@prakashacharya/vendure-plugin-nepal-payments 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Planned
+
+- End-to-end tests against provider sandboxes and a real Vendure test server
+- Fonepay dynamic QR support after official merchant API documentation is available
+- Channel-specific provider credentials
+- Admin Dashboard payment-attempt and reconciliation views
+
+## [0.1.0] - 2026-07-13
+
+### Added
+
+- Vendure 3.7 plugin package with MIT licensing
+- Khalti KPG-2 payment initiation, lookup verification, and wallet refunds, with bank-refund limitations documented
+- eSewa ePay v2 signed form generation, callback validation, and status verification
+- Persistent and idempotent payment-attempt records
+- Authenticated settlement proofs bound to a Vendure order
+- GET and POST provider callback routes
+- Scheduled reconciliation for pending payments
+- NPR-safe integer amount conversion
+- Storefront GraphQL API and integration documentation
+- Unit tests for configuration, signing, amount conversion, Khalti, and eSewa
+
+[Unreleased]: https://github.com/pracharya2601/NPP/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/pracharya2601/NPP/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TIAT
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,9 @@
+# Notices
+
+This project is an independent community plugin and is not affiliated with, endorsed by, or sponsored by Vendure, Khalti by IME, eSewa, Fonepay, or Nepal Rastra Bank.
+
+Vendure is licensed separately under GPLv3. Vendure's official plugin-publishing documentation states that its plugin exception permits independently distributed plugins to use a different license. This plugin's own source code is distributed under the MIT License in [`LICENSE`](./LICENSE).
+
+Vendure, Khalti, IME Pay, eSewa, Fonepay, and other names or logos are trademarks of their respective owners. They are used only to identify interoperability targets.
+
+No payment-provider SDK source code, credentials, logos, or private merchant documentation are included in this package.

package/README.md

@@ -0,0 +1,223 @@
+# Vendure Nepal Payments
+
+[![CI](https://github.com/pracharya2601/NPP/actions/workflows/ci.yml/badge.svg)](https://github.com/pracharya2601/NPP/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
+
+An open-source Vendure 3.7 plugin for Nepalese payment providers, licensed under MIT. The initial release implements Khalti KPG-2 and eSewa ePay v2 behind a shared payment-attempt and provider interface. Fonepay is reserved in the API, but intentionally disabled until current official merchant documentation is available.
+
+> **Pre-release status:** the code is suitable for integration and sandbox testing, but version 0.1.0 has not yet been validated with real merchant sandbox credentials or published to npm. Do not process production payments until the production checklist and provider certification/onboarding steps are complete.
+
+## Documentation
+
+- [Install in an existing Vendure project](./docs/INSTALLATION.md)
+- [Configuration reference](./docs/CONFIGURATION.md)
+- [Storefront integration](./docs/STOREFRONT.md)
+- [Provider support](./docs/PROVIDERS.md)
+- [Architecture](./docs/ARCHITECTURE.md)
+- [Production checklist](./docs/PRODUCTION.md)
+- [Data handling and privacy](./docs/DATA_HANDLING.md)
+- [Troubleshooting](./docs/TROUBLESHOOTING.md)
+- [Complete documentation index](./docs/README.md)
+
+## What is implemented
+
+- Khalti server-side initiation, redirect, lookup verification, and wallet refund calls; some bank-funded refunds require manual provider handling
+- eSewa signed ePay form generation, signed callback validation, and status verification
+- Separate Vendure payment handlers: `nepal-khalti` and `nepal-esewa`
+- Persistent, idempotent `NepalPaymentAttempt` records
+- Signed internal settlement proofs that bind a provider transaction to its Vendure order
+- GET and POST callback routes
+- A worker-safe scheduled task that retries pending payments every five minutes
+- Integer-only NPR conversion and provider contract tests
+
+Only a server-to-server provider lookup can settle an order. Browser callback fields are never accepted as proof of payment.
+
+## Install
+
+This repository is currently the package itself. In a Vendure application, install the package and ensure Vendure's recommended `DefaultSchedulerPlugin` is enabled.
+
+```bash
+# Available after the first npm publication
+npm install @prakashacharya/vendure-plugin-nepal-payments
+```
+
+For installation from a local clone before publication, build an npm tarball and install it into the Vendure server project. See the [complete installation guide](./docs/INSTALLATION.md#1-install-the-package).
+
+Configure it in `vendure-config.ts`:
+
+```ts
+import { DefaultSchedulerPlugin, VendureConfig } from '@vendure/core';
+import { NepalPaymentsPlugin } from '@prakashacharya/vendure-plugin-nepal-payments';
+
+export const config: VendureConfig = {
+  // ...
+  plugins: [
+    DefaultSchedulerPlugin.init(),
+    NepalPaymentsPlugin.init({
+      publicServerUrl: process.env.PUBLIC_SERVER_URL!,
+      storefrontResultUrl: process.env.STOREFRONT_PAYMENT_RESULT_URL!,
+      internalSigningSecret: process.env.NEPAL_PAYMENTS_INTERNAL_SECRET!,
+      khalti: {
+        environment: process.env.KHALTI_ENVIRONMENT as 'sandbox' | 'production',
+        secretKey: process.env.KHALTI_SECRET_KEY!,
+        websiteUrl: process.env.KHALTI_WEBSITE_URL!,
+        paymentMethodCode: 'khalti',
+      },
+      esewa: {
+        environment: process.env.ESEWA_ENVIRONMENT as 'sandbox' | 'production',
+        productCode: process.env.ESEWA_PRODUCT_CODE!,
+        secretKey: process.env.ESEWA_SECRET_KEY!,
+        paymentMethodCode: 'esewa',
+      },
+      reconciliationSchedule: '*/5 * * * *',
+    }),
+  ],
+};
+```
+
+`publicServerUrl` must be the externally reachable Vendure origin. Production values must use HTTPS. Generate `internalSigningSecret` independently from gateway credentials, with at least 32 random characters.
+
+## Database migration
+
+The plugin adds the `NepalPaymentAttempt` entity. Generate and run a Vendure migration from the host application before deploying:
+
+```bash
+npx vendure migrate
+```
+
+Do not enable schema synchronization in production.
+
+## Create payment methods
+
+In the Vendure Dashboard, create and assign these payment methods to the NPR channel:
+
+| Payment method code | Handler |
+| --- | --- |
+| `khalti` | `Khalti by IME` / `nepal-khalti` |
+| `esewa` | `eSewa` / `nepal-esewa` |
+
+If a different payment method code is used, set the matching `paymentMethodCode` in plugin configuration. Keep the methods unavailable outside NPR channels using channel assignment or an eligibility checker.
+
+## Storefront checkout
+
+First transition the active order to `ArrangingPayment`, then initiate a provider payment:
+
+```graphql
+mutation InitiateNepalPayment($provider: NepalPaymentProviderCode!) {
+  initiateNepalPayment(provider: $provider) {
+    attemptId
+    provider
+    status
+    redirectUrl
+    expiresAt
+    form {
+      action
+      fields { name value }
+    }
+  }
+}
+```
+
+For Khalti, redirect the browser to `redirectUrl`.
+
+For eSewa, submit the returned fields as an HTML POST without changing any value:
+
+```ts
+function submitProviderForm(form: { action: string; fields: Array<{ name: string; value: string }> }) {
+  const element = document.createElement('form');
+  element.method = 'POST';
+  element.action = form.action;
+  for (const field of form.fields) {
+    const input = document.createElement('input');
+    input.type = 'hidden';
+    input.name = field.name;
+    input.value = field.value;
+    element.appendChild(input);
+  }
+  document.body.appendChild(element);
+  element.submit();
+}
+```
+
+After the provider returns, the plugin redirects to `storefrontResultUrl` with `attemptId`, `provider`, and `status` query parameters. The storefront should then query the active order/order state from Vendure; it must not treat the redirect query string itself as proof of fulfillment.
+
+## Callback routes
+
+The plugin creates both GET and POST routes:
+
+```text
+/nepal-payments/callback/khalti/:attemptId
+/nepal-payments/callback/esewa/:attemptId
+```
+
+These URLs are generated automatically. They must be reachable from the public internet in production.
+
+## Payment lifecycle
+
+1. A UUID payment attempt is stored against the active Vendure order.
+2. The plugin creates a Khalti payment or signed eSewa form.
+3. The provider returns the customer to the callback route.
+4. The plugin claims the attempt atomically and calls the provider status endpoint.
+5. It verifies the exact amount and successful provider state.
+6. It generates a short-lived internal settlement proof bound to provider, attempt, order, amount, and provider reference.
+7. The Vendure payment handler verifies that proof and independently checks the provider again.
+8. Vendure creates a `Settled` payment and transitions the order normally.
+9. The scheduled reconciliation task repeats verification for delayed or interrupted callbacks.
+
+## Fonepay
+
+Fonepay dynamic QR requires merchant-specific onboarding documentation and credentials. The shared adapter boundary and GraphQL enum are present, but initiating `FONEPAY` currently fails explicitly. Do not implement signing or callback rules from unofficial copies of its API document. Add the provider only after obtaining:
+
+- sandbox and production base URLs
+- authentication and signing specification
+- dynamic QR request and response schema
+- transaction enquiry endpoint
+- refund capability
+- callback authentication or source requirements
+
+IME Pay is not implemented separately because it has merged into Khalti by IME.
+
+## Development
+
+```bash
+npm install
+npm run typecheck
+npm test
+npm run build
+```
+
+The unit tests mock provider HTTP requests and do not contact live gateways.
+
+## Compatibility
+
+| Component | Supported |
+| --- | --- |
+| Vendure | `>=3.7.0 <4.0.0` |
+| Node.js | 22 and 24 |
+| Currency | NPR |
+| Databases | Vendure-supported PostgreSQL, MySQL/MariaDB, and SQLite; end-to-end database tests are planned before 1.0 |
+
+## Contributing and support
+
+Contributions are welcome. Read [CONTRIBUTING.md](./CONTRIBUTING.md), the [Code of Conduct](./CODE_OF_CONDUCT.md), and [SECURITY.md](./SECURITY.md) before participating. General support expectations are in [SUPPORT.md](./SUPPORT.md), and planned work is tracked in [ROADMAP.md](./ROADMAP.md).
+
+Do not open public issues containing credentials, customer information, private merchant documents, or security vulnerabilities.
+
+## License
+
+The plugin's original code is available under the [MIT License](./LICENSE). Vendure's official plugin-publishing guide states that its GPLv3 plugin exception permits independently distributed plugins to use another license. See [licensing and trademark details](./docs/LICENSING.md) and [NOTICE.md](./NOTICE.md).
+
+This community project is not affiliated with or endorsed by Vendure or any payment provider.
+
+## Production checklist
+
+- Complete merchant onboarding separately with Khalti and eSewa.
+- Use distinct sandbox and production credentials.
+- Keep all secrets in a secret manager, not source control or Dashboard descriptions.
+- Run the generated database migration before enabling payment methods.
+- Run Vendure workers and `DefaultSchedulerPlugin` for reconciliation.
+- Test duplicate, delayed, cancelled, expired, altered-amount, pending, timeout, and refund flows.
+- Alert on attempts that remain pending or unknown beyond an agreed threshold.
+- Confirm provider refund rules and transaction limits in the signed merchant agreements.
+
+Official references: [Vendure payments](https://docs.vendure.io/current/core/core-concepts/payment), [publishing a Vendure plugin](https://docs.vendure.io/current/core/how-to/publish-plugin), [Khalti KPG-2](https://docs.khalti.com/khalti-epayment/), [Khalti refunds](https://docs.khalti.com/api/refund/), and [eSewa ePay](https://developer.esewa.com.np/pages/Epay).

package/dist/api/api-extensions.d.ts

@@ -0,0 +1 @@
+export declare const shopApiExtensions: import("graphql").DocumentNode;

package/dist/api/api-extensions.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shopApiExtensions = void 0;
+const graphql_tag_1 = require("graphql-tag");
+exports.shopApiExtensions = (0, graphql_tag_1.gql) `
+  enum NepalPaymentProviderCode {
+    KHALTI
+    ESEWA
+    FONEPAY
+  }
+
+  type NepalPaymentFormField {
+    name: String!
+    value: String!
+  }
+
+  type NepalPaymentForm {
+    action: String!
+    fields: [NepalPaymentFormField!]!
+  }
+
+  type NepalPaymentInitiation {
+    attemptId: ID!
+    provider: NepalPaymentProviderCode!
+    status: String!
+    redirectUrl: String
+    qrPayload: String
+    expiresAt: DateTime
+    form: NepalPaymentForm
+  }
+
+  extend type Mutation {
+    initiateNepalPayment(provider: NepalPaymentProviderCode!): NepalPaymentInitiation!
+  }
+`;
+//# sourceMappingURL=api-extensions.js.map

package/dist/api/api-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-extensions.js","sourceRoot":"","sources":["../../src/api/api-extensions.ts"],"names":[],"mappings":";;;AAAA,6CAAkC;AAErB,QAAA,iBAAiB,GAAG,IAAA,iBAAG,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BnC,CAAC"}

package/dist/api/payment-callback.controller.d.ts

@@ -0,0 +1,9 @@
+import type { Response } from 'express';
+import { PaymentOrchestratorService } from '../services/payment-orchestrator.service';
+export declare class PaymentCallbackController {
+    private readonly orchestrator;
+    constructor(orchestrator: PaymentOrchestratorService);
+    getCallback(provider: string, attemptId: string, query: Record<string, string | string[]>, response: Response): Promise<void>;
+    postCallback(provider: string, attemptId: string, body: Record<string, unknown>, response: Response): Promise<void>;
+    private handle;
+}

package/dist/api/payment-callback.controller.js

@@ -0,0 +1,83 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaymentCallbackController = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("../config");
+const payment_orchestrator_service_1 = require("../services/payment-orchestrator.service");
+const types_1 = require("../types");
+let PaymentCallbackController = class PaymentCallbackController {
+    constructor(orchestrator) {
+        this.orchestrator = orchestrator;
+    }
+    async getCallback(provider, attemptId, query, response) {
+        return this.handle(provider, attemptId, flatten(query), response);
+    }
+    async postCallback(provider, attemptId, body, response) {
+        return this.handle(provider, attemptId, body, response);
+    }
+    async handle(providerValue, attemptId, payload, response) {
+        const provider = providerValue.toLowerCase();
+        let status = 'error';
+        let message;
+        if (!types_1.NEPAL_PAYMENT_PROVIDERS.includes(provider)) {
+            message = 'Unsupported payment provider';
+        }
+        else {
+            try {
+                const attempt = await this.orchestrator.processCallback(provider, attemptId, payload);
+                status = attempt.status;
+            }
+            catch (error) {
+                message = 'Payment verification could not be completed';
+            }
+        }
+        const target = new URL((0, config_1.getPluginOptions)().storefrontResultUrl);
+        target.searchParams.set('attemptId', attemptId);
+        target.searchParams.set('provider', providerValue);
+        target.searchParams.set('status', status);
+        if (message)
+            target.searchParams.set('message', message.slice(0, 200));
+        return response.redirect(303, target.toString());
+    }
+};
+exports.PaymentCallbackController = PaymentCallbackController;
+__decorate([
+    (0, common_1.Get)('callback/:provider/:attemptId'),
+    __param(0, (0, common_1.Param)('provider')),
+    __param(1, (0, common_1.Param)('attemptId')),
+    __param(2, (0, common_1.Query)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], PaymentCallbackController.prototype, "getCallback", null);
+__decorate([
+    (0, common_1.Post)('callback/:provider/:attemptId'),
+    __param(0, (0, common_1.Param)('provider')),
+    __param(1, (0, common_1.Param)('attemptId')),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], PaymentCallbackController.prototype, "postCallback", null);
+exports.PaymentCallbackController = PaymentCallbackController = __decorate([
+    (0, common_1.Controller)('nepal-payments'),
+    __metadata("design:paramtypes", [payment_orchestrator_service_1.PaymentOrchestratorService])
+], PaymentCallbackController);
+function flatten(input) {
+    return Object.fromEntries(Object.entries(input).map(([key, value]) => [key, Array.isArray(value) ? value[0] : value]));
+}
+//# sourceMappingURL=payment-callback.controller.js.map

package/dist/api/payment-callback.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payment-callback.controller.js","sourceRoot":"","sources":["../../src/api/payment-callback.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAgF;AAEhF,sCAA6C;AAC7C,2FAAsF;AACtF,oCAAkF;AAG3E,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YAA6B,YAAwC;QAAxC,iBAAY,GAAZ,YAAY,CAA4B;IAAG,CAAC;IAGnE,AAAN,KAAK,CAAC,WAAW,CACI,QAAgB,EACf,SAAiB,EAC5B,KAAwC,EAC1C,QAAkB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CACG,QAAgB,EACf,SAAiB,EAC7B,IAA6B,EAC9B,QAAkB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,aAAqB,EACrB,SAAiB,EACjB,OAAgC,EAChC,QAAkB;QAElB,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAA8B,CAAC;QACzE,IAAI,MAAM,GAAG,OAAO,CAAC;QACrB,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC,+BAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,GAAG,8BAA8B,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtF,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,6CAA6C,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAA,yBAAgB,GAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACnD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAjDY,8DAAyB;AAI9B;IADL,IAAA,YAAG,EAAC,+BAA+B,CAAC;IAElC,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAGP;AAGK;IADL,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAGP;oCArBU,yBAAyB;IADrC,IAAA,mBAAU,EAAC,gBAAgB,CAAC;qCAEgB,yDAA0B;GAD1D,yBAAyB,CAiDrC;AAED,SAAS,OAAO,CAAC,KAAwC;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzH,CAAC"}

package/dist/api/shop.resolver.d.ts

@@ -0,0 +1,9 @@
+import { RequestContext } from '@vendure/core';
+import { PaymentOrchestratorService } from '../services/payment-orchestrator.service';
+export declare class NepalPaymentsShopResolver {
+    private readonly orchestrator;
+    constructor(orchestrator: PaymentOrchestratorService);
+    initiateNepalPayment(ctx: RequestContext, args: {
+        provider: 'KHALTI' | 'ESEWA' | 'FONEPAY';
+    }): Promise<import("../services/payment-orchestrator.service").InitiatedPayment>;
+}

package/dist/api/shop.resolver.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NepalPaymentsShopResolver = void 0;
+const graphql_1 = require("@nestjs/graphql");
+const core_1 = require("@vendure/core");
+const payment_orchestrator_service_1 = require("../services/payment-orchestrator.service");
+let NepalPaymentsShopResolver = class NepalPaymentsShopResolver {
+    constructor(orchestrator) {
+        this.orchestrator = orchestrator;
+    }
+    initiateNepalPayment(ctx, args) {
+        return this.orchestrator.initiate(ctx, args.provider.toLowerCase());
+    }
+};
+exports.NepalPaymentsShopResolver = NepalPaymentsShopResolver;
+__decorate([
+    (0, graphql_1.Mutation)(),
+    (0, core_1.Allow)(core_1.Permission.Owner),
+    __param(0, (0, core_1.Ctx)()),
+    __param(1, (0, graphql_1.Args)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [core_1.RequestContext, Object]),
+    __metadata("design:returntype", void 0)
+], NepalPaymentsShopResolver.prototype, "initiateNepalPayment", null);
+exports.NepalPaymentsShopResolver = NepalPaymentsShopResolver = __decorate([
+    (0, graphql_1.Resolver)(),
+    __metadata("design:paramtypes", [payment_orchestrator_service_1.PaymentOrchestratorService])
+], NepalPaymentsShopResolver);
+//# sourceMappingURL=shop.resolver.js.map

package/dist/api/shop.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shop.resolver.js","sourceRoot":"","sources":["../../src/api/shop.resolver.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,6CAA2D;AAC3D,wCAAuE;AACvE,2FAAsF;AAI/E,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YAA6B,YAAwC;QAAxC,iBAAY,GAAZ,YAAY,CAA4B;IAAG,CAAC;IAIzE,oBAAoB,CACX,GAAmB,EAClB,IAAkD;QAE1D,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAA8B,CAAC,CAAC;IAClG,CAAC;CACF,CAAA;AAXY,8DAAyB;AAKpC;IAFC,IAAA,kBAAQ,GAAE;IACV,IAAA,YAAK,EAAC,iBAAU,CAAC,KAAK,CAAC;IAErB,WAAA,IAAA,UAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAI,GAAE,CAAA;;qCADK,qBAAc;;qEAI3B;oCAVU,yBAAyB;IADrC,IAAA,kBAAQ,GAAE;qCAEkC,yDAA0B;GAD1D,yBAAyB,CAWrC"}

package/dist/config.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Configuration for the Khalti KPG-2 integration.
+ *
+ * @category Configuration
+ */
+export interface KhaltiPluginOptions {
+    secretKey: string;
+    websiteUrl: string;
+    paymentMethodCode?: string;
+    environment?: 'sandbox' | 'production';
+}
+/**
+ * Configuration for the eSewa ePay v2 integration.
+ *
+ * @category Configuration
+ */
+export interface EsewaPluginOptions {
+    productCode: string;
+    secretKey: string;
+    paymentMethodCode?: string;
+    environment?: 'sandbox' | 'production';
+}
+/**
+ * Reserved configuration shape for a future official Fonepay integration.
+ * Fonepay is not implemented in the current release.
+ *
+ * @category Configuration
+ */
+export interface FonepayPluginOptions {
+    paymentMethodCode?: string;
+}
+/**
+ * Options passed to {@link NepalPaymentsPlugin.init}.
+ *
+ * @category Configuration
+ */
+export interface NepalPaymentsPluginOptions {
+    /** Public origin of the Vendure server, without a trailing slash. */
+    publicServerUrl: string;
+    /** Storefront page to receive the final attempt status. */
+    storefrontResultUrl: string;
+    /** At least 32 random characters, used to authenticate internal settlement metadata. */
+    internalSigningSecret: string;
+    /** Cron expression for pending-payment reconciliation, or false to disable. Defaults to every 5 minutes. */
+    reconciliationSchedule?: string | false;
+    khalti?: KhaltiPluginOptions;
+    esewa?: EsewaPluginOptions;
+    fonepay?: FonepayPluginOptions;
+}
+export declare const defaultPaymentMethodCodes: {
+    readonly khalti: "khalti";
+    readonly esewa: "esewa";
+    readonly fonepay: "fonepay";
+};
+export declare function setPluginOptions(value: NepalPaymentsPluginOptions): void;
+export declare function getPluginOptions(): NepalPaymentsPluginOptions;

package/dist/config.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPaymentMethodCodes = void 0;
+exports.setPluginOptions = setPluginOptions;
+exports.getPluginOptions = getPluginOptions;
+exports.defaultPaymentMethodCodes = {
+    khalti: 'khalti',
+    esewa: 'esewa',
+    fonepay: 'fonepay',
+};
+let options;
+function setPluginOptions(value) {
+    assertPublicUrl(value.publicServerUrl, 'publicServerUrl');
+    assertPublicUrl(value.storefrontResultUrl, 'storefrontResultUrl');
+    if (value.internalSigningSecret.length < 32) {
+        throw new Error('internalSigningSecret must contain at least 32 characters');
+    }
+    if (!value.khalti && !value.esewa) {
+        throw new Error('At least one implemented payment provider must be configured');
+    }
+    if (value.khalti && (!value.khalti.secretKey || !value.khalti.websiteUrl)) {
+        throw new Error('Khalti secretKey and websiteUrl are required');
+    }
+    if (value.khalti)
+        assertPublicUrl(value.khalti.websiteUrl, 'Khalti websiteUrl');
+    if (value.esewa && (!value.esewa.secretKey || !value.esewa.productCode)) {
+        throw new Error('eSewa secretKey and productCode are required');
+    }
+    options = value;
+}
+function getPluginOptions() {
+    if (!options) {
+        throw new Error('NepalPaymentsPlugin.init() must be called before the plugin is used');
+    }
+    return options;
+}
+function assertPublicUrl(value, name) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${name} must be an absolute URL`);
+    }
+    const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '::1';
+    if (url.protocol !== 'https:' && !(local && url.protocol === 'http:')) {
+        throw new Error(`${name} must use HTTPS outside localhost`);
+    }
+    if (url.username || url.password)
+        throw new Error(`${name} must not include credentials`);
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA6DA,4CAiBC;AAED,4CAKC;AAhCY,QAAA,yBAAyB,GAAG;IACvC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,IAAI,OAA+C,CAAC;AAEpD,SAAgB,gBAAgB,CAAC,KAAiC;IAChE,eAAe,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC1D,eAAe,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM;QAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY;IAClD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC;IACrG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;AAC5F,CAAC"}

package/dist/entities/payment-attempt.entity.d.ts

@@ -0,0 +1,29 @@
+import { DeepPartial, VendureEntity } from '@vendure/core';
+import type { NepalPaymentProviderCode, PaymentAttemptStatus } from '../types';
+/**
+ * Stores the asynchronous provider-side lifecycle before a verified Vendure
+ * {@link Payment} is created. Applications should treat these records as
+ * operational data and must not manually mark them settled.
+ *
+ * @category Entity
+ */
+export declare class NepalPaymentAttempt extends VendureEntity {
+    constructor(input?: DeepPartial<NepalPaymentAttempt>);
+    orderId: string;
+    orderCode: string;
+    channelId: string;
+    channelToken: string;
+    provider: NepalPaymentProviderCode;
+    paymentMethodCode: string;
+    merchantReference: string;
+    providerReference: string | null;
+    amount: number;
+    currencyCode: string;
+    status: PaymentAttemptStatus | 'verifying';
+    idempotencyKey: string;
+    expiresAt?: Date;
+    verifiedAt?: Date;
+    providerTransactionId: string | null;
+    vendurePaymentId: string | null;
+    providerResponse: Record<string, unknown> | null;
+}