@copilotkit/license-verifier - npm Package Compare versions

Comparing version 0.4.2 to 0.5.0

dist/index.d.mts

@@ -0,1 +1,3 @@
+import { z } from "zod";
+
 //#region src/types.d.ts
@@ -12,5 +14,6 @@ interface LicenseOwner {
   "sdk.angular"?: boolean;
+  msteams?: boolean;
   [key: string]: boolean | number | undefined;
 }
-type LicenseTier = "free" | "developer" | "pro" | "team_self_hosted" | "enterprise";
+type LicenseTier = "free" | "developer" | "pro" | "team" | "team_self_hosted" | "enterprise";
 interface LicensePayload {
@@ -56,2 +59,12 @@ version: number;
 /**
+ * Check whether a catalog-boolean feature is enabled in a raw features map.
+ * Returns false when the feature is unknown, missing, the catalog says the
+ * feature is not boolean-valued, or the value is not exactly `true`.
+ *
+ * @param features - Raw feature map (license payload features or org overlay).
+ * @param feature - Candidate feature key.
+ * @returns Whether the feature is granted.
+ */
+
+/**
  * Check whether a specific feature is enabled in the license.
@@ -67,6 +80,5 @@ * Returns false if the license is null, the feature is unknown, the feature is
  */
-declare function getFeatureLimit(license: LicensePayload | null, feature: string): number | null;
+declare function getFeatureLimit(license: LicensePayload | null, feature: string): number | null; //#endregion
+//#region src/keystore.d.ts
 
-//#endregion
-//#region src/keystore.d.ts
 //# sourceMappingURL=verify.d.ts.map
@@ -108,3 +120,3 @@ /**
 //# sourceMappingURL=keystore.d.ts.map
-declare const FEATURE_IDS: readonly ["threads.retention_hours", "threads.max_count", "multimodal_storage_gb", "sdk.angular", "deployment_via_helm_chart", "analytics", "self_learning"];
+declare const FEATURE_IDS: readonly ["threads.retention_hours", "threads.max_count", "multimodal_storage_gb", "sdk.angular", "deployment_via_helm_chart", "analytics", "self_learning", "msteams"];
 type FeatureId = (typeof FEATURE_IDS)[number];
@@ -117,3 +129,3 @@ /**
 
-type FeatureValueKind = "boolean" | "number";
+type FeatureValueKind = 'boolean' | 'number';
 interface FeatureDefinition {
@@ -155,3 +167,3 @@ /** Stable feature id embedded in license feature snapshots. */
 //#endregion
-//#region src/license-check.d.ts
+//#region src/organization-entitlement.d.ts
 /**
@@ -164,2 +176,59 @@ * Resolve a feature definition by id.
 /**
+ * Wire contract for an organization's effective entitlement as consumed by the
+ * runtime feature checker. This is the published wire DTO for the
+ * `@copilotkit/runtime` consumer (Layer 3, in the CopilotKit OSS repo —
+ * intentionally NOT this monorepo's `@copilotkit/runtime-enterprise`); the
+ * app-api `/api/entitlements/runtime` producer projects its internal
+ * `@cpki/ops-contracts` DTO onto this shape and re-validates against it (the
+ * shapes are duplicated in spirit, not a single shared definition). `active`
+ * means the org has a resolved, non-blocked entitlement; `features` is the
+ * catalog-keyed feature snapshot (the OR side of the runtime merge). For
+ * inactive entitlements `features` is empty.
+ *
+ * `planCode` and `source` are opaque, catalog/ops-defined tokens carried for
+ * diagnostics; they are deliberately typed as free strings (not closed enums)
+ * because this published package must not import the internal catalog, so a
+ * Layer 3 consumer must not assume an exhaustive set.
+ *
+ * NOTE: `features` is intentionally catalog-AGNOSTIC here (no
+ * `getFeatureDefinition` check) — this published package must not depend on the
+ * internal `@cpki/license-catalog`. Catalog validation (unknown ids, value-kind)
+ * happens upstream in ops-api / `@cpki/ops-contracts`; this schema only enforces
+ * the structural shape.
+ */
+declare const organizationEntitlementSchema: z.ZodObject<{
+  active: z.ZodBoolean;
+  features: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber]>>;
+  planCode: z.ZodOptional<z.ZodString>;
+  source: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Organization entitlement wire DTO. */
+type OrganizationEntitlement = z.infer<typeof organizationEntitlementSchema>;
+/**
+ * Parse and return a validated organization entitlement.
+ *
+ * @param value - Unknown payload (e.g. an app-api response body).
+ * @returns The validated organization entitlement.
+ */
+declare function parseOrganizationEntitlement(value: unknown): OrganizationEntitlement;
+
+//#endregion
+//#region src/license-check.d.ts
+//# sourceMappingURL=organization-entitlement.d.ts.map
+/**
+ * Merged (base deployment + organization overlay) feature reader.
+ *
+ * Deliberately does NOT expose `getStatus()`: deployment validity is unrelated
+ * to the merged feature view (a hosted-no-token base is `valid: false` while an
+ * active overlay still grants features), so a reader `getStatus()` would invite
+ * wrongly gating out an active org. Consumers needing deployment diagnostics use
+ * the base `checker.getStatus()`.
+ */
+interface EntitlementReader {
+  /** Whether the feature is granted by the deployment OR the organization. */
+  checkFeature(feature: string): boolean;
+  /** Most-generous numeric limit across deployment and organization; `0` = unlimited. */
+  getFeatureLimit(feature: string): number | null;
+}
+/**
  * Runtime-agnostic license checker that caches verification results
@@ -173,2 +242,8 @@ * and re-evaluates expiration on each access for long-lived processes.
   checkFeature(feature: string): boolean;
+  /**
+   * Derive a non-mutating reader that merges an organization entitlement with
+   * the deployment base. Fresh per call; never mutates the base payload or the
+   * shared checker. Safe to call per request with a different org.
+   */
+  withOrganizationEntitlement(org: OrganizationEntitlement): EntitlementReader;
 }
@@ -188,3 +263,3 @@ /**
 
-export { KeyAttestationData, LICENSED_FEATURES, LicenseChecker, LicenseFeatures, LicenseOwner, LicensePayload, LicenseStatus, LicenseTier, addRuntimeKeyAttestation, clearRuntimeKeys, createLicenseChecker, getFeatureDisplayName, getFeatureLimit, getMasterPublicKey, getPublicKey, isComponentFeature, isFeatureEnabled, isRuntimeFeature, verifyKeyAttestation, verifyLicense };
+export { EntitlementReader, KeyAttestationData, LICENSED_FEATURES, LicenseChecker, LicenseFeatures, LicenseOwner, LicensePayload, LicenseStatus, LicenseTier, OrganizationEntitlement, addRuntimeKeyAttestation, clearRuntimeKeys, createLicenseChecker, getFeatureDisplayName, getFeatureLimit, getMasterPublicKey, getPublicKey, isComponentFeature, isFeatureEnabled, isRuntimeFeature, organizationEntitlementSchema, parseOrganizationEntitlement, verifyKeyAttestation, verifyLicense };
 //# sourceMappingURL=index.d.mts.map

dist/index.d.ts

@@ -0,1 +1,3 @@
+import { z } from "zod";
+
 //#region src/types.d.ts
@@ -12,5 +14,6 @@ interface LicenseOwner {
   "sdk.angular"?: boolean;
+  msteams?: boolean;
   [key: string]: boolean | number | undefined;
 }
-type LicenseTier = "free" | "developer" | "pro" | "team_self_hosted" | "enterprise";
+type LicenseTier = "free" | "developer" | "pro" | "team" | "team_self_hosted" | "enterprise";
 interface LicensePayload {
@@ -56,2 +59,12 @@ version: number;
 /**
+ * Check whether a catalog-boolean feature is enabled in a raw features map.
+ * Returns false when the feature is unknown, missing, the catalog says the
+ * feature is not boolean-valued, or the value is not exactly `true`.
+ *
+ * @param features - Raw feature map (license payload features or org overlay).
+ * @param feature - Candidate feature key.
+ * @returns Whether the feature is granted.
+ */
+
+/**
  * Check whether a specific feature is enabled in the license.
@@ -67,6 +80,5 @@ * Returns false if the license is null, the feature is unknown, the feature is
  */
-declare function getFeatureLimit(license: LicensePayload | null, feature: string): number | null;
+declare function getFeatureLimit(license: LicensePayload | null, feature: string): number | null; //#endregion
+//#region src/keystore.d.ts
 
-//#endregion
-//#region src/keystore.d.ts
 //# sourceMappingURL=verify.d.ts.map
@@ -108,3 +120,3 @@ /**
 //# sourceMappingURL=keystore.d.ts.map
-declare const FEATURE_IDS: readonly ["threads.retention_hours", "threads.max_count", "multimodal_storage_gb", "sdk.angular", "deployment_via_helm_chart", "analytics", "self_learning"];
+declare const FEATURE_IDS: readonly ["threads.retention_hours", "threads.max_count", "multimodal_storage_gb", "sdk.angular", "deployment_via_helm_chart", "analytics", "self_learning", "msteams"];
 type FeatureId = (typeof FEATURE_IDS)[number];
@@ -117,3 +129,3 @@ /**
 
-type FeatureValueKind = "boolean" | "number";
+type FeatureValueKind = 'boolean' | 'number';
 interface FeatureDefinition {
@@ -155,3 +167,3 @@ /** Stable feature id embedded in license feature snapshots. */
 //#endregion
-//#region src/license-check.d.ts
+//#region src/organization-entitlement.d.ts
 /**
@@ -164,2 +176,59 @@ * Resolve a feature definition by id.
 /**
+ * Wire contract for an organization's effective entitlement as consumed by the
+ * runtime feature checker. This is the published wire DTO for the
+ * `@copilotkit/runtime` consumer (Layer 3, in the CopilotKit OSS repo —
+ * intentionally NOT this monorepo's `@copilotkit/runtime-enterprise`); the
+ * app-api `/api/entitlements/runtime` producer projects its internal
+ * `@cpki/ops-contracts` DTO onto this shape and re-validates against it (the
+ * shapes are duplicated in spirit, not a single shared definition). `active`
+ * means the org has a resolved, non-blocked entitlement; `features` is the
+ * catalog-keyed feature snapshot (the OR side of the runtime merge). For
+ * inactive entitlements `features` is empty.
+ *
+ * `planCode` and `source` are opaque, catalog/ops-defined tokens carried for
+ * diagnostics; they are deliberately typed as free strings (not closed enums)
+ * because this published package must not import the internal catalog, so a
+ * Layer 3 consumer must not assume an exhaustive set.
+ *
+ * NOTE: `features` is intentionally catalog-AGNOSTIC here (no
+ * `getFeatureDefinition` check) — this published package must not depend on the
+ * internal `@cpki/license-catalog`. Catalog validation (unknown ids, value-kind)
+ * happens upstream in ops-api / `@cpki/ops-contracts`; this schema only enforces
+ * the structural shape.
+ */
+declare const organizationEntitlementSchema: z.ZodObject<{
+  active: z.ZodBoolean;
+  features: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodNumber]>>;
+  planCode: z.ZodOptional<z.ZodString>;
+  source: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Organization entitlement wire DTO. */
+type OrganizationEntitlement = z.infer<typeof organizationEntitlementSchema>;
+/**
+ * Parse and return a validated organization entitlement.
+ *
+ * @param value - Unknown payload (e.g. an app-api response body).
+ * @returns The validated organization entitlement.
+ */
+declare function parseOrganizationEntitlement(value: unknown): OrganizationEntitlement;
+
+//#endregion
+//#region src/license-check.d.ts
+//# sourceMappingURL=organization-entitlement.d.ts.map
+/**
+ * Merged (base deployment + organization overlay) feature reader.
+ *
+ * Deliberately does NOT expose `getStatus()`: deployment validity is unrelated
+ * to the merged feature view (a hosted-no-token base is `valid: false` while an
+ * active overlay still grants features), so a reader `getStatus()` would invite
+ * wrongly gating out an active org. Consumers needing deployment diagnostics use
+ * the base `checker.getStatus()`.
+ */
+interface EntitlementReader {
+  /** Whether the feature is granted by the deployment OR the organization. */
+  checkFeature(feature: string): boolean;
+  /** Most-generous numeric limit across deployment and organization; `0` = unlimited. */
+  getFeatureLimit(feature: string): number | null;
+}
+/**
  * Runtime-agnostic license checker that caches verification results
@@ -173,2 +242,8 @@ * and re-evaluates expiration on each access for long-lived processes.
   checkFeature(feature: string): boolean;
+  /**
+   * Derive a non-mutating reader that merges an organization entitlement with
+   * the deployment base. Fresh per call; never mutates the base payload or the
+   * shared checker. Safe to call per request with a different org.
+   */
+  withOrganizationEntitlement(org: OrganizationEntitlement): EntitlementReader;
 }
@@ -188,3 +263,3 @@ /**
 
-export { KeyAttestationData, LICENSED_FEATURES, LicenseChecker, LicenseFeatures, LicenseOwner, LicensePayload, LicenseStatus, LicenseTier, addRuntimeKeyAttestation, clearRuntimeKeys, createLicenseChecker, getFeatureDisplayName, getFeatureLimit, getMasterPublicKey, getPublicKey, isComponentFeature, isFeatureEnabled, isRuntimeFeature, verifyKeyAttestation, verifyLicense };
+export { EntitlementReader, KeyAttestationData, LICENSED_FEATURES, LicenseChecker, LicenseFeatures, LicenseOwner, LicensePayload, LicenseStatus, LicenseTier, OrganizationEntitlement, addRuntimeKeyAttestation, clearRuntimeKeys, createLicenseChecker, getFeatureDisplayName, getFeatureLimit, getMasterPublicKey, getPublicKey, isComponentFeature, isFeatureEnabled, isRuntimeFeature, organizationEntitlementSchema, parseOrganizationEntitlement, verifyKeyAttestation, verifyLicense };
 //# sourceMappingURL=index.d.ts.map

package.json

 {
   "name": "@copilotkit/license-verifier",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "CopilotKit license verification",
@@ -5,0 +5,0 @@ "license": "MIT",

README.md

@@ -23,4 +23,7 @@ # @copilotkit/license-verifier
   isRuntimeFeature,
+  organizationEntitlementSchema,
+  parseOrganizationEntitlement,
   verifyKeyAttestation,
   verifyLicense,
+  type EntitlementReader,
   type KeyAttestationData,
@@ -33,2 +36,3 @@ type LicenseChecker,
   type LicenseTier,
+  type OrganizationEntitlement,
 } from "@copilotkit/license-verifier";
@@ -47,2 +51,24 @@ ```
 
+### Organization-entitlement merge
+
+`createLicenseChecker(token?)` returns a `LicenseChecker` whose
+`withOrganizationEntitlement(org)` derives a **non-mutating** `EntitlementReader`
+that merges a parsed `OrganizationEntitlement` overlay with the deployment base:
+
+- `reader.checkFeature(feature)` — boolean **OR**: granted if the deployment
+  (grace-respecting; expired-but-in-grace contributes nothing) OR the active org
+  grants it. An inactive org, or an active org with an empty `features` map,
+  contributes nothing.
+- `reader.getFeatureLimit(feature)` — numeric **most-generous**: `0` means
+  unlimited and wins over any finite value; otherwise the larger present value
+  wins; `null` only when neither side is present.
+
+The reader is fresh per call, never mutates the base payload, and never stores
+overlay state on the checker, so a long-lived multi-tenant process can call it
+per request with a different org without leaking entitlements. The reader
+deliberately does not expose `getStatus()` — use the base `checker.getStatus()`
+for deployment diagnostics. Feed `withOrganizationEntitlement` an
+already-`parseOrganizationEntitlement`'d value; overlay values are catalog-gated
+the same way as the base, so unknown ids and value-kind mismatches are ignored.
+
 ## Online Key Attestation
@@ -49,0 +75,0 @@

No alert changes

Improved metrics

Total package byte prevSize

326321

6.1%

Lines of code

9474

3.57%

Number of lines in readme file

78

50%

No dependency changes