monetization-and-billing

# Monetization and Billing ## Fail-Fast Rule If any payment operation fails, **return a structured error and do not grant access**. Never optimistically grant paid features before payment confirmation. Never silently ignore webhook failures. A missed webhook = a user who paid but has no access, or a user who canceled but keeps access. ## Cardinal Rule **Stripe is the single source of truth for billing state.** Your database is a cache of Stripe's state, synchronized via webhooks. Never make billing decisions based solely on local database state without webhook confirmation. Never store raw credit card numbers or sensitive payment data locally. ## Architecture: {{PROJECT_NAME}} Billing Stack ``` ┌─────────────────┐ ┌──────────────┐ ┌─────────────┐ │ Frontend (React)│────▶│ Supabase Auth │────▶│ Supabase DB │ │ Vercel │ │ + RLS │ │ billing_* │ └────────┬────────┘ └──────────────┘ └──────┬──────┘ │ │ │ Checkout Session │ RLS checks ▼ │ tier column ┌─────────────────┐ ┌──────────────┐ │ │ Stripe Checkout │────▶│ Stripe │───────────┘ │ (hosted page) │ │ Webhooks │ sync via └─────────────────┘ │ → Backend │ webhook handler └──────────────┘ ``` ### Component Responsibilities - **Frontend**: Creates Checkout Sessions via Backend API,...