myxl-core 1.0.0

package/dist/index.js

@@ -0,0 +1,1487 @@
+// @bun
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// src/lib/encrypt-helper.ts
+var exports_encrypt_helper = {};
+__export(exports_encrypt_helper, {
+  makeXSignaturePayment: () => makeXSignaturePayment,
+  makeXSignatureLoyalty: () => makeXSignatureLoyalty,
+  makeXSignatureBountyAllotment: () => makeXSignatureBountyAllotment,
+  makeXSignatureBounty: () => makeXSignatureBounty,
+  makeXSignatureBasic: () => makeXSignatureBasic,
+  makeXSignature: () => makeXSignature,
+  makeAxApiSignature: () => makeAxApiSignature,
+  encryptXData: () => encryptXData,
+  encryptEncryptedField: () => encryptEncryptedField,
+  decryptXData: () => decryptXData,
+  decryptEncryptedField: () => decryptEncryptedField
+});
+import crypto from "crypto";
+function pkcs7Pad(buf, blockSize = 16) {
+  const pad = blockSize - buf.length % blockSize;
+  const padBuf = Buffer.alloc(pad, pad);
+  return Buffer.concat([buf, padBuf]);
+}
+function pkcs7Unpad(buf) {
+  const pad = buf[buf.length - 1] ?? 16;
+  if (pad < 1 || pad > 16)
+    throw new Error("Invalid PKCS7 padding");
+  return buf.slice(0, buf.length - pad);
+}
+function deriveIv(xtimeMs) {
+  const sha = crypto.createHash("sha256").update(String(xtimeMs)).digest("hex");
+  return Buffer.from(sha.slice(0, 16), "ascii");
+}
+function urlsafeB64Encode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function urlsafeB64Decode(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function encryptXData(plaintext, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-256-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct);
+}
+function decryptXData(xdata, xtimeMs) {
+  const key = Buffer.from(XDATA_KEY, "ascii");
+  const iv = deriveIv(xtimeMs);
+  const ct = urlsafeB64Decode(xdata);
+  const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function makeXSignature(idToken, method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${idToken};${method};${path};${sigTimeSec}`;
+  const msg = `${idToken};${sigTimeSec};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignaturePayment(accessToken, sigTimeSec, packageCode, tokenPayment, paymentMethod, paymentFor, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${paymentFor};${paymentMethod};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBounty(accessToken, sigTimeSec, packageCode, tokenPayment) {
+  const path = "api/v8/personalization/bounties-exchange";
+  const keyStr = `${X_API_BASE_SECRET};${accessToken};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${accessToken};${tokenPayment};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureLoyalty(sigTimeSec, packageCode, tokenConfirmation, path) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBountyAllotment(sigTimeSec, packageCode, tokenConfirmation, path, destinationMsisdn) {
+  const keyStr = `${X_API_BASE_SECRET};${sigTimeSec}#ae-hei_9Tee6he+Ik3Gais5=;${destinationMsisdn};POST;${path};${sigTimeSec}`;
+  const msg = `${tokenConfirmation};${sigTimeSec};${destinationMsisdn};${packageCode};`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeXSignatureBasic(method, path, sigTimeSec) {
+  const keyStr = `${X_API_BASE_SECRET};${method};${path};${sigTimeSec}`;
+  const msg = `${sigTimeSec};en;`;
+  return crypto.createHmac("sha512", keyStr).update(msg).digest("hex");
+}
+function makeAxApiSignature(tsForSign, contact, code, contactType) {
+  const preimage = `${tsForSign}password${contactType}${contact}${code}openid`;
+  const digest = crypto.createHmac("sha256", Buffer.from(AX_API_SIG_KEY, "ascii")).update(preimage).digest();
+  return digest.toString("base64");
+}
+function decryptEncryptedField(encryptedB64) {
+  const ivAscii = encryptedB64.slice(-16);
+  const b64Part = encryptedB64.slice(0, -16);
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const iv = Buffer.from(ivAscii, "ascii");
+  const ct = urlsafeB64Decode(b64Part);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, iv);
+  decipher.setAutoPadding(false);
+  const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+  return pkcs7Unpad(pt).toString("utf-8");
+}
+function encryptEncryptedField(plaintext) {
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const ivHex = crypto.randomBytes(8).toString("hex");
+  const iv = Buffer.from(ivHex, "ascii");
+  const padded = pkcs7Pad(Buffer.from(plaintext, "utf-8"));
+  const cipher = crypto.createCipheriv("aes-128-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return urlsafeB64Encode(ct) + ivHex;
+}
+var init_encrypt_helper = __esm(() => {
+  init_config();
+});
+
+// src/encrypt.ts
+var exports_encrypt = {};
+__export(exports_encrypt, {
+  makeXSignaturePayment: () => makeXSignaturePayment,
+  makeXSignatureLoyalty: () => makeXSignatureLoyalty,
+  makeXSignatureBountyAllotment: () => makeXSignatureBountyAllotment,
+  makeXSignatureBounty: () => makeXSignatureBounty,
+  makeXSignatureBasic: () => makeXSignatureBasic,
+  makeAxApiSignature: () => makeAxApiSignature,
+  encryptSignXData: () => encryptSignXData,
+  encryptEncryptedField: () => encryptEncryptedField,
+  decryptXDataSync: () => decryptXDataSync,
+  decryptXData: () => decryptXData2,
+  decryptEncryptedField: () => decryptEncryptedField,
+  buildEncryptedField: () => buildEncryptedField
+});
+import crypto2 from "crypto";
+function encryptSignXData(method, path, idToken, payload) {
+  const plainBody = JSON.stringify(payload);
+  const xtime = Date.now();
+  const xdata = encryptXData(plainBody, xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const xSignature = makeXSignature(idToken, method, path, sigTimeSec);
+  return {
+    x_signature: xSignature,
+    encrypted_body: { xdata, xtime }
+  };
+}
+function decryptXDataSync(xdata, xtimeMs) {
+  const { decryptXData: decryptXData2 } = (init_encrypt_helper(), __toCommonJS(exports_encrypt_helper));
+  const plaintext = decryptXData2(xdata, xtimeMs);
+  return JSON.parse(plaintext);
+}
+async function decryptXData2(xdata, xtimeMs) {
+  const { decryptXData: _decrypt } = (init_encrypt_helper(), __toCommonJS(exports_encrypt_helper));
+  return JSON.parse(_decrypt(xdata, xtimeMs));
+}
+function randomIvHex16() {
+  return crypto2.randomBytes(8).toString("hex");
+}
+function b64(data, urlsafe) {
+  const b64str = data.toString("base64");
+  if (urlsafe) {
+    return b64str.replace(/\+/g, "-").replace(/\//g, "_");
+  }
+  return b64str;
+}
+function buildEncryptedField(ivHex16 = null, urlsafeB64 = false) {
+  const key = Buffer.from(ENCRYPTED_FIELD_KEY, "ascii");
+  const ivHex = ivHex16 ?? randomIvHex16();
+  const iv = Buffer.from(ivHex, "ascii");
+  const pt = Buffer.alloc(16, 16);
+  const cipher = crypto2.createCipheriv("aes-128-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(pt), cipher.final()]);
+  return b64(ct, urlsafeB64) + ivHex;
+}
+var init_encrypt = __esm(() => {
+  init_config();
+  init_encrypt_helper();
+  init_encrypt_helper();
+});
+
+// src/lib/utils.ts
+var exports_utils = {};
+__export(exports_utils, {
+  unseal: () => unseal,
+  tsGmt7WithoutColon: () => tsGmt7WithoutColon,
+  sendApiRequest: () => sendApiRequest,
+  javaLikeTimestamp: () => javaLikeTimestamp,
+  interceptPage: () => interceptPage,
+  base64Encode: () => base64Encode
+});
+import axios from "axios";
+import { v4 as uuidv4 } from "uuid";
+import { DateTime } from "luxon";
+function javaLikeTimestamp(dt = DateTime.now()) {
+  return dt.toMillis().toString();
+}
+async function sendApiRequest(path, payloadDict, idToken, method = "POST") {
+  const encryptedPayload = encryptSignXData(method, path, idToken, payloadDict);
+  const xtime = Number(encryptedPayload.encrypted_body.xtime);
+  const sigTimeSec = Math.floor(xtime / 1000);
+  const body = encryptedPayload.encrypted_body;
+  const x_sig = encryptedPayload.x_signature;
+  const headers = {
+    host: BASE_API_URL.replace(/^https?:\/\//, ""),
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": x_sig,
+    "x-request-id": uuidv4(),
+    "x-request-at": javaLikeTimestamp(),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL.replace(/\/$/, "")}/${path.replace(/^\//, "")}`;
+  const resp = await axios.post(url, body, {
+    headers,
+    timeout: 30000
+  });
+  const respData = resp.data;
+  const decryptedXData = await decryptXData2(respData.xdata, respData.xtime);
+  if (decryptedXData.status === "FAILED") {
+    throw new Error(JSON.stringify(decryptedXData));
+  }
+  return decryptedXData;
+}
+function base64Encode(str) {
+  return Buffer.from(str, "utf-8").toString("base64");
+}
+function tsGmt7WithoutColon(date) {
+  let formatted = date.toFormat("yyyy-MM-dd'T'HH:mm:ss.SSSZZ");
+  if (formatted.endsWith("+07:00")) {
+    formatted = formatted.replace("+07:00", "+0700");
+  }
+  return formatted;
+}
+async function interceptPage(idToken, optionCode, isEnterprise = false) {
+  const path = "misc/api/v8/utility/intercept-page";
+  const rawPayload = {
+    is_enterprise: isEnterprise,
+    lang: "en",
+    package_option_code: optionCode
+  };
+  console.log("Fetching intercept page...");
+  try {
+    const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+    if ("status" in res) {
+      console.log(`Intercept status: ${res["status"]}`);
+    } else {
+      console.log("Intercept error");
+    }
+  } catch (err) {
+    console.log("Intercept error", err);
+  }
+}
+function unseal(getter, fallback) {
+  try {
+    const hex = getter();
+    if (!hex || typeof __SEED__ === "undefined")
+      return fallback;
+    const seed = Buffer.from(__SEED__, "hex");
+    const data = Buffer.from(hex, "hex");
+    return Buffer.from(data.map((b, i) => b ^ seed[i % seed.length])).toString("utf8");
+  } catch {
+    return fallback;
+  }
+}
+var init_utils = __esm(() => {
+  init_config();
+  init_encrypt();
+});
+
+// src/config.ts
+var exports_config = {};
+__export(exports_config, {
+  X_APP_VERSION: () => X_APP_VERSION,
+  X_API_BASE_SECRET: () => X_API_BASE_SECRET,
+  XDATA_KEY: () => XDATA_KEY,
+  UA: () => UA,
+  ENCRYPTED_FIELD_KEY: () => ENCRYPTED_FIELD_KEY,
+  DEFAULT_AX_FP: () => DEFAULT_AX_FP,
+  DEFAULT_AX_DEVICE_ID: () => DEFAULT_AX_DEVICE_ID,
+  CIRCLE_MSISDN_KEY: () => CIRCLE_MSISDN_KEY,
+  BASIC_AUTH: () => BASIC_AUTH,
+  BASE_CIAM_URL: () => BASE_CIAM_URL,
+  BASE_API_URL: () => BASE_API_URL,
+  AX_FP_KEY: () => AX_FP_KEY,
+  AX_API_SIG_KEY: () => AX_API_SIG_KEY,
+  API_KEY: () => API_KEY
+});
+var BASE_API_URL, BASE_CIAM_URL, BASIC_AUTH, AX_FP_KEY, UA, API_KEY, ENCRYPTED_FIELD_KEY, XDATA_KEY, AX_API_SIG_KEY, X_API_BASE_SECRET, CIRCLE_MSISDN_KEY, DEFAULT_AX_DEVICE_ID = "a9698fc65ed122e1b0efb2b7e9d93728", DEFAULT_AX_FP = "LDMGk/l1xEViBHOOsQb/CtVyh6FI0QvxXGfsoizEhr7ms1SBTYN07kcmSY3CWDlkG39iSV4p0AuafPoIL+pyoI+1StGif01C7Z/3Lprtkn+WHS3QAKHuAb8LQGe9/2pn", X_APP_VERSION = "8.9.0";
+var init_config = __esm(() => {
+  init_utils();
+  BASE_API_URL = unseal(() => __E_BASE_API_URL__, "https://api.myxl.xlaxiata.co.id");
+  BASE_CIAM_URL = unseal(() => __E_BASE_CIAM_URL__, "https://gede.ciam.xlaxiata.co.id");
+  BASIC_AUTH = unseal(() => __E_BASIC_AUTH__, "OWZjOTdlZDEtNmEzMC00OGQ1LTk1MTYtNjBjNTNjZTNhMTM1OllEV21GNExKajlYSUt3UW56eTJlMmxiMHRKUWIyOW8z");
+  AX_FP_KEY = unseal(() => __E_AX_FP_KEY__, "18b4d589826af50241177961590e6693");
+  UA = unseal(() => __E_UA__, "myXL / 8.9.0(1202); com.android.vending; (samsung; SM-N935F; SDK 33; Android 13)");
+  API_KEY = unseal(() => __E_API_KEY__, "vT8tINqHaOxXbGE7eOWAhA==");
+  ENCRYPTED_FIELD_KEY = unseal(() => __E_ENCRYPTED_FIELD_KEY__, "5dccbf08920a5527");
+  XDATA_KEY = unseal(() => __E_XDATA_KEY__, "5dccbf08920a5527b99e222789c34bb7");
+  AX_API_SIG_KEY = unseal(() => __E_AX_API_SIG_KEY__, "18b4d589826af50241177961590e6693");
+  X_API_BASE_SECRET = unseal(() => __E_X_API_BASE_SECRET__, "mU1Y4n1vBjf3M7tMnRkFU08mVyUJHed8B5En3EAniu1mXLixeuASmBmKnkyzVziOye7rG5nIekMdthensbQMcOJ6SLnrkGyfXALD7mrBC6vuWv6G01pmD3XlU5rT7Tzx");
+  CIRCLE_MSISDN_KEY = unseal(() => __E_CIRCLE_MSISDN_KEY__, "5dccbf08920a5527");
+});
+
+// src/auth.ts
+init_config();
+init_utils();
+init_encrypt();
+var exports_auth = {};
+__export(exports_auth, {
+  submitSmsOtp: () => submitSmsOtp,
+  submitOtp: () => submitOtp,
+  getOtp: () => getOtp
+});
+import axios2 from "axios";
+import { v4 as uuidv42 } from "uuid";
+import { DateTime as DateTime2, FixedOffsetZone } from "luxon";
+import * as crypto3 from "crypto";
+async function getOtp(contact, axDeviceId, axFingerprint) {
+  const url = BASE_CIAM_URL + "/realms/xl-ciam/auth/otp";
+  const querystring = {
+    contact,
+    contactType: "SMS",
+    alternateContact: "false"
+  };
+  const gmt7Zone = FixedOffsetZone.instance(420);
+  const now = DateTime2.now().setZone(gmt7Zone);
+  const ax_request_at = javaLikeTimestamp(now);
+  const ax_request_id = uuidv42();
+  const headers = {
+    "Accept-Encoding": "gzip, deflate, br",
+    Authorization: `Basic ${BASIC_AUTH}`,
+    "Ax-Device-Id": axDeviceId,
+    "Ax-Fingerprint": axFingerprint,
+    "Ax-Request-At": ax_request_at,
+    "Ax-Request-Device": "samsung",
+    "Ax-Request-Device-Model": "SM-N935F",
+    "Ax-Request-Id": ax_request_id,
+    "Ax-Substype": "PREPAID",
+    "Content-Type": "application/json",
+    Host: BASE_CIAM_URL.replace(/^https?:\/\//, ""),
+    "User-Agent": UA
+  };
+  const { data } = await axios2.get(url, {
+    headers,
+    params: querystring,
+    timeout: 30000
+  });
+  return data;
+}
+async function submitOtp(contactType, contact, code, axDeviceId, axFingerprint) {
+  let finalContact = "";
+  let finalCode = "";
+  if (contactType === "SMS") {
+    finalContact = contact;
+    finalCode = code;
+  } else if (contactType === "DEVICEID") {
+    finalContact = base64Encode(contact);
+    finalCode = code;
+  }
+  const url = BASE_CIAM_URL + "/realms/xl-ciam/protocol/openid-connect/token";
+  const now = DateTime2.now().setZone("Asia/Jakarta");
+  const ts_for_sign = tsGmt7WithoutColon(now);
+  const ts_header = tsGmt7WithoutColon(now.minus({ minutes: 5 }));
+  const signature = await makeAxApiSignature(ts_for_sign, finalContact, code, contactType);
+  const payload = `contactType=${encodeURIComponent(contactType)}&code=${encodeURIComponent(finalCode)}&grant_type=password&contact=${encodeURIComponent(finalContact)}&scope=openid`;
+  const axRequestId = crypto3.randomUUID();
+  const headers = {
+    "Accept-Encoding": "gzip, deflate, br",
+    Authorization: `Basic ${BASIC_AUTH}`,
+    "Ax-Api-Signature": signature,
+    "Ax-Device-Id": axDeviceId,
+    "Ax-Fingerprint": axFingerprint,
+    "Ax-Request-At": ts_header,
+    "Ax-Request-Device": "samsung",
+    "Ax-Request-Device-Model": "SM-N935F",
+    "Ax-Request-Id": axRequestId,
+    "Ax-Substype": "PREPAID",
+    "Content-Type": "application/x-www-form-urlencoded",
+    "User-Agent": UA
+  };
+  const response = await axios2.post(url, payload, {
+    headers,
+    timeout: 30000
+  });
+  return response.data;
+}
+async function submitSmsOtp(contact, code, axDeviceId, axFingerprint) {
+  return submitOtp("SMS", contact, code, axDeviceId, axFingerprint);
+}
+// src/ciam.ts
+init_config();
+init_utils();
+var exports_ciam = {};
+__export(exports_ciam, {
+  getTieringInfo: () => getTieringInfo,
+  getRedeemables: () => getRedeemables,
+  getProfile: () => getProfile,
+  getNewToken: () => getNewToken,
+  getBalance: () => getBalance,
+  fetchMyPackages: () => fetchMyPackages,
+  checkQuota: () => checkQuota
+});
+import axios3 from "axios";
+import { DateTime as DateTime3, FixedOffsetZone as FixedOffsetZone2 } from "luxon";
+import { v4 as uuidv43 } from "uuid";
+async function getNewToken(refreshToken, axDeviceId, axFingerprint) {
+  try {
+    const url = `${BASE_CIAM_URL}/realms/xl-ciam/protocol/openid-connect/token`;
+    const gmt7Zone = FixedOffsetZone2.instance(420);
+    const now = DateTime3.now().setZone(gmt7Zone);
+    const ax_request_at = now.toFormat("yyyy-MM-dd'T'HH:mm:ss.SSS") + "+0700";
+    const ax_request_id = uuidv43();
+    const headers = {
+      Host: BASE_CIAM_URL.replace("https://", ""),
+      "ax-request-at": ax_request_at,
+      "ax-device-id": axDeviceId,
+      "ax-request-id": ax_request_id,
+      "ax-request-device": "samsung",
+      "ax-request-device-model": "SM-N935F",
+      "ax-fingerprint": axFingerprint,
+      authorization: `Basic ${BASIC_AUTH}`,
+      "user-agent": UA,
+      "ax-substype": "PREPAID",
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const data = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    });
+    const resp = await axios3.post(url, data.toString(), {
+      headers,
+      timeout: 30000
+    });
+    return resp.data;
+  } catch (error) {
+    console.error("Refresh token tidak valid:", error);
+    throw new Error("Refresh token tidak valid.");
+  }
+}
+async function getProfile(accessToken, idToken) {
+  const path = "api/v8/profile";
+  const rawPayload = {
+    access_token: accessToken,
+    app_version: X_APP_VERSION,
+    is_enterprise: false,
+    lang: "en"
+  };
+  const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+  return res.data.profile;
+}
+async function getBalance(idToken) {
+  const path = "api/v8/packages/balance-and-credit";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function getTieringInfo(idToken) {
+  const path = "gamification/api/v8/loyalties/tiering/info";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function getRedeemables({ idToken, isEnterprise }) {
+  const path = "api/v8/personalization/redeemables";
+  const rawPayload = {
+    is_enterprise: isEnterprise,
+    lang: "en"
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+async function checkQuota(msisdn) {
+  const url = `https://xl-ku.my.id/end.php?check=package&number=${msisdn}&version=2`;
+  console.log(`Fetching quota for ${msisdn} from external API...`);
+  const response = await axios3.get(url);
+  return response.data;
+}
+async function fetchMyPackages({ idToken }) {
+  const path = "api/v8/packages/quota-details";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en",
+    family_member_id: ""
+  };
+  return await sendApiRequest(path, rawPayload, idToken, "POST");
+}
+// src/client.ts
+init_utils();
+var exports_client = {};
+__export(exports_client, {
+  getTransactionHistory: () => getTransactionHistory,
+  dashboardSegments: () => dashboardSegments
+});
+async function getTransactionHistory({ idToken }) {
+  const path = "payments/api/v8/transaction-history";
+  const payload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  console.log("Fetching transaction history...");
+  const res = await sendApiRequest(path, payload, idToken, "POST");
+  return res.data.list;
+}
+async function dashboardSegments({ idToken, accessToken }) {
+  const path = "dashboard/api/v8/segments";
+  const rawPayload = {
+    access_token: accessToken
+  };
+  const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+  return res;
+}
+
+// src/index.ts
+init_config();
+
+// src/device.ts
+init_config();
+var exports_device = {};
+__export(exports_device, {
+  getAxDeviceId: () => getAxDeviceId,
+  generateAxFp: () => generateAxFp,
+  buildFingerprintPlain: () => buildFingerprintPlain,
+  axFingerprint: () => axFingerprint
+});
+import crypto4 from "crypto";
+function randint(min, max) {
+  return Math.floor(Math.random() * (max - min + 1)) + min;
+}
+function buildFingerprintPlain(dev) {
+  return `${dev.manufacturer}|${dev.model}|${dev.lang}|${dev.resolution}|` + `${dev.tz_short}|${dev.ip}|${dev.font_scale}|Android ${dev.android_release}|${dev.msisdn}`;
+}
+function pkcs7Pad2(buf, blockSize = 16) {
+  const padLen = blockSize - (buf.length % blockSize || blockSize);
+  const padByte = padLen;
+  const padding = Buffer.alloc(padLen, padByte);
+  return Buffer.concat([buf, padding]);
+}
+function axFingerprint(dev, secretKey32Ascii) {
+  const key = Buffer.from(secretKey32Ascii, "ascii");
+  if (![16, 24, 32].includes(key.length)) {
+    throw new Error(`AX_FP_KEY invalid length: got ${key.length} bytes. Expected 16/24/32 ASCII chars.`);
+  }
+  const iv = Buffer.alloc(16, 0);
+  const pt = Buffer.from(buildFingerprintPlain(dev), "utf8");
+  const padded = pkcs7Pad2(pt, 16);
+  const cipher = crypto4.createCipheriv(key.length === 16 ? "aes-128-cbc" : key.length === 24 ? "aes-192-cbc" : "aes-256-cbc", key, iv);
+  cipher.setAutoPadding(false);
+  const ct = Buffer.concat([cipher.update(padded), cipher.final()]);
+  return ct.toString("base64");
+}
+function generateAxFp(params) {
+  const dev = {
+    manufacturer: "samsung" + String(randint(1000, 9999)),
+    model: "SM-N93" + String(randint(1000, 9999)),
+    lang: "en",
+    resolution: "720x1540",
+    tz_short: "GMT07:00",
+    ip: params?.ip ?? "192.169.69.69",
+    font_scale: 1,
+    android_release: "13",
+    msisdn: params?.msisdn ?? "6281398370564"
+  };
+  const fp = axFingerprint(dev, AX_FP_KEY);
+  return fp;
+}
+function getAxDeviceId(axFp) {
+  if (!axFp || !axFp.trim())
+    throw new Error("AX_FP is empty");
+  return crypto4.createHash("md5").update(axFp, "utf8").digest("hex");
+}
+
+// src/index.ts
+init_encrypt();
+
+// src/family.ts
+init_utils();
+var exports_family = {};
+__export(exports_family, {
+  getFamilySafe: () => getFamilySafe,
+  getFamily: () => getFamily
+});
+async function getFamily(idToken, familyCode, isEnterprise, migrationType) {
+  let isEnterpriseList = [false, true];
+  let migrationTypeList = [
+    "NONE",
+    "PRE_TO_PRIOH",
+    "PRIOH_TO_PRIO",
+    "PRIO_TO_PRIOH"
+  ];
+  if (typeof isEnterprise !== "undefined") {
+    isEnterpriseList = [isEnterprise];
+  }
+  if (typeof migrationType !== "undefined") {
+    migrationTypeList = [migrationType];
+  }
+  const path = "api/v8/xl-stores/options/list";
+  const comboList = [];
+  for (const mt of migrationTypeList) {
+    for (const ie of isEnterpriseList) {
+      comboList.push({ ie, mt });
+    }
+  }
+  const requests = comboList.map(({ ie, mt }) => {
+    const payloadDict = {
+      is_show_tagging_tab: true,
+      is_dedicated_event: true,
+      is_transaction_routine: false,
+      migration_type: mt,
+      package_family_code: familyCode,
+      is_autobuy: false,
+      is_enterprise: ie,
+      is_pdlp: true,
+      referral_code: "",
+      is_migration: false,
+      lang: "en"
+    };
+    return sendApiRequest(path, payloadDict, idToken, "POST").then((res) => ({
+      res,
+      ie,
+      mt
+    })).catch((e) => {
+      return { res: null, ie, mt, error: e };
+    });
+  });
+  const results = await Promise.all(requests);
+  for (const { res, ie, mt } of results) {
+    if (res && res["status"] === "SUCCESS") {
+      const familyName = res.data?.package_family?.name ?? "";
+      if (familyName !== "") {
+        console.log(`Success with is_enterprise=${ie}, migration_type=${mt}. Family name: ${familyName}`);
+        return res.data;
+      }
+    }
+  }
+  return null;
+}
+async function getFamilySafe(idToken, familyCode, isEnterprise, migrationType) {
+  let isEnterpriseList = [false, true];
+  let migrationTypeList = [
+    "NONE",
+    "PRE_TO_PRIOH",
+    "PRIOH_TO_PRIO",
+    "PRIO_TO_PRIOH"
+  ];
+  if (typeof isEnterprise !== "undefined") {
+    isEnterpriseList = [isEnterprise];
+  }
+  if (typeof migrationType !== "undefined") {
+    migrationTypeList = [migrationType];
+  }
+  const path = "api/v8/xl-stores/options/list";
+  let familyData = null;
+  for (const mt of migrationTypeList) {
+    if (familyData !== null)
+      break;
+    for (const ie of isEnterpriseList) {
+      if (familyData !== null)
+        break;
+      const payloadDict = {
+        is_show_tagging_tab: true,
+        is_dedicated_event: true,
+        is_transaction_routine: false,
+        migration_type: mt,
+        package_family_code: familyCode,
+        is_autobuy: false,
+        is_enterprise: ie,
+        is_pdlp: true,
+        referral_code: "",
+        is_migration: false,
+        lang: "en"
+      };
+      try {
+        const res = await sendApiRequest(path, payloadDict, idToken, "POST");
+        if (!res || res["status"] !== "SUCCESS") {
+          continue;
+        }
+        const familyName = res.data?.package_family?.name ?? "";
+        if (familyName !== "") {
+          familyData = res.data;
+          console.log(`Success with is_enterprise=${ie}, migration_type=${mt}. Family name: ${familyName}`);
+        }
+      } catch (e) {
+        continue;
+      }
+    }
+  }
+  return familyData;
+}
+// src/family-plan.ts
+init_utils();
+var exports_family_plan = {};
+__export(exports_family_plan, {
+  validateMsisdn: () => validateMsisdn,
+  setQuotaLimit: () => setQuotaLimit,
+  removeMember: () => removeMember,
+  getFamilyData: () => getFamilyData,
+  changeMember: () => changeMember
+});
+async function getFamilyData(idToken) {
+  const path = "sharings/api/v8/family-plan/member-info";
+  const payload = {
+    group_id: 0,
+    is_enterprise: false,
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+async function validateMsisdn(idToken, msisdn) {
+  const path = "api/v8/auth/validate-msisdn";
+  const payload = {
+    with_bizon: true,
+    with_family_plan: true,
+    is_enterprise: false,
+    with_optimus: true,
+    lang: "en",
+    msisdn,
+    with_regist_status: true,
+    with_enterprise: true
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+async function changeMember(idToken, parentAlias, alias, slotId, familyMemberId, newMsisdn) {
+  const path = "sharings/api/v8/family-plan/change-member";
+  const payload = {
+    parent_alias: parentAlias,
+    is_enterprise: false,
+    slot_id: slotId,
+    alias,
+    lang: "en",
+    msisdn: newMsisdn,
+    family_member_id: familyMemberId
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+async function removeMember(idToken, familyMemberId) {
+  const path = "sharings/api/v8/family-plan/remove-member";
+  const payload = {
+    is_enterprise: false,
+    family_member_id: familyMemberId,
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+async function setQuotaLimit(idToken, originalAllocation, newAllocation, familyMemberId) {
+  const path = "sharings/api/v8/family-plan/allocate-quota";
+  const payload = {
+    is_enterprise: false,
+    member_allocations: [{
+      new_text_allocation: 0,
+      original_text_allocation: 0,
+      original_voice_allocation: 0,
+      original_allocation: originalAllocation,
+      new_voice_allocation: 0,
+      message: "",
+      new_allocation: newAllocation,
+      family_member_id: familyMemberId,
+      status: ""
+    }],
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+// src/notification.ts
+init_utils();
+var exports_notification = {};
+__export(exports_notification, {
+  getNotifications: () => getNotifications,
+  getNotificationDetail: () => getNotificationDetail
+});
+async function getNotifications(idToken) {
+  const path = "api/v8/notification-non-grouping";
+  const payload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+async function getNotificationDetail(idToken, notificationId) {
+  const path = "api/v8/notification/detail";
+  const payload = {
+    is_enterprise: false,
+    lang: "en",
+    notification_id: notificationId
+  };
+  return sendApiRequest(path, payload, idToken, "POST");
+}
+// src/package.ts
+var exports_package = {};
+__export(exports_package, {
+  getPackageByOrderId: () => getPackageByOrderId,
+  getPackage: () => getPackage,
+  getAddons: () => getAddons
+});
+init_utils();
+async function getPackage({
+  idToken,
+  packageOptionCode,
+  packageFamilyCode = "",
+  packageVariantCode = ""
+}) {
+  const path = "api/v8/xl-stores/options/detail";
+  const payload = {
+    is_transaction_routine: false,
+    migration_type: "NONE",
+    package_family_code: packageFamilyCode,
+    family_role_hub: "",
+    is_autobuy: false,
+    is_enterprise: false,
+    is_shareable: false,
+    is_migration: false,
+    lang: "en",
+    package_option_code: packageOptionCode,
+    is_upsell_pdp: false,
+    package_variant_code: packageVariantCode
+  };
+  console.log("Fetching package...");
+  const response = await sendApiRequest(path, payload, idToken, "POST");
+  return response.data;
+}
+async function getPackageByOrderId({
+  idToken,
+  packageFamilyCode,
+  packageVariantCode,
+  order,
+  isEnterprise,
+  migrationType
+}) {
+  const xpackages = await getFamily(idToken, packageFamilyCode, isEnterprise, migrationType);
+  if (!xpackages) {
+    throw new Error("Data tidak ditemukan untuk family code yang diberikan.");
+  }
+  const findVariant = xpackages.package_variants.find((v) => v.package_variant_code === packageVariantCode);
+  if (!findVariant) {
+    throw new Error(`Package variant with code ${packageVariantCode} not found in family ${packageFamilyCode}`);
+  }
+  const findPackageOption = findVariant.package_options.find((x) => x.order === order);
+  if (!findPackageOption) {
+    throw new Error(`Package option with order ${order} not found in variant ${findVariant.package_variant_code}`);
+  }
+  const data = await getPackage({
+    idToken,
+    packageOptionCode: findPackageOption.package_option_code
+  });
+  data.package_option.package_option_code = findPackageOption.package_option_code;
+  return data;
+}
+async function getAddons({
+  idToken,
+  packageOptionCode
+}) {
+  const path = "api/v8/xl-stores/options/addons-pinky-box";
+  const rawPayload = {
+    is_enterprise: false,
+    lang: "en",
+    package_option_code: packageOptionCode
+  };
+  console.log("Fetching addons...");
+  const res = await sendApiRequest(path, rawPayload, idToken, "POST");
+  if (!("data" in res)) {
+    console.log("Error getting addons:", res.error ?? "Unknown error");
+    return null;
+  }
+  return res.data;
+}
+// src/payments/index.ts
+var exports_payments = {};
+__export(exports_payments, {
+  settlementQris: () => settlementQris,
+  settlementEWallet: () => settlementEWallet,
+  settlementBalance: () => settlementBalance,
+  EWalletProviderEnum: () => EWalletProviderEnum
+});
+
+// src/payments/balance.ts
+init_encrypt();
+init_utils();
+init_config();
+import axios4 from "axios";
+import { v4 as uuidv44 } from "uuid";
+import { DateTime as DateTime4 } from "luxon";
+async function settlementBalance({
+  idToken,
+  accessToken,
+  item,
+  items,
+  paymentFor,
+  tokenConfirmation,
+  topup_number = "",
+  stage_token = "",
+  overwriteAmount = null,
+  paymentTargetsMethodsOption
+}) {
+  const payment_targets = items.map((item2) => item2.item_code).join(";");
+  const [paymentRes, encryptedFields] = await Promise.all([
+    sendApiRequest("payments/api/v8/payment-methods-option", {
+      payment_type: "PURCHASE",
+      is_enterprise: false,
+      payment_target: paymentTargetsMethodsOption ?? item.item_code,
+      lang: "en",
+      is_referral: false,
+      token_confirmation: tokenConfirmation
+    }, idToken, "POST"),
+    Promise.all([
+      buildEncryptedField(null, true),
+      buildEncryptedField(null, true)
+    ])
+  ]);
+  const { token_payment, timestamp } = paymentRes.data;
+  const price = overwriteAmount === 0 ? 0 : item.item_price;
+  const [encrypted_payment_token, encrypted_authentication_id] = encryptedFields;
+  const settlementPath = "payments/api/v8/settlement-multipayment";
+  const sigInput = {
+    accessToken,
+    timestamp,
+    itemCode: item.item_code,
+    token_payment,
+    payment_method: "BALANCE",
+    paymentFor,
+    settlementPath
+  };
+  const settlementPayload = {
+    total_discount: 0,
+    is_enterprise: false,
+    payment_token: "",
+    token_payment,
+    activated_autobuy_code: "",
+    cc_payment_type: "",
+    is_myxl_wallet: false,
+    pin: "",
+    ewallet_promo_id: "",
+    members: [],
+    total_fee: 0,
+    fingerprint: "",
+    autobuy_threshold_setting: { label: "", type: "", value: 0 },
+    is_use_point: false,
+    lang: "en",
+    payment_method: "BALANCE",
+    timestamp,
+    points_gained: 0,
+    can_trigger_rating: false,
+    akrab_members: [],
+    akrab_parent_alias: "",
+    referral_unique_code: "",
+    coupon: "",
+    payment_for: paymentFor,
+    with_upsell: false,
+    topup_number,
+    stage_token,
+    authentication_id: "",
+    encrypted_payment_token,
+    token: "",
+    token_confirmation: "",
+    access_token: accessToken,
+    wallet_number: "",
+    encrypted_authentication_id,
+    additional_data: {
+      original_price: item.item_price,
+      is_spend_limit_temporary: false,
+      migration_type: "",
+      akrab_m2m_group_id: "false",
+      spend_limit_amount: 0,
+      is_spend_limit: false,
+      mission_id: "",
+      tax: 0,
+      quota_bonus: 0,
+      cashtag: "",
+      is_family_plan: false,
+      combo_details: [],
+      is_switch_plan: false,
+      discount_recurring: 0,
+      is_akrab_m2m: false,
+      balance_type: "PREPAID_BALANCE",
+      has_bonus: false,
+      discount_promo: 0
+    },
+    total_amount: price,
+    is_using_autobuy: false,
+    items
+  };
+  const [encrypted, xSig] = await Promise.all([
+    encryptSignXData("POST", settlementPath, idToken, settlementPayload),
+    makeXSignaturePayment(accessToken, timestamp, payment_targets, token_payment, "BALANCE", paymentFor, settlementPath)
+  ]);
+  const xtimeRaw = encrypted.encrypted_body?.xtime;
+  const sigTimeSec = Math.floor(Number(xtimeRaw) / 1000);
+  const apiHost = BASE_API_URL.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  const headers = {
+    host: apiHost,
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": xSig,
+    "x-request-id": uuidv44(),
+    "x-request-at": javaLikeTimestamp(DateTime4.fromSeconds(sigTimeSec, { zone: "utc" }).setZone("local")),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL.replace(/\/$/, "")}/${settlementPath}`;
+  const resp = await axios4.post(url, encrypted.encrypted_body, { headers, timeout: 30000 });
+  const { xdata, xtime } = resp.data;
+  const decryptedXData = await decryptXData2(xdata, xtime);
+  return decryptedXData;
+}
+// src/payments/ewallet.ts
+init_encrypt();
+init_utils();
+init_config();
+import axios5 from "axios";
+import { v4 as uuidv45 } from "uuid";
+import { DateTime as DateTime5 } from "luxon";
+var EWalletProviderEnum;
+((EWalletProviderEnum2) => {
+  EWalletProviderEnum2["DANA"] = "DANA";
+  EWalletProviderEnum2["ShopeePay"] = "SHOPEEPAY";
+  EWalletProviderEnum2["GoPay"] = "GOPAY";
+  EWalletProviderEnum2["OVO"] = "OVO";
+})(EWalletProviderEnum ||= {});
+async function settlementEWallet({
+  idToken,
+  accessToken,
+  item,
+  items,
+  paymentFor,
+  tokenConfirmation,
+  topup_number = "",
+  walletNumber = "",
+  stage_token = "",
+  overwriteAmount = null,
+  paymentTargetsMethodsOption,
+  paymentMethod
+}) {
+  const payment_targets = items.map((item2) => item2.item_code).join(";");
+  await interceptPage(idToken, item.item_code, false);
+  const paymentRes = await sendApiRequest("payments/api/v8/payment-methods-option", {
+    payment_type: "PURCHASE",
+    is_enterprise: false,
+    payment_target: paymentTargetsMethodsOption ?? item.item_code,
+    lang: "en",
+    is_referral: false,
+    token_confirmation: tokenConfirmation
+  }, idToken, "POST");
+  const { token_payment, timestamp } = paymentRes.data;
+  const price = overwriteAmount === 0 ? 0 : item.item_price;
+  const settlementPath = "payments/api/v8/settlement-multipayment/ewallet";
+  const settlementPayload = {
+    akrab: {
+      akrab_members: [],
+      akrab_parent_alias: "",
+      members: []
+    },
+    can_trigger_rating: false,
+    total_discount: 0,
+    coupon: "",
+    payment_for: paymentFor,
+    topup_number,
+    stage_token,
+    is_enterprise: false,
+    autobuy: {
+      is_using_autobuy: false,
+      activated_autobuy_code: "",
+      autobuy_threshold_setting: {
+        label: "",
+        type: "",
+        value: 0
+      }
+    },
+    access_token: accessToken,
+    is_myxl_wallet: false,
+    wallet_number: walletNumber,
+    additional_data: {},
+    total_amount: price,
+    total_fee: 0,
+    is_use_point: false,
+    lang: "en",
+    items,
+    verification_token: token_payment,
+    payment_method: paymentMethod,
+    timestamp
+  };
+  const encrypted = await encryptSignXData("POST", settlementPath, idToken, settlementPayload);
+  const xtimeRaw = encrypted.encrypted_body?.xtime;
+  const sigTimeSec = Math.floor((typeof xtimeRaw === "string" ? parseInt(xtimeRaw) : Number(xtimeRaw)) / 1000);
+  const xSig = await makeXSignaturePayment(accessToken, timestamp, payment_targets, token_payment, paymentMethod, paymentFor, settlementPath);
+  const headers = {
+    host: BASE_API_URL.replace("https://", ""),
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": xSig,
+    "x-request-id": uuidv45(),
+    "x-request-at": javaLikeTimestamp(DateTime5.fromSeconds(sigTimeSec, { zone: "utc" }).setZone("local")),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL}/${settlementPath}`;
+  const resp = await axios5.post(url, encrypted.encrypted_body, { headers, timeout: 30000 });
+  const decryptedXData = await decryptXData2(resp.data.xdata, resp.data.xtime);
+  return decryptedXData;
+}
+// src/payments/qris.ts
+init_encrypt();
+init_utils();
+init_config();
+import axios6 from "axios";
+import { v4 as uuidv46 } from "uuid";
+import { DateTime as DateTime6 } from "luxon";
+async function settlementQris({
+  idToken,
+  accessToken,
+  item,
+  items,
+  paymentFor,
+  tokenConfirmation,
+  topup_number = "",
+  stage_token = "",
+  overwriteAmount = null,
+  paymentTargetsMethodsOption
+}) {
+  const payment_targets = items.map((item2) => item2.item_code).join(";");
+  await interceptPage(idToken, item.item_code, false);
+  const paymentRes = await sendApiRequest("payments/api/v8/payment-methods-option", {
+    payment_type: "PURCHASE",
+    is_enterprise: false,
+    payment_target: paymentTargetsMethodsOption ?? item.item_code,
+    lang: "en",
+    is_referral: false,
+    token_confirmation: tokenConfirmation
+  }, idToken, "POST");
+  const { token_payment, timestamp } = paymentRes.data;
+  const price = overwriteAmount === 0 ? 0 : item.item_price;
+  const settlementPath = "payments/api/v8/settlement-multipayment/qris";
+  const settlementPayload = {
+    akrab: {
+      akrab_members: [],
+      akrab_parent_alias: "",
+      members: []
+    },
+    can_trigger_rating: false,
+    total_discount: 0,
+    coupon: "",
+    payment_for: paymentFor,
+    topup_number,
+    stage_token,
+    is_enterprise: false,
+    autobuy: {
+      is_using_autobuy: false,
+      activated_autobuy_code: "",
+      autobuy_threshold_setting: {
+        label: "",
+        type: "",
+        value: 0
+      }
+    },
+    access_token: accessToken,
+    is_myxl_wallet: false,
+    additional_data: {
+      original_price: item.item_price,
+      is_spend_limit_temporary: false,
+      migration_type: "",
+      spend_limit_amount: 0,
+      is_spend_limit: false,
+      tax: 0,
+      benefit_type: "",
+      quota_bonus: 0,
+      cashtag: "",
+      is_family_plan: false,
+      combo_details: [],
+      is_switch_plan: false,
+      discount_recurring: 0,
+      has_bonus: false,
+      discount_promo: 0
+    },
+    total_amount: price,
+    total_fee: 0,
+    is_use_point: false,
+    lang: "en",
+    items,
+    verification_token: token_payment,
+    payment_method: "QRIS",
+    timestamp
+  };
+  const encrypted = await encryptSignXData("POST", settlementPath, idToken, settlementPayload);
+  const xtimeRaw = encrypted.encrypted_body?.xtime;
+  const sigTimeSec = Math.floor((typeof xtimeRaw === "string" ? parseInt(xtimeRaw) : Number(xtimeRaw)) / 1000);
+  const xSig = await makeXSignaturePayment(accessToken, timestamp, payment_targets, token_payment, "QRIS", paymentFor, settlementPath);
+  const headers = {
+    host: BASE_API_URL.replace("https://", ""),
+    "content-type": "application/json; charset=utf-8",
+    "user-agent": UA,
+    "x-api-key": API_KEY,
+    authorization: `Bearer ${idToken}`,
+    "x-hv": "v3",
+    "x-signature-time": String(sigTimeSec),
+    "x-signature": xSig,
+    "x-request-id": uuidv46(),
+    "x-request-at": javaLikeTimestamp(DateTime6.fromSeconds(sigTimeSec, { zone: "utc" }).setZone("local")),
+    "x-version-app": X_APP_VERSION
+  };
+  const url = `${BASE_API_URL}/${settlementPath}`;
+  const resp = await axios6.post(url, encrypted.encrypted_body, { headers, timeout: 30000 });
+  const decryptedXData = await decryptXData2(resp.data.xdata, resp.data.xtime);
+  return decryptedXData;
+}
+// src/profile.ts
+init_utils();
+var exports_profile = {};
+__export(exports_profile, {
+  getPendingTransaction: () => getPendingTransaction
+});
+async function getPendingTransaction(idToken) {
+  const path = "api/v8/profile";
+  const payload = {
+    is_enterprise: false,
+    lang: "en"
+  };
+  const res = await sendApiRequest(path, payload, idToken, "POST");
+  return res.data;
+}
+// src/@types/payment.ts
+var exports_payment = {};
+__export(exports_payment, {
+  PaymentMethodEnum: () => PaymentMethodEnum
+});
+var PaymentMethodEnum;
+((PaymentMethodEnum2) => {
+  PaymentMethodEnum2["Pulsa"] = "BALANCE";
+  PaymentMethodEnum2["EWallet"] = "EWALLET";
+  PaymentMethodEnum2["QRIS"] = "QRIS";
+  PaymentMethodEnum2["PulsaDecoy"] = "BALANCE_DECOY";
+  PaymentMethodEnum2["PulsaDecoyV2"] = "BALANCE_DECOY_V2";
+  PaymentMethodEnum2["QRISDecoy"] = "QRIS_DECOY";
+  PaymentMethodEnum2["QRISDecoyV2"] = "QRIS_DECOY_V2";
+  PaymentMethodEnum2["PulsaN"] = "BALANCE_N";
+})(PaymentMethodEnum ||= {});
+
+// src/index.ts
+init_utils();
+
+// src/verification.ts
+init_utils();
+var exports_verification = {};
+__export(exports_verification, {
+  validatePuk: () => validatePuk,
+  checkDukcapil: () => checkDukcapil
+});
+async function validatePuk(msisdn, puk) {
+  const path = "api/v8/infos/validate-puk";
+  const payload = {
+    is_enterprise: false,
+    puk,
+    is_enc: false,
+    msisdn,
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, "", "POST");
+}
+async function checkDukcapil(msisdn, kk, nik) {
+  const path = "api/v8/auth/regist/dukcapil";
+  const payload = {
+    msisdn,
+    kk,
+    nik,
+    lang: "en"
+  };
+  return sendApiRequest(path, payload, "", "POST");
+}
+
+// src/index.ts
+init_encrypt_helper();
+
+// src/lib/payment.ts
+init_utils();
+var exports_payment2 = {};
+__export(exports_payment2, {
+  getTransactionDetail: () => getTransactionDetail
+});
+async function getTransactionDetail({
+  idToken,
+  transactionId
+}) {
+  const path = "payments/api/v8/pending-detail";
+  const payload = {
+    transaction_id: transactionId,
+    is_enterprise: false,
+    lang: "en",
+    status: ""
+  };
+  const res = await sendApiRequest(path, payload, idToken, "POST");
+  return res.data;
+}
+// src/lib/decoy.ts
+var exports_decoy = {};
+__export(exports_decoy, {
+  getDecoyName: () => getDecoyName,
+  getDecoyData: () => getDecoyData,
+  decoyIsExits: () => decoyIsExits
+});
+// src/data/decoys/decoy-default-balance.json
+var decoy_default_balance_default = {
+  family_name: "XL PASS",
+  family_code: "b0a20d74-0c54-4e3b-8f3f-01e7482e50bf",
+  is_enterprise: true,
+  migration_type: "NONE",
+  variant_code: "719d093f-6f8d-46a4-8390-6a0003a172ea",
+  option_name: "XL PASS 30 days",
+  order: 1,
+  price: 889750
+};
+// src/data/decoys/decoy-default-qris.json
+var decoy_default_qris_default = {
+  family_name: "",
+  family_code: "580c1f94-7dc4-416e-96f6-8faf26567516",
+  is_enterprise: false,
+  migration_type: "NONE",
+  variant_code: "b50f954a-696e-46d0-8700-8e4d38521525",
+  option_name: "",
+  order: 27,
+  price: 1000
+};
+// src/data/decoys/decoy-default-qris0.json
+var decoy_default_qris0_default = {
+  family_name: "Kuota Aplikasi BIZ 2GB",
+  family_code: "c6f2cd72-8b21-420a-b8d5-e0186afe5be6",
+  is_enterprise: true,
+  migration_type: "NONE",
+  variant_code: "b7cf278e-c989-4760-8a26-0a20c1a47a40",
+  option_name: "Vidio 2GB",
+  order: 11,
+  price: 0
+};
+// src/data/decoys/decoy-prio-balance.json
+var decoy_prio_balance_default = {
+  family_name: "PRIO PASS",
+  family_code: "2512b72a-a3cd-4c70-a736-132cf2c1f0c0",
+  is_enterprise: null,
+  migration_type: null,
+  variant_code: "cff298bd-8ec8-4696-b689-12407d36be15",
+  option_name: "PRIO PASS 30 days",
+  order: 1,
+  price: 999000
+};
+// src/data/decoys/decoy-prio-qris.json
+var decoy_prio_qris_default = {
+  family_name: "Conference",
+  family_code: "5dab52d5-6f02-4678-b72f-088396ceb113",
+  is_enterprise: true,
+  migration_type: "PRIOH_TO_PRIO",
+  variant_code: "bf84ad5b-87e9-4769-9bd2-2359535c05e4",
+  option_name: "Conference 2GB",
+  order: 1,
+  price: 2000
+};
+// src/data/decoys/decoy-prio-qris0.json
+var decoy_prio_qris0_default = {
+  family_name: "Conference",
+  family_code: "5dab52d5-6f02-4678-b72f-088396ceb113",
+  is_enterprise: true,
+  migration_type: "PRIOH_TO_PRIO",
+  variant_code: "bf84ad5b-87e9-4769-9bd2-2359535c05e4",
+  option_name: "Conference 2GB",
+  order: 1,
+  price: 2000
+};
+
+// src/lib/decoy.ts
+var needPrioDecoys = ["PRIORITAS", "PRIOHYBRID", "GO"];
+var getDecoyName = (paymentMethod) => {
+  switch (paymentMethod) {
+    case "BALANCE_DECOY" /* PulsaDecoy */:
+      return "balance";
+    case "BALANCE_DECOY_V2" /* PulsaDecoyV2 */:
+      return "balance";
+    case "QRIS_DECOY" /* QRISDecoy */:
+      return "qris";
+    case "QRIS_DECOY_V2" /* QRISDecoyV2 */:
+      return "qris0";
+    default:
+      return "balance";
+  }
+};
+var decoyIsExits = (paymentMethod) => {
+  return [
+    "BALANCE_DECOY" /* PulsaDecoy */,
+    "BALANCE_DECOY_V2" /* PulsaDecoyV2 */,
+    "QRIS_DECOY" /* QRISDecoy */,
+    "QRIS_DECOY_V2" /* QRISDecoyV2 */
+  ].includes(paymentMethod);
+};
+var decoyMap = {
+  prio: {
+    balance: decoy_prio_balance_default,
+    qris: decoy_prio_qris_default,
+    qris0: decoy_prio_qris0_default
+  },
+  default: {
+    balance: decoy_default_balance_default,
+    qris: decoy_default_qris_default,
+    qris0: decoy_default_qris0_default
+  }
+};
+var getDecoyData = ({
+  subscriptionType,
+  decoy
+}) => {
+  const isPrio = needPrioDecoys.includes(subscriptionType);
+  const group = isPrio ? "prio" : "default";
+  return decoyMap[group][decoy];
+};
+// src/payments/decoy.ts
+var exports_decoy2 = {};
+__export(exports_decoy2, {
+  default: () => decoy_default
+});
+var decoy_default = undefined;
+export {
+  exports_verification as Verification,
+  exports_utils as Utils,
+  exports_payment as Types,
+  exports_profile as Profile,
+  exports_decoy2 as PaymentsDecoy,
+  exports_payments as Payments,
+  exports_payment2 as Payment,
+  exports_package as Package,
+  exports_notification as Notification,
+  exports_family_plan as FamilyPlan,
+  exports_family as Family,
+  exports_encrypt_helper as EncryptHelper,
+  exports_encrypt as Encrypt,
+  exports_device as Device,
+  exports_decoy as Decoy,
+  exports_config as Config,
+  exports_client as Client,
+  exports_ciam as Ciam,
+  exports_auth as Auth
+};