Extend the programmatic connect snippet with the checkout + poll steps
(POST /v1/purchase, GET /v1/purchase/{id}) and note the purchased license
carries the policy entitlements, so it unlocks the same gate the worked
example builds. Ties connect, buyer-pays, and gate-unlock together in one
place; previously that money path lived only in the OpenAPI spec.
Add the "Connect BTCPay programmatically" agent workflow and a payment_providers:write
extra-scope note to agent.html; correct the "not exposed to agents" section to the
accurate gate (scoped connect is sandbox + non-mainnet only; disconnect and
production/mainnet stay master-only). Fix the BTCPay permission list in install.html to
the five permissions the daemon actually requests, and point operators at the agent path.
Fixes surfaced by the onboarding test harness, each verified against the
published SDKs and the daemon:
- integrate.html: real v0.3 verify() shape (throws/Err, returns
VerifyOk{payload,...}, no `valid` bool; LicensingError `.code` in TS,
`.kind` in Python; Rust Error::BadSignature/BadFormat). Offline-expiry
and server-side key-transport notes; corrected the admin-API table
(licenses list needs product_id; added the /search row).
- agent.html: merchant-onboard role row; product/policy-create workflows;
buyer_note -> note; find-by-email -> /search; the worked-example
walkthrough; code blocks restyled to the pre.code design contract.
- wire-format.html: corrected the GET /v1/issuer/public-key response shape.
Keysat has no refund functionality — refunds are handled out-of-band in the
payment processor (the v0.3 revoke-on-refund webhook hook is currently a
no-op). Drop refund mentions so the docs do not describe a flow the daemon
does not implement.
- docs.js (new): sync sidebar .active pill with location.hash on load, click, and hashchange so in-page anchor links (Architecture, Discount codes, Backups, etc.) update the pill instead of leaving it stuck on whatever was statically marked
- Wire docs.js into every page just before </body>
- license.html: sidebar Project/Operate order matches every other page (Project first)
- pricing.html: rewritten to use the standard docs layout (full sidebar groups, prose main, breadcrumb) instead of a one-off shell that felt detached from the rest of the docs
- Reference section: remove Admin API + SDKs anchor links (they masqueraded as separate pages but just scrolled within integrate.html); Wire format stands alone
- Pricing copy: Zaprite reframed as "expanded payment options including card payment capabilities", "shipping in v0.3" removed (it shipped), Patron rephrased as perpetual (never expires or renews)
- "Toggling inactive" cap-evasion language replaced — admin UI exposes delete only, no soft-disable affordance for products
- ~70 em-dashes removed across 8 pages using a small pattern set (elaboration→period, list-intro→colon, tight clarification→comma, parentheticals→parens). Decorative stamp ornaments and references to actual third-party UI labels are kept verbatim.
- New license.html: plain-English summary of the Keysat
Source-Available License 1.0 (daemon) and MIT (SDKs +
template). TL;DR table, "what you can do / can't do" lists,
contribution-flow explainer, links to each repo's LICENSE
file on GitHub. Anchor sections + on-this-page TOC.
- New "Project" sidebar group (Pricing + License) inserted
above the existing Operate group on every docs page so the
/license page is discoverable from anywhere in the docs.
Five-page sweep to match the current daemon state.
install.html:
- Step 6 (first product): "Price (sats)" → reflects the
currency picker (sats / USD / EUR) shipped in migration 0010.
- Step 7 (first policy): drop the "default slug is consumed by
public flow" myth — buy page renders a tier picker for any
product with ≥2 public policies. Add references to entitlements
catalog, hide-on-buy toggles, marketing bullets, recurring
subscriptions, and the drag-to-reorder policy grid.
integrate.html:
- "Three official SDKs" → "Four official SDKs" + Go tab + install
snippet. Notes the daemon's cross-check fixtures assert
byte-for-byte parity across all four.
- Admin API table: drop "by npub" from the licenses search
description (backend supports it; UI hasn't surfaced it yet
since the purchase flow doesn't capture npubs).
operate.html:
- Backups section: drop the imaginary `/data/issuer-key.pem`
file — the signing keypair lives in the `server_keys` SQLite
table, not in a PEM file on disk. Mention the self-license
file path (`/data/keysat-license.txt`).
- Rotation: drop the "v0.1 doesn't support / v0.2 will" framing;
rotation isn't on the v0.2 / v0.3 roadmap and the v0.1 caveat
is misleading. Update steps to reflect SQLite-as-keystore.
- Webhook troubleshooting: point at the dedicated
Webhooks → Failed (DLQ) view rather than the audit log.
pricing.html:
- Creator: 21,000 sats one-time → Free forever (matches actual
master Keysat configuration).
- Pro: 250,000 sats/yr → 100,000 sats/yr (recurring). Note
recurring + tier upgrades have shipped; only Zaprite remains
v0.3.
- Patron: 500,000 sats/yr → 250,000 sats one-time perpetual.
Differentiation rewritten: perpetual license + direct 1:1
support (not just "Pro with a badge").
- Active discount-code cap: 5 → 10 (real cap).
- New "Prices shown are a snapshot" note pointing at the
canonical live source (keysat.xyz#tiers + the buy page).
- Updated unlicensed-caps line to show 5/5/10 with units.
wire-format.html:
- Replace the entirely-fabricated "KS-base32-blob with KSAT magic
bytes" layout with the actual LIC1 envelope:
`LIC1-<base32 payload>-<base32 signature>` split on dashes.
- Document BOTH payload versions: v1 (legacy 74-byte fixed) and
v2 (current default, 83-byte head + variable entitlements
table). Field offsets, flag bits, signature scope all match
the daemon source.
- Drop the bogus Crockford-base32 + dash-grouping sections —
the daemon uses RFC 4648 base32 with single-dash structure
separators, not grouped-dashes for readability.
- Drop the fabricated hex-dump worked example.
- Porting section now points at `licensing-service/tests/crosscheck/`
(the actual fixtures location) instead of a Python-SDK path.
- Versioning policy: clarify envelope-tag vs payload-version
cadence.
Nine wording fixes:
- Hero lede: drop "Bitcoin payment via BTCPay" → "payment via
BTCPay" (matches landing-page de-emphasis); split the dense
one-paragraph lede into two.
- Products: "price in sats" → "price (sats / USD / EUR)";
introduce the entitlements catalog concept.
- Policies table: add is_recurring + renewal_period_days,
marketing_bullets, hidden_entitlements. Fix "default slug is
canonical" myth — multi-tier ladders (Basic / Pro / Max) are
first-class and the buy page renders a tier picker for products
with 2+ public policies. Note tier_rank + drag-and-drop ordering.
Split "private policies" out as a paragraph.
- Discounts: add set_price as a 4th kind. Note discount_currency
on fixed-amount codes. Add multi-policy scope. Add featured
/ launch-special section (ribbon, auto-apply, pre-filled input).
- Revocation: "v0.2 will ship recurring renewals" → past-tense.
Recurring is shipped.
- New "Operator tiers" section: explains Keysat self-licenses
(Creator / Pro / Patron), notes caps are enforce-on-create
(existing rows grandfathered), and lists four canonical sources
for the live tier list (keysat.xyz, pricing.html, the public
/v1/products/keysat/policies endpoint, the admin /v1/admin/tier
endpoint). "As of this writing" framing for the current cap
values so they don't go stale silently.
- TOC: add #operator-tiers anchor.
Pricing.html, install.html, integrate.html, wire-format.html,
operate.html — not touched; this is the introduction page only.
A separate pass should audit those too.
Recurring subscriptions and Zaprite payments — the two v0.3
features the section advertised as upcoming — both shipped in the
v0.2 line and gate on the recurring_billing / card_payments
entitlements as planned. Section copy was stale and confusing.
Ports the in-repo KEYSAT_AGENT_GUIDE.md into the docs site as a
first-class page rather than linking out to a raw markdown file on
GitHub. The page covers authentication, scoped API keys, OpenAPI
discovery, error envelope conventions, common workflows (issue /
revoke / find / cancel / change-tier / free-machine), webhook
event types + signature verification, robust-agent patterns, a
"comp-license-via-email" recipe, and the operator-only
operations that aren't exposed to any scoped key.
Sidebar gains an "Agent integration" entry under Get started on
every page (index, install, integrate, wire-format, operate, agent
itself). Docs index "These docs cover" + "Where to next" grids
each gain a third card pointing at the agent guide so it's
discoverable from the introduction page even for visitors who
don't scan the sidebar.
The left sidebar already covers Install / Integrate / Wire format /
Operate across its four groups (Get started, Concepts, Reference,
Operate). The top-right nav duplicated those links one level up. On
mobile it was already hidden via @media rule, so the sidebar was
always the canonical navigation. Now it's the only navigation —
cleaner topbar, no duplication.
Standard docs-site convention: top-left brand goes to the marketing
home, the 'Docs' badge next to it signals you're in the docs section.
The separate 'Marketing' nav item is no longer needed once the brand
itself handles that link.
Keysat