Add payment-provider signatures: Square, Braintree, Razorpay, Adyen (pick one)

[jpbelmo]

Payments is this project's flagship detection category — it's where the structural tier (webhook flow → signature verification → DB write → idempotency) already goes deepest. But Tier 1 coverage of payment providers still has real gaps. Covered today: Stripe, PayPal, Mercado Pago, Lemon Squeezy, Paddle. Missing, verified against the current signatures/package-map.json:

• Square — official SDK package square
• Braintree — braintree
• Razorpay — razorpay
• Adyen — @adyen/api-library

The ask

Pick ONE provider (comment here to claim it, so two people don't duplicate work) and add it end to end. Because each of these needs a new taxonomy slug (payments/square, payments/braintree, payments/razorpay, payments/adyen), the repo's process is two small PRs:

1. PR 1 — the slug: add { "slug": "payments/<provider>", "label": "<Provider>" } to taxonomy.json, with a one-line rationale in the PR description. New vocabulary is reviewed on its own — see CONTRIBUTING.md.
2. PR 2 — the map entries: add the SDK package(s) to signatures/package-map.json mapping to your new slug. These imports are unambiguous, so Tier 1 is enough — no signature file, no fixtures needed. If you find the provider's other official SDK packages (e.g. a React wrapper), add those keys too, same slug.

Definition of done

• Slug merged in taxonomy.json (PR 1, with rationale)
• Map entries in signatures/package-map.json (PR 2)
• npm test green (new entries are picked up automatically — nothing to wire)
• One line in CHANGELOG.md under [Unreleased]

Pointers: docs/signatures.md#contributing is the exact contract; the map key must be the package name as actually imported (see the map's own $comment on dead keys). If you work with an AI coding agent, point it at the add-signature skill — it walks this exact path.

[itxhadi27-cmd]

"Hi there! I would love to contribute and work on this issue. Could you please assign it to me? Thank you!"

[jpbelmo]

Welcome, glad to have you! This issue is pick-one: tell me which provider you want (Square, Braintree, Razorpay or Adyen) and I'll assign it to you. If there's another major provider you'd rather add (one with an official SDK), propose it here and we can fold it into the list, same process. The path is two small PRs, laid out in the issue body and in CONTRIBUTING's "Your first PR, in five steps". One heads-up: if there's no update after a couple of weeks I'll free it up for the next person, no hard feelings. Happy to answer questions here.

[itxhadi27-cmd]

Hi @jpbelmo, thanks for the reply! I'd like to claim Square for this — I'll work through the two-PR path (taxonomy slug first, then the package-map entries) as laid out in the issue and CONTRIBUTING.md. Will follow up here once PR 1 is up.

[jpbelmo]

Square is yours @itxhadi27-cmd! Exactly the right path: taxonomy slug PR first (with a one-line rationale), then the package-map entries. The official npm SDK package is square, and if you spot other official Square SDK packages, same slug for all of them. Braintree, Razorpay and Adyen stay open for whoever comes next. Same friendly window as always: if a couple of weeks go by without news I'll free it up. Go get your first one!

[jpbelmo]

@waterlemonnn Braintree is yours, welcome! Exactly right: taxonomy slug PR first with a one-line rationale, then the package-map entry for braintree. The issue body and CONTRIBUTING's "Your first PR, in five steps" have the full path. Ping me here with any questions.

@itxhadi27-cmd checking in: it's been two weeks since you claimed Square with no news, which is the window I mentioned. Life happens, no judgment. If you're still on it, just say so here (a WIP branch counts) and it stays yours through the weekend. If I don't hear back by Friday I'll free Square up for the next person. Either way you're welcome here anytime.

[SulimanAbdulrazzaq]

Hi @jpbelmo, I'd like to take Adyen. I'll use the official npm SDK package @adyen/api-library and follow the required two-PR path: first payments/adyen in the taxonomy with its rationale, version bump, and changelog; then, only after that slug merges, the Tier 1 package-map entry. I'll keep the second PR blocked on the taxonomy prerequisite and run the repository's taxonomy, privacy, typecheck, build, and reviewer gates.

[jpbelmo]

@SulimanAbdulrazzaq Adyen is yours, and you're already ahead of me: the taxonomy PR is up and you've been tracking the merge queue on your own. One heads-up: your #79 and #80 currently both claim 1.15.0. GitLab CI (#79) lands first, so Adyen becomes 1.16.0; update it when #79 merges, or say the word and I'll push the bump to your branch.

@itxhadi27-cmd the Friday window passed without news, so Square is back up for grabs as promised. No hard feelings, and if you come back later there'll be other issues with your name on them.

That makes the scoreboard for this issue: Braintree shipped, Razorpay shipped, Okta shipped as a bonus, Adyen in flight, and Square free for whoever wants the last one.