/iblai-vibe-monetization-app-paywall

Gate a whole app behind a one-time or subscription payment on the tenant's own Stripe account. The ibl.ai platform (DM) owns entitlement end to end: it mints the Stripe Checkout session, verifies the buyer's return read-after-write, records payments durably, caches answers (grants 60s, denies 15s — a session_id punches through a cached deny), checks subscriptions live so cancellation bites within the cache window, and keeps recorded payers in during a Stripe outage (stale: true) while failing closed for unknown users. The app stays thin: two server routes, one client gate, one pricing page. No cookies, no webhooks, no local payment ledger.

How a visit flows: anonymous visitor → AuthProvider → hosted Auth SPA → back logged in → PaywallGate (inside the (app) layout) asks GET /api/paywall/access → denied → /paywall pricing page → buy → Stripe Checkout → /paywall/return?session_id=… → access confirmed → app.

Common setup (brand, conventions, env files, verification): see docs/skill-setup.md.