Payments
Payment providers are plugins behind one capability. Core routes money out as events and line items; it never calls a gateway.
Provider plugins
Central rails ship as plugins: stripe (Checkout Sessions + webhooks), paypal (Orders API + webhooks) and token_payment (pay any invoice from a token balance — no external gateway). Regional rails (YooKassa, Conekta, Mercado Pago, PromptPay, TrueMoney, Toss, …) are additional plugins enabled per-instance.
How a provider plugs in
A provider implements the payment capability and registers its line-item handler + lifecycle hook in on_enable. Inbound webhooks are signature-verified per provider. Core's hardened /webhooks/payment (admin mark-paid) is permission-gated. This open/closed shape means a new gateway is a new plugin — no core edit.