@dineway-ai/plugin-payment 0.2.6 → 0.2.8

package/src/subscriptions/funding.ts

@@ -0,0 +1,256 @@
+import type Stripe from "stripe";
+
+import { relationId } from "./purchases.js";
+import {
+	SubscriptionError,
+	type ChargeEvidence,
+	type InvoiceFundingEvidence,
+	type PurchaseContract,
+	type SubscriptionScope,
+} from "./types.js";
+
+/** Fail instead of silently truncating provider evidence. */
+export async function collectBounded<T>(items: AsyncIterable<T>, limit = 1000): Promise<T[]> {
+	const result: T[] = [];
+	for await (const item of items) {
+		if (result.length === limit)
+			throw new SubscriptionError(
+				"RECONCILIATION_LIMIT",
+				"Payment evidence exceeds its safe limit",
+				503,
+			);
+		result.push(item);
+	}
+	return result;
+}
+
+export async function inspectCharge(
+	stripe: Stripe,
+	scope: SubscriptionScope,
+	chargeId: string,
+): Promise<ChargeEvidence> {
+	const charge = await stripe.charges.retrieve(chargeId);
+	if (charge.livemode !== (scope.mode === "live"))
+		throw new SubscriptionError("MODE_MISMATCH", "Invalid charge mode");
+	const refunds = await collectBounded(stripe.refunds.list({ charge: charge.id, limit: 100 }));
+	const disputes = await collectBounded(stripe.disputes.list({ charge: charge.id, limit: 100 }));
+	if (
+		refunds.some(
+			(refund) => relationId(refund.charge) !== charge.id || refund.currency !== charge.currency,
+		) ||
+		disputes.some(
+			(dispute) =>
+				relationId(dispute.charge) !== charge.id ||
+				dispute.currency !== charge.currency ||
+				dispute.livemode !== charge.livemode,
+		)
+	)
+		throw new SubscriptionError(
+			"INVALID_EVIDENCE",
+			"Payment evidence does not match the charge",
+			409,
+		);
+	return {
+		id: charge.id,
+		paymentIntentId: relationId(charge.payment_intent),
+		customerId: relationId(charge.customer),
+		currency: charge.currency,
+		amount: charge.amount,
+		captured: charge.amount_captured,
+		refunded: charge.amount_refunded,
+		settled:
+			charge.paid &&
+			charge.captured &&
+			charge.status === "succeeded" &&
+			charge.amount_captured === charge.amount &&
+			Number.isSafeInteger(charge.amount) &&
+			charge.amount > 0 &&
+			Number.isSafeInteger(charge.amount_refunded) &&
+			charge.amount_refunded >= 0 &&
+			charge.amount_refunded <= charge.amount &&
+			(!charge.disputed ||
+				(disputes.length > 0 &&
+					disputes.every((dispute) => ["won", "warning_closed"].includes(dispute.status)))),
+		refunds: refunds.map((refund) => ({
+			id: refund.id,
+			amount: refund.amount,
+			status: refund.status ?? "unknown",
+			metadata: refund.metadata ?? {},
+		})),
+		disputes: disputes.map((dispute) => ({
+			id: dispute.id,
+			amount: dispute.amount,
+			status: dispute.status,
+		})),
+	};
+}
+
+export async function invoiceFunding(
+	stripe: Stripe,
+	scope: SubscriptionScope,
+	subscription: Stripe.Subscription,
+	invoice: Stripe.Invoice,
+	contract: PurchaseContract | null,
+	now: number,
+): Promise<InvoiceFundingEvidence> {
+	const item = subscription.items.data[0]!;
+	const amount = contract?.amount ?? item.price.unit_amount ?? 0;
+	const currency = contract?.currency ?? item.price.currency;
+	const credit =
+		invoice.billing_reason === "subscription_create" ? (contract?.firstPeriodCredit ?? 0) : 0;
+	const cash = amount - credit;
+	const evidence: InvoiceFundingEvidence = {
+		verifiedAt: now,
+		amount,
+		currency,
+		credit,
+		cash,
+		charges: [],
+		paymentMethodId: null,
+		reason: null,
+	};
+	const invalid = (reason: string) => ({ ...evidence, reason });
+	const line = invoice.lines.data[0];
+	const details = line?.parent?.subscription_item_details;
+	const customer = relationId(subscription.customer);
+	if (
+		invoice.status !== "paid" ||
+		invoice.livemode !== (scope.mode === "live") ||
+		!customer ||
+		relationId(invoice.customer) !== customer ||
+		relationId(invoice.parent?.subscription_details?.subscription) !== subscription.id ||
+		!["subscription_create", "subscription_cycle"].includes(invoice.billing_reason ?? "") ||
+		invoice.currency !== currency ||
+		invoice.lines.has_more ||
+		invoice.lines.data.length !== 1 ||
+		!line ||
+		!details ||
+		details.proration ||
+		details.subscription_item !== item.id ||
+		details.subscription !== subscription.id ||
+		relationId(line.pricing?.price_details?.price) !== item.price.id ||
+		line.quantity !== 1 ||
+		line.currency !== currency ||
+		line.amount !== amount ||
+		line.subtotal !== amount ||
+		invoice.subtotal !== amount ||
+		invoice.total !== cash ||
+		invoice.amount_due !== cash ||
+		invoice.amount_paid !== cash ||
+		invoice.amount_remaining !== 0 ||
+		invoice.starting_balance !== 0 ||
+		invoice.ending_balance !== 0 ||
+		invoice.pre_payment_credit_notes_amount !== 0 ||
+		invoice.post_payment_credit_notes_amount !== 0 ||
+		invoice.total_taxes?.some((tax) => tax.amount !== 0) ||
+		!Number.isSafeInteger(line.period.start) ||
+		!Number.isSafeInteger(line.period.end) ||
+		line.period.start >= line.period.end
+	)
+		return invalid("INVOICE_CONTRACT_MISMATCH");
+	if (
+		contract?.interval === "day" &&
+		line.period.end - line.period.start !== contract.intervalCount * 86400
+	)
+		return invalid("SERVICE_PERIOD_MISMATCH");
+	const discounts = invoice.total_discount_amounts ?? [];
+	if (credit) {
+		if (discounts.length !== 1 || discounts[0]!.amount !== credit)
+			return invalid("CREDIT_MISMATCH");
+		const discount = invoice.discounts.find(
+			(value) => typeof value !== "string" && value.id === relationId(discounts[0]!.discount),
+		);
+		if (
+			!discount ||
+			typeof discount === "string" ||
+			discount.source.type !== "coupon" ||
+			relationId(discount.source.coupon) !== contract?.couponId
+		)
+			return invalid("CREDIT_MISMATCH");
+		const coupon =
+			typeof discount.source.coupon === "string"
+				? await stripe.coupons.retrieve(discount.source.coupon)
+				: discount.source.coupon;
+		if (
+			!coupon ||
+			coupon.livemode !== invoice.livemode ||
+			coupon.amount_off !== credit ||
+			coupon.currency !== currency ||
+			coupon.percent_off !== null ||
+			coupon.duration !== "once" ||
+			coupon.max_redemptions !== 1 ||
+			coupon.metadata?.dineway_app !== scope.namespace ||
+			coupon.metadata.purchase_reference !== contract?.reference ||
+			coupon.metadata.user_id !== subscription.metadata.user_id
+		)
+			return invalid("CREDIT_MISMATCH");
+	} else if (discounts.some((discount) => discount.amount !== 0))
+		return invalid("UNEXPECTED_DISCOUNT");
+	const payments = await collectBounded(
+		stripe.invoicePayments.list({
+			invoice: invoice.id,
+			status: "paid",
+			limit: 100,
+			expand: ["data.payment.payment_intent"],
+		}),
+	);
+	if (payments.length !== (cash ? 1 : 0)) return invalid("UNVERIFIED_CASH");
+	if (cash) {
+		const payment = payments[0]!;
+		const intentRef = payment.payment.payment_intent;
+		const intent =
+			typeof intentRef === "string" ? await stripe.paymentIntents.retrieve(intentRef) : intentRef;
+		if (
+			payment.status !== "paid" ||
+			payment.livemode !== invoice.livemode ||
+			payment.currency !== currency ||
+			relationId(payment.invoice) !== invoice.id ||
+			payment.amount_paid !== cash ||
+			payment.payment.type !== "payment_intent" ||
+			!intent ||
+			intent.status !== "succeeded" ||
+			intent.livemode !== invoice.livemode ||
+			intent.currency !== currency ||
+			intent.amount_received !== cash ||
+			relationId(intent.customer) !== customer ||
+			!intent.latest_charge
+		)
+			return invalid("UNVERIFIED_CASH");
+		const charge = await inspectCharge(stripe, scope, relationId(intent.latest_charge)!);
+		evidence.charges.push(charge);
+		if (
+			!charge.settled ||
+			charge.amount !== cash ||
+			charge.captured !== cash ||
+			charge.currency !== currency ||
+			charge.customerId !== customer ||
+			charge.paymentIntentId !== intent.id
+		)
+			return invalid("UNSETTLED_CHARGE");
+		if (
+			charge.refunded > 0 ||
+			charge.refunds.some((refund) => !["failed", "canceled"].includes(refund.status)) ||
+			charge.disputes.some((dispute) => !["won", "warning_closed"].includes(dispute.status))
+		)
+			return invalid("FUNDING_REVERSED");
+	} else {
+		let method = subscription.default_payment_method;
+		if (!method) {
+			const account = await stripe.customers.retrieve(customer);
+			if (account.deleted || account.livemode !== invoice.livemode)
+				return invalid("PAYMENT_METHOD_REQUIRED");
+			method = account.invoice_settings.default_payment_method;
+		}
+		if (!method) return invalid("PAYMENT_METHOD_REQUIRED");
+		const resolved =
+			typeof method === "string" ? await stripe.paymentMethods.retrieve(method) : method;
+		if (
+			resolved.type !== "card" ||
+			resolved.livemode !== invoice.livemode ||
+			relationId(resolved.customer) !== customer
+		)
+			return invalid("PAYMENT_METHOD_REQUIRED");
+		evidence.paymentMethodId = resolved.id;
+	}
+	return evidence;
+}

package/src/subscriptions/index.ts

@@ -4,3 +4,4 @@ export { getPaymentSubscriptionService, getSubscriptionConfiguration } from "./r
 export { createSubscriptionRoutes } from "./routes.js";
 export * from "./types.js";
 export { formatSubscriptionPrice } from "./format.js";
+export type { SubscriptionRefundInput } from "./refunds.js";

package/src/subscriptions/projection.ts

@@ -8,6 +8,7 @@ import {
 	type SubscriptionPlan,
 	type SubscriptionPrice,
 	type SubscriptionScope,
+	type SubscriptionPurchase,
 } from "./types.js";
 
 export function recurringPrice(
@@ -76,30 +77,53 @@ export function subscriptionProjection(
 	userId: string,
 	customerId: string,
 	now: number,
+	purchase?: SubscriptionPurchase | null,
 ): MemberSubscription {
 	ownedSubscription(subscription, scope, userId, customerId);
 	const item = subscription.items.data[0];
 	const plan = plans.find((value) => value.prices.some((price) => price.id === item?.price.id));
 	if (
-		!plan ||
+		(!plan && purchase?.contract.pricing.kind !== "dynamic") ||
 		subscription.items.has_more ||
 		subscription.items.data.length !== 1 ||
 		item?.quantity !== 1
 	) {
 		throw new SubscriptionError("UNRECOGNIZED_SUBSCRIPTION", "Subscription requires review", 409);
 	}
-	recurringPrice(item.price, scope, false);
+	if (purchase) {
+		const { contract } = purchase;
+		if (
+			purchase.userId !== userId ||
+			subscription.metadata.purchase_reference !== purchase.reference ||
+			(purchase.subscriptionId && purchase.subscriptionId !== subscription.id) ||
+			item.price.livemode !== (scope.mode === "live") ||
+			item.price.currency !== contract.currency ||
+			item.price.unit_amount !== contract.amount ||
+			item.price.recurring?.interval !== contract.interval ||
+			item.price.recurring.interval_count !== contract.intervalCount ||
+			item.price.recurring.usage_type !== "licensed" ||
+			item.price.billing_scheme !== "per_unit" ||
+			item.price.transform_quantity ||
+			(contract.priceId && item.price.id !== contract.priceId)
+		)
+			throw new SubscriptionError(
+				"UNRECOGNIZED_SUBSCRIPTION",
+				"Subscription does not match its purchase",
+				409,
+			);
+	} else recurringPrice(item.price, scope, false);
 	return {
 		id: subscription.id,
 		userId,
 		customerId,
-		planCode: plan.code,
+		planCode: purchase?.contract.pricing.kind === "dynamic" ? "" : plan!.code,
 		priceId: item.price.id,
-		status: subscription.status,
+		status: subscription.pause_collection ? "paused" : subscription.status,
 		periodEnd: item.current_period_end,
 		cancelAtPeriodEnd: subscription.cancel_at_period_end,
 		verifiedAt: now,
 		lastError: null,
+		purchaseReference: purchase?.reference ?? null,
 	};
 }
 
@@ -134,7 +158,7 @@ export function invoicePeriods(
 			!details ||
 			details.subscription !== subscription.id ||
 			details.proration ||
-			!plan ||
+			(!plan && !subscription.purchaseReference) ||
 			line.quantity !== 1 ||
 			line.amount <= 0
 		)
@@ -150,7 +174,7 @@ export function invoicePeriods(
 				id: invoice.id + ":" + line.id,
 				invoiceId: invoice.id,
 				subscriptionId: subscription.id,
-				planCode: plan.code,
+				planCode: plan?.code ?? "",
 				startsAt: line.period.start,
 				endsAt: line.period.end,
 			},
@@ -166,7 +190,15 @@ export function memberProjection(
 	now: number,
 ): MemberBilling {
 	const valid = periods.filter(
-		(period) => period.startsAt * 1000 <= now && period.endsAt * 1000 > now,
+		(period) =>
+			period.eligible === true &&
+			period.startsAt * 1000 <= now &&
+			period.endsAt * 1000 > now &&
+			subscriptions.some(
+				(subscription) =>
+					subscription.id === period.subscriptionId &&
+					["active", "past_due", "canceled"].includes(subscription.status),
+			),
 	);
 	const entitlements: Record<string, boolean | number> = {};
 	for (const period of valid) {

package/src/subscriptions/purchases.ts

@@ -0,0 +1,329 @@
+import { createHash } from "node:crypto";
+
+import type Stripe from "stripe";
+
+import { recurringPrice } from "./projection.js";
+import type { SubscriptionRepository } from "./repository.js";
+import { purchaseSchema } from "./schemas.js";
+import {
+	SubscriptionError,
+	type BillingSubject,
+	type PurchaseContract,
+	type SubscriptionPurchaseInput,
+	type SubscriptionPurchase,
+	type SubscriptionScope,
+} from "./types.js";
+
+export const digest = (value: unknown) =>
+	createHash("sha256").update(JSON.stringify(value)).digest("hex");
+export const relationId = (value: string | { id: string } | null | undefined) =>
+	typeof value === "string" ? value : (value?.id ?? null);
+export interface PurchaseContext {
+	stripe: Stripe;
+	repository: SubscriptionRepository;
+	scope: SubscriptionScope;
+	now: () => number;
+	origin: string;
+}
+const idempotency = (context: PurchaseContext, ...values: unknown[]) =>
+	"dineway:" + digest([context.repository.scope, ...values]);
+const purchaseInput = ({
+	reference,
+	groupKey,
+	pricing,
+	firstPeriodCredit,
+	returnPath,
+	locale,
+}: SubscriptionPurchaseInput) =>
+	purchaseSchema.parse({ reference, groupKey, pricing, firstPeriodCredit, returnPath, locale });
+export function purchaseMetadata(context: PurchaseContext, userId: string, reference: string) {
+	return { dineway_app: context.scope.namespace, user_id: userId, purchase_reference: reference };
+}
+
+async function customer(
+	context: PurchaseContext,
+	store: SubscriptionRepository,
+	userId: string,
+	subject: BillingSubject,
+) {
+	const existing = await store.customer(userId);
+	if (existing) return existing;
+	const attemptKey = "customer:" + userId;
+	const attempt = await store.attempt(attemptKey);
+	if (attempt) {
+		const listed = await context.stripe.customers.list({ email: attempt.fingerprint, limit: 100 });
+		if (listed.has_more)
+			throw new SubscriptionError(
+				"CUSTOMER_REVIEW_REQUIRED",
+				"Customer recovery exceeds its safe limit",
+				409,
+			);
+		const matches = listed.data.filter(
+			(value) =>
+				value.metadata.dineway_app === context.scope.namespace &&
+				value.metadata.user_id === userId &&
+				value.livemode === (context.scope.mode === "live"),
+		);
+		if (matches.length > 1)
+			throw new SubscriptionError(
+				"CUSTOMER_REVIEW_REQUIRED",
+				"Multiple customers match this billing subject",
+				409,
+			);
+		if (matches[0]) {
+			await store.saveCustomer(userId, matches[0].id, subject);
+			return matches[0].id;
+		}
+	}
+	if (attempt && context.now() - attempt.created_at > 23 * 3600000) {
+		throw new SubscriptionError(
+			"CUSTOMER_REVIEW_REQUIRED",
+			"An unconfirmed customer creation requires reconciliation",
+			409,
+		);
+	}
+	// Pin the email as part of the request so a retry cannot change Stripe's idempotent payload.
+	const email = attempt ? attempt.fingerprint : subject.email;
+	if (!attempt)
+		await store.saveAttempt(attemptKey, {
+			fingerprint: email,
+			request_id: userId,
+			created_at: context.now(),
+			session_id: null,
+		});
+	const created = await context.stripe.customers.create(
+		{ email, metadata: { dineway_app: context.scope.namespace, user_id: userId } },
+		{ idempotencyKey: idempotency(context, "customer", userId) },
+	);
+	if (created.livemode !== (context.scope.mode === "live"))
+		throw new SubscriptionError("MODE_MISMATCH", "Invalid customer mode");
+	await store.saveCustomer(userId, created.id, subject);
+	return created.id;
+}
+
+export async function createPurchase(
+	context: PurchaseContext,
+	userId: string,
+	subject: BillingSubject,
+	input: SubscriptionPurchaseInput,
+) {
+	const parsed = purchaseSchema.parse(input);
+	return context.repository.withLock("member:" + userId, async (store) => {
+		const previous = await store.purchase(parsed.reference);
+		if (previous) {
+			if (previous.userId !== userId)
+				throw new SubscriptionError("NOT_FOUND", "Purchase not found", 404);
+			if (digest(purchaseInput(previous.contract)) !== digest(parsed))
+				throw new SubscriptionError(
+					"PURCHASE_CONFLICT",
+					"A purchase reference cannot change its contract",
+					409,
+				);
+			return resumePurchase(context, store, previous);
+		}
+		const open = await store.openPurchase(userId, parsed.groupKey);
+		if (open)
+			throw new SubscriptionError(
+				"SUBSCRIPTION_EXISTS",
+				"Resolve the existing purchase before starting another",
+				409,
+			);
+		let contract: PurchaseContract;
+		if (parsed.pricing.kind === "catalogue") {
+			const pricing = parsed.pricing;
+			const plan = (await store.plans()).find(
+				(value) => value.enabled && value.code === pricing.planCode,
+			);
+			const price = plan?.prices.find(
+				(value) => value.enabled && value.interval === pricing.interval,
+			);
+			if (!price) throw new SubscriptionError("PLAN_UNAVAILABLE", "This plan is unavailable", 409);
+			const verified = recurringPrice(
+				await context.stripe.prices.retrieve(price.id),
+				context.scope,
+			);
+			if (
+				verified.amount !== price.amount ||
+				verified.currency !== price.currency ||
+				verified.productId !== price.productId ||
+				verified.interval !== price.interval
+			)
+				throw new SubscriptionError("PRICE_CHANGED", "Refresh the plan price before checkout", 409);
+			contract = {
+				...parsed,
+				amount: price.amount,
+				currency: price.currency,
+				interval: price.interval,
+				intervalCount: 1,
+				priceId: price.id,
+				couponId: null,
+			};
+		} else {
+			contract = {
+				...parsed,
+				amount: parsed.pricing.amount,
+				currency: parsed.pricing.currency,
+				interval: parsed.pricing.interval,
+				intervalCount: parsed.pricing.intervalCount,
+				priceId: null,
+				couponId: null,
+			};
+		}
+		if (
+			parsed.firstPeriodCredit > contract.amount ||
+			(parsed.pricing.kind === "catalogue" && parsed.firstPeriodCredit)
+		)
+			throw new SubscriptionError(
+				"INVALID_CREDIT",
+				"Credit must fit a dynamic purchase's first invoice",
+			);
+		if (parsed.firstPeriodCredit)
+			contract.couponId = "dw_" + digest([store.scope, parsed.reference, "credit"]);
+		await customer(context, store, userId, subject);
+		await store.savePurchase(
+			userId,
+			contract,
+			digest(parsed),
+			Math.floor(context.now() / 1000) + 3600,
+		);
+		return resumePurchase(context, store, (await store.purchase(parsed.reference))!);
+	});
+}
+
+export async function resumePurchase(
+	context: PurchaseContext,
+	store: SubscriptionRepository,
+	purchase: SubscriptionPurchase,
+): Promise<{ reference: string; url: string | null; status: string }> {
+	const customerId = await store.customer(purchase.userId);
+	if (!customerId)
+		throw new SubscriptionError("CUSTOMER_NOT_FOUND", "No billing account exists", 404);
+	const { contract } = purchase;
+	let session: Stripe.Checkout.Session | undefined;
+	if (purchase.sessionId)
+		session = await context.stripe.checkout.sessions.retrieve(purchase.sessionId);
+	else {
+		const sessions = await context.stripe.checkout.sessions.list({
+			customer: customerId,
+			limit: 100,
+		});
+		if (sessions.has_more)
+			throw new SubscriptionError(
+				"REVIEW_REQUIRED",
+				"Checkout recovery exceeds its safe limit",
+				409,
+			);
+		const matches = sessions.data.filter(
+			(value) =>
+				value.metadata?.dineway_app === context.scope.namespace &&
+				value.metadata.purchase_reference === purchase.reference,
+		);
+		if (matches.length > 1)
+			throw new SubscriptionError("REVIEW_REQUIRED", "Purchase has multiple checkouts", 409);
+		session = matches[0];
+	}
+	if (!session) {
+		if (
+			purchase.closed ||
+			purchase.cancelMode ||
+			purchase.expiresAt < Math.floor(context.now() / 1000) + 1800
+		)
+			throw new SubscriptionError(
+				"CHECKOUT_REVIEW_REQUIRED",
+				"The checkout outcome must be confirmed before retrying",
+				409,
+			);
+		const metadata = purchaseMetadata(context, purchase.userId, purchase.reference);
+		if (contract.couponId) {
+			const coupon = await context.stripe.coupons.create(
+				{
+					id: contract.couponId,
+					amount_off: contract.firstPeriodCredit,
+					currency: contract.currency,
+					duration: "once",
+					max_redemptions: 1,
+					metadata,
+				},
+				{ idempotencyKey: idempotency(context, "coupon", purchase.reference) },
+			);
+			if (
+				coupon.id !== contract.couponId ||
+				coupon.amount_off !== contract.firstPeriodCredit ||
+				coupon.currency !== contract.currency ||
+				coupon.livemode !== (context.scope.mode === "live") ||
+				coupon.duration !== "once" ||
+				coupon.max_redemptions !== 1 ||
+				coupon.percent_off !== null ||
+				Object.entries(metadata).some(([key, value]) => coupon.metadata?.[key] !== value)
+			)
+				throw new SubscriptionError(
+					"INVALID_CREDIT",
+					"Credit coupon does not match the purchase",
+					409,
+				);
+		}
+		const returnUrl = new URL(contract.returnPath, context.origin);
+		if (returnUrl.origin !== context.origin)
+			throw new SubscriptionError("INVALID_RETURN_URL", "Return to this site");
+		const successUrl = new URL(returnUrl);
+		successUrl.searchParams.set("checkout", "returned");
+		const line: Stripe.Checkout.SessionCreateParams.LineItem = contract.priceId
+			? { price: contract.priceId, quantity: 1 }
+			: {
+					quantity: 1,
+					price_data: {
+						currency: contract.currency,
+						unit_amount: contract.amount,
+						recurring: { interval: contract.interval, interval_count: contract.intervalCount },
+						product_data: {
+							name: contract.pricing.kind === "dynamic" ? contract.pricing.name : "Subscription",
+							metadata,
+						},
+					},
+				};
+		await store.updatePurchase(purchase.reference, { last_attempt_at: context.now() });
+		session = await context.stripe.checkout.sessions.create(
+			{
+				mode: "subscription",
+				customer: customerId,
+				line_items: [line],
+				payment_method_types: ["card"],
+				payment_method_collection: "always",
+				client_reference_id: purchase.reference,
+				metadata,
+				subscription_data: { metadata },
+				success_url: successUrl.href,
+				cancel_url: returnUrl.href,
+				locale: purchaseInput(contract).locale,
+				expires_at: purchase.expiresAt,
+				allow_promotion_codes: false,
+				...(contract.couponId ? { discounts: [{ coupon: contract.couponId }] } : {}),
+			},
+			{ idempotencyKey: idempotency(context, "checkout", purchase.reference) },
+		);
+	}
+	if (
+		relationId(session.customer) !== customerId ||
+		session.mode !== "subscription" ||
+		session.livemode !== (context.scope.mode === "live") ||
+		session.metadata?.dineway_app !== context.scope.namespace ||
+		session.metadata.user_id !== purchase.userId ||
+		session.metadata.purchase_reference !== purchase.reference ||
+		session.client_reference_id !== purchase.reference
+	)
+		throw new SubscriptionError("OWNER_CONFLICT", "Checkout ownership conflict", 409);
+	await store.updatePurchase(purchase.reference, {
+		session_id: session.id,
+		subscription_id: relationId(session.subscription),
+		closed: Number(session.status === "expired"),
+		last_error: null,
+		last_attempt_at: context.now(),
+	});
+	if (session.url && new URL(session.url).origin !== "https://checkout.stripe.com")
+		throw new SubscriptionError("INVALID_DESTINATION", "Invalid checkout destination", 502);
+	return {
+		reference: purchase.reference,
+		url: session.status === "open" ? session.url : null,
+		status: session.status ?? "unknown",
+	};
+}