Stripe Entitlement Ledger

The natural way to gate paid content is to call Stripe at request time and check the subscription's status. That adds Stripe's latency and outage risk to every view of content that changes maybe once a month, and it has no answer for two webhook deliveries racing each other -- Stripe retries on any non-200, and duplicates are normal, not exceptional.

WHAT SHIPS: receive() durably records every webhook event exactly once (a primary key is the dedupe key; re-delivery is a guaranteed no-op); a separate drain() step projects the backlog into an entitlements table under FOR UPDATE SKIP LOCKED, so overlapping worker runs never double-grant or double-revoke; has_entitlement() reads only that derived table, so Stripe is never consulted at read time and your session state never has to agree with billing state. Handles the full lifecycle -- checkout.session.completed and invoice.paid grant; customer.subscription.deleted, charge.refunded and charge.dispute.created revoke -- plus per-row expiry checked at read time. About 140 lines of DB-API 2.0 Python (stdlib only), a three-table Postgres schema (schema_pg.sql), and tests that run identically against in-memory SQLite.

WHAT IT LEAVES TO YOU, on purpose: Stripe signature verification at the HTTP boundary, the cron or queue trigger that calls drain(), and dead-letter handling (an attempts column is reserved for it).

VERIFIED: 6 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.