@dineway-ai/plugin-payment 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dineway-ai/plugin-payment",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Provider-neutral payment infrastructure and Stripe integration for Dineway plugins",
   "type": "module",
   "publishConfig": {
@@ -30,7 +30,7 @@
   "license": "MIT",
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
-    "dineway": "^0.2.30"
+    "dineway": "^0.2.31"
   },
   "dependencies": {
     "@stripe/stripe-js": "9.9.0",

package/src/admin/form.ts

@@ -2,10 +2,11 @@ import type {
 	PaymentStripeConfiguration,
 	UpdatePaymentStripeConfigurationInput,
 } from "../configuration/service.js";
-import type { StripeMode } from "../types.js";
+import type { StripeCollectionMode, StripeMode } from "../types.js";
 
 export interface PaymentSettingsForm {
 	mode: StripeMode;
+	collectionMode: StripeCollectionMode;
 	publishableKey: string;
 	secretKey: string;
 	webhookSecret: string;
@@ -16,6 +17,7 @@ export function paymentSettingsForm(
 ): PaymentSettingsForm {
 	return {
 		mode: configuration.settings.mode,
+		collectionMode: configuration.settings.collectionMode,
 		publishableKey: configuration.settings.publishableKey ?? "",
 		secretKey: "",
 		webhookSecret: "",
@@ -45,6 +47,7 @@ export function buildPaymentSettingsUpdate(
 	return {
 		expectedVersion: configuration.settings.version,
 		mode: form.mode,
+		collectionMode: form.collectionMode,
 		publishableKey: publishableKey || null,
 		...(secretKey ? { secretKey } : {}),
 		...(webhookSecret ? { webhookSecret } : {}),

package/src/admin/subscriptions.tsx

@@ -41,7 +41,6 @@ export function PaymentSubscriptionsPage() {
 	const [editorRevision, setEditorRevision] = React.useState(0);
 	const [boundPrices, setBoundPrices] = React.useState<SubscriptionPlan["prices"]>([]);
 	const [features, setFeatures] = React.useState<Feature[]>([]);
-	const [webhookSecret, setWebhookSecret] = React.useState("");
 	const [detail, setDetail] = React.useState<
 		(SubscriptionSnapshot & { member: MemberBilling }) | null
 	>(null);
@@ -153,7 +152,10 @@ export function PaymentSubscriptionsPage() {
 				<p className="mt-2 text-sm text-kumo-subtle">
 					Bind Stripe prices, configure plan entitlements, and inspect paid membership periods.
 				</p>
-				<a href="/_dineway/admin/payments" className="mt-2 inline-block text-sm underline">
+				<a
+					href="/_dineway/admin/plugins/dineway-payment/payments"
+					className="mt-2 inline-block text-sm underline"
+				>
 					Stripe account settings
 				</a>
 			</header>
@@ -178,58 +180,27 @@ export function PaymentSubscriptionsPage() {
 			) : (
 				<>
 					<section className="space-y-4 rounded-xl border border-kumo-line p-5">
-						<h2 className="text-lg font-semibold">Subscription webhook</h2>
+						<h2 className="text-lg font-semibold">Payment webhook</h2>
 						<p className="text-sm">
 							Application: {configuration.namespace} · {configuration.mode} ·{" "}
-							{configuration.ready ? "Ready" : "Configuration required"}
+							{configuration.collectionMode === "managed"
+								? "Managed Payments"
+								: "Standard Stripe Billing"}{" "}
+							· {configuration.ready ? "Ready" : "Configuration required"}
 						</p>
 						<label className="block text-sm">
 							Endpoint
 							<input className={inputClass} readOnly value={configuration.webhookUrl} />
 						</label>
 						<p className="text-sm text-kumo-subtle">
-							Create a Stripe webhook for this endpoint using the subscription events in the Payment
-							documentation. Its signing secret is separate from other payment webhooks.
+							Payment receives and verifies Stripe events for subscriptions, restaurant orders, and
+							venue payments at this shared endpoint. Configure its signing secret once in Payments
+							using the Stripe account settings link above.
 						</p>
-						<form
-							className="flex flex-wrap items-end gap-3"
-							onSubmit={(event) => {
-								event.preventDefault();
-								void run(async () => {
-									setConfiguration(
-										await postPaymentRoute<Configuration>("subscriptions/configuration/update", {
-											webhookSecret,
-										}),
-									);
-									setWebhookSecret("");
-									await refresh();
-									setNotice("Subscription webhook secret saved.");
-								});
-							}}
-						>
-							<label className="min-w-64 flex-1 text-sm">
-								Signing secret
-								<input
-									type="password"
-									autoComplete="new-password"
-									required
-									className={inputClass}
-									value={webhookSecret}
-									placeholder={
-										configuration.webhookSecret
-											? "Leave unchanged unless rotating the secret"
-											: "whsec_…"
-									}
-									onChange={(event) => setWebhookSecret(event.target.value)}
-								/>
-							</label>
-							<button className={buttonClass} disabled={busy || !webhookSecret}>
-								Save secret
-							</button>
-						</form>
 						{!configuration.ready && (
 							<p className="text-sm text-kumo-subtle">
-								Verify the Stripe account and save this webhook secret to manage subscription plans.
+								Verify the Stripe account and configure the shared webhook in Payments to manage
+								plans.
 							</p>
 						)}
 					</section>
@@ -440,6 +411,10 @@ export function PaymentSubscriptionsPage() {
 														{purchase.reference}
 														<br />
 														{purchase.contract.pricing.kind}
+														<br />
+														{purchase.collectionMode === "managed"
+															? "Managed Payments"
+															: "Standard"}
 													</td>
 													<td className="p-2">
 														{formatSubscriptionPrice(

package/src/admin.tsx

@@ -8,6 +8,7 @@ import {
 } from "./admin/form.js";
 import { PaymentSubscriptionsPage } from "./admin/subscriptions.js";
 import type { PaymentStripeConfiguration } from "./configuration/service.js";
+import { PAYMENT_WEBHOOK_PATH } from "./webhooks/types.js";
 
 type CredentialName = "secretKey" | "webhookSecret";
 
@@ -102,6 +103,7 @@ export function PaymentSettingsPage() {
 		configuration.settings.publishableKey &&
 		configuration.secretKey &&
 		form.mode === configuration.settings.mode &&
+		form.collectionMode === configuration.settings.collectionMode &&
 		form.publishableKey.trim() === configuration.settings.publishableKey &&
 		!form.secretKey.trim(),
 	);
@@ -149,6 +151,31 @@ export function PaymentSettingsPage() {
 						))}
 					</div>
 				</fieldset>
+				<label className="grid gap-1 text-sm font-medium">
+					Collection mode
+					<select
+						className="rounded-lg border border-kumo-line bg-kumo-base px-3 py-2 font-normal"
+						value={form.collectionMode}
+						disabled={pending}
+						onChange={(event) =>
+							setForm({
+								...form,
+								collectionMode: event.target.value === "managed" ? "managed" : "standard",
+							})
+						}
+					>
+						<option value="standard">Standard Stripe Billing (default)</option>
+						<option value="managed">Stripe Managed Payments</option>
+					</select>
+				</label>
+				<p className="text-sm text-kumo-subtle">
+					{form.collectionMode === "managed"
+						? "Stripe acts as merchant of record for eligible digital products. Enable Managed Payments in your Stripe account and assign an eligible tax code to each product. Stripe calculates tax and chooses supported payment methods."
+						: "Your business is the merchant of record and manages its tax obligations. Subscriptions use standard Stripe Billing."}{" "}
+					This setting applies to new subscription Checkouts. Existing subscriptions and pending
+					purchases keep their original mode. Restaurant orders and venue payments continue to use
+					standard payments.
+				</p>
 				<Field
 					label="Publishable key"
 					value={form.publishableKey}
@@ -184,6 +211,10 @@ export function PaymentSettingsPage() {
 					}
 					type="password"
 				/>
+				<p className="text-sm text-kumo-subtle">
+					Use the complete whsec_… signing secret from Stripe for the endpoint below. For local
+					forwarding, use the value printed by stripe listen. Do not generate your own value.
+				</p>
 				<Credential
 					label="Webhook secret"
 					present={Boolean(configuration.webhookSecret)}
@@ -210,10 +241,19 @@ export function PaymentSettingsPage() {
 			</form>
 			<section className="max-w-3xl rounded-xl bg-kumo-tint/40 p-5 text-sm text-kumo-subtle">
 				<h2 className="font-semibold text-kumo-default">Webhook endpoint</h2>
+				<input
+					aria-label="Payment webhook endpoint"
+					className="mt-2 w-full rounded-lg border border-kumo-line bg-kumo-base px-3 py-2"
+					readOnly
+					value={
+						typeof window === "undefined"
+							? PAYMENT_WEBHOOK_PATH
+							: new URL(PAYMENT_WEBHOOK_PATH, window.location.origin).href
+					}
+				/>
 				<p className="mt-2">
-					Configure Stripe to send domain events to the webhook shown by each installed
-					transactional plugin. Venue and Restaurant validate exact request bytes with this shared
-					signing secret.
+					Configure one Stripe endpoint for Venue, Restaurant, and Subscriptions. Payment verifies
+					each event and delivers it to the enabled plugins.
 				</p>
 			</section>
 		</div>

package/src/configuration/repository.ts

@@ -38,6 +38,7 @@ export class PaymentStripeConfigurationRepository {
 	): Promise<PaymentStripeSettings> {
 		const update: Updateable<PaymentDatabase["payment_stripe_settings"]> = {
 			...(input.mode === undefined ? {} : { mode: input.mode }),
+			...(input.collectionMode === undefined ? {} : { collection_mode: input.collectionMode }),
 			...(input.publishableKey === undefined ? {} : { publishable_key: input.publishableKey }),
 			...(input.configurationStatus === undefined
 				? {}
@@ -75,6 +76,7 @@ function mapSettings(row: SettingsRow): PaymentStripeSettings {
 	return {
 		id: row.id,
 		mode: row.mode,
+		collectionMode: row.collection_mode,
 		publishableKey: row.publishable_key,
 		configurationStatus: row.configuration_status,
 		stripeAccountId: row.stripe_account_id,

package/src/configuration/secrets.ts

@@ -10,12 +10,10 @@ import { PAYMENT_PLUGIN_ID } from "../constants.js";
 
 export const PAYMENT_STRIPE_SECRET_KEY = "stripe_secret_key";
 export const PAYMENT_STRIPE_WEBHOOK_SECRET = "stripe_webhook_secret";
-export const PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET = "stripe_subscription_webhook_secret";
 
 export type PaymentStripeSecretName =
 	| typeof PAYMENT_STRIPE_SECRET_KEY
-	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET
-	| typeof PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET;
+	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET;
 
 export class PaymentStripeSecretStore {
 	private readonly store: PluginSecretStore;

package/src/configuration/service.ts

@@ -1,7 +1,7 @@
 import type { Database, PluginSecretStatus, PluginSecretStoreOptions } from "dineway";
 import type { Kysely, Transaction } from "kysely";
 
-import type { StripeAccountProbe, StripeMode } from "../types.js";
+import type { StripeAccountProbe, StripeCollectionMode, StripeMode } from "../types.js";
 import { PaymentStripeConfigurationRepository } from "./repository.js";
 import {
 	PAYMENT_STRIPE_SECRET_KEY,
@@ -19,6 +19,7 @@ export interface PaymentStripeConfiguration {
 export interface UpdatePaymentStripeConfigurationInput {
 	expectedVersion: number;
 	mode?: StripeMode;
+	collectionMode?: StripeCollectionMode;
 	publishableKey?: string | null;
 	secretKey?: string | null;
 	webhookSecret?: string | null;
@@ -89,6 +90,7 @@ export async function updatePaymentStripeConfiguration(
 		const credentialsComplete = Boolean(publishableKey && nextSecret);
 		await repository.updateSettings(before.version, {
 			mode,
+			collectionMode: input.collectionMode,
 			publishableKey,
 			...(credentialsChanged || !credentialsComplete
 				? {
@@ -212,6 +214,12 @@ function normalizeOptionalSecret(value: string | null): string | null {
 }
 
 function validateUpdate(input: UpdatePaymentStripeConfigurationInput): void {
+	if (
+		input.collectionMode !== undefined &&
+		!["standard", "managed"].includes(input.collectionMode)
+	) {
+		throw new PaymentConfigurationError("VALIDATION_ERROR", "Choose Standard or Managed Payments");
+	}
 	if (!Number.isSafeInteger(input.expectedVersion) || input.expectedVersion < 1) {
 		throw new PaymentConfigurationError("VALIDATION_ERROR", "Expected version is invalid");
 	}

package/src/configuration/types.ts

@@ -1,4 +1,4 @@
-import type { StripeMode, StripeTaxStatus } from "../types.js";
+import type { StripeCollectionMode, StripeMode, StripeTaxStatus } from "../types.js";
 
 export type PaymentStripeConfigurationStatus = "unconfigured" | "unverified" | "valid" | "invalid";
 export type PaymentStripeConnectStatus = "not_configured" | "restricted" | "ready";
@@ -6,6 +6,7 @@ export type PaymentStripeConnectStatus = "not_configured" | "restricted" | "read
 export interface PaymentStripeSettings {
 	id: string;
 	mode: StripeMode;
+	collectionMode: StripeCollectionMode;
 	publishableKey: string | null;
 	configurationStatus: PaymentStripeConfigurationStatus;
 	stripeAccountId: string | null;
@@ -22,6 +23,7 @@ export interface PaymentStripeSettings {
 
 export interface UpdatePaymentStripeSettings {
 	mode?: StripeMode;
+	collectionMode?: StripeCollectionMode;
 	publishableKey?: string | null;
 	configurationStatus?: PaymentStripeConfigurationStatus;
 	stripeAccountId?: string | null;

package/src/database/index.ts

@@ -3,10 +3,12 @@ import type { PluginMigration } from "dineway";
 import * as configuration from "./migrations/001_stripe_configuration.js";
 import * as subscriptions from "./migrations/002_subscriptions.js";
 import * as purchases from "./migrations/003_purchases.js";
+import * as collectionMode from "./migrations/004_collection_mode.js";
 
 export const paymentMigrations = {
 	"001_stripe_configuration": configuration,
 	"002_subscriptions": subscriptions,
 	"003_purchases": purchases,
+	"004_collection_mode": collectionMode,
 } satisfies Record<string, PluginMigration>;
 export type { PaymentDatabase, PaymentTables } from "./types.js";

package/src/database/migrations/004_collection_mode.ts

@@ -0,0 +1,26 @@
+import { sql, type Kysely } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	for (const table of ["payment_stripe_settings", "payment_subscription_purchases"]) {
+		await db.schema
+			.alterTable(table)
+			.addColumn("collection_mode", "text", (column) =>
+				column
+					.notNull()
+					.defaultTo("standard")
+					.check(sql`collection_mode IN ('standard', 'managed')`),
+			)
+			.execute();
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	const purchases = await sql`SELECT 1 FROM payment_subscription_purchases LIMIT 1`.execute(db);
+	if (purchases.rows.length)
+		throw new Error(
+			"Restore a database snapshot to roll back payment purchases without losing their collection mode.",
+		);
+	for (const table of ["payment_subscription_purchases", "payment_stripe_settings"]) {
+		await db.schema.alterTable(table).dropColumn("collection_mode").execute();
+	}
+}

package/src/database/types.ts

@@ -1,6 +1,8 @@
 import type { Database } from "dineway";
 import type { Generated } from "kysely";
 
+import type { StripeCollectionMode } from "../types.js";
+
 export interface PaymentSubscriptionKey {
 	scope: string;
 	id: string;
@@ -86,6 +88,7 @@ export interface PaymentSubscriptionPortalTable extends PaymentSubscriptionKey {
 }
 
 export interface PaymentSubscriptionPurchaseTable extends PaymentSubscriptionKey {
+	collection_mode: Generated<StripeCollectionMode>;
 	user_id: string;
 	group_key: string;
 	contract: string;
@@ -117,6 +120,7 @@ export interface PaymentStripeSettingsTable {
 	id: string;
 	default_key: Generated<"default">;
 	mode: Generated<PaymentStripeMode>;
+	collection_mode: Generated<StripeCollectionMode>;
 	publishable_key: string | null;
 	configuration_status: Generated<PaymentStripeConfigurationStatus>;
 	stripe_account_id: string | null;

package/src/index.ts

@@ -7,7 +7,14 @@ import { PAYMENT_PLUGIN_ID } from "./constants.js";
 import { paymentMigrations } from "./database/index.js";
 import { createPaymentRoutes } from "./routes/index.js";
 import { createSubscriptionRoutes } from "./subscriptions/routes.js";
+import { getPaymentSubscriptionService } from "./subscriptions/runtime.js";
+import { SUBSCRIPTION_WEBHOOK_EVENTS } from "./subscriptions/service.js";
 import type { SubscriptionOptions } from "./subscriptions/types.js";
+import {
+	createPaymentWebhookRoute,
+	PAYMENT_WEBHOOK_EXTENSION,
+	type PaymentWebhookConsumer,
+} from "./webhooks/index.js";
 
 const PAYMENT_ADMIN_ENTRY = "@dineway-ai/plugin-payment/admin";
 const PAYMENT_ADMIN_PAGES = [
@@ -63,9 +70,23 @@ export function createPlugin(options: PaymentPluginOptions = {}): ResolvedPlugin
 			],
 		},
 		migrations: paymentMigrations,
+		nativeExtensions: options.subscriptions
+			? {
+					[PAYMENT_WEBHOOK_EXTENSION]: {
+						id: "subscriptions",
+						eventTypes: SUBSCRIPTION_WEBHOOK_EVENTS,
+						consume: async ({ event, rawBody }) => {
+							await (
+								await getPaymentSubscriptionService(options.subscriptions!)
+							).receiveVerifiedWebhook(event, rawBody);
+						},
+					} satisfies PaymentWebhookConsumer,
+				}
+			: {},
 		hooks,
 		routes: {
 			...createPaymentRoutes(),
+			"stripe/webhook": createPaymentWebhookRoute(),
 			...(options.subscriptions ? createSubscriptionRoutes(options.subscriptions) : {}),
 		},
 	});
@@ -76,3 +97,5 @@ export { PAYMENT_PLUGIN_ID } from "./constants.js";
 export * from "./stripe/index.js";
 export * from "./routes/index.js";
 export * from "./types.js";
+
+export * from "./webhooks/index.js";

package/src/routes/index.ts

@@ -22,7 +22,7 @@ import {
 } from "./schemas.js";
 
 const AUTHORIZATION = {
-	permission: "content:edit_any" as const,
+	permission: "payments:manage" as const,
 	anyOfTokenScopes: ["admin"],
 };
 

package/src/routes/schemas.ts

@@ -6,6 +6,7 @@ export const updatePaymentStripeConfigurationSchema = z
 	.object({
 		expectedVersion: z.number().int().positive(),
 		mode: z.enum(["test", "live"]).optional(),
+		collectionMode: z.enum(["standard", "managed"]).optional(),
 		publishableKey: z.string().max(512).nullable().optional(),
 		secretKey: z.string().max(512).nullable().optional(),
 		webhookSecret: z.string().max(512).nullable().optional(),

package/src/stripe/webhook-verifier.ts

@@ -97,6 +97,7 @@ function projectEvent(event: Stripe.Event, rawBody: Uint8Array): StripeWebhookEv
 
 	return {
 		eventId: event.id,
+		...(event.account ? { accountId: requiredSafeString(event.account, 255) } : {}),
 		eventType: event.type,
 		eventCreated: event.created,
 		livemode: event.livemode,

package/src/subscriptions/funding.ts

@@ -1,5 +1,6 @@
 import type Stripe from "stripe";
 
+import type { StripeCollectionMode } from "../types.js";
 import { relationId } from "./purchases.js";
 import {
 	SubscriptionError,
@@ -92,13 +93,31 @@ export async function invoiceFunding(
 	invoice: Stripe.Invoice,
 	contract: PurchaseContract | null,
 	now: number,
+	collectionMode: StripeCollectionMode = "standard",
 ): Promise<InvoiceFundingEvidence> {
 	const item = subscription.items.data[0]!;
 	const amount = contract?.amount ?? item.price.unit_amount ?? 0;
 	const currency = contract?.currency ?? item.price.currency;
 	const credit =
 		invoice.billing_reason === "subscription_create" ? (contract?.firstPeriodCredit ?? 0) : 0;
-	const cash = amount - credit;
+	const taxes = invoice.total_taxes ?? [];
+	const invalidTax = taxes.some(
+		(tax) =>
+			!Number.isSafeInteger(tax.amount) ||
+			tax.amount < 0 ||
+			(tax.amount !== 0 &&
+				(collectionMode !== "managed" || !["exclusive", "inclusive"].includes(tax.tax_behavior))),
+	);
+	const exclusiveTax = taxes.reduce(
+		(sum, tax) => sum + (tax.tax_behavior === "exclusive" ? tax.amount : 0),
+		0,
+	);
+	// Stripe line subtotals exclude inclusive tax; invoice subtotals retain it.
+	const inclusiveTax = taxes.reduce(
+		(sum, tax) => sum + (tax.tax_behavior === "inclusive" ? tax.amount : 0),
+		0,
+	);
+	const cash = amount - credit + exclusiveTax;
 	const evidence: InvoiceFundingEvidence = {
 		verifiedAt: now,
 		amount,
@@ -132,7 +151,7 @@ export async function invoiceFunding(
 		line.quantity !== 1 ||
 		line.currency !== currency ||
 		line.amount !== amount ||
-		line.subtotal !== amount ||
+		line.subtotal !== amount - inclusiveTax ||
 		invoice.subtotal !== amount ||
 		invoice.total !== cash ||
 		invoice.amount_due !== cash ||
@@ -142,7 +161,11 @@ export async function invoiceFunding(
 		invoice.ending_balance !== 0 ||
 		invoice.pre_payment_credit_notes_amount !== 0 ||
 		invoice.post_payment_credit_notes_amount !== 0 ||
-		invoice.total_taxes?.some((tax) => tax.amount !== 0) ||
+		invalidTax ||
+		!Number.isSafeInteger(inclusiveTax) ||
+		inclusiveTax > amount - credit ||
+		!Number.isSafeInteger(cash) ||
+		cash < 0 ||
 		!Number.isSafeInteger(line.period.start) ||
 		!Number.isSafeInteger(line.period.end) ||
 		line.period.start >= line.period.end
@@ -245,7 +268,7 @@ export async function invoiceFunding(
 		const resolved =
 			typeof method === "string" ? await stripe.paymentMethods.retrieve(method) : method;
 		if (
-			resolved.type !== "card" ||
+			(collectionMode === "standard" && resolved.type !== "card") ||
 			resolved.livemode !== invoice.livemode ||
 			relationId(resolved.customer) !== customer
 		)

package/src/subscriptions/projection.ts

@@ -94,6 +94,7 @@ export function subscriptionProjection(
 		const { contract } = purchase;
 		if (
 			purchase.userId !== userId ||
+			Boolean(subscription.managed_payments?.enabled) !== (purchase.collectionMode === "managed") ||
 			subscription.metadata.purchase_reference !== purchase.reference ||
 			(purchase.subscriptionId && purchase.subscriptionId !== subscription.id) ||
 			item.price.livemode !== (scope.mode === "live") ||

package/src/subscriptions/purchases.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 
 import type Stripe from "stripe";
 
+import type { StripeCollectionMode } from "../types.js";
 import { recurringPrice } from "./projection.js";
 import type { SubscriptionRepository } from "./repository.js";
 import { purchaseSchema } from "./schemas.js";
@@ -24,6 +25,7 @@ export interface PurchaseContext {
 	scope: SubscriptionScope;
 	now: () => number;
 	origin: string;
+	collectionMode: StripeCollectionMode;
 }
 const idempotency = (context: PurchaseContext, ...values: unknown[]) =>
 	"dineway:" + digest([context.repository.scope, ...values]);
@@ -108,6 +110,8 @@ export async function createPurchase(
 	input: SubscriptionPurchaseInput,
 ) {
 	const parsed = purchaseSchema.parse(input);
+	if (!["standard", "managed"].includes(context.collectionMode))
+		throw new SubscriptionError("INVALID_COLLECTION_MODE", "Choose Standard or Managed Payments");
 	return context.repository.withLock("member:" + userId, async (store) => {
 		const previous = await store.purchase(parsed.reference);
 		if (previous) {
@@ -128,6 +132,15 @@ export async function createPurchase(
 				"Resolve the existing purchase before starting another",
 				409,
 			);
+		if (
+			context.collectionMode === "managed" &&
+			parsed.pricing.kind === "dynamic" &&
+			!parsed.pricing.taxCode
+		)
+			throw new SubscriptionError(
+				"MANAGED_PAYMENTS_TAX_CODE_REQUIRED",
+				"Managed Payments requires an eligible Stripe product tax code",
+			);
 		let contract: PurchaseContract;
 		if (parsed.pricing.kind === "catalogue") {
 			const pricing = parsed.pricing;
@@ -149,6 +162,23 @@ export async function createPurchase(
 				verified.interval !== price.interval
 			)
 				throw new SubscriptionError("PRICE_CHANGED", "Refresh the plan price before checkout", 409);
+			if (context.collectionMode === "managed") {
+				const product = await context.stripe.products.retrieve(price.productId);
+				if (
+					product.deleted ||
+					!product.active ||
+					product.livemode !== (context.scope.mode === "live")
+				)
+					throw new SubscriptionError(
+						"INVALID_PRODUCT",
+						"Choose an active product from this Stripe environment",
+					);
+				if (!product.tax_code)
+					throw new SubscriptionError(
+						"MANAGED_PAYMENTS_TAX_CODE_REQUIRED",
+						"Set an eligible tax code on the Stripe product before using Managed Payments",
+					);
+			}
 			contract = {
 				...parsed,
 				amount: price.amount,
@@ -185,6 +215,7 @@ export async function createPurchase(
 			contract,
 			digest(parsed),
 			Math.floor(context.now() / 1000) + 3600,
+			context.collectionMode,
 		);
 		return resumePurchase(context, store, (await store.purchase(parsed.reference))!);
 	});
@@ -274,9 +305,12 @@ export async function resumePurchase(
 					price_data: {
 						currency: contract.currency,
 						unit_amount: contract.amount,
+						tax_behavior:
+							contract.pricing.kind === "dynamic" ? contract.pricing.taxBehavior : undefined,
 						recurring: { interval: contract.interval, interval_count: contract.intervalCount },
 						product_data: {
 							name: contract.pricing.kind === "dynamic" ? contract.pricing.name : "Subscription",
+							tax_code: contract.pricing.kind === "dynamic" ? contract.pricing.taxCode : undefined,
 							metadata,
 						},
 					},
@@ -287,7 +321,10 @@ export async function resumePurchase(
 				mode: "subscription",
 				customer: customerId,
 				line_items: [line],
-				payment_method_types: ["card"],
+				managed_payments: { enabled: purchase.collectionMode === "managed" },
+				...(purchase.collectionMode === "standard"
+					? { payment_method_types: ["card" as const] }
+					: {}),
 				payment_method_collection: "always",
 				client_reference_id: purchase.reference,
 				metadata,
@@ -305,6 +342,7 @@ export async function resumePurchase(
 	if (
 		relationId(session.customer) !== customerId ||
 		session.mode !== "subscription" ||
+		Boolean(session.managed_payments?.enabled) !== (purchase.collectionMode === "managed") ||
 		session.livemode !== (context.scope.mode === "live") ||
 		session.metadata?.dineway_app !== context.scope.namespace ||
 		session.metadata.user_id !== purchase.userId ||

package/src/subscriptions/repository.ts

@@ -478,6 +478,7 @@ export class SubscriptionRepository {
 		if (!row) return null;
 		return {
 			reference: row.id,
+			collectionMode: row.collection_mode,
 			userId: row.user_id,
 			contract: JSON.parse(row.contract),
 			createdAt: row.created_at,
@@ -523,6 +524,7 @@ export class SubscriptionRepository {
 		contract: PurchaseContract,
 		digest: string,
 		expiresAt: number,
+		collectionMode: SubscriptionPurchase["collectionMode"],
 	) {
 		await this.db.transaction().execute(async (trx) => {
 			await this.assertLease(trx);
@@ -534,6 +536,7 @@ export class SubscriptionRepository {
 					user_id: userId,
 					group_key: contract.groupKey,
 					contract: JSON.stringify(contract),
+					collection_mode: collectionMode,
 					fingerprint: digest,
 					created_at: this.now(),
 					expires_at: expiresAt,

package/src/subscriptions/routes.ts

@@ -1,10 +1,6 @@
 import { z } from "astro/zod";
-import { getDb, PluginRouteError, type PluginRoute, type RouteContext } from "dineway";
+import { PluginRouteError, type PluginRoute, type RouteContext } from "dineway";
 
-import {
-	PaymentStripeSecretStore,
-	PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
-} from "../configuration/secrets.js";
 import { getPaymentSubscriptionService, getSubscriptionConfiguration } from "./runtime.js";
 import {
 	checkoutSchema,
@@ -19,9 +15,6 @@ import type { PaymentSubscriptionService } from "./service.js";
 import { SubscriptionError, type SubscriptionOptions } from "./types.js";
 
 const empty = z.object({}).strict();
-const secretSchema = z
-	.object({ webhookSecret: z.string().trim().startsWith("whsec_").max(512) })
-	.strict();
 type PaymentPermission = "payments:read_own" | "payments:manage_own" | "payments:manage";
 export interface SubscriptionRouteOptions {
 	service?: () => Promise<PaymentSubscriptionService>;
@@ -83,17 +76,6 @@ export function createSubscriptionRoutes(
 		"subscriptions/configuration/get": privateRoute(empty, "payments:manage", async () =>
 			getSubscriptionConfiguration(options),
 		),
-		"subscriptions/configuration/update": privateRoute(
-			secretSchema,
-			"payments:manage",
-			async (context) => {
-				await new PaymentStripeSecretStore(await getDb()).set(
-					PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
-					context.input.webhookSecret,
-				);
-				return getSubscriptionConfiguration(options);
-			},
-		),
 		"subscriptions/plans/list": privateRoute(empty, "payments:manage", async () => ({
 			items: await (await service()).listPlans(true),
 		})),
@@ -132,24 +114,9 @@ export function createSubscriptionRoutes(
 			await client.refreshSubscription(context.input.subscriptionId);
 			return client.subscriptionDetail(context.input.subscriptionId);
 		}),
-		"subscriptions/webhook": {
-			methods: ["POST"],
-			public: true,
-			body: "raw",
-			maxBodyBytes: 262144,
-			handler: async (context) =>
-				run(async () => {
-					if (!context.rawBody)
-						throw new SubscriptionError("INVALID_SIGNATURE", "A signed body is required");
-					await (
-						await service()
-					).receiveWebhook(context.rawBody, context.request.headers.get("Stripe-Signature"));
-					return { received: true };
-				}, true),
-		},
 	};
 }
-async function run<T>(action: () => Promise<T>, webhook = false): Promise<T> {
+async function run<T>(action: () => Promise<T>): Promise<T> {
 	try {
 		return await action();
 	} catch (error) {
@@ -157,10 +124,6 @@ async function run<T>(action: () => Promise<T>, webhook = false): Promise<T> {
 			throw new PluginRouteError(error.code, error.message, error.status);
 		if (error instanceof z.ZodError)
 			throw new PluginRouteError("VALIDATION_ERROR", "Invalid subscription input", 400);
-		throw new PluginRouteError(
-			webhook ? "WEBHOOK_RETRY_REQUIRED" : "BILLING_UNAVAILABLE",
-			webhook ? "Retry this webhook" : "Billing is temporarily unavailable",
-			503,
-		);
+		throw new PluginRouteError("BILLING_UNAVAILABLE", "Billing is temporarily unavailable", 503);
 	}
 }

package/src/subscriptions/runtime.ts

@@ -3,9 +3,10 @@ import { getDb, type PluginSecretStoreOptions } from "dineway";
 import {
 	PaymentStripeSecretStore,
 	PAYMENT_STRIPE_SECRET_KEY,
-	PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
+	PAYMENT_STRIPE_WEBHOOK_SECRET,
 } from "../configuration/secrets.js";
 import { getPaymentStripeConfiguration } from "../configuration/service.js";
+import { PAYMENT_WEBHOOK_PATH } from "../webhooks/types.js";
 import { PaymentSubscriptionService } from "./service.js";
 import { SubscriptionError, type SubscriptionOptions } from "./types.js";
 
@@ -17,7 +18,7 @@ export async function getPaymentSubscriptionService(
 	const config = await getPaymentStripeConfiguration(db, secretOptions);
 	const store = new PaymentStripeSecretStore(db, secretOptions);
 	const secretKey = await store.resolveForRuntime(PAYMENT_STRIPE_SECRET_KEY);
-	const webhookSecret = await store.resolveForRuntime(PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET);
+	const webhookSecret = await store.resolveForRuntime(PAYMENT_STRIPE_WEBHOOK_SECRET);
 	if (
 		config.settings.configurationStatus !== "valid" ||
 		!config.settings.stripeAccountId ||
@@ -26,7 +27,7 @@ export async function getPaymentSubscriptionService(
 	) {
 		throw new SubscriptionError(
 			"BILLING_UNAVAILABLE",
-			"Configure and verify Stripe and the subscription webhook first",
+			"Configure and verify Stripe and the Payment webhook first",
 			503,
 		);
 	}
@@ -40,6 +41,7 @@ export async function getPaymentSubscriptionService(
 		siteUrl: options.siteUrl,
 		secretKey,
 		webhookSecret,
+		collectionMode: config.settings.collectionMode,
 	});
 }
 
@@ -47,19 +49,17 @@ export async function getSubscriptionConfiguration(options: SubscriptionOptions)
 	const db = await getDb();
 	const configuration = await getPaymentStripeConfiguration(db);
 	const webhookSecret = await new PaymentStripeSecretStore(db).status(
-		PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
+		PAYMENT_STRIPE_WEBHOOK_SECRET,
 	);
 	return {
 		namespace: options.namespace,
 		mode: configuration.settings.mode,
+		collectionMode: configuration.settings.collectionMode,
 		accountId: configuration.settings.stripeAccountId,
 		ready:
 			configuration.settings.configurationStatus === "valid" &&
 			Boolean(configuration.secretKey && webhookSecret),
 		webhookSecret,
-		webhookUrl: new URL(
-			"/_dineway/api/plugins/dineway-payment/subscriptions/webhook",
-			options.siteUrl,
-		).href,
+		webhookUrl: new URL(PAYMENT_WEBHOOK_PATH, options.siteUrl).href,
 	};
 }

package/src/subscriptions/schemas.ts

@@ -127,6 +127,11 @@ export const purchaseSchema = z
 					currency: z.string().regex(/^[a-z]{3}$/),
 					interval: z.enum(["day", "week", "month", "year"]),
 					intervalCount: z.number().int().min(1).max(365),
+					taxCode: z
+						.string()
+						.regex(/^txcd_[0-9]+$/)
+						.optional(),
+					taxBehavior: z.enum(["exclusive", "inclusive"]).optional(),
 				})
 				.strict(),
 		]),

package/src/subscriptions/service.ts

@@ -5,6 +5,7 @@ import type { Kysely } from "kysely";
 import Stripe from "stripe";
 
 import { StripeNodeWebhookVerifier } from "../stripe/webhook-verifier.js";
+import type { StripeCollectionMode, StripeWebhookEvent } from "../types.js";
 import { collectBounded, invoiceFunding, inspectCharge } from "./funding.js";
 import {
 	recurringPrice,
@@ -44,6 +45,7 @@ import {
 } from "./types.js";
 
 export interface SubscriptionServiceOptions {
+	collectionMode?: StripeCollectionMode;
 	db: Kysely<Database>;
 	scope: SubscriptionScope;
 	siteUrl: string;
@@ -53,7 +55,7 @@ export interface SubscriptionServiceOptions {
 	stripe?: Stripe;
 }
 const terminal = new Set(["canceled", "incomplete_expired"]);
-const events = new Set([
+export const SUBSCRIPTION_WEBHOOK_EVENTS = [
 	"checkout.session.completed",
 	"checkout.session.async_payment_succeeded",
 	"checkout.session.async_payment_failed",
@@ -76,7 +78,8 @@ const events = new Set([
 	"refund.updated",
 	"refund.failed",
 	"payment_intent.payment_failed",
-]);
+] as const;
+const events = new Set<string>(SUBSCRIPTION_WEBHOOK_EVENTS);
 const localeSchema = checkoutSchema.shape.locale;
 const fingerprint = (values: unknown[]) =>
 	createHash("sha256").update(JSON.stringify(values)).digest("hex");
@@ -235,6 +238,7 @@ export class PaymentSubscriptionService {
 			scope: this.options.scope,
 			now: this.now,
 			origin: this.origin,
+			collectionMode: this.options.collectionMode ?? "standard",
 		};
 	}
 	private async resolveSubject(subject: BillingSubject | string) {
@@ -565,6 +569,7 @@ export class PaymentSubscriptionService {
 						invoice,
 						purchase?.contract ?? null,
 						this.now(),
+						purchase?.collectionMode ?? "standard",
 					);
 					const old = previousPeriods.filter((period) => period.invoiceId === invoiceId);
 					const projected = old.length
@@ -723,7 +728,9 @@ export class PaymentSubscriptionService {
 		});
 		if (!verified.ok)
 			throw new SubscriptionError("INVALID_SIGNATURE", "Invalid Stripe webhook", 400);
-		const event = verified.event;
+		await this.receiveVerifiedWebhook(verified.event, rawBody);
+	}
+	async receiveVerifiedWebhook(event: StripeWebhookEvent, rawBody: Uint8Array): Promise<void> {
 		if (event.livemode !== (this.options.scope.mode === "live"))
 			throw new SubscriptionError("MODE_MISMATCH", "Invalid webhook mode", 400);
 		if (!events.has(event.eventType)) return;

package/src/subscriptions/types.ts

@@ -1,4 +1,4 @@
-import type { StripeMode } from "../types.js";
+import type { StripeCollectionMode, StripeMode } from "../types.js";
 
 export type SubscriptionEntitlements = Record<string, boolean | number>;
 export type SubscriptionInterval = "month" | "year";
@@ -92,6 +92,8 @@ export type PurchasePricing =
 			currency: string;
 			interval: "day" | "week" | "month" | "year";
 			intervalCount: number;
+			taxCode?: string;
+			taxBehavior?: "exclusive" | "inclusive";
 	  };
 export interface SubscriptionPurchaseInput {
 	reference: string;
@@ -110,6 +112,7 @@ export interface PurchaseContract extends SubscriptionPurchaseInput {
 	couponId: string | null;
 }
 export interface SubscriptionPurchase {
+	collectionMode: StripeCollectionMode;
 	reference: string;
 	userId: string;
 	contract: PurchaseContract;

package/src/types.ts

@@ -1,5 +1,6 @@
 export type { PaymentDatabase, PaymentTables } from "./database/types.js";
 export type StripeMode = "test" | "live";
+export type StripeCollectionMode = "standard" | "managed";
 export type StripeTaxStatus = "unknown" | "active" | "pending" | "unavailable";
 
 export type StripeProviderErrorCode =
@@ -262,6 +263,7 @@ export interface StripeWebhookRefund {
 }
 
 export interface StripeWebhookEvent {
+	accountId?: string;
 	subscriptionId?: string;
 	eventId: string;
 	eventType: string;

package/src/webhooks/index.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./routes.js";

package/src/webhooks/routes.ts

@@ -0,0 +1,109 @@
+import { getDb, PluginRouteError, type PluginRoute, type PluginSecretStoreOptions } from "dineway";
+
+import { PaymentStripeConfigurationRepository } from "../configuration/repository.js";
+import {
+	PaymentStripeSecretStore,
+	PAYMENT_STRIPE_SECRET_KEY,
+	PAYMENT_STRIPE_WEBHOOK_SECRET,
+} from "../configuration/secrets.js";
+import { StripeNodeWebhookVerifier, STRIPE_WEBHOOK_MAX_BYTES } from "../stripe/webhook-verifier.js";
+import type { StripeWebhookVerifier } from "../types.js";
+import { PAYMENT_WEBHOOK_EXTENSION, type PaymentWebhookConsumer } from "./types.js";
+
+export interface PaymentWebhookRouteOptions {
+	secretOptions?: PluginSecretStoreOptions;
+	verifier?: StripeWebhookVerifier;
+	now?: () => Date;
+}
+export function createPaymentWebhookRoute(options: PaymentWebhookRouteOptions = {}): PluginRoute {
+	return {
+		methods: ["POST"],
+		public: true,
+		body: "raw",
+		maxBodyBytes: STRIPE_WEBHOOK_MAX_BYTES,
+		handler: async (context) => {
+			const rawBody = context.rawBody ?? new Uint8Array();
+			const signature = context.request.headers.get("stripe-signature");
+			if (
+				!rawBody.byteLength ||
+				rawBody.byteLength > STRIPE_WEBHOOK_MAX_BYTES ||
+				!signature?.trim()
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			const db = await getDb();
+			let runtime;
+			try {
+				const store = new PaymentStripeSecretStore(db, options.secretOptions);
+				const [settings, secretKey, webhookSecret] = await Promise.all([
+					new PaymentStripeConfigurationRepository(db).requireSettings(),
+					store.resolveForRuntime(PAYMENT_STRIPE_SECRET_KEY),
+					store.resolveForRuntime(PAYMENT_STRIPE_WEBHOOK_SECRET),
+				]);
+				if (!secretKey || !webhookSecret) throw new Error("Missing credentials");
+				runtime = { settings, secretKey, webhookSecret };
+			} catch {
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Stripe webhook is not configured",
+					503,
+				);
+			}
+			const now = options.now?.() ?? new Date();
+			const result = (options.verifier ?? new StripeNodeWebhookVerifier()).verify({
+				secretKey: runtime.secretKey,
+				webhookSecret: runtime.webhookSecret,
+				rawBody,
+				signature,
+				receivedAt: Math.floor(now.getTime() / 1000),
+			});
+			if (
+				!result.ok ||
+				result.event.livemode !== (runtime.settings.mode === "live") ||
+				(result.event.accountId && result.event.accountId !== runtime.settings.stripeAccountId)
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			if (!context.getNativeExtensions)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Update Dineway to enable payment event dispatch",
+					503,
+				);
+			let failed = false;
+			for (const extension of context.getNativeExtensions(PAYMENT_WEBHOOK_EXTENSION)) {
+				if (!isConsumer(extension)) {
+					failed = true;
+					continue;
+				}
+				if (!extension.eventTypes.includes(result.event.eventType)) continue;
+				try {
+					await extension.consume({
+						db,
+						event: result.event,
+						rawBody,
+						expectedLivemode: result.event.livemode,
+						now,
+					});
+				} catch {
+					failed = true;
+				}
+			}
+			if (failed)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_PROCESSING_FAILED",
+					"Stripe webhook could not be processed",
+					503,
+				);
+			return { received: true };
+		},
+	};
+}
+function isConsumer(value: unknown): value is PaymentWebhookConsumer {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value as Partial<PaymentWebhookConsumer>;
+	return (
+		typeof candidate.id === "string" &&
+		Array.isArray(candidate.eventTypes) &&
+		candidate.eventTypes.every((type) => typeof type === "string") &&
+		typeof candidate.consume === "function"
+	);
+}

package/src/webhooks/types.ts

@@ -0,0 +1,21 @@
+import type { Database } from "dineway";
+import type { Kysely } from "kysely";
+
+import type { StripeWebhookEvent } from "../types.js";
+
+export const PAYMENT_WEBHOOK_EXTENSION = "dineway-payment:stripe-webhook";
+export const PAYMENT_WEBHOOK_PATH = "/_dineway/api/plugins/dineway-payment/stripe/webhook";
+
+/** Delivered only after Payment has verified the exact request bytes and environment. */
+export interface PaymentWebhookDelivery {
+	db: Kysely<Database>;
+	event: StripeWebhookEvent;
+	rawBody: Uint8Array;
+	expectedLivemode: boolean;
+	now: Date;
+}
+export interface PaymentWebhookConsumer {
+	id: string;
+	eventTypes: readonly string[];
+	consume(delivery: PaymentWebhookDelivery): Promise<void>;
+}