[akrindev]

Summary

This PR adds and hardens gateway payment support for Duitku and DOKU, while keeping the SDK's local QRIS transformation flow unchanged.

Main changes:

• Add DOKU SNAP QRIS MPM adapter support for QR generation, status query, and webhook parsing.
• Update Duitku integration to use Direct API /v2/inquiry with HMAC-SHA256 signatures.
• Harden webhook verification for Duitku and DOKU:
  • strict invalid-signature behavior by default
  • safe { throwOnInvalid: false } fallback
  • DOKU raw body support
  • DOKU timestamp replay-window validation
  • Duitku merchantCode validation
• Improve provider error handling by sanitizing exposed error messages while preserving raw provider data in cause.
• Add gateway verification options through gateway.verify().
• Align bilingual README/docs and update gateway references for Duitku/DOKU.

Security Notes

• DOKU X-EXTERNAL-ID now uses cryptographically secure random bytes.
• DOKU webhook verification supports raw request bodies to avoid signature mismatches from JSON reserialization.
• DOKU webhook timestamps are rejected outside the configured skew window, defaulting to 5 minutes.
• Duitku webhook verification validates both signature and merchant code.
• Invalid Duitku/DOKU webhooks throw by default to avoid accidentally trusting fake normalized payment status.

Docs

• Normalize Indonesian/English language switches.
• Keep README.md as Indonesian and README.en.md as English.
• Keep docs/ as Indonesian docs and docs/en/ as English mirror.
• Update Duitku docs from old MD5/createInvoice references to Direct API HMAC-SHA256.
• Add DOKU gateway/webhook docs.

Testing

• bun run typecheck
• bun test tests/providers/adapters/webhook.test.ts
• git diff --check
• Project markdown link sanity check passed for README/docs/examples.