Five pages, meant to be read in order. Each one states the mechanism first, then how it behaves in the cases that bite, then what it costs you.
They stop at how the thing works. Why it was chosen over the alternatives is in docs/adr/, and every page links the decisions it depends on by path.
Three ideas recur across all five, so they are worth having in advance.
A webhook is a trigger, not data. Every handler takes an id off the event and re-fetches the object, so replays and out-of-order delivery converge without bookkeeping.
Entitlement is derived from the price actually paid. There is no plan column and no field that says what somebody bought.
The api is what enforces an entitlement, so a client-side check is a loading state rather than a security boundary. The web app only decides whether the caller is signed in. Request policy lives in src/start.ts, and each private route calls the server-side requireAuth guard before loading.