Commerce and delivery

V03 sells one product through the built-in commerce path: the signed source-template release. Directory inclusion, ratings, rankings, matchups, and editorial decisions are not sold.

Checkout

POST /api/checkout accepts only kind=template, rate-limits anonymous callers, and creates a Polar checkout for the configured product. The browser receives a checkout URL, not an entitlement.

Paid webhook

POST /api/webhooks/polar verifies the raw request signature before parsing business data. A paid event must match the configured product and Site. The transaction then:

1. Upserts the Order by provider event and checkout identity.
2. Creates or activates the buyer entitlement.
3. Writes a unique fulfillment Outbox event.
4. Stores an Inbox receipt so replay is a no-op.

No download is created in the webhook request.

Fulfillment worker

The Worker validates the deployed release descriptor, writes the immutable delivery artifact, and marks the Outbox event delivered. The descriptor includes release version, commit, manifest, artifact hash, byte size, SBOM, AIBOM, storage key, and signature reference.

The checkout-success page exchanges an entitled order for a short-lived, bounded download grant. The grant is tied to Site, entitlement, artifact, expiry, and maximum use count. Download tokens are HMAC-signed with a dedicated secret.

Refunds and disputes

A verified refund event revokes the entitlement and enqueues revocation. The Worker expires delivery artifacts and all outstanding download grants. Replayed refunds remain idempotent. Exhausted fulfillment or revocation attempts enter the dead-letter queue for operator resolution.

Required configuration

Configure Polar access token, product UUID, environment, and webhook secret. Configure R2 release storage and every field of the signed release descriptor. If any release field is missing, the Worker does not claim fulfillment readiness.

The retired Stripe webhook returns 410 Gone; V03 contains no paid fast-track or Featured ranking path.