neplextech/payments-sdk/payments-sdk-maintainer

Payments SDK Maintainer

Maintain the payments-sdk repository as a typed, provider-independent monorepo. Use the repository plan as the acceptance contract and preserve package ownership boundaries.

Canonical references

• Repository: https://github.com/neplextech/payments-sdk
• Documentation: https://payments.neplex.dev
• Agent index: https://payments.neplex.dev/llms.txt
• Full agent documentation: https://payments.neplex.dev/llms-full.txt
• Source docs: apps/docs/content/docs
• Plan and decisions: docs/scratchpad/PLAN.md

Read the relevant source docs and LLM endpoint before making assumptions about public APIs. Treat package source and tests as authoritative when docs and generated output differ.

Package map

• packages/core: @payments-sdk/core, provider protocol and shared

types.

• packages/sdk: @payments-sdk/payments, configured runtime and

orchestration.

• packages/esewa: @payments-sdk/esewa.
• packages/fonepay: @payments-sdk/fonepay.
• packages/khalti: @payments-sdk/khalti.
• apps/docs: public documentation site.
• apps/integration-tests: cross-package examples and tests.

The GitHub repository slug and local directory packages/sdk remain payments-sdk; the publishable runtime package name is @payments-sdk/payments.

Validation workflow

1. Inspect git status and preserve unrelated uncommitted work. Read

the current plan section before editing.

1. Install deterministically:

pnpm install --frozen-lockfile

1. Run the full checks:

pnpm run format:check
pnpm run lint
pnpm run build
pnpm run typecheck
pnpm run test
pnpm --filter @payments-sdk/docs run build

1. Inspect every publishable package with the same packer used by

release:

pnpm --dir packages/core pack --pack-destination /tmp/payments-sdk-pack
pnpm --dir packages/esewa pack --pack-destination /tmp/payments-sdk-pack
pnpm --dir packages/fonepay pack --pack-destination /tmp/payments-sdk-pack
pnpm --dir packages/khalti pack --pack-destination /tmp/payments-sdk-pack
pnpm --dir packages/sdk pack --pack-destination /tmp/payments-sdk-pack

Confirm packed metadata rewrites workspace dependencies to concrete versions and contains only intended README, LICENSE, package metadata, declarations, maps, and dist output. Reject tests, fixtures, secrets, source files, and internal configuration.

The release workflow uses pnpm pack. npm pack is useful for a dry-run file listing but does not rewrite workspace protocol dependencies.

Architectural checks

• Provider compiled JavaScript must not runtime-import

@payments-sdk/core; core is a type-only provider development dependency.

• @payments-sdk/payments must not import, register, or mention

concrete provider IDs in shipped output.

• Adding a structural fake provider must require no runtime source

change in packages/sdk.

• Providers own gateway requests and signatures; the runtime owns

orchestration and validation.

• Applications own HTTP routes, persistence, idempotency, settlement,

retries, and fulfillment.

• Keep credentials server-side and never add real secrets or gateway

payloads to fixtures.

Release workflow

Review .github/workflows/release.yml and .github/RELEASING.md together. The workflow checks each exact npm package version: HTTP 200 skips an already-published version, HTTP 404 publishes it, and any other registry response fails. Do not bypass trusted publishing or add a token-based fallback.

Do not push, publish, tag, or create a release unless the user explicitly authorizes it. Report the exact verification boundary and leave unrelated work untouched.