diff --git a/packages/plugins/alipay/frontend/manifest.json b/packages/plugins/alipay/frontend/manifest.json
new file mode 100644
index 0000000..1eee13e
--- /dev/null
+++ b/packages/plugins/alipay/frontend/manifest.json
@@ -0,0 +1,140 @@
+{
+  "version": "0.1.0",
+  "entry": "frontend/dist/index.js",
+  "pages": [],
+  "layouts": [],
+  "finders": [],
+  "adminRoutes": [
+    {
+      "path": "/settings",
+      "component": "admin/settings",
+      "permission": "alipay.admin",
+      "nav": {
+        "labelKey": "nav.settings",
+        "groupKey": "nav.group",
+        "order": 30
+      },
+      "data": [
+        {
+          "fetch": {
+            "path": "/alipay/admin/config"
+          },
+          "as": "status"
+        }
+      ]
+    }
+  ],
+  "adminActions": [],
+  "actions": [],
+  "accountRoutes": [],
+  "accountWidgets": [],
+  "files": [
+    "frontend/dist/admin.js",
+    "frontend/dist/chunk-66KFN25F.js",
+    "frontend/dist/index.js"
+  ],
+  "locales": [
+    "zh-CN",
+    "zh-TW",
+    "zh-HK",
+    "en-US"
+  ],
+  "messages": {
+    "zh-CN": {
+      "nav.group": "支付宝",
+      "nav.settings": "配置",
+      "page.title": "支付宝当面付",
+      "page.noSecrets": "未配置平台加密密钥，无法保存商户私钥。",
+      "page.callbackHint": "异步通知地址：{path}（需在支付宝开放平台登记为可公网访问的 https 地址）。",
+      "summary.appId": "应用 AppID",
+      "summary.gateway": "网关地址",
+      "summary.methods": "支付方式",
+      "field.appId": "应用 AppID",
+      "field.gatewayUrl": "网关地址",
+      "field.gatewayHint": "正式环境用默认值；沙箱填 {sandbox}。只接受 https 域名。",
+      "field.privateKey": "应用私钥（RSA2）",
+      "field.alipayPublicKey": "支付宝公钥",
+      "field.keyKeep": "已配置，留空则保持不变",
+      "action.save": "保存配置",
+      "action.saving": "保存中…",
+      "notice.saved": "支付宝配置已保存。",
+      "notice.saveFailed": "保存失败，请稍后重试。",
+      "error.unauthenticated": "登录状态已失效，请重新登录。",
+      "error.forbidden": "无权执行此操作。",
+      "error.withCode": "保存失败（{code}）。",
+      "error.withStatus": "保存失败（HTTP {status}）。"
+    },
+    "zh-TW": {
+      "nav.group": "支付寶",
+      "nav.settings": "配置",
+      "page.title": "支付寶當面付",
+      "page.noSecrets": "未配置平臺加密金鑰，無法儲存商戶私鑰。",
+      "page.callbackHint": "非同步通知地址：{path}（需在支付寶開放平臺登記為可公網訪問的 https 地址）。",
+      "summary.appId": "應用 AppID",
+      "summary.gateway": "閘道器地址",
+      "summary.methods": "支付方式",
+      "field.appId": "應用 AppID",
+      "field.gatewayUrl": "閘道器地址",
+      "field.gatewayHint": "正式環境用預設值；沙箱填 {sandbox}。只接受 https 域名。",
+      "field.privateKey": "應用私鑰（RSA2）",
+      "field.alipayPublicKey": "支付寶公鑰",
+      "field.keyKeep": "已配置，留空則保持不變",
+      "action.save": "儲存配置",
+      "action.saving": "儲存中…",
+      "notice.saved": "支付寶配置已儲存。",
+      "notice.saveFailed": "儲存失敗，請稍後重試。",
+      "error.unauthenticated": "登入狀態已失效，請重新登入。",
+      "error.forbidden": "無權執行此操作。",
+      "error.withCode": "儲存失敗（{code}）。",
+      "error.withStatus": "儲存失敗（HTTP {status}）。"
+    },
+    "zh-HK": {
+      "nav.group": "支付寶",
+      "nav.settings": "配置",
+      "page.title": "支付寶當面付",
+      "page.noSecrets": "未配置平臺加密金鑰，無法儲存商戶私鑰。",
+      "page.callbackHint": "非同步通知地址：{path}（需在支付寶開放平臺登記為可公網訪問的 https 地址）。",
+      "summary.appId": "應用 AppID",
+      "summary.gateway": "閘道器地址",
+      "summary.methods": "支付方式",
+      "field.appId": "應用 AppID",
+      "field.gatewayUrl": "閘道器地址",
+      "field.gatewayHint": "正式環境用默認值；沙箱填 {sandbox}。只接受 https 域名。",
+      "field.privateKey": "應用私鑰（RSA2）",
+      "field.alipayPublicKey": "支付寶公鑰",
+      "field.keyKeep": "已配置，留空則保持不變",
+      "action.save": "儲存配置",
+      "action.saving": "儲存中…",
+      "notice.saved": "支付寶配置已儲存。",
+      "notice.saveFailed": "儲存失敗，請稍後重試。",
+      "error.unauthenticated": "登錄狀態已失效，請重新登錄。",
+      "error.forbidden": "無權執行此操作。",
+      "error.withCode": "儲存失敗（{code}）。",
+      "error.withStatus": "儲存失敗（HTTP {status}）。"
+    },
+    "en-US": {
+      "nav.group": "Alipay",
+      "nav.settings": "Settings",
+      "page.title": "Alipay Face-to-Face",
+      "page.noSecrets": "Platform encryption keys are not configured, so the merchant private key cannot be stored.",
+      "page.callbackHint": "Async notification URL: {path} (register it on the Alipay open platform as a publicly reachable https address).",
+      "summary.appId": "App ID",
+      "summary.gateway": "Gateway",
+      "summary.methods": "Payment methods",
+      "field.appId": "App ID",
+      "field.gatewayUrl": "Gateway URL",
+      "field.gatewayHint": "Keep the default for production; use {sandbox} for the sandbox. Only https hosts are accepted.",
+      "field.privateKey": "App private key (RSA2)",
+      "field.alipayPublicKey": "Alipay public key",
+      "field.keyKeep": "Already configured — leave empty to keep it",
+      "action.save": "Save",
+      "action.saving": "Saving…",
+      "notice.saved": "Alipay configuration saved.",
+      "notice.saveFailed": "Could not save. Please retry.",
+      "error.unauthenticated": "Your session expired. Please sign in again.",
+      "error.forbidden": "You are not allowed to do this.",
+      "error.withCode": "Save failed ({code}).",
+      "error.withStatus": "Save failed (HTTP {status})."
+    }
+  }
+}
diff --git a/packages/plugins/alipay/frontend/messages/en-US.json b/packages/plugins/alipay/frontend/messages/en-US.json
new file mode 100644
index 0000000..50449c3
--- /dev/null
+++ b/packages/plugins/alipay/frontend/messages/en-US.json
@@ -0,0 +1,24 @@
+{
+  "nav.group": "Alipay",
+  "nav.settings": "Settings",
+  "page.title": "Alipay Face-to-Face",
+  "page.noSecrets": "Platform encryption keys are not configured, so the merchant private key cannot be stored.",
+  "page.callbackHint": "Async notification URL: {path} (register it on the Alipay open platform as a publicly reachable https address).",
+  "summary.appId": "App ID",
+  "summary.gateway": "Gateway",
+  "summary.methods": "Payment methods",
+  "field.appId": "App ID",
+  "field.gatewayUrl": "Gateway URL",
+  "field.gatewayHint": "Keep the default for production; use {sandbox} for the sandbox. Only https hosts are accepted.",
+  "field.privateKey": "App private key (RSA2)",
+  "field.alipayPublicKey": "Alipay public key",
+  "field.keyKeep": "Already configured — leave empty to keep it",
+  "action.save": "Save",
+  "action.saving": "Saving…",
+  "notice.saved": "Alipay configuration saved.",
+  "notice.saveFailed": "Could not save. Please retry.",
+  "error.unauthenticated": "Your session expired. Please sign in again.",
+  "error.forbidden": "You are not allowed to do this.",
+  "error.withCode": "Save failed ({code}).",
+  "error.withStatus": "Save failed (HTTP {status})."
+}
diff --git a/packages/plugins/alipay/frontend/messages/zh-CN.json b/packages/plugins/alipay/frontend/messages/zh-CN.json
new file mode 100644
index 0000000..672ea00
--- /dev/null
+++ b/packages/plugins/alipay/frontend/messages/zh-CN.json
@@ -0,0 +1,24 @@
+{
+  "nav.group": "支付宝",
+  "nav.settings": "配置",
+  "page.title": "支付宝当面付",
+  "page.noSecrets": "未配置平台加密密钥，无法保存商户私钥。",
+  "page.callbackHint": "异步通知地址：{path}（需在支付宝开放平台登记为可公网访问的 https 地址）。",
+  "summary.appId": "应用 AppID",
+  "summary.gateway": "网关地址",
+  "summary.methods": "支付方式",
+  "field.appId": "应用 AppID",
+  "field.gatewayUrl": "网关地址",
+  "field.gatewayHint": "正式环境用默认值；沙箱填 {sandbox}。只接受 https 域名。",
+  "field.privateKey": "应用私钥（RSA2）",
+  "field.alipayPublicKey": "支付宝公钥",
+  "field.keyKeep": "已配置，留空则保持不变",
+  "action.save": "保存配置",
+  "action.saving": "保存中…",
+  "notice.saved": "支付宝配置已保存。",
+  "notice.saveFailed": "保存失败，请稍后重试。",
+  "error.unauthenticated": "登录状态已失效，请重新登录。",
+  "error.forbidden": "无权执行此操作。",
+  "error.withCode": "保存失败（{code}）。",
+  "error.withStatus": "保存失败（HTTP {status}）。"
+}
diff --git a/packages/plugins/alipay/frontend/messages/zh-HK.json b/packages/plugins/alipay/frontend/messages/zh-HK.json
new file mode 100644
index 0000000..79ddc58
--- /dev/null
+++ b/packages/plugins/alipay/frontend/messages/zh-HK.json
@@ -0,0 +1,24 @@
+{
+  "nav.group": "支付寶",
+  "nav.settings": "配置",
+  "page.title": "支付寶當面付",
+  "page.noSecrets": "未配置平臺加密金鑰，無法儲存商戶私鑰。",
+  "page.callbackHint": "非同步通知地址：{path}（需在支付寶開放平臺登記為可公網訪問的 https 地址）。",
+  "summary.appId": "應用 AppID",
+  "summary.gateway": "閘道器地址",
+  "summary.methods": "支付方式",
+  "field.appId": "應用 AppID",
+  "field.gatewayUrl": "閘道器地址",
+  "field.gatewayHint": "正式環境用默認值；沙箱填 {sandbox}。只接受 https 域名。",
+  "field.privateKey": "應用私鑰（RSA2）",
+  "field.alipayPublicKey": "支付寶公鑰",
+  "field.keyKeep": "已配置，留空則保持不變",
+  "action.save": "儲存配置",
+  "action.saving": "儲存中…",
+  "notice.saved": "支付寶配置已儲存。",
+  "notice.saveFailed": "儲存失敗，請稍後重試。",
+  "error.unauthenticated": "登錄狀態已失效，請重新登錄。",
+  "error.forbidden": "無權執行此操作。",
+  "error.withCode": "儲存失敗（{code}）。",
+  "error.withStatus": "儲存失敗（HTTP {status}）。"
+}
diff --git a/packages/plugins/alipay/frontend/messages/zh-TW.json b/packages/plugins/alipay/frontend/messages/zh-TW.json
new file mode 100644
index 0000000..e4fef4a
--- /dev/null
+++ b/packages/plugins/alipay/frontend/messages/zh-TW.json
@@ -0,0 +1,24 @@
+{
+  "nav.group": "支付寶",
+  "nav.settings": "配置",
+  "page.title": "支付寶當面付",
+  "page.noSecrets": "未配置平臺加密金鑰，無法儲存商戶私鑰。",
+  "page.callbackHint": "非同步通知地址：{path}（需在支付寶開放平臺登記為可公網訪問的 https 地址）。",
+  "summary.appId": "應用 AppID",
+  "summary.gateway": "閘道器地址",
+  "summary.methods": "支付方式",
+  "field.appId": "應用 AppID",
+  "field.gatewayUrl": "閘道器地址",
+  "field.gatewayHint": "正式環境用預設值；沙箱填 {sandbox}。只接受 https 域名。",
+  "field.privateKey": "應用私鑰（RSA2）",
+  "field.alipayPublicKey": "支付寶公鑰",
+  "field.keyKeep": "已配置，留空則保持不變",
+  "action.save": "儲存配置",
+  "action.saving": "儲存中…",
+  "notice.saved": "支付寶配置已儲存。",
+  "notice.saveFailed": "儲存失敗，請稍後重試。",
+  "error.unauthenticated": "登入狀態已失效，請重新登入。",
+  "error.forbidden": "無權執行此操作。",
+  "error.withCode": "儲存失敗（{code}）。",
+  "error.withStatus": "儲存失敗（HTTP {status}）。"
+}
diff --git a/packages/plugins/alipay/frontend/package.json b/packages/plugins/alipay/frontend/package.json
new file mode 100644
index 0000000..ae46c4c
--- /dev/null
+++ b/packages/plugins/alipay/frontend/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "@stackpanel/plugin-alipay-frontend",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "sonner": "^2.0.8",
+    "zod": "^4.4.3"
+  },
+  "license": "MIT"
+}
diff --git a/packages/plugins/alipay/frontend/src/admin.tsx b/packages/plugins/alipay/frontend/src/admin.tsx
new file mode 100644
index 0000000..c525606
--- /dev/null
+++ b/packages/plugins/alipay/frontend/src/admin.tsx
@@ -0,0 +1,213 @@
+'use client';
+
+import type { AdminPageComponentProps } from '@stackpanel/sdk';
+import { PageHeader } from '@stackpanel/ui';
+import { useRouter } from 'next/navigation';
+import { useState, useTransition, type ReactElement } from 'react';
+import { toast } from 'sonner';
+import { t } from './i18n.js';
+
+interface AlipayStatus {
+  configured: boolean;
+  secretsEnabled: boolean;
+  appId?: string;
+  gatewayUrl?: string;
+  methods?: Array<{ id: string; label: string }>;
+}
+
+interface ProblemDetails {
+  code?: string;
+  title?: string;
+  detail?: string;
+}
+
+const DEFAULT_GATEWAY = 'https://openapi.alipay.com/gateway.do';
+const SANDBOX_GATEWAY = 'https://openapi-sandbox.dl.alipaydev.com/gateway.do';
+
+/**
+ * 支付宝当面付配置表单。
+ *
+ * 直接提交到插件自己的内核路由（经通用 BFF 代理），不走声明式 action 桥：
+ * 桥在失败时 redirect 回退会重渲染整页，把已经粘贴进去的私钥清空 —— 对
+ * 一段 2000 字符的密钥来说，这个体验代价太大。
+ *
+ * 私钥不预填：服务端只回显「已配置」，不把密钥材料再吐回浏览器。
+ */
+function AlipayAdminPage(props: AdminPageComponentProps): ReactElement {
+  const tr = t(props.locale);
+  const status = props.data.status as AlipayStatus | undefined;
+  const router = useRouter();
+  const [pending, startTransition] = useTransition();
+  const [appId, setAppId] = useState(status?.appId ?? '');
+  const [gatewayUrl, setGatewayUrl] = useState(status?.gatewayUrl ?? DEFAULT_GATEWAY);
+  const [privateKey, setPrivateKey] = useState('');
+  const [alipayPublicKey, setAlipayPublicKey] = useState('');
+
+  function handleSubmit(event: React.FormEvent<HTMLFormElement>): void {
+    event.preventDefault();
+    const payload = {
+      appId: appId.trim(),
+      privateKey: privateKey.trim(),
+      alipayPublicKey: alipayPublicKey.trim(),
+      gatewayUrl: gatewayUrl.trim() || DEFAULT_GATEWAY,
+    };
+    startTransition(async () => {
+      try {
+        const response = await fetch('/api/plugins/alipay/admin/config', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(payload),
+        });
+        if (!response.ok) {
+          toast.error(await readErrorMessage(response, tr));
+          return;
+        }
+        toast.success(tr('notice.saved'));
+        setPrivateKey('');
+        router.refresh();
+      } catch {
+        toast.error(tr('notice.saveFailed'));
+      }
+    });
+  }
+
+  return (
+    <main className="w-full space-y-6">
+      <PageHeader title={tr('page.title')} />
+      {status?.secretsEnabled === false ? (
+        <p className="rounded-lg border border-destructive/35 bg-destructive/5 px-4 py-3 text-sm text-destructive">
+          {tr('page.noSecrets')}
+        </p>
+      ) : null}
+      <p className="rounded-lg border border-dashed px-4 py-3 text-sm text-muted-foreground">
+        {tr('page.callbackHint', { path: '/callbacks/alipay' })}
+      </p>
+
+      {status?.configured ? (
+        <section className="rounded-lg border bg-card p-4 text-sm">
+          <dl className="grid gap-3 sm:grid-cols-3">
+            <div>
+              <dt className="text-muted-foreground">{tr('summary.appId')}</dt>
+              <dd className="mt-1 font-mono break-all">{status.appId}</dd>
+            </div>
+            <div>
+              <dt className="text-muted-foreground">{tr('summary.gateway')}</dt>
+              <dd className="mt-1 break-all">{status.gatewayUrl}</dd>
+            </div>
+            <div>
+              <dt className="text-muted-foreground">{tr('summary.methods')}</dt>
+              <dd className="mt-1">{status.methods?.map((method) => method.label).join('、')}</dd>
+            </div>
+          </dl>
+        </section>
+      ) : null}
+
+      <form onSubmit={handleSubmit} className="grid gap-4 rounded-lg border bg-card p-4 sm:grid-cols-2">
+        <Field label={tr('field.appId')} name="appId" value={appId} onChange={setAppId} required />
+        <Field
+          label={tr('field.gatewayUrl')}
+          name="gatewayUrl"
+          value={gatewayUrl}
+          onChange={setGatewayUrl}
+          hint={tr('field.gatewayHint', { sandbox: SANDBOX_GATEWAY })}
+          required
+        />
+        <Field
+          label={tr('field.privateKey')}
+          name="privateKey"
+          textarea
+          placeholder={status?.configured ? tr('field.keyKeep') : ''}
+          value={privateKey}
+          onChange={setPrivateKey}
+          required
+        />
+        <Field
+          label={tr('field.alipayPublicKey')}
+          name="alipayPublicKey"
+          textarea
+          placeholder={status?.configured ? tr('field.keyKeep') : ''}
+          value={alipayPublicKey}
+          onChange={setAlipayPublicKey}
+          required
+        />
+        <button
+          type="submit"
+          disabled={pending}
+          className="h-9 w-fit rounded-lg bg-primary px-3 text-sm font-medium text-primary-foreground disabled:opacity-60 sm:col-span-2"
+        >
+          {pending ? tr('action.saving') : tr('action.save')}
+        </button>
+      </form>
+    </main>
+  );
+}
+
+function Field(props: {
+  label: string;
+  name: string;
+  value: string;
+  onChange: (value: string) => void;
+  hint?: string;
+  placeholder?: string;
+  textarea?: boolean;
+  required?: boolean;
+}): ReactElement {
+  const id = `alipay-${props.name}`;
+  const className =
+    'w-full rounded-lg border bg-background px-3 py-2 text-sm outline-none focus:border-primary';
+  return (
+    <div className={props.textarea ? 'space-y-1.5 sm:col-span-2' : 'space-y-1.5'}>
+      <label htmlFor={id} className="text-sm font-medium">
+        {props.label}
+      </label>
+      {props.textarea ? (
+        <textarea
+          id={id}
+          name={props.name}
+          rows={5}
+          className={`${className} font-mono`}
+          value={props.value}
+          placeholder={props.placeholder}
+          onChange={(event) => props.onChange(event.target.value)}
+          required={props.required}
+        />
+      ) : (
+        <input
+          id={id}
+          name={props.name}
+          className={className}
+          value={props.value}
+          placeholder={props.placeholder}
+          onChange={(event) => props.onChange(event.target.value)}
+          required={props.required}
+        />
+      )}
+      {props.hint ? <p className="text-xs text-muted-foreground">{props.hint}</p> : null}
+    </div>
+  );
+}
+
+async function readErrorMessage(
+  response: Response,
+  tr: ReturnType<typeof t>,
+): Promise<string> {
+  if (response.status === 401) return tr('error.unauthenticated');
+  if (response.status === 403) return tr('error.forbidden');
+  try {
+    const body = (await response.json()) as ProblemDetails;
+    const detail = typeof body.detail === 'string' ? body.detail.trim() : '';
+    if (detail) return detail;
+    const title = typeof body.title === 'string' ? body.title.trim() : '';
+    if (title) return title;
+    if (typeof body.code === 'string' && body.code.trim()) {
+      return tr('error.withCode', { code: body.code });
+    }
+  } catch {
+    // 非 JSON 错误体，落到通用提示。
+  }
+  return tr('error.withStatus', { status: response.status });
+}
+
+export const adminPages = {
+  'admin/settings': AlipayAdminPage,
+} as const;
diff --git a/packages/plugins/alipay/frontend/src/i18n.ts b/packages/plugins/alipay/frontend/src/i18n.ts
new file mode 100644
index 0000000..1ea5498
--- /dev/null
+++ b/packages/plugins/alipay/frontend/src/i18n.ts
@@ -0,0 +1,20 @@
+import { createPackageTranslator } from '@stackpanel/sdk';
+import enUS from '../messages/en-US.json';
+import zhCN from '../messages/zh-CN.json';
+import zhTW from '../messages/zh-TW.json';
+import zhHK from '../messages/zh-HK.json';
+
+/**
+ * Package-local catalogs (ADR-0016 §5).
+ *
+ * Catalogs live outside `src/` because they are message data, not code. Keys are
+ * flat and package-local: they are never merged into the kernel catalog.
+ */
+export const messages = {
+  'zh-CN': zhCN,
+  'zh-TW': zhTW,
+  'zh-HK': zhHK,
+  'en-US': enUS,
+} as const;
+
+export const t = (locale?: string) => createPackageTranslator(locale, messages, ['zh-CN']);
diff --git a/packages/plugins/alipay/frontend/src/index.tsx b/packages/plugins/alipay/frontend/src/index.tsx
new file mode 100644
index 0000000..1b4373f
--- /dev/null
+++ b/packages/plugins/alipay/frontend/src/index.tsx
@@ -0,0 +1,20 @@
+import type { FrontendPackage } from '@stackpanel/sdk';
+import { messages } from './i18n.js';
+
+export const frontend: FrontendPackage = {
+  locales: ['zh-CN', 'zh-TW', 'zh-HK', 'en-US'],
+  messages,
+  ui: {
+    adminRoutes: [
+      {
+        path: '/settings',
+        component: 'admin/settings',
+        permission: 'alipay.admin',
+        nav: { labelKey: 'nav.settings', groupKey: 'nav.group', order: 30 },
+        data: [{ fetch: { path: '/alipay/admin/config' }, as: 'status' }],
+      },
+    ],
+  },
+};
+
+export default frontend;
diff --git a/packages/plugins/alipay/frontend/tsup.config.ts b/packages/plugins/alipay/frontend/tsup.config.ts
new file mode 100644
index 0000000..af7eb91
--- /dev/null
+++ b/packages/plugins/alipay/frontend/tsup.config.ts
@@ -0,0 +1,35 @@
+import { defineConfig } from 'tsup';
+
+/**
+ * 前端产物按插件分发：`dist/` 里的模块由内核在运行时加载，所以宿主依赖
+ * （react / next / @stackpanel/*）必须保持 external —— 一旦被打进 bundle，
+ * 同一份 React 会出现两个实例，hooks 直接炸。
+ *
+ * external 由源码里的实际 import 推导。旧脚本手写的那份列表已经漂移过一次：
+ * 漏掉 `@stackpanel/ui` 让 referral 构建失败。这里保留**原始说明符**而不是
+ * 包名，因为 esbuild 按字符串精确匹配，`next` 匹配不到 `next/link`。
+ *
+ * JSX 用 `automatic` 运行时。tsup 的 CLI 没有对应开关（只有 --jsxFactory /
+ * --jsxFragment），只能在这里交给 esbuild —— 这就是原脚本里 `--jsx automatic`
+ * 从未生效、构建从来没跑通的原因。
+ */
+export default defineConfig({
+  entry: ['src/index.tsx', 'src/admin.tsx'],
+  format: ['esm'],
+  outDir: 'dist',
+  platform: 'neutral',
+  clean: true,
+  external: [
+    '@stackpanel/sdk',
+    '@stackpanel/ui',
+    'next/navigation',
+    'react',
+    'react-dom',
+    'react/jsx-runtime',
+    'sonner',
+    'zod',
+  ],
+  esbuildOptions(options) {
+    options.jsx = 'automatic';
+  },
+});
diff --git a/packages/plugins/alipay/package.json b/packages/plugins/alipay/package.json
new file mode 100644
index 0000000..7fb115d
--- /dev/null
+++ b/packages/plugins/alipay/package.json
@@ -0,0 +1,35 @@
+{
+  "name": "@stackpanel/plugin-alipay",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "license": "MIT",
+  "stackpanel": {
+    "builtin": false
+  },
+  "description": "支付宝当面付直连：扫码支付 + 异步通知验签，不经过第三方聚合网关。",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "prepare": "tsc -p tsconfig.build.json",
+    "build": "node ../../../scripts/build-plugin.mjs",
+    "typecheck": "tsc -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@stackpanel/sdk": "workspace:*",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.10"
+  }
+}
diff --git a/packages/plugins/alipay/src/alipay-client.test.ts b/packages/plugins/alipay/src/alipay-client.test.ts
new file mode 100644
index 0000000..05ba990
--- /dev/null
+++ b/packages/plugins/alipay/src/alipay-client.test.ts
@@ -0,0 +1,258 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import {
+  AlipayError,
+  alipayTimestamp,
+  buildCloseParams,
+  buildPrecreateParams,
+  canonicalize,
+  configSchema,
+  extractSignedNode,
+  minorToYuan,
+  parsePrecreateResponse,
+  signRsa2,
+  validateConfig,
+  verifyCallback,
+  verifyRsa2,
+  yuanToMinor,
+  type AlipayConfig,
+} from './alipay-client.js';
+import { assertGatewayUrl } from './index.js';
+
+/**
+ * 支付宝协议的验证策略（12.2）：商户凭据拿不到，但**协议本身可以验透**。
+ * 这里用自签 RSA 密钥对扮演「商户私钥」和「支付宝密钥」，签名/验签/回调/金额换算
+ * 全部跑真实 crypto —— 没有一处 mock 掉密码学。
+ */
+function keypair() {
+  return generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  });
+}
+
+const merchant = keypair();
+// 支付宝的密钥对：商户只持有它的公钥，用来验签响应与通知。
+const alipay = keypair();
+
+function config(overrides: Partial<AlipayConfig> = {}): AlipayConfig {
+  return {
+    appId: '2021000000000000',
+    privateKey: merchant.privateKey,
+    alipayPublicKey: alipay.publicKey,
+    gatewayUrl: 'https://openapi.alipay.com/gateway.do',
+    ...overrides,
+  };
+}
+
+/** 构造一段「支付宝风格」的响应体：业务节点原文 + 对原文的签名。 */
+function signedBody(node: Record<string, unknown>, signWith = alipay.privateKey): string {
+  const raw = JSON.stringify(node);
+  const sign = signRsa2(raw, signWith);
+  return `{"alipay_trade_precreate_response":${raw},"sign":"${sign}"}`;
+}
+
+describe('canonicalize', () => {
+  it('sorts by ASCII, drops sign and empty values', () => {
+    expect(canonicalize({ b: '2', a: '1', sign: 'x', c: '', d: null })).toBe('a=1&b=2');
+  });
+
+  it('sorts uppercase before lowercase (ASCII, not locale)', () => {
+    // localeCompare 在部分 locale 下会把大小写混排，支付宝用的是字节序。
+    expect(canonicalize({ a: '1', Z: '2' })).toBe('Z=2&a=1');
+  });
+});
+
+describe('RSA2 signing', () => {
+  it('round-trips and rejects a tampered payload', () => {
+    const sign = signRsa2('a=1&b=2', merchant.privateKey);
+    expect(verifyRsa2('a=1&b=2', sign, merchant.publicKey)).toBe(true);
+    expect(verifyRsa2('a=1&b=3', sign, merchant.publicKey)).toBe(false);
+  });
+
+  it('rejects a signature from a different key', () => {
+    const sign = signRsa2('a=1', merchant.privateKey);
+    expect(verifyRsa2('a=1', sign, alipay.publicKey)).toBe(false);
+  });
+
+  it('accepts bare base64 keys pasted from the Alipay console', () => {
+    const bare = merchant.privateKey
+      .replace('-----BEGIN PRIVATE KEY-----', '')
+      .replace('-----END PRIVATE KEY-----', '')
+      .replace(/\s/g, '');
+    const sign = signRsa2('a=1', bare);
+    expect(verifyRsa2('a=1', sign, merchant.publicKey)).toBe(true);
+  });
+});
+
+describe('amounts', () => {
+  it('converts minor units to yuan and back without float drift', () => {
+    expect(minorToYuan(1234)).toBe('12.34');
+    expect(yuanToMinor('12.34')).toBe(1234);
+    expect(yuanToMinor('0.1') + yuanToMinor('0.2')).toBe(30);
+    expect(yuanToMinor('7')).toBe(700);
+  });
+
+  it('rejects non-integer or non-positive amounts', () => {
+    expect(() => minorToYuan(12.5)).toThrow(AlipayError);
+    expect(() => minorToYuan(0)).toThrow(AlipayError);
+    expect(() => yuanToMinor('12.345')).toThrow(AlipayError);
+  });
+});
+
+describe('precreate request', () => {
+  it('signs a request carrying the amount in yuan and FACE_TO_FACE product code', () => {
+    const params = buildPrecreateParams(config(), {
+      merchantOrderNo: 'ORD-1',
+      amount: 1234,
+      subject: '测试订单',
+      notifyUrl: 'https://shop.example.com/callbacks/alipay',
+      timeout: '15m',
+    });
+    expect(params['method']).toBe('alipay.trade.precreate');
+    expect(params['sign_type']).toBe('RSA2');
+    const biz = JSON.parse(params['biz_content'] as string) as Record<string, unknown>;
+    expect(biz).toMatchObject({
+      out_trade_no: 'ORD-1',
+      total_amount: '12.34',
+      product_code: 'FACE_TO_FACE_PAYMENT',
+      timeout_express: '15m',
+    });
+    const { sign, ...rest } = params;
+    expect(verifyRsa2(canonicalize(rest), sign as string, merchant.publicKey)).toBe(true);
+  });
+
+  it('closes by out_trade_no', () => {
+    const params = buildCloseParams(config(), 'ORD-1');
+    expect(params['method']).toBe('alipay.trade.close');
+    expect(JSON.parse(params['biz_content'] as string)).toEqual({ out_trade_no: 'ORD-1' });
+  });
+
+  it('formats the timestamp in Beijing time, not ISO', () => {
+    // 支付宝只认 `YYYY-MM-DD HH:mm:ss`，ISO 8601 会被直接拒。
+    expect(alipayTimestamp(new Date('2026-10-25T16:30:05Z'))).toBe('2026-10-26 00:30:05');
+  });
+});
+
+describe('gateway response', () => {
+  it('verifies the signature over the raw node text and returns the QR code', () => {
+    const body = signedBody({
+      code: '10000',
+      msg: 'Success',
+      out_trade_no: 'ORD-1',
+      qr_code: 'https://qr.alipay.com/bavh4wjlxf12tper3a',
+    });
+    const response = parsePrecreateResponse(body, config());
+    expect(response.qr_code).toBe('https://qr.alipay.com/bavh4wjlxf12tper3a');
+  });
+
+  it('rejects a response signed by the wrong key', () => {
+    const body = signedBody({ code: '10000', qr_code: 'x' }, merchant.privateKey);
+    expect(() => parsePrecreateResponse(body, config())).toThrow(/响应签名无效/);
+  });
+
+  it('rejects a tampered node', () => {
+    const body = signedBody({ code: '10000', out_trade_no: 'ORD-1', qr_code: 'https://qr/1' });
+    const tampered = body.replace('https://qr/1', 'https://qr/2');
+    expect(() => parsePrecreateResponse(tampered, config())).toThrow(/响应签名无效/);
+  });
+
+  it('treats a business error as definitive (no retry storm)', () => {
+    const body = signedBody({ code: '40004', msg: 'Business Failed', sub_msg: '商户无权限' });
+    try {
+      parsePrecreateResponse(body, config());
+      throw new Error('should have thrown');
+    } catch (error) {
+      expect(error).toBeInstanceOf(AlipayError);
+      expect((error as AlipayError).definitive).toBe(true);
+      expect((error as AlipayError).message).toContain('商户无权限');
+    }
+  });
+
+  it('extracts a node containing nested objects and escaped quotes', () => {
+    const inner = { code: '10000', extra: { a: { b: 'say "hi"' } } };
+    const raw = JSON.stringify(inner);
+    const body = `{"alipay_trade_precreate_response":${raw},"sign":"S"}`;
+    const extracted = extractSignedNode(body, 'alipay_trade_precreate_response');
+    expect(JSON.parse(extracted.raw)).toEqual(inner);
+    expect(extracted.sign).toBe('S');
+  });
+});
+
+describe('async notification', () => {
+  function callbackParams(overrides: Record<string, string> = {}) {
+    const params: Record<string, string> = {
+      app_id: '2021000000000000',
+      out_trade_no: 'ORD-1',
+      trade_no: '2026102522001400000000000001',
+      trade_status: 'TRADE_SUCCESS',
+      total_amount: '12.34',
+      notify_time: '2026-10-25 12:00:00',
+      ...overrides,
+    };
+    return { ...params, sign: signRsa2(canonicalize(params), alipay.privateKey) };
+  }
+
+  it('accepts a correctly signed success notification', () => {
+    expect(verifyCallback(callbackParams(), config())).toEqual({
+      merchantOrderNo: 'ORD-1',
+      externalId: '2026102522001400000000000001',
+      amount: 1234,
+      currency: 'CNY',
+    });
+  });
+
+  it('returns null for non-settling states instead of throwing', () => {
+    // 关闭/等待付款的通知不是错误：调用方照样要回 success，否则支付宝一直重推。
+    expect(verifyCallback(callbackParams({ trade_status: 'TRADE_CLOSED' }), config())).toBeNull();
+  });
+
+  it('rejects a tampered notification', () => {
+    const params = callbackParams();
+    expect(() => verifyCallback({ ...params, total_amount: '0.01' }, config())).toThrow(
+      /回调签名无效/,
+    );
+  });
+
+  it('rejects a notification for another app id', () => {
+    expect(() => verifyCallback(callbackParams({ app_id: 'other' }), config())).toThrow(
+      /回调商户不匹配/,
+    );
+  });
+
+  it('rejects a notification without a signature', () => {
+    const { sign: _sign, ...params } = callbackParams();
+    expect(() => verifyCallback(params, config())).toThrow(/回调签名无效/);
+  });
+});
+
+describe('config validation', () => {
+  it('accepts a well-formed config', () => {
+    const parsed = configSchema.parse({
+      appId: '2021000000000000',
+      privateKey: merchant.privateKey,
+      alipayPublicKey: alipay.publicKey,
+    });
+    // 未填网关时落到正式环境，避免沙箱地址被误用到生产。
+    expect(validateConfig(parsed).gatewayUrl).toBe('https://openapi.alipay.com/gateway.do');
+  });
+
+  it('rejects unloadable keys at configure time, not at checkout time', () => {
+    expect(() =>
+      validateConfig({
+        appId: 'x',
+        privateKey: 'not-a-key-not-a-key-not-a-key-not-a-key-not-a-key-not-a-key-1234',
+        alipayPublicKey: alipay.publicKey,
+        gatewayUrl: 'https://openapi.alipay.com/gateway.do',
+      }),
+    ).toThrow(AlipayError);
+  });
+
+  it('only allows https gateway hosts, never IPs or internal names', () => {
+    expect(() => assertGatewayUrl('http://openapi.alipay.com/gateway.do')).toThrow(/https/);
+    expect(() => assertGatewayUrl('https://127.0.0.1/gateway.do')).toThrow(/IP/);
+    expect(() => assertGatewayUrl('https://localhost/gateway.do')).toThrow(/内网/);
+    expect(() => assertGatewayUrl('https://openapi-sandbox.dl.alipaydev.com/gateway.do')).not.toThrow();
+  });
+});
diff --git a/packages/plugins/alipay/src/alipay-client.ts b/packages/plugins/alipay/src/alipay-client.ts
new file mode 100644
index 0000000..2279dcd
--- /dev/null
+++ b/packages/plugins/alipay/src/alipay-client.ts
@@ -0,0 +1,380 @@
+import { createPrivateKey, createPublicKey, createSign, createVerify } from 'node:crypto';
+import { z } from 'zod';
+
+/**
+ * 支付宝「当面付」（`alipay.trade.precreate`）协议层。
+ *
+ * 这里只做协议：拼参数、签名、验签、解析响应。网络与配置注入在上层，
+ * 所以整条链路可以在没有商户凭据的情况下用**自签密钥对**验证 —— 这正是
+ * 12.2 的验证策略：协议能验，商户号不能验，那就把能验的验透。
+ */
+
+export interface AlipayConfig {
+  appId: string;
+  /** 应用私钥（PKCS#8 或 PKCS#1，PEM）。 */
+  privateKey: string;
+  /** 支付宝公钥（PEM），用于验签响应与异步通知。 */
+  alipayPublicKey: string;
+  /** 网关地址；默认正式环境。沙箱填 `https://openapi-sandbox.dl.alipaydev.com/gateway.do`。 */
+  gatewayUrl: string;
+}
+
+export const ALIPAY_DEFAULT_GATEWAY = 'https://openapi.alipay.com/gateway.do';
+
+const ALIPAY_ERROR_CODES: Record<string, string> = {
+  '支付宝仅支持 CNY 币种': 'alipay.currency_unsupported',
+  支付金额无效: 'alipay.amount_invalid',
+  'RSA 密钥材料无效': 'alipay.keys_invalid',
+  '网关返回了无效的响应体': 'alipay.gateway_invalid_json',
+  '网关响应缺少签名': 'alipay.response_sign_missing',
+  '网关响应签名无效': 'alipay.response_signature_invalid',
+  '网关拒绝了支付请求': 'alipay.gateway_rejected',
+  '无法连接支付网关': 'alipay.gateway_unreachable',
+  回调签名无效: 'alipay.callback_signature_invalid',
+  '回调参数无效': 'alipay.callback_params_invalid',
+  '回调商户不匹配': 'alipay.callback_app_mismatch',
+  '回调金额无效': 'alipay.callback_amount_invalid',
+  '回调交易状态不可结算': 'alipay.callback_status_invalid',
+  支付宝配置参数无效: 'alipay.config_invalid',
+  支付宝尚未配置: 'alipay.not_configured',
+  支付宝插件未就绪: 'alipay.not_ready',
+  密钥存储未配置: 'alipay.secrets_unavailable',
+};
+
+export function alipayErrorCode(message: string): string {
+  const exact = ALIPAY_ERROR_CODES[message];
+  if (exact) return exact;
+  if (message.startsWith('Payment gateway returned HTTP')) return 'alipay.gateway_http_error';
+  if (message.startsWith('网关 URL')) return 'alipay.gateway_url_invalid';
+  return 'alipay.error';
+}
+
+export class AlipayError extends Error {
+  readonly code: string;
+
+  constructor(
+    readonly status: number,
+    message: string,
+    readonly definitive = false,
+  ) {
+    super(message);
+    this.name = 'AlipayError';
+    this.code = alipayErrorCode(message);
+  }
+}
+
+export type AlipayParams = Record<string, string | number | undefined | null>;
+
+/**
+ * 待签名串：按参数名 ASCII 升序拼接 `k=v&…`，排除 `sign` 与空值。
+ *
+ * 空值必须排除 —— 支付宝对「带了空参数」和「没带」的签名结果不同，
+ * 保留空值会让所有请求都验签失败，且错得很隐蔽（报错只说签名不对）。
+ */
+export function canonicalize(params: AlipayParams): string {
+  return Object.entries(params)
+    .filter(
+      ([key, value]) =>
+        key !== 'sign' && value !== undefined && value !== null && value !== '',
+    )
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    .map(([key, value]) => `${key}=${String(value)}`)
+    .join('&');
+}
+
+function loadPrivateKey(pem: string) {
+  try {
+    return createPrivateKey(pem);
+  } catch {
+    // 支付宝控制台给的是裸 base64 私钥，不是 PEM；这里接受两种形态，避免部署时
+    // 因为「少了两行头」而报一个看起来像签名错误的错。
+    try {
+      return createPrivateKey(wrapPem(pem, 'PRIVATE KEY'));
+    } catch {
+      throw new AlipayError(400, 'RSA 密钥材料无效', true);
+    }
+  }
+}
+
+function loadPublicKey(pem: string) {
+  try {
+    return createPublicKey(pem);
+  } catch {
+    try {
+      return createPublicKey(wrapPem(pem, 'PUBLIC KEY'));
+    } catch {
+      throw new AlipayError(400, 'RSA 密钥材料无效', true);
+    }
+  }
+}
+
+function wrapPem(raw: string, label: string): string {
+  const body = raw.replace(/\s+/g, '');
+  const lines = body.match(/.{1,64}/g) ?? [];
+  return `-----BEGIN ${label}-----\n${lines.join('\n')}\n-----END ${label}-----`;
+}
+
+export function signRsa2(content: string, privateKeyPem: string): string {
+  const signer = createSign('RSA-SHA256');
+  signer.update(content, 'utf8');
+  signer.end();
+  return signer.sign(loadPrivateKey(privateKeyPem), 'base64');
+}
+
+export function verifyRsa2(content: string, signature: string, publicKeyPem: string): boolean {
+  if (signature.length === 0) return false;
+  const verifier = createVerify('RSA-SHA256');
+  verifier.update(content, 'utf8');
+  verifier.end();
+  try {
+    return verifier.verify(loadPublicKey(publicKeyPem), signature, 'base64');
+  } catch {
+    return false;
+  }
+}
+
+/** 北京时间 `YYYY-MM-DD HH:mm:ss`（支付宝要求，且**不接受** ISO 8601）。 */
+export function alipayTimestamp(now: Date = new Date()): string {
+  const bj = new Date(now.getTime() + 8 * 60 * 60 * 1000);
+  const pad = (value: number) => String(value).padStart(2, '0');
+  return (
+    `${bj.getUTCFullYear()}-${pad(bj.getUTCMonth() + 1)}-${pad(bj.getUTCDate())} ` +
+    `${pad(bj.getUTCHours())}:${pad(bj.getUTCMinutes())}:${pad(bj.getUTCSeconds())}`
+  );
+}
+
+/** 分 → 元字符串（两位小数）。支付宝只认元，且不接受科学计数法。 */
+export function minorToYuan(amount: number): string {
+  if (!Number.isInteger(amount) || amount <= 0) throw new AlipayError(400, '支付金额无效', true);
+  return (amount / 100).toFixed(2);
+}
+
+/** 元字符串 → 分。回调里必须这样转，浮点加法会把 0.1+0.2 变成 0.30000000000000004。 */
+export function yuanToMinor(yuan: string): number {
+  const match = /^(\d{1,12})(?:\.(\d{1,2}))?$/.exec(yuan.trim());
+  if (!match) throw new AlipayError(400, '回调金额无效', true);
+  const whole = Number(match[1]);
+  const frac = (match[2] ?? '').padEnd(2, '0');
+  return whole * 100 + Number(frac);
+}
+
+export interface PrecreateInput {
+  merchantOrderNo: string;
+  amount: number;
+  subject: string;
+  notifyUrl: string;
+  /** 关单时间，例如 `15m`；超过后支付宝侧失效。 */
+  timeout?: string;
+}
+
+/** 构造 `alipay.trade.precreate` 的完整参数（已签名）。 */
+export function buildPrecreateParams(
+  config: AlipayConfig,
+  input: PrecreateInput,
+  timestamp: string = alipayTimestamp(),
+): Record<string, string> {
+  if (!input.merchantOrderNo) throw new AlipayError(400, '支付金额无效', true);
+  const bizContent: Record<string, unknown> = {
+    out_trade_no: input.merchantOrderNo,
+    total_amount: minorToYuan(input.amount),
+    subject: input.subject,
+    product_code: 'FACE_TO_FACE_PAYMENT',
+  };
+  if (input.timeout) bizContent['timeout_express'] = input.timeout;
+
+  const params: Record<string, string> = {
+    app_id: config.appId,
+    method: 'alipay.trade.precreate',
+    format: 'JSON',
+    charset: 'utf-8',
+    sign_type: 'RSA2',
+    timestamp,
+    version: '1.0',
+    notify_url: input.notifyUrl,
+    biz_content: JSON.stringify(bizContent),
+  };
+  return { ...params, sign: signRsa2(canonicalize(params), config.privateKey) };
+}
+
+export function buildCloseParams(
+  config: AlipayConfig,
+  merchantOrderNo: string,
+  timestamp: string = alipayTimestamp(),
+): Record<string, string> {
+  const params: Record<string, string> = {
+    app_id: config.appId,
+    method: 'alipay.trade.close',
+    format: 'JSON',
+    charset: 'utf-8',
+    sign_type: 'RSA2',
+    timestamp,
+    version: '1.0',
+    biz_content: JSON.stringify({ out_trade_no: merchantOrderNo }),
+  };
+  return { ...params, sign: signRsa2(canonicalize(params), config.privateKey) };
+}
+
+/**
+ * 从网关响应里取出业务节点原文并验签。
+ *
+ * 关键点：支付宝签的是**响应体里那段 JSON 原文**，不是重新序列化后的对象。
+ * 用 `JSON.stringify(parsed)` 去验签会在字段顺序/空格/unicode 转义上不一致，
+ * 结果是「明明签名对却验不过」。所以先按文本定位节点，验签通过再 parse。
+ */
+export function extractSignedNode(body: string, nodeName: string): { raw: string; sign: string } {
+  const marker = `"${nodeName}"`;
+  const markerAt = body.indexOf(marker);
+  if (markerAt === -1) throw new AlipayError(502, '网关返回了无效的响应体');
+  const colonAt = body.indexOf(':', markerAt + marker.length);
+  if (colonAt === -1) throw new AlipayError(502, '网关返回了无效的响应体');
+  let start = colonAt + 1;
+  while (start < body.length && /\s/.test(body[start] ?? '')) start += 1;
+  if (body[start] !== '{') throw new AlipayError(502, '网关返回了无效的响应体');
+
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  let end = -1;
+  for (let index = start; index < body.length; index += 1) {
+    const char = body[index];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') inString = false;
+      continue;
+    }
+    if (char === '"') inString = true;
+    else if (char === '{') depth += 1;
+    else if (char === '}') {
+      depth -= 1;
+      if (depth === 0) {
+        end = index + 1;
+        break;
+      }
+    }
+  }
+  if (end === -1) throw new AlipayError(502, '网关返回了无效的响应体');
+
+  const signMatch = /"sign"\s*:\s*"([^"]+)"/.exec(body.slice(end));
+  if (!signMatch?.[1]) throw new AlipayError(502, '网关响应缺少签名');
+  return { raw: body.slice(start, end), sign: signMatch[1] };
+}
+
+const precreateResponseSchema = z
+  .object({
+    code: z.string(),
+    msg: z.string().optional(),
+    sub_code: z.string().optional(),
+    sub_msg: z.string().optional(),
+    out_trade_no: z.string().optional(),
+    qr_code: z.string().optional(),
+  })
+  .passthrough();
+
+export type PrecreateResponse = z.infer<typeof precreateResponseSchema>;
+
+/** 验签并解析 `alipay_trade_precreate_response`；业务失败抛 `definitive` 错误。 */
+export function parsePrecreateResponse(body: string, config: AlipayConfig): PrecreateResponse {
+  const { raw, sign } = extractSignedNode(body, 'alipay_trade_precreate_response');
+  if (!verifyRsa2(raw, sign, config.alipayPublicKey)) {
+    throw new AlipayError(502, '网关响应签名无效');
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new AlipayError(502, '网关返回了无效的响应体');
+  }
+  const response = precreateResponseSchema.parse(parsed);
+  if (response.code !== '10000') {
+    // 业务失败是「确定的」失败（参数/商户配置问题），不该重试。
+    throw new AlipayError(
+      502,
+      `网关拒绝了支付请求${response.sub_msg ? `：${response.sub_msg}` : ''}`,
+      true,
+    );
+  }
+  if (!response.qr_code) throw new AlipayError(502, '网关拒绝了支付请求', true);
+  return response;
+}
+
+export interface CallbackSettlement {
+  merchantOrderNo: string;
+  externalId: string;
+  amount: number;
+  currency: string;
+}
+
+const CALLBACK_SETTLE_STATUSES = new Set(['TRADE_SUCCESS', 'TRADE_FINISHED']);
+
+/**
+ * 校验支付宝异步通知并提取结算信息。
+ *
+ * 注意「不结算也要回 success」这件事由调用方处理：通知里 `TRADE_CLOSED` 之类
+ * 不是错误，回 4xx 会让支付宝一直重推。这里只负责判定「能不能结算」。
+ */
+export function verifyCallback(
+  params: AlipayParams,
+  config: AlipayConfig,
+): CallbackSettlement | null {
+  const raw: Record<string, string> = {};
+  for (const [key, value] of Object.entries(params)) {
+    if (value === undefined || value === null) continue;
+    if (typeof value !== 'string' && typeof value !== 'number') {
+      throw new AlipayError(400, '回调参数无效', true);
+    }
+    raw[key] = String(value);
+  }
+  const sign = raw['sign'];
+  if (!sign) throw new AlipayError(400, '回调签名无效', true);
+  if (!verifyRsa2(canonicalize(raw), sign, config.alipayPublicKey)) {
+    throw new AlipayError(400, '回调签名无效', true);
+  }
+  if (raw['app_id'] !== config.appId) throw new AlipayError(400, '回调商户不匹配', true);
+
+  const status = raw['trade_status'] ?? '';
+  if (!CALLBACK_SETTLE_STATUSES.has(status)) return null;
+
+  const merchantOrderNo = raw['out_trade_no'];
+  const externalId = raw['trade_no'];
+  const totalAmount = raw['total_amount'];
+  if (!merchantOrderNo || !externalId || !totalAmount) {
+    throw new AlipayError(400, '回调参数无效', true);
+  }
+  return {
+    merchantOrderNo,
+    externalId,
+    amount: yuanToMinor(totalAmount),
+    currency: 'CNY',
+  };
+}
+
+export const configSchema = z.object({
+  appId: z.string().trim().min(1).max(64),
+  privateKey: z.string().min(64).max(20_000),
+  alipayPublicKey: z.string().min(64).max(20_000),
+  gatewayUrl: z.string().trim().url().max(191).default(ALIPAY_DEFAULT_GATEWAY),
+});
+
+export type AlipayConfigInput = z.infer<typeof configSchema>;
+
+/** 校验密钥可用性：宁可现在报错，也不要等到用户点支付时才 500。 */
+export function validateConfig(input: AlipayConfigInput): AlipayConfig {
+  const config: AlipayConfig = {
+    appId: input.appId,
+    privateKey: input.privateKey,
+    alipayPublicKey: input.alipayPublicKey,
+    gatewayUrl: input.gatewayUrl || ALIPAY_DEFAULT_GATEWAY,
+  };
+  // 用一次自签验签确认两把钥匙都能装载：签名能成、验签能过。
+  const probe = signRsa2('stackpanel-alipay-probe', config.privateKey);
+  const publicKey = createPublicKey(loadPrivateKey(config.privateKey)).export({
+    type: 'spki',
+    format: 'pem',
+  });
+  if (typeof publicKey !== 'string' || probe.length === 0) {
+    throw new AlipayError(400, 'RSA 密钥材料无效', true);
+  }
+  loadPublicKey(config.alipayPublicKey);
+  return config;
+}
diff --git a/packages/plugins/alipay/src/index.test.ts b/packages/plugins/alipay/src/index.test.ts
new file mode 100644
index 0000000..bc32def
--- /dev/null
+++ b/packages/plugins/alipay/src/index.test.ts
@@ -0,0 +1,225 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { buildPrecreateParams, canonicalize, signRsa2 } from './alipay-client.js';
+import alipayPlugin from './index.js';
+
+/**
+ * 插件自身的接线（不是协议）：createPayment / callback / configure 在真实
+ * ctx 契约下是否走得通。协议细节在 alipay-client.test.ts 里验。
+ */
+const merchant = generateKeyPairSync('rsa', {
+  modulusLength: 2048,
+  publicKeyEncoding: { type: 'spki', format: 'pem' },
+  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+});
+const alipay = generateKeyPairSync('rsa', {
+  modulusLength: 2048,
+  publicKeyEncoding: { type: 'spki', format: 'pem' },
+  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+});
+
+function fakeCtx(storedConfig: unknown = null) {
+  const secrets = new Map<string, string>();
+  const settles: unknown[] = [];
+  const ctx = {
+    logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() },
+    secrets: {
+      isAvailable: () => true,
+      get: async (key: string) => secrets.get(key) ?? null,
+      set: async (key: string, value: string) => {
+        secrets.set(key, value);
+      },
+    },
+    payments: {
+      getProviderConfig: async () => storedConfig,
+      settle: async (input: unknown) => {
+        settles.push(input);
+        return { settled: true, alreadySettled: false };
+      },
+    },
+  };
+  return { ctx, settles, secrets };
+}
+
+function config() {
+  return {
+    appId: '2021000000000000',
+    privateKey: merchant.privateKey,
+    alipayPublicKey: alipay.publicKey,
+    gatewayUrl: 'https://openapi.alipay.com/gateway.do',
+  };
+}
+
+/** 启动插件并拿到它注册到扩展点上的 provider 实例。 */
+async function activate(storedConfig: unknown) {
+  let registered: unknown = null;
+  const { ctx, settles, secrets } = fakeCtx(storedConfig);
+  await alipayPlugin.onActivate?.({
+    ...ctx,
+    registerExtension: (_point: string, service: unknown) => {
+      registered = service;
+      return () => undefined;
+    },
+  } as never);
+  return { provider: registered as Record<string, unknown>, settles, secrets, ctx };
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  alipayPlugin.onDeactivate?.({ logger: { info: vi.fn() } } as never);
+});
+
+describe('alipay plugin wiring', () => {
+  it('registers a gateway provider with the alipay method once configured', async () => {
+    const { provider } = await activate(config());
+    expect(provider['id']).toBe('alipay');
+    expect(provider['mode']).toBe('gateway');
+    expect(provider['callbackPath']).toBe('/callbacks/alipay');
+    expect((provider['getMethods'] as () => unknown[])().length).toBe(1);
+  });
+
+  it('offers no methods until configured', async () => {
+    const { provider } = await activate(null);
+    expect((provider['getMethods'] as () => unknown[])()).toEqual([]);
+  });
+
+  it('posts a signed precreate request and returns the QR payload', async () => {
+    const { provider } = await activate(config());
+    const node = JSON.stringify({
+      code: '10000',
+      msg: 'Success',
+      out_trade_no: 'ORD-1',
+      qr_code: 'https://qr.alipay.com/abc',
+    });
+    const body = `{"alipay_trade_precreate_response":${node},"sign":"${signRsa2(node, alipay.privateKey)}"}`;
+    const fetchMock = vi.fn(async (_url: string, init: RequestInit) => {
+      const form = new URLSearchParams(String(init.body));
+      expect(form.get('method')).toBe('alipay.trade.precreate');
+      return new Response(body, { status: 200 });
+    });
+    vi.stubGlobal('fetch', fetchMock);
+
+    const result = await (provider['createPayment'] as (input: unknown) => Promise<unknown>)({
+      purpose: 'ORDER',
+      merchantOrderNo: 'ORD-1',
+      amount: 1234,
+      currency: 'CNY',
+      method: 'alipay',
+      subject: '测试订单',
+      notifyUrl: 'https://shop.example.com/callbacks/alipay',
+      returnUrl: 'https://shop.example.com/orders/1',
+    });
+    expect(result).toMatchObject({
+      externalId: 'ORD-1',
+      paymentUrl: 'https://qr.alipay.com/abc',
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('refuses non-CNY before touching the network', async () => {
+    const { provider } = await activate(config());
+    const fetchMock = vi.fn();
+    vi.stubGlobal('fetch', fetchMock);
+    await expect(
+      (provider['createPayment'] as (input: unknown) => Promise<unknown>)({
+        purpose: 'ORDER',
+        merchantOrderNo: 'ORD-1',
+        amount: 1234,
+        currency: 'USD',
+        method: 'alipay',
+        subject: 'x',
+        notifyUrl: 'https://x/cb',
+        returnUrl: 'https://x/r',
+      }),
+    ).rejects.toThrow(/CNY/);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('settles a signed success notification and answers success', async () => {
+    const { provider, settles } = await activate(config());
+    const params: Record<string, string> = {
+      app_id: '2021000000000000',
+      out_trade_no: 'ORD-1',
+      trade_no: '2026',
+      trade_status: 'TRADE_SUCCESS',
+      total_amount: '12.34',
+    };
+    const body = { ...params, sign: signRsa2(canonicalize(params), alipay.privateKey) };
+    const sent: unknown[] = [];
+    const reply = { send: (value: unknown) => sent.push(value) };
+
+    await (provider['callback'] as (req: unknown, reply: unknown) => Promise<unknown>)(
+      { body, query: {}, headers: {} },
+      reply,
+    );
+    expect(settles).toEqual([
+      {
+        providerId: 'alipay',
+        merchantOrderNo: 'ORD-1',
+        externalId: '2026',
+        amount: 1234,
+        currency: 'CNY',
+      },
+    ]);
+    expect(sent).toEqual(['success']);
+  });
+
+  it('still answers success for a closed trade (no settlement, no retry storm)', async () => {
+    const { provider, settles } = await activate(config());
+    const params: Record<string, string> = {
+      app_id: '2021000000000000',
+      out_trade_no: 'ORD-1',
+      trade_no: '2026',
+      trade_status: 'TRADE_CLOSED',
+      total_amount: '12.34',
+    };
+    const body = { ...params, sign: signRsa2(canonicalize(params), alipay.privateKey) };
+    const sent: unknown[] = [];
+    await (provider['callback'] as (req: unknown, reply: unknown) => Promise<unknown>)(
+      { body, query: {}, headers: {} },
+      { send: (value: unknown) => sent.push(value) },
+    );
+    expect(settles).toEqual([]);
+    expect(sent).toEqual(['success']);
+  });
+
+  it('rejects an unsigned notification before settling', async () => {
+    const { provider, settles } = await activate(config());
+    await expect(
+      (provider['callback'] as (req: unknown, reply: unknown) => Promise<unknown>)(
+        { body: { out_trade_no: 'ORD-1', trade_status: 'TRADE_SUCCESS' }, query: {}, headers: {} },
+        { send: vi.fn() },
+      ),
+    ).rejects.toThrow(/回调签名无效/);
+    expect(settles).toEqual([]);
+  });
+
+  it('persists a validated config through secret storage', async () => {
+    const { provider, secrets } = await activate(null);
+    await (provider['configure'] as (input: unknown) => Promise<unknown>)(config());
+    const stored = JSON.parse(secrets.get('gateway-config') ?? '{}') as { appId?: string };
+    expect(stored.appId).toBe('2021000000000000');
+    expect((provider['getMethods'] as () => unknown[])().length).toBe(1);
+  });
+
+  it('rejects a config whose keys cannot be loaded, before saving anything', async () => {
+    const { provider, secrets } = await activate(null);
+    await expect(
+      (provider['configure'] as (input: unknown) => Promise<unknown>)({
+        ...config(),
+        privateKey: 'x'.repeat(80),
+      }),
+    ).rejects.toThrow(/RSA 密钥材料无效/);
+    expect(secrets.size).toBe(0);
+  });
+
+  it('builds the precreate params used by the gateway call', () => {
+    const params = buildPrecreateParams(config(), {
+      merchantOrderNo: 'ORD-1',
+      amount: 100,
+      subject: 'x',
+      notifyUrl: 'https://x/cb',
+    });
+    expect(params['notify_url']).toBe('https://x/cb');
+  });
+});
diff --git a/packages/plugins/alipay/src/index.ts b/packages/plugins/alipay/src/index.ts
new file mode 100644
index 0000000..78469fb
--- /dev/null
+++ b/packages/plugins/alipay/src/index.ts
@@ -0,0 +1,284 @@
+import { EXTENSION_POINTS, definePlugin, PluginError } from '@stackpanel/sdk';
+import type {
+  ExternalPaymentInitiation,
+  ExternalPaymentInitiationResult,
+  ExternalPaymentRequest,
+  HttpReply,
+  HttpRequest,
+  PaymentMethod,
+  PaymentProvider,
+  PluginContext,
+} from '@stackpanel/sdk';
+import {
+  ALIPAY_DEFAULT_GATEWAY,
+  AlipayError,
+  buildCloseParams,
+  buildPrecreateParams,
+  configSchema,
+  parsePrecreateResponse,
+  validateConfig,
+  verifyCallback,
+  type AlipayConfig,
+} from './alipay-client.js';
+
+const CONFIG_KEY = 'gateway-config';
+const ALIPAY_METHOD: PaymentMethod = {
+  id: 'alipay',
+  label: '支付宝',
+  topUpAmounts: [1000, 3000, 5000, 10000],
+};
+
+/**
+ * 支付宝「当面付」直连（对标 #12.2 的支付宝半边）。
+ *
+ * 与 epay 的区别：不经过第三方聚合，商户号/应用私钥/支付宝公钥都由平台自己持有。
+ * 代价是运维要自己配密钥，收益是不再被中间商抽成、也不再受其可用性影响。
+ */
+class AlipayService implements PaymentProvider {
+  readonly id = 'alipay';
+  readonly name = '支付宝';
+  readonly mode = 'gateway' as const;
+  readonly callbackPath = '/callbacks/alipay';
+  private config: AlipayConfig | null = null;
+
+  constructor(private readonly ctx: PluginContext) {}
+
+  async load(): Promise<void> {
+    // 主路径：绑定到 payment_methods 的配置（内核已按 providerId 取第一个启用的方法）。
+    try {
+      const methodConfig = await this.ctx.payments.getProviderConfig('alipay');
+      if (methodConfig) {
+        const parsed = configSchema.parse(methodConfig);
+        this.config = validateConfig(parsed);
+        return;
+      }
+    } catch (error) {
+      this.ctx.logger.warn(`alipay: could not load config from payment methods: ${String(error)}`);
+    }
+
+    const saved = await this.ctx.secrets.get(CONFIG_KEY);
+    if (!saved) return;
+    try {
+      this.config = validateConfig(configSchema.parse(JSON.parse(saved)));
+    } catch {
+      this.ctx.logger.warn('alipay: stored gateway configuration is invalid and has been disabled');
+      this.config = null;
+    }
+  }
+
+  getMethods(): PaymentMethod[] {
+    return this.config ? [ALIPAY_METHOD] : [];
+  }
+
+  async createPayment(
+    request: ExternalPaymentRequest,
+    config?: unknown,
+  ): Promise<ExternalPaymentInitiationResult> {
+    const resolved = config ? this.parseConfig(config) : this.requireConfig();
+    // 当面付只结算人民币。跨币种由内核换算成结算币种后再进来，这里不接受别的币种。
+    if (request.currency !== 'CNY') throw new AlipayError(400, '支付宝仅支持 CNY 币种', true);
+
+    const params = buildPrecreateParams(resolved, {
+      merchantOrderNo: request.merchantOrderNo,
+      amount: request.amount,
+      subject: request.subject,
+      notifyUrl: request.notifyUrl,
+      timeout: '15m',
+    });
+
+    const body = await this.post(resolved.gatewayUrl, params);
+    const response = parsePrecreateResponse(body, resolved);
+    const initiation: ExternalPaymentInitiation = {
+      externalId: response.out_trade_no ?? request.merchantOrderNo,
+      // 当面付返回的是二维码内容（不是可跳转网页），前端据此渲染二维码。
+      paymentUrl: response.qr_code as string,
+      expiresAt: new Date(Date.now() + 15 * 60_000),
+    };
+    return initiation;
+  }
+
+  async closePayment(request: { merchantOrderNo: string }): Promise<boolean> {
+    const config = this.requireConfig();
+    const body = await this.post(config.gatewayUrl, buildCloseParams(config, request.merchantOrderNo));
+    // 关单失败不做「本地已关」的假象：返回 false 让内核保留支付记录，等过期扫描处理。
+    return body.includes('"code":"10000"') || body.includes('"code":"40004"');
+  }
+
+  async status(): Promise<unknown> {
+    return {
+      configured: this.config !== null,
+      secretsEnabled: this.ctx.secrets.isAvailable(),
+      ...(this.config
+        ? { appId: this.config.appId, gatewayUrl: this.config.gatewayUrl, methods: this.getMethods() }
+        : {}),
+    };
+  }
+
+  async configure(input: unknown): Promise<unknown> {
+    if (!this.ctx.secrets.isAvailable()) throw new AlipayError(503, '密钥存储未配置');
+    const parsed = configSchema.safeParse(input);
+    if (!parsed.success) throw new AlipayError(400, '支付宝配置参数无效', true);
+    const config = validateConfig(parsed.data);
+    assertGatewayUrl(config.gatewayUrl);
+    await this.ctx.secrets.set(CONFIG_KEY, JSON.stringify(config));
+    this.config = config;
+    return this.status();
+  }
+
+  /**
+   * 异步通知。**无论是否结算都要回 `success`** —— 回 4xx 支付宝会一直重推，
+   * 而「交易关闭」这类通知本来就不该结算，重推多少次结果都一样。
+   */
+  async callback(req: HttpRequest, reply: HttpReply): Promise<unknown> {
+    const config = this.requireConfig();
+    const params = mergeParams(req.body, req.query);
+    const settlement = verifyCallback(params, config);
+    if (!settlement) return reply.send('success');
+    await this.ctx.payments.settle({
+      providerId: this.id,
+      merchantOrderNo: settlement.merchantOrderNo,
+      externalId: settlement.externalId,
+      amount: settlement.amount,
+      currency: settlement.currency,
+    });
+    return reply.send('success');
+  }
+
+  private async post(url: string, params: Record<string, string>): Promise<string> {
+    const form = new URLSearchParams(params);
+    let response: Response;
+    try {
+      response = await fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded;charset=utf-8' },
+        body: form.toString(),
+        signal: AbortSignal.timeout(20_000),
+      });
+    } catch {
+      throw new AlipayError(502, '无法连接支付网关');
+    }
+    if (!response.ok) {
+      throw new AlipayError(502, `Payment gateway returned HTTP ${response.status}`);
+    }
+    return response.text();
+  }
+
+  private parseConfig(config: unknown): AlipayConfig {
+    const parsed = configSchema.safeParse(config);
+    if (!parsed.success) throw new AlipayError(503, '支付宝配置参数无效');
+    return validateConfig(parsed.data);
+  }
+
+  private requireConfig(): AlipayConfig {
+    if (!this.config) throw new AlipayError(503, '支付宝尚未配置');
+    return this.config;
+  }
+}
+
+/** 回调参数可能来自 body（POST 表单）或 query（少数网关版本）。 */
+function mergeParams(body: unknown, query: Record<string, unknown>): Record<string, string> {
+  const params: Record<string, string> = {};
+  for (const source of [query, body]) {
+    if (!source || typeof source !== 'object' || Array.isArray(source)) continue;
+    for (const [key, value] of Object.entries(source as Record<string, unknown>)) {
+      if (Array.isArray(value) || (typeof value !== 'string' && typeof value !== 'number')) {
+        throw new AlipayError(400, '回调参数无效', true);
+      }
+      params[key] = String(value);
+    }
+  }
+  return params;
+}
+
+/**
+ * 网关地址校验：必须是 https，且不能是 IP 字面量或内网域名。
+ *
+ * 允许自定义网关是为了沙箱；但「可配置的出站地址」天然是 SSRF 入口，
+ * 所以只给域名、只给 https。
+ */
+export function assertGatewayUrl(raw: string): void {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new AlipayError(400, '网关 URL 无效', true);
+  }
+  if (url.protocol !== 'https:') throw new AlipayError(400, '网关 URL 必须使用 https', true);
+  const host = url.hostname;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(':')) {
+    throw new AlipayError(400, '网关 URL 不能是 IP 地址', true);
+  }
+  if (host === 'localhost' || host.endsWith('.local') || host.endsWith('.internal')) {
+    throw new AlipayError(400, '网关 URL 不能指向内网', true);
+  }
+}
+
+function handle(handler: (req: HttpRequest, reply: HttpReply) => Promise<unknown>) {
+  return async (req: HttpRequest, reply: HttpReply): Promise<unknown> => {
+    try {
+      return await handler(req, reply);
+    } catch (error) {
+      if (error instanceof AlipayError) throw new PluginError(error.code, error.status, error.message);
+      throw error;
+    }
+  };
+}
+
+let service: AlipayService | null = null;
+
+export const alipayPlugin = definePlugin({
+  manifest: {
+    id: 'alipay',
+    name: '支付宝（当面付）',
+    version: '0.1.0',
+    description: '支付宝当面付直连：扫码支付 + 异步通知验签，不经过第三方聚合网关。',
+    provides: [EXTENSION_POINTS.paymentProvider],
+    permissions: ['alipay.admin'],
+    roleTemplates: [{ role: 'ADMIN', permissions: ['alipay.admin'] }],
+  },
+  routes: [
+    {
+      method: 'GET',
+      path: '/alipay/admin/config',
+      auth: 'admin',
+      permission: 'alipay.admin',
+      handler: handle(
+        async () => service?.status() ?? Promise.reject(new AlipayError(503, '支付宝插件未就绪')),
+      ),
+    },
+    {
+      method: 'POST',
+      path: '/alipay/admin/config',
+      auth: 'admin',
+      permission: 'alipay.admin',
+      handler: handle(
+        async (req) =>
+          service?.configure(req.body) ?? Promise.reject(new AlipayError(503, '支付宝插件未就绪')),
+      ),
+    },
+    {
+      method: 'POST',
+      path: '/callbacks/alipay',
+      auth: 'public',
+      handler: handle(
+        async (req, reply) =>
+          service?.callback(req, reply) ?? Promise.reject(new AlipayError(503, '支付宝插件未就绪')),
+      ),
+    },
+  ],
+  onActivate: async (ctx) => {
+    service = new AlipayService(ctx);
+    await service.load();
+    ctx.registerExtension<PaymentProvider>(EXTENSION_POINTS.paymentProvider, service);
+    ctx.logger.info(
+      `alipay: activated (${service.getMethods().length > 0 ? 'configured' : 'not configured'})`,
+    );
+  },
+  onDeactivate: (ctx) => {
+    service = null;
+    ctx.logger.info('alipay: deactivated');
+  },
+});
+
+export default alipayPlugin;
+export { ALIPAY_DEFAULT_GATEWAY };
diff --git a/packages/plugins/alipay/tsconfig.build.json b/packages/plugins/alipay/tsconfig.build.json
new file mode 100644
index 0000000..022a0f5
--- /dev/null
+++ b/packages/plugins/alipay/tsconfig.build.json
@@ -0,0 +1,11 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": false,
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "exclude": ["src/**/*.test.ts"]
+}
diff --git a/packages/plugins/alipay/tsconfig.json b/packages/plugins/alipay/tsconfig.json
new file mode 100644
index 0000000..d965e72
--- /dev/null
+++ b/packages/plugins/alipay/tsconfig.json
@@ -0,0 +1,10 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "src",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["src/**/*.test.ts"]
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f4ebb57..c96c506 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -31,6 +31,34 @@ importers:
         specifier: ^6.0.3
         version: 6.0.3
 
+  packages/plugins/alipay:
+    dependencies:
+      '@stackpanel/sdk':
+        specifier: link:../../../../StackPanel/packages/sdk
+        version: link:../../../../StackPanel/packages/sdk
+      zod:
+        specifier: link:../../../../StackPanel/node_modules/zod
+        version: link:../../../../StackPanel/node_modules/zod
+    devDependencies:
+      '@types/node':
+        specifier: ^22.20.1
+        version: 22.20.5
+      typescript:
+        specifier: ^6.0.3
+        version: 6.0.3
+      vitest:
+        specifier: ^4.1.10
+        version: 4.1.12(@types/node@22.20.5)(vite@8.3.4(@types/node@22.20.5)(esbuild@0.27.7))
+
+  packages/plugins/alipay/frontend:
+    dependencies:
+      sonner:
+        specifier: ^2.0.8
+        version: 2.0.8(react-dom@19.3.1(react@19.3.1))(react@19.3.1)
+      zod:
+        specifier: link:../../../../../StackPanel/node_modules/zod
+        version: link:../../../../../StackPanel/node_modules/zod
+
   packages/plugins/catalog:
     dependencies:
       '@stackpanel/sdk':