Licensing

At a glance

NextPDF Enterprise resolves your license into a runtime entitlement: an edition tier, a set of capabilities, and a branding decision. A paid license that has expired continues to run under a perpetual-fallback guarantee; only updates and support stop. This page describes the externally observable behavior of the licensing surface, the capability and feature gates, and the optional online activation contract.

Availability & licensing

This capability ships in NextPDF Enterprise (nextpdf/enterprise) and activates with an Enterprise-tier license envelope. A deployment without that entitlement does not load the capability’s classes. Compare editions and get a license.

Licensing is the base Enterprise surface: it resolves every other capability, so it is always present once the Enterprise package is installed. Individual downstream features are gated by capability codes — edition-tier capabilities and independently expiring add-on packs. The gate reports the active edition, validity, grace-period state, and the set of active packs.

Conceptual overview

The licensing surface has one job: turn a license into a decision a host application can act on. It produces an immutable entitlement result with five fields that matter at runtime — the edition tier, the channel (paid or evaluation), the branding mode, whether the installed version may run, and whether updates and support are entitled.

Editions form a strict hierarchy: Enterprise includes Pro, Pro includes Core. A capability check therefore succeeds when the licensed edition is at or above the capability’s minimum tier. Some capabilities are not tied to an edition at all — they belong to add-on packs that carry their own expiry, independent of the base license term.

The entitlement decision distinguishes five discrete states. An active license has full access. A paid license past its term but inside its grace window keeps full access and surfaces a renew-soon warning. A paid license past its grace window enters perpetual fallback: the installed version keeps running indefinitely, but updates and support are no longer entitled. An evaluation license behaves differently — when it expires, the runtime is restricted, because evaluation is time-boxed by design. When no license is present, the host resolves to a fail-closed state and any output is visually marked so an unlicensed deployment is never mistaken for a paid one.

A contractual seat count is not enforced at runtime. There is no telemetry and no mandatory phone-home for ordinary operation. The optional online client exists only for explicit activation, renewal checks, and best-effort heartbeats, and a host that never calls it still receives a complete entitlement decision from a locally supplied license.

Trial mode is a separate, narrower policy. When a license is marked as a trial it caps processing throughput and applies an evaluation watermark to generated output, so that bulk production work requires a paid license. Trial expiry is enforced strictly, with no grace period.

Why it works this way

The load-bearing decision is that a paid license never disables the installed runtime. When a paid term ends, entitlement moves to EntitlementStatus::PerpetualFallback — the installed version keeps running, and only forward updates and support are revoked. That guarantee holds because entitlement is a pure in-memory decision over a locally supplied license, so no phone-home and no network outage can pull a paid runtime out from under a customer. The counterweight is fail-closed defaults: an absent license or an expired evaluation resolves to the Core tier and sets brandingMode to an evaluation watermark. So an unlicensed deployment is never silently mistaken for a paid one. Perpetual fallback for what you bought, fail-closed for what you did not — that pairing is what keeps licensing offline-friendly without becoming an honor system.

Design background: Open core, no lock-in.

Public API surface

composer require nextpdf/enterprise:^3

The supported integration points are the entitlement evaluator (license to entitlement result), the runtime feature gate (isFeatureEnabled, requireFeature, hasCapability, requireCapability, isInGracePeriod, currentEdition, getActivePacks, trialPolicy), the capability registry (route-to-capability resolution and the available-capability set), and the optional license client (activate, checkRenewal, heartbeat). Treat the entitlement evaluator as the single authority for license-derived decisions; do not branch on raw license fields directly.

Code sample — quick start

use NextPDF\Enterprise\Licensing\EntitlementEvaluator;

$result = (new EntitlementEvaluator())->evaluate($license);

if (! $result->runtimeAllowed) {
    // No license, or an expired evaluation license.
    throw new RuntimeException($result->warningMessage ?? 'Enterprise runtime disabled.');
}

// Perpetual fallback: still allowed to run; updates/support may be off.
$canUpdate  = $result->updateEntitled;
$watermark  = $result->shouldApplyEvaluationBranding();

Code sample — production

use NextPDF\Enterprise\Licensing\CapabilityCode;
use NextPDF\Enterprise\Licensing\FeatureGate;

final class ReportController
{
    public function __construct(private readonly FeatureGate $gate) {}

    public function generate(): Response
    {
        // Throws a structured 403-style exception carrying the required
        // capability, the required pack, the current packs, and an
        // upgrade-info URL — usable as an upsell touchpoint.
        $this->gate->requireCapability(CapabilityCode::EnterpriseComplianceEvidence);

        if ($this->gate->isInGracePeriod()) {
            $this->logger->notice('Enterprise license in grace period — renewal due.');
        }

        return $this->renderReport();
    }
}

Edge cases & gotchas

• Perpetual fallback is not a grace period. Grace keeps updates and support on; fallback keeps only the runtime on. Both keep the installed version running for paid licenses.
• Evaluation expiry restricts the runtime. Unlike a paid license, an expired evaluation license stops the runtime and keeps the evaluation watermark.
• No license fails closed. With no license configured the entitlement is “no license”, the runtime is disabled for Enterprise paths, and emitted output is watermarked so the state is visible in logs and artifacts.
• Pack expiry is independent. An add-on pack can expire while the base license is still active; the capability it granted then fails with a distinct “pack expired” outcome separate from “not licensed”.
• Capability denial is structured. A denied capability carries the required capability, the required pack (if any), the current packs, and an upgrade-info URL — surface these to the user rather than a bare error.

Performance

Entitlement evaluation and capability checks are constant-time, in-memory operations against a parsed license — no I/O on the request path. The optional online client performs network calls only on explicit activation, renewal checks, and heartbeats; heartbeat failures are non-fatal and never block processing.

Security notes

This page intentionally describes only observable behavior. The license-envelope verification, signature checking, anti-abuse logic, and the location of enforcement code are out of scope and are not documented on the public surface. Operators interact with the public package contract and the documented behavior contract. The online activation contract uses a signed-response envelope and a client-supplied nonce so a host can detect a replayed or tampered activation response; the precise verification procedure is not part of the public contract.

Conformance

• The online activation response is carried in a JWS-style signed envelope — a protected-header / payload / signature triple in the compact, URL-safe form described by RFC 7515 (JSON Web Signature), §3.1.
• Signature material is base64url, decoded per RFC 7515 §5.2.
• Canonical JSON for envelope integrity follows the JSON Canonicalization Scheme, RFC 8785, §3.
• The activation signature is an Ed25519 signature verified against a 32-byte public key, per RFC 8032 (EdDSA), §5.1.
• Short-lived service tokens used between components carry the registered claims iss, aud, sub, exp, and jti, and honor the exp not-after rule of RFC 7519 (JWT), §4.1.4.

Behavior contract

• Entitlement evaluation produces an immutable result with a fixed set of runtime-relevant fields (edition tier, channel, branding mode, runtime-allowed, update/support entitled).
• A paid license never disables the installed runtime: expiry moves it through grace and then perpetual fallback, revoking only updates and support.
• An expired evaluation license restricts the runtime and keeps the evaluation watermark; trial expiry is enforced strictly with no grace period.
• The “no license” state is fail-closed for Enterprise paths, and emitted output is watermarked so an unlicensed deployment is never mistaken for a paid one.
• Capability denial is structured: it carries the required capability, the required pack (if any), the active packs, and an upgrade-info URL.
• Entitlement and capability checks are constant-time in-memory operations with no I/O on the request path.

Publication boundary

This page documents externally observable behavior and the supported public API surface only. Internal namespace paths, helper classes, mechanism tables, runbook filenames, and ticket prefixes are out of scope.

Core fallback

NextPDF Core (Apache-2.0) has no edition or capability entitlement surface — no feature gate, no entitlement evaluator, no license client. A host that needs unlicensed Apache-2.0 behavior uses the Core engine directly rather than the Enterprise pipeline. Core does not gate, watermark for licensing, or evaluate entitlement.

Pro fallback

NextPDF Pro has no entitlement surface either — none; this capability has no Pro-tier equivalent. Licensing, the capability registry, the feature gate, and the activation contract ship in the nextpdf/enterprise package only.

Enterprise boundary note

The license-envelope verification procedure, signature-checking implementation, anti-abuse logic, and the location of enforcement code are described at the behavior level only and are not reproduced on the public surface. The online activation contract is documented as a signed-response envelope with a client-supplied nonce; the precise verification procedure is not part of the public contract.

Deployment boundary

NextPDF Enterprise resolves entitlement from a locally supplied license with no mandatory phone-home for ordinary operation. The optional online client performs network calls only on explicit activation, renewal checks, and best-effort heartbeats; heartbeat failures are non-fatal and never block processing. The operator owns license provisioning, the activation/renewal configuration, and the transport policy for the optional online client. NextPDF Enterprise does not enforce a contractual seat count at runtime.

Legal-compliance boundary

Capacity and seat terms are governed by your license agreement, not by runtime enforcement. This documentation is not a legal opinion; consult your own compliance and legal advisers for your contractual and regulatory obligations.

See also

• Licensing reference — NextPDF Enterprise
• Billing — NextPDF Enterprise
• Metering — NextPDF Enterprise
• SaaS — NextPDF Enterprise
• Branding — NextPDF Enterprise