@xemahq/entitlement-client

NestJS enforcement point for Xema entitlement, resolved offline from a license.

Overview

The platform's enforcement point for entitlement. It resolves the installation's Xema license offline with @xemahq/license-verifier — no network call, no service to be reachable, identical behaviour on a connected control plane and on an air-gapped appliance — and answers both entitlement faces from that one source:

• the license axis — requireEntitled / requireBiomeInstallEntitled / requireEditionEntitled, gating biome installation and the running edition over { distribution | biome | capability-class };
• the platform axis — getEffective, the Edition, projected from the same license by @xemahq/kernel-contracts/entitlement.

It is fail-closed: an unverifiable license grants nothing, and a license in force grants only what it enumerates. It never fails fast at boot — expiry degrades what may be done next and never stops a running workload.

When to use it

• Use it inside a NestJS service that gates a NEW action (installing a biome, an upgrade, provisioning an org), or that must read the installation's Edition.
• Reach for @xemahq/license-verifier directly when you need offline license verification with no NestJS container at all.

Installation

pnpm add @xemahq/entitlement-client

Usage

import {
  EntitlementClientModule,
  EntitlementService,
  readLicenseFromEnv,
} from '@xemahq/entitlement-client';

EntitlementClientModule.forRoot({
  customerLicense: readLicenseFromEnv(), // XEMA_LICENSE; undefined ⇒ the OSS license
  distributionId: 'core',                // what this deployment actually runs
});

constructor(private readonly entitlements: EntitlementService) {}

installBiome(biomeId: string): void {
  this.entitlements.requireBiomeInstallEntitled(biomeId); // 403 when unentitled
}

Peer requirements

• @nestjs/common and @nestjs/core >= 10
• reflect-metadata >= 0.1.12
• @xemahq/kernel-contracts and @xemahq/license-verifier

License

Apache-2.0 © Xema — xema.dev