Payments

Modules create payment intents, capture and refund them, and read a reconciled ledger through one API, never touching card data or a PSP SDK. Amounts are integer minor units throughout — money is never a float. Status is folded from an append-only event stream at read time, so it cannot drift. The default provider is a deterministic offline mock that settles on a tick; an optional Stripe adapter (one fetch, no SDK) activates when a key is configured. A refund claims the refundable balance before the PSP is called, so two concurrent refunds can never exceed it, and idempotency keys make a retried request a no-op rather than a second payment.

Responsibilities

• Payment intents in integer minor units, idempotent on creation
• Status folded from an append-only event stream, never stored
• Full and partial refunds validated against a pre-claimed balance
• Append-only ledger of credits and debits for reconciliation
• HMAC-verified inbound webhooks with a replay window; mock PSP by default, Stripe optional

API surface

• POST /api/intents · GET /api/intents
• POST /api/intents/:id/confirm · POST /api/intents/:id/refund
• GET /api/ledger
• POST /api/webhooks/:provider
• POST /api/tick

CONSUMED BY Any module that charges or refunds a customer. A Platform Service never depends on a Business Module.