Finishing your B2B invoicing MVP — Stripe seats, RLS, PDF, prod.

Stripe webhooks firing but seats not syncing — that's almost always the subscription.updated handler missing the items.data[0].quantity diff against your org_seats row. Fixable in one sitting if your webhook log is intact.

I run themeknock.net — an AI-first studio building Next.js + Supabase + Stripe SaaS since 2019. Supabase + Stripe is the core stack of half our agency work — last one was a seat-based B2B tool, $19/seat/mo, shipped to production in 18 days. Multi-tenant RLS with tenant_id enforced at the policy layer, not the app layer.

Here's what I'd ship in your 3-4 week window:

1. Stripe seat sync — webhook handler for customer.subscription.updated + invoice.payment_succeeded, proration via proration_behavior: 'create_prorations', idempotency keys on every write
2. RLS lockdown — tenant_id policy on invoices, line_items, customers. Leak-test with two seeded orgs before merge
3. PDF generator — @react-pdf/renderer server-side, signed URLs, 24h expiry, stored in Supabase Storage
4. Vercel prod — env split, preview branches, webhook secret rotation, status page

One flag before kickoff — your JD says “last dev didn't lock tenant_id.” I'd want 30 minutes to read the current policies and the invoices schema before quoting firm. If the schema needs a migration (not just policy fixes), the PDF piece slides a week.

Pricing — $6,500 fixed, milestoned at 25/25/25/25. I work fixed-fee, not hourly. No bait-and-switch, no hourly creep. If Stripe seats aren't syncing cleanly by milestone 2, you don't pay milestone 3.

Trial week is on the table — first 5 days, you keep the Stripe handler and the RLS audit either way. Free, no commitment.

Three questions before we kick off — webhook logs in Stripe dashboard, last 30 days intact? Supabase project on free tier or Pro? PDFs need branded templates per tenant, or one shared layout?