Fix Polar webhook processing

[naaiyy]

What changed

• verify Polar webhooks with the official SDK against the unmodified request body
• process billing events through one atomic Convex mutation
• make delivery and provider-resource handling idempotent
• reconcile paid orders, refunds, subscriptions, entitlements, and AI credit grants
• validate production billing configuration at deployment time
• remove the previous hand-rolled verification and fragmented event-ordering code

Root cause

The previous webhook boundary did not match Polar's signature contract. Repeated non-2xx responses caused Polar to disable the endpoint, and the paid order was not reflected in the BaseBlocks credit ledger.

Impact

Polar deliveries now return 202 after SDK verification and atomic application. Duplicate delivery and duplicate order redelivery cannot grant credits twice. Refund and stale-event ordering is monotonic.

Verification

• 244 tests passed
• 495 assertions passed
• all workspace TypeScript checks passed
• Biome lint passed across 520 files
• production endpoint returned 202 for two deliveries
• production order granted 5,000,000 prepaid units exactly once

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
base-blocks	Ready	Preview	Aug 14, 2026 11:32pm