@cosmicdrift/kumiko-bundled-features 0.248.0 → 0.249.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.248.0",
+  "version": "0.249.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.248.0",
-    "@cosmicdrift/kumiko-framework": "0.248.0",
-    "@cosmicdrift/kumiko-headless": "0.248.0",
-    "@cosmicdrift/kumiko-renderer": "0.248.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.248.0",
-    "@cosmicdrift/kumiko-types": "0.248.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.249.0",
+    "@cosmicdrift/kumiko-framework": "0.249.0",
+    "@cosmicdrift/kumiko-headless": "0.249.0",
+    "@cosmicdrift/kumiko-renderer": "0.249.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.249.0",
+    "@cosmicdrift/kumiko-types": "0.249.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.248.0",
-    "@cosmicdrift/kumiko-locale-es": "0.248.0"
+    "@cosmicdrift/kumiko-locale-de": "0.249.0",
+    "@cosmicdrift/kumiko-locale-es": "0.249.0"
   }
 }

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -68,6 +68,7 @@ const mockCheckoutCalls: Array<{
   successUrl: string;
   cancelUrl: string;
   providerCustomerId?: string;
+  mode?: "subscription" | "payment";
 }> = [];
 const mockPortalCalls: Array<{ providerCustomerId: string; returnUrl: string }> = [];
 
@@ -82,6 +83,7 @@ const mockProviderFeature = defineFeature("test-mock-provider", (r) => {
         successUrl: options.successUrl,
         cancelUrl: options.cancelUrl,
         ...(options.providerCustomerId && { providerCustomerId: options.providerCustomerId }),
+        ...(options.mode && { mode: options.mode }),
       });
       return { url: `https://mock.example/checkout/${options.priceId}` };
     },
@@ -513,6 +515,41 @@ describe("scenario 6: create-checkout-session — Plugin-routing", () => {
     );
     expect(mockCheckoutCalls[0]?.providerCustomerId).toBe("cus_existing_xyz");
   });
+
+  test("optional mode wird durchgereicht (One-off-Payment-Flow, fw#2755)", async () => {
+    mockCheckoutCalls.length = 0;
+    const admin = adminFor(3014);
+    await stack.http.writeOk(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_topup_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+        mode: "payment",
+      },
+      admin,
+    );
+    expect(mockCheckoutCalls).toHaveLength(1);
+    expect(mockCheckoutCalls[0]?.mode).toBe("payment");
+  });
+
+  test("mode omitted → plugin receives no mode field (Regression-Pin für bestehende Aufrufer)", async () => {
+    mockCheckoutCalls.length = 0;
+    const admin = adminFor(3015);
+    await stack.http.writeOk(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_pro_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+      },
+      admin,
+    );
+    expect(mockCheckoutCalls).toHaveLength(1);
+    expect(mockCheckoutCalls[0]?.mode).toBeUndefined();
+  });
 });
 
 describe("scenario 7: create-portal-session — Plugin-routing", () => {

package/src/billing-foundation/handlers/create-checkout-session.write.ts

@@ -32,13 +32,16 @@ const createCheckoutSessionSchema = z.object({
   /** Optional: existierender provider-customer wenn der Tenant schon
    *  einen account beim Provider hat (= Plan-Wechsel statt Neuregistrierung). */
   providerCustomerId: z.string().max(200).optional(),
+  /** Optional: `"payment"` for a one-off checkout (e.g. credit top-up)
+   *  instead of a recurring subscription. Defaults to `"subscription"`. */
+  mode: z.enum(["subscription", "payment"]).optional(),
 });
 type CreateCheckoutSessionPayload = z.infer<typeof createCheckoutSessionSchema>;
 
 export const createCheckoutSessionHandler: WriteHandlerDef = {
   name: "create-checkout-session",
   description:
-    "Opens a hosted checkout page at the named subscription provider for the caller's tenant and returns its URL; use it when a tenant admin wants to subscribe or switch to a paid plan.",
+    'Opens a hosted checkout page at the named subscription provider for the caller\'s tenant and returns its URL; use it when a tenant admin wants to subscribe, switch plans, or make a one-off payment (mode: "payment").',
   schema: createCheckoutSessionSchema,
   // Tenant-Admin-only — der Tenant muss bewusst seine Subscription
   // konfigurieren. SystemAdmin als Fallback für Operator-Initiated-Flows.
@@ -71,6 +74,7 @@ export const createCheckoutSessionHandler: WriteHandlerDef = {
       successUrl: payload.successUrl,
       cancelUrl: payload.cancelUrl,
       ...(payload.providerCustomerId && { providerCustomerId: payload.providerCustomerId }),
+      ...(payload.mode && { mode: payload.mode }),
     });
 
     return {

package/src/billing-foundation/types.ts

@@ -129,6 +129,11 @@ export type SubscriptionProviderPlugin = {
        *  schon einen Account beim Provider hat. Sonst legt der Provider
        *  beim checkout einen neuen customer an. */
       readonly providerCustomerId?: string;
+      /** Checkout mode. `"subscription"` (default) starts a recurring
+       *  billing flow; `"payment"` a one-off checkout (e.g. pay-per-use
+       *  credit top-ups). Optional with default `"subscription"` — existing
+       *  callers are unaffected. */
+      readonly mode?: "subscription" | "payment";
     },
   ) => Promise<{ readonly url: string }>;
 

package/src/cap-overview/__tests__/cap-overview-security.integration.test.ts

@@ -158,6 +158,55 @@ describe("cap-overview tenant isolation", () => {
   });
 });
 
+describe("cap-overview my-caps for regular tenant members", () => {
+  test("a regular User(A) reads A's own usage, not a 403", async () => {
+    const memberA = createTestUser({ id: 90041, tenantId: TENANT_A, roles: ["User"] });
+    const result = await stack.http.queryOk<{
+      rows: readonly { id: string; used: number | null }[];
+    }>(CapOverviewQueries.capsUsage, {}, memberA);
+    const widgetsRow = result.rows.find((row) => row.id === testCap.id);
+    expect(widgetsRow?.used).toBe(USAGE_BY_TENANT[TENANT_A]);
+  });
+
+  test("an Editor(B) reads B's own usage, not A's", async () => {
+    const editorB = createTestUser({ id: 90042, tenantId: TENANT_B, roles: ["Editor"] });
+    const result = await stack.http.queryOk<{
+      rows: readonly { id: string; used: number | null }[];
+    }>(CapOverviewQueries.capsUsage, {}, editorB);
+    const widgetsRow = result.rows.find((row) => row.id === testCap.id);
+    expect(widgetsRow?.used).toBe(USAGE_BY_TENANT[TENANT_B]);
+    expect(widgetsRow?.used).not.toBe(USAGE_BY_TENANT[TENANT_A]);
+  });
+
+  test("a regular User(A) cannot read tenant B's usage via override", async () => {
+    const memberA = createTestUser({ id: 90043, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(
+      CapOverviewQueries.capsUsage,
+      { tenantId: TENANT_B },
+      memberA,
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("a regular User(A) cannot list all tenants", async () => {
+    const memberA = createTestUser({ id: 90044, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(CapOverviewQueries.tenantCapsList, {}, memberA);
+    expect(res.status).toBe(403);
+  });
+
+  test("a regular User(A) cannot enumerate tenant names via the platform picker", async () => {
+    const memberA = createTestUser({ id: 90045, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(CapOverviewQueries.tenantOptions, {}, memberA);
+    expect(res.status).toBe(403);
+  });
+
+  test("an unranked app role still cannot reach my-caps", async () => {
+    const viewerA = createTestUser({ id: 90046, tenantId: TENANT_A, roles: ["Viewer"] });
+    const res = await stack.http.query(CapOverviewQueries.capsUsage, {}, viewerA);
+    expect(res.status).toBe(403);
+  });
+});
+
 describe("cap-overview tier filter operators", () => {
   test("op:ne excludes tenants matching the value, not just those matching it", async () => {
     const sysAdmin = createTestUser({ id: 90017, tenantId: TENANT_A, roles: ["SystemAdmin"] });

package/src/cap-overview/__tests__/cap-overview.boot.test.ts

@@ -1,11 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { billingFoundationFeature } from "../../billing-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { tierEngineFeature } from "../../tier-engine";
+import { MY_CAPS_ACCESS_ROLES } from "../access";
 import {
   MY_CAPS_SCREEN_ID,
   PLATFORM_TENANT_CAPS_SCREEN_ID,
@@ -58,6 +60,29 @@ describe("cap-overview boot", () => {
     expect(feature.screens[PLATFORM_TENANT_CAPS_SCREEN_ID]?.type).toBe("dashboard");
   });
 
+  test("my-caps screen and the query filling its cards carry the SAME rule", () => {
+    const feature = createCapOverviewFeature({ caps: [testCap] });
+    expect(rolesOf(feature.screens[MY_CAPS_SCREEN_ID]?.access)).toEqual([...MY_CAPS_ACCESS_ROLES]);
+    expect(rolesOf(feature.queryHandlers["caps:usage"]?.access)).toEqual([...MY_CAPS_ACCESS_ROLES]);
+  });
+
+  test("my-caps stays reachable for every role that reached it before", () => {
+    for (const role of access.admin) {
+      expect(MY_CAPS_ACCESS_ROLES).toContain(role);
+    }
+    expect(MY_CAPS_ACCESS_ROLES).toContain("User");
+  });
+
+  test("the platform-wide screens and their queries stay SystemAdmin-only", () => {
+    const feature = createCapOverviewFeature({ caps: [testCap] });
+    expect(rolesOf(feature.screens[TENANT_CAP_LIST_SCREEN_ID]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(feature.screens[PLATFORM_TENANT_CAPS_SCREEN_ID]?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+    expect(rolesOf(feature.queryHandlers["tenant-caps:list"]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(feature.queryHandlers["tenant-options"]?.access)).toEqual(["SystemAdmin"]);
+  });
+
   test("tenant-cap-list facet field is a declared column and the list handler schema accepts filters", () => {
     const feature = createCapOverviewFeature({ caps: [testCap], tiers: ["free", "pro"] });
     const screen = feature.screens[TENANT_CAP_LIST_SCREEN_ID];

package/src/cap-overview/access.ts

@@ -0,0 +1,9 @@
+import { access } from "@cosmicdrift/kumiko-framework/engine";
+
+// Every built-in membership rank (role-assignment.ts: User < Editor < Admin <
+// TenantAdmin < SystemAdmin), so a regular team member can see their own
+// tenant's usage. Deliberately not `access.authenticated` — that preset omits
+// TenantAdmin and would revoke the access TenantAdmins already have. The
+// screen and the query that fills its cards must carry the SAME rule, or the
+// dashboard renders and every card 403s.
+export const MY_CAPS_ACCESS_ROLES = access.roles("User", "Editor", ...access.admin);

package/src/cap-overview/feature.ts

@@ -5,8 +5,8 @@
 //      platform-wide table of every tenant's tier, billing status, and
 //      usage against a configurable set of caps.
 //   2. caps:usage query + my-caps / platform-tenant-caps dashboards —
-//      per-tenant usage cards. TenantAdmin sees their own tenant;
-//      SystemAdmin can additionally view any tenant via `tenantId`.
+//      per-tenant usage cards. Every member of a tenant sees their own
+//      tenant; SystemAdmin can additionally view any tenant via `tenantId`.
 //
 // **What this feature does NOT do:**
 //   - No writes. Reads tier-engine's read_tier_assignments, billing-
@@ -52,7 +52,7 @@ export function createCapOverviewFeature(opts: CreateCapOverviewOptions): Featur
 
   return defineFeature(CAP_OVERVIEW_FEATURE, (r) => {
     r.describe(
-      "Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; TenantAdmin gets their own usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.",
+      "Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; every member of a tenant gets their own tenant's usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.",
     );
     r.uiHints({
       displayLabel: "Cap Overview · Tier & Usage Visibility",

package/src/cap-overview/handlers/caps-usage.query.ts

@@ -1,7 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
-  access,
   crossTenantOverrideDenied,
   defineQueryHandler,
   type QueryHandlerDefinition,
@@ -9,6 +8,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { tierAssignmentEntity } from "../../tier-engine";
+import { MY_CAPS_ACCESS_ROLES } from "../access";
 import type { CapSpec, CapUsageWithMeta } from "../types";
 import { computeFraction, computeTone, computeUnclampedFraction } from "../usage-math";
 
@@ -20,9 +20,9 @@ export function createCapsUsageQuery(caps: readonly CapSpec[]): QueryHandlerDefi
   return defineQueryHandler({
     name: "caps:usage",
     description:
-      "Returns one tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (SystemAdmin may target another tenant via tenantId).",
+      "Returns the calling user's own tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (only SystemAdmin may target another tenant via tenantId).",
     schema: z.object({ tenantId: z.string().min(1).optional() }),
-    access: { roles: access.admin },
+    access: { roles: MY_CAPS_ACCESS_ROLES },
     handler: async (query, ctx) => {
       if (!ctx.systemDb) {
         throw new InternalError({

package/src/cap-overview/index.ts

@@ -1,5 +1,6 @@
 // Public API of the cap-overview bundled-feature.
 
+export { MY_CAPS_ACCESS_ROLES } from "./access";
 export {
   CAP_CARDS_PANEL_COMPONENT,
   CAP_OVERVIEW_FEATURE,

package/src/cap-overview/screens.ts

@@ -1,4 +1,5 @@
-import { access, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { MY_CAPS_ACCESS_ROLES } from "./access";
 import {
   CAP_CARDS_PANEL_COMPONENT,
   CAP_USAGE_CELL_COMPONENT,
@@ -78,7 +79,7 @@ export const myCapsScreen: ScreenDefinition = {
       component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
     },
   ],
-  access: { roles: access.admin },
+  access: { roles: MY_CAPS_ACCESS_ROLES },
 };
 
 export const platformTenantCapsScreen: ScreenDefinition = {

package/src/subscription-mollie/__tests__/plugin-methods.test.ts

@@ -0,0 +1,86 @@
+// Unit tests for the Mollie plugin methods (createCheckoutSession only —
+// createPortalSession/cancelSubscription are not implemented, see
+// plugin-methods.ts). Mollie-SDK calls are mocked via spyOn — we test our
+// sequenceType/metadata mapping, NOT Mollie itself.
+
+import { describe, expect, spyOn, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { MollieClient } from "@mollie/api-client";
+import { createMollieCheckoutSession, type MolliePriceConfig } from "../plugin-methods";
+
+const PRICE_CONFIG: Readonly<Record<string, MolliePriceConfig>> = {
+  plan_pro: {
+    amountValue: "9.99",
+    amountCurrency: "EUR",
+    interval: "1 month",
+    description: "Pro Plan",
+  },
+};
+
+const WEBHOOK_URL = "https://app.example.com/api/subscription/webhook/mollie";
+const stubCtx = {} as HandlerContext;
+
+// No `: MollieClient` return-type annotation — keeping the inferred narrow
+// shape lets spyOn resolve a non-overloaded signature for `payments.create`
+// (MollieClient's real signature is Promise|void-overloaded, which makes
+// spyOn(...).mockResolvedValue infer `never`, see plugin-methods.ts's own
+// `@cast-boundary` comment on the same overload).
+function buildClient() {
+  return {
+    customers: {
+      create: async () => ({ id: "cus_mock" }),
+    },
+    payments: {
+      create: async () => ({ getCheckoutUrl: () => "https://www.mollie.com/checkout/mock" }),
+    },
+  };
+}
+
+describe("createMollieCheckoutSession", () => {
+  test("mode omitted defaults to sequenceType 'first' (mandate-setup, Regression-Pin für bestehende Aufrufer)", async () => {
+    const client = buildClient();
+    const createMock = spyOn(client.payments, "create").mockResolvedValue({
+      getCheckoutUrl: () => "https://www.mollie.com/checkout/mock",
+    });
+
+    const checkout = createMollieCheckoutSession(
+      client as unknown as MollieClient,
+      PRICE_CONFIG,
+      WEBHOOK_URL,
+    );
+    const result = await checkout(stubCtx, {
+      priceId: "plan_pro",
+      tenantId: "tenant-001",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      providerCustomerId: "cus_existing",
+    });
+
+    expect(result).toEqual({ url: "https://www.mollie.com/checkout/mock" });
+    expect(createMock).toHaveBeenCalledWith(expect.objectContaining({ sequenceType: "first" }));
+  });
+
+  test("mode='payment': sequenceType wird zu 'oneoff' (One-off-Top-up, kein Mandate-setup)", async () => {
+    const client = buildClient();
+    const createMock = spyOn(client.payments, "create").mockResolvedValue({
+      getCheckoutUrl: () => "https://www.mollie.com/checkout/topup",
+    });
+
+    const checkout = createMollieCheckoutSession(
+      client as unknown as MollieClient,
+      PRICE_CONFIG,
+      WEBHOOK_URL,
+    );
+    const result = await checkout(stubCtx, {
+      priceId: "plan_pro",
+      tenantId: "tenant-002",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      providerCustomerId: "cus_existing",
+      mode: "payment",
+    });
+
+    expect(result).toEqual({ url: "https://www.mollie.com/checkout/topup" });
+    expect(createMock).toHaveBeenCalledWith(expect.objectContaining({ sequenceType: "oneoff" }));
+  });
+});

package/src/subscription-mollie/plugin-methods.ts

@@ -52,12 +52,20 @@ export function createMollieCheckoutSession(
       customerId = customer.id;
     }
 
+    // mode "payment" (one-off top-up) → sequenceType.oneoff, no mandate
+    // setup. verify-webhook.ts's ensureSubscriptionForMandate already
+    // gates on sequenceType === "first" — a oneoff payment falls into
+    // its "not our domain" branch and creates NO Mollie subscription.
+    // Webhook resolution for oneoff payments is separate follow-up
+    // work (offlot#109), not part of this contract.
+    const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
+
     // payments.create ist overloaded (Promise OR void mit callback);
     // explicit cast auf Promise<Payment>-overload.
     const payment = (await (client.payments.create({
       amount: { currency: priceCfg.amountCurrency, value: priceCfg.amountValue },
       description: priceCfg.description,
-      sequenceType: SequenceType.first,
+      sequenceType,
       customerId,
       redirectUrl: options.successUrl,
       cancelUrl: options.cancelUrl,

package/src/subscription-stripe/__tests__/plugin-methods.test.ts

@@ -116,6 +116,55 @@ describe("createStripeCheckoutSession", () => {
     );
   });
 
+  test("mode='payment': ruft stripe.checkout.sessions.create mit mode=payment + payment_intent_data.metadata (KEIN subscription_data)", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://checkout.stripe.com/c/pay/topup" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe));
+    const result = await checkout(stubCtx, {
+      priceId: "price_credits_topup",
+      tenantId: "tenant-003",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      mode: "payment",
+    });
+
+    expect(result).toEqual({ url: "https://checkout.stripe.com/c/pay/topup" });
+    expect(createMock).toHaveBeenCalledWith({
+      mode: "payment",
+      line_items: [{ price: "price_credits_topup", quantity: 1 }],
+      success_url: "https://example.com/success",
+      cancel_url: "https://example.com/cancel",
+      // Drift-Pin: payment-mode carries tenantId via payment_intent_data,
+      // NOT subscription_data — Stripe rejects subscription_data outside
+      // subscription-mode.
+      payment_intent_data: {
+        metadata: { tenantId: "tenant-003" },
+      },
+    });
+  });
+
+  test("mode omitted defaults to 'subscription' (Regression-Pin für bestehende Aufrufer)", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://x" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe));
+    await checkout(stubCtx, {
+      priceId: "price_x",
+      tenantId: "tenant-004",
+      successUrl: "https://x/s",
+      cancelUrl: "https://x/c",
+    });
+
+    expect(createMock).toHaveBeenCalledWith(
+      expect.objectContaining({ mode: "subscription", subscription_data: expect.anything() }),
+    );
+  });
+
   test("throws wenn Stripe keine url returnt (defensive — sollte nie passieren bei mode=subscription)", async () => {
     const stripe = buildStripe();
     spyOn(stripe.checkout.sessions, "create")

package/src/subscription-stripe/plugin-methods.ts

@@ -41,24 +41,26 @@ export function createStripeCheckoutSession(runtime: StripeCtxRuntime) {
     // billing-live-config-key write-side.
     await runtime.assertBillingLive(ctx);
     const stripe = await runtime.clientForCtx(ctx);
+    const mode = options.mode ?? "subscription";
 
     const session = await stripe.checkout.sessions.create({
-      mode: "subscription",
+      mode,
       line_items: [{ price: options.priceId, quantity: 1 }],
       success_url: options.successUrl,
       cancel_url: options.cancelUrl,
-      // metadata.tenantId landet auf der subscription die durch diese
-      // checkout-session entsteht — beim subsequent webhook lesen wir's
-      // aus subscription.metadata.tenantId zurück.
-      subscription_data: {
-        metadata: { tenantId: options.tenantId },
-      },
+      // subscription_data is subscription-mode-only (Stripe rejects it in
+      // payment-mode) — the subsequent webhook reads metadata.tenantId off
+      // the subscription it creates. payment-mode has no subscription, so
+      // tenantId travels via payment_intent_data.metadata instead.
+      ...(mode === "subscription"
+        ? { subscription_data: { metadata: { tenantId: options.tenantId } } }
+        : { payment_intent_data: { metadata: { tenantId: options.tenantId } } }),
       ...(options.providerCustomerId && { customer: options.providerCustomerId }),
     });
 
     if (!session.url) {
-      // Stripe garantiert url für mode: subscription. Defensive für
-      // zukünftige API-Drift.
+      // Defensive: Stripe returns a hosted url for both modes today —
+      // guards against future API drift.
       throw new Error("subscription-stripe: checkout.sessions.create returned no url");
     }
     return { url: session.url };