@xemahq/entitlement-client

NestJS enforcement point for Xema entitlement, resolved offline from a license.

Overview

The enforcement point for entitlement in a NestJS service. It resolves the installation's Xema license offline with @xemahq/license-verifier (no network call) and answers two questions from it: whether an action such as installing a biome or running an edition is entitled, and what the installation's Edition is. It is fail-closed: an unverifiable license grants nothing, and expiry never stops a running workload.

When to use it

• Use it inside a NestJS service that gates a NEW action (installing a biome, an upgrade, provisioning an org), or that must read the installation's Edition.
• Use @xemahq/license-verifier directly when you need license verification without NestJS.

Installation

pnpm add @xemahq/entitlement-client

Usage

import {
  EntitlementClientModule,
  EntitlementService,
  readLicenseFromEnv,
} from '@xemahq/entitlement-client';

EntitlementClientModule.forRoot({
  customerLicense: readLicenseFromEnv(), // XEMA_LICENSE; undefined ⇒ the OSS license
  distributionId: 'core',                // what this deployment actually runs
});

constructor(private readonly entitlements: EntitlementService) {}

installBiome(biomeId: string): void {
  this.entitlements.requireBiomeInstallEntitled(biomeId); // 403 when unentitled
}

Configuration

| Option / env | Meaning | | --- | --- | | customerLicense | The license token. readLicenseFromEnv() reads it from XEMA_LICENSE; undefined uses the open-source license. | | distributionId | The distribution this deployment runs, or null. |

Peer requirements

• @nestjs/common and @nestjs/core >= 10
• reflect-metadata >= 0.1.12
• @xemahq/kernel-contracts and @xemahq/license-verifier

License

Apache-2.0 © Xema — xema.dev