@batterai/trust

BUSL trust primitives for Battery authoring surfaces and MCP operations.

This package contains framework-neutral security helpers that are intentionally kept out of MIT packages:

• Ed25519 signing and verification with explicit key IDs.
• Canonical JSON and SHA-256 digest helpers.
• Hash-chain generation and verification for exported audit logs.
• Editor license evaluation, release-date gating, domain matching, localhost development exemption, and watermark decisions.
• Commerce/license-portal primitives for Paddle Billing webhooks, idempotent key issuance, trial keys, domain updates, reissue flows, and email handoff.

Production deployments should inject their own signing keys. The exported local development key is only for hermetic tests and non-production fixtures.

Commerce storage boundary

@batterai/trust does not own production storage. The commerce APIs accept a LicensePortalStore and LicenseMailer so the host CMS, CRM, or billing backend remains the durable system of record for accounts, processed webhooks, issued license records, domains, and outbound email status.

The exported createMemoryLicensePortalStore() is only for tests and local fixtures. Production integrations should back the store with CMS-owned tables or collections and enforce uniqueness for processed webhook ids and license ids.

The Paddle helper verifies the Paddle-Signature header (ts + h1) against the raw request body before parsing JSON. Accepted billing events can issue a signed Batterai license, persist the issued record through the injected store, and hand the email payload to the injected mailer. Portal APIs cover self-serve trial keys, domain changes, and key reissue without introducing canvas-owned state.

For live sandbox verification, use the repository-level bun run commerce:verify-gate runner documented in docs/license-commerce-gate.md.