cukup ubah kredensial di `.env`, semuanya jalan.
 
@@ -52,7 +52,7 @@ Cukup isi **variabel universal** yang sama untuk semua provider. SDK otomatis me
 ```env
 # (opsional) Provider aktif: midtrans, duitku, ipaymu, xendit, doku, prismalink,
 # faspay, finpay, nicepay, oy, stripe, paypal, adyen, checkoutcom,
-# razorpay, square, payu, braintree, twocheckout
+# razorpay, square, payu, braintree, twocheckout, sumopod
 # Bila dikosongkan, provider AUTO-DIDETEKSI dari kredensial yang terisi.
 BUAYAR_PROVIDER=midtrans
 
@@ -414,6 +414,9 @@ Rangkuman kemampuan ekstra tiap provider:
 | PayU | - | `getPayuClient()` | cancelOrder, getOrder, refundOrder |
 | Braintree | - | `getBraintreeClient()` | getClientToken, findTransaction, refundTransaction, voidTransaction |
 | 2Checkout | - | `getTwoCheckoutClient()` | getOrder, listOrders, getSubscription, refundOrder |
+| [SumoPod](sumopod.md) | Tested | `getSumopodClient()` | createPayment, getPayment. *Lihat [panduan lengkap SumoPod](sumopod.md)* |
+
+> ℹ️ **Catatan Status:** Hanya provider yang memiliki file dokumentasi panduan khusus di folder `docs/` yang berstatus **Tested** ([iPaymu](ipaymu.md) dan [SumoPod](sumopod.md)). Provider lain bertanda `-` berstatus siap pakai sesuai spesifikasi API resmi.
 
 ---
 
@@ -444,6 +447,7 @@ Tabel berikut menunjukkan data apa dari dashboard masing-masing payment gateway
 | **PayU** | `payu` | MD5 Key / Secret | POS ID | POS ID |
 | **Braintree** | `braintree` | Private Key | Merchant ID | Public Key |
 | **2Checkout** | `twocheckout` | Secret Key | Merchant Code | Secret Word (`BUAYAR_WEBHOOK_SECRET`) |
+| **SumoPod** | `sumopod` | API Key (`X-Api-Key`) | *(tidak perlu)* | Webhook Secret (`BUAYAR_WEBHOOK_SECRET`) / Token (`BUAYAR_WEBHOOK_TOKEN`) |
 
 > 💡 **Mode Sandbox:** Cukup tambahkan `BUAYAR_SANDBOX=true` (atau `false` saat production), SDK otomatis menyesuaikan URL endpoint API seluruh provider di atas tanpa perlu konfigurasi tambahan.