WardenKit
Menu

Commercial provider review surface

Open-Source Licence Policy SDK

A provider-neutral review surface prepared so an external commercial provider can inspect truthful product, pricing, rights, policy and fulfilment information for this product on the WardenKit domain before it is released. This page is not the product launch and does not indicate provider approval or product release.

Status: Release preparation@wardenkit/open-source-licence-policycandidate version 0.1.2
Product
Open-Source Licence Policy SDK
Package
@wardenkit/open-source-licence-policy
Candidate version
0.1.2
Registry
npm — not yet published
Status
Release preparation

Release preparation. Not generally available.

  • The package candidate @wardenkit/open-source-licence-policy@0.1.2 is prepared but not yet published to npm.
  • Checkout is not yet available. No purchase can be made on this site.
  • Production entitlements cannot yet be issued.
  • The product is not generally available.
  • This page does not indicate provider approval or product release.

Product description

What the product does

Open-source licence policy as code. Turn your licence policy into an enforceable build rule: validate SPDX licence evidence locally and fail CI when a component breaks your policy.

Open-source licence policy as code: turn your licence policy into an enforceable build rule. Give WardenKit your software-component list and your licence rules; it validates SPDX licence evidence locally and fails CI when a component breaks your policy, without uploading your repository to a heavyweight SCA platform. Not SCA, not licence detection, not legal advice.

  • Applies your organization's own open-source licence policy — a JSON policy document you author — to the machine-readable licence and component evidence you supply.
  • Evaluates deterministically and locally, inside your own Node.js process and CI.
  • Ships as a Node.js SDK and a CLI for CI use, so a pipeline can fail closed on your configured policy.
  • Produces structured, machine-readable policy decisions and evidence with recorded provenance.

What it is not

  • No source-code licence detection or licence-text classification.
  • No dependency discovery: you supply the component records.
  • No vulnerability, malware or general SCA scanning.
  • No SBOM generation, and no SPDX-document or CycloneDX adapters in this version.
  • No lockfile, manifest, registry or dependency-graph readers.
  • No legal advice, legal permission or obligation determination.
  • No licence compatibility opinion.
  • No compliance certification, endorsement or binding decision.
  • No copyright analysis, obligation generation or attribution-sufficiency assessment.
  • No hosted evaluation API, dashboard, portal or remediation workflow.
  • No telemetry and no transmission of customer operational data.
  • No SPDX or Linux Foundation affiliation or endorsement.

Key features and deliverables

What a customer receives

Included in the product

  • Local Node.js SDK (Node.js 22.x and Node.js 24.x).
  • CLI (wardenkit-licence-policy) for local and CI use.
  • Deterministic policy evaluation over customer-supplied component records.
  • Structured, machine-readable output with a CI-consumable aggregate outcome and exit code.
  • Signed, time-bounded production entitlement model, verified locally.
  • Signed and versioned WardenKit Licence Reference Pack model.
  • Local verification in the customer's own process; the evaluator makes no network call.
  • Signed production authorization valid for at most 72 hours per refresh; no additional offline grace after the signed deadline.
  • Maintained production updates while the subscription is current.

The production signing and activation infrastructure is provisioned but the product is unreleased and checkout is disabled; the entitlement and Reference Pack model above describes the production release behaviour that becomes purchasable at release.

Capabilities

  • Validates SPDX licence expressions against the SPDX Specification 3.0.1 Annex B grammar, including AND, OR, WITH, the + operator and parentheses.
  • Normalizes valid expressions to a canonical form: canonical SPDX identifier case, canonical operand ordering for the commutative AND and OR operators, and canonically re-emitted parentheses.
  • Resolves identifiers and exception identifiers against a pinned SPDX License List 3.28.0 baseline and flags deprecated identifiers with a deterministic diagnostic instead of substituting a successor.
  • Supports LicenseRef- custom licence identities and AdditionRef- custom additions as opaque customer-defined references, with no legal meaning assigned.
  • Validates the customer-authored policy document under a strict schema, rejects unknown fields, and reports a stable policy hash.
  • Evaluates the policy over each component record and derives an aggregate outcome from the policy's own configured thresholds.
  • Fails closed on malformed input, unknown identifiers and schema violations unless the policy explicitly tolerates that diagnostic code.
  • Prints the pinned SPDX reference metadata and the local entitlement state as machine-readable JSON.

Structured output

  • Per-component category: policy-allowed, policy-denied, review-required or invalid-unsupported.
  • Normalized SPDX expression and expression shape for each component record.
  • Coded diagnostics with stable machine-readable codes, for example EXPR_UNKNOWN_ID and EXPR_DEPRECATED_ID.
  • Aggregate outcome plus an explicit CI-blocking flag, mirrored by the CLI exit code.
  • Provenance block: product version, SPDX License List version, reference snapshot version and policy hash.

Data and topology boundary

Where the product runs and what it sends

  • Local Node.js execution: Local Node.js SDK.
  • Zero-network core evaluation: evaluation, policy validation, the SPDX reference command and status make no network call.
  • The customer supplies the input evidence — component records and the policy document — from their own repository.
  • No hosted evaluator: WardenKit operates no evaluation API, dashboard or portal for this product.
  • No telemetry and no customer payload collection by the evaluator; component records, policies and results never leave the customer's process.
Family
Security and Assurance
Topology
Local Node.js SDK and CLI, no hosted evaluator
Input
JSON component records and a JSON policy you author
Output
Machine-readable JSON with a CI-consumable aggregate outcome
SPDX baseline
License List 3.28.0, Specification 3.0.1 Annex B grammar
Network at evaluation
None for createEvaluator and the CLI evaluate command. Managed Production: bounded authorization refresh only. Telemetry: none

Pricing

Plans and commercial rights

Paid tiers differ in commercial scope only. Repository and client-organization limits are commercial licence rights recorded in entitlement metadata and customer terms; the SDK does not meter, count or report repositories, dependencies or usage, and transmits no telemetry. There are no seat, transaction, revenue or API quota limits, and no other quota dimension exists.

Developer / Evaluation

$0

Evaluate locally with the full SDK and CLI. No account, licence key or network call required.

  • Full local SDK and CLI evaluation against the bundled SPDX evaluation reference snapshot.
  • Non-production evaluation and integration rights, including local trials and integration spikes.
  • No account, sign-up, email address or licence key is required to install and evaluate.
  • No production or production-CI use rights.
  • No continuing maintained Reference Pack refresh.
  • No production support or service-level commitment.

Free evaluation needs no checkout, account or licence key: install the package and run the CLI locally.

Production

$49 / month

Production and CI rights for one organization, up to 10 repositories, with maintained signed Reference Pack updates.

  • Production and CI use rights for one customer organization.
  • Up to 10 repositories.
  • Maintained signed WardenKit Licence Reference Pack refresh as new pinned SPDX License List releases are adopted.
  • Managed Production authorization: a signed 72-hour technical authorization refreshed on evaluate activity by createManagedProductionEvaluator, with no daemon and no background traffic.
  • Compatibility and security releases, and a documented support boundary.
  • Production use on behalf of client organizations is covered by Platform / Agency, not by this tier.

No Live customer checkout is enabled and the product is unreleased, so this price cannot be purchased on this site. A non-canonical release-candidate preview may expose a payment-provider Sandbox test checkout, which is not a Live WardenKit sale.

Platform / Agency

$149 / month

Production use for up to 5 client organizations and 50 repositories in aggregate.

  • Production and CI use rights for up to 5 client organizations.
  • Up to 50 repositories in aggregate.
  • Production use on behalf of clients, including agency, consultancy, platform and multi-tenant delivery.
  • The same maintained material and update rights as Production.
  • Aggregate repository and client limits are commercial licence rights, not metered technical quotas.

No Live customer checkout is enabled and the product is unreleased, so this price cannot be purchased on this site. A non-canonical release-candidate preview may expose a payment-provider Sandbox test checkout, which is not a Live WardenKit sale.

Production vs Platform / Agency. Production covers one entitled customer organization using the SDK and CLI for its own repositories and CI, up to 10 repositories. Platform / Agency adds production use on behalf of client organizations — agency and consultancy delivery, platform and multi-tenant use, and embedding within a broader customer-facing product or service — for up to 5 client organizations and up to 50 repositories in aggregate. Perfect technical enforcement of these limits is not claimed.

Billing model. Production and Platform / Agency are intended to be recurring monthly subscriptions once checkout becomes available. Each renews on its monthly billing cycle until cancelled; cancellation stops future renewals and is non-destructive. The exact transaction total, currency, applicable taxes and transaction terms will be shown at checkout. No subscription can currently be purchased. Developer / Evaluation is free for non-production evaluation and is not a trial of a paid plan.

Platform / Agency is not a resale right. It permits use of the SDK as a component of the customer's own broader product, service or client delivery, within the accepted client-organization and repository limits. It does not permit selling, relicensing or sublicensing WardenKit itself as a standalone SDK, library, CLI, API or service, and it does not permit operating a marketplace for WardenKit.

No checkout is open and no purchase action exists on this page. Prices are shown for review only.

Licence and commercial model

Source-available, production-entitled

WardenKit source-available commercial licence, distributed as LICENSE.md inside the package.

  • Custom WardenKit source-available licence; production use requires a valid commercial entitlement.
  • Source-available: the published package contents may be read, audited and inspected.
  • Evaluation and integration use is permitted at no cost; production use requires a paid entitlement.
  • Not an OSI-approved open source licence and not an SPDX-listed identifier.
  • The licence covers the WardenKit product only. Your policies, component records and results remain yours.
  • Cancellation and expiry are non-destructive; evaluation rights remain as defined by the Developer / Evaluation tier above.

Responsibility boundary

Technical results, not legal opinions

  • WardenKit performs deterministic technical validation, normalization and evaluation of the policy you author.
  • WardenKit does not provide legal advice, determine legal permissions or obligations, opine on licence compatibility, or certify compliance.
  • Which licences your organization allows, denies or reviews is your decision and your advisers' decision, expressed in your policy file.

Maintenance while subscribed

  • The maintained signed WardenKit Licence Reference Pack binds a published SPDX License List release, with WardenKit normalization and deprecation-diagnostics metadata, pack version, provenance and signature envelope.
  • New published SPDX License List releases are tracked, and a new maintained pack is produced when a release is adopted.
  • Node.js support windows and the package's minimal dependency set are monitored for compatibility and security releases.
  • Paid tiers receive maintained Reference Pack refreshes, compatibility releases and security releases while the subscription is current.
  • Cancellation keeps paid access through the end of the paid period with no automatic prorated refund; an approved refund of the current paid period, a confirmed chargeback or terminal cancellation stops further issuance and refresh immediately, while a refund that is only requested or pending does not. Installed files and cached evidence are never remotely deleted or disabled, and evaluation-rights use may continue.
  • Each signed production authorization lasts at most 72 hours. The managed Production evaluator refreshes it on evaluate activity once 24 hours have passed (no daemon, no background timer, no traffic while dormant), and the CLI refresh command is a recovery and diagnostic action; every refresh re-verifies the subscription with the payment provider and there is no extra grace. Transient service failures follow a bounded retry ladder; an authorization that expires while the service is unreachable reports REVALIDATION_REQUIRED after two bounded recovery attempts (a technical state, not a revocation; the next evaluate on the same evaluator begins a fresh bounded recovery, so no routine daily manual refresh is required), and a subscription in provider-confirmed payment recovery (past due) keeps refreshing under PAYMENT_RECOVERY until the provider reports a rights-changing event.
  • A 30-calendar-day initial-purchase refund guarantee applies once, from an organization's first paid transaction for this product; renewals outside that window are handled under the payment provider's refund policy and statutory rights. See the Refund Policy.

Fulfilment and activation model

Intended post-payment flow at release

The following describes the intended production release behaviour. It is not live today.

  1. Payment / provider event
  2. Production entitlement issued
  3. Activation through the CLI
  4. Signed Licence Reference Pack
  5. Local production verification
  6. Refresh / cancellation / 72-hour authorization / expiry lifecycle

PRODUCTION ACTIVATION: NOT YET AVAILABLE.

Production activation runs against the WardenKit Live activation service. An activation credential is issued only after Paddle's verified webhook confirms the subscription; the credential is shown once and never stored by this site. Evaluation, policy validation, the SPDX reference command and status run locally and need no service.

Activation and refresh will run out of band through the CLIwardenkit-licence-policy, the only writer of the local artefact cache in ~/.wardenkit/open-source-licence-policy/. Production use will be authorized by a signed, time-bounded local entitlement paired with a signed and versioned Licence Reference Pack, verified locally, with each signed authorization valid for at most 72 hours and no additional offline grace after the signed deadline.

Legal business identity

WardenKit is a product of BRIDGER SERVICES (SMC-PRIVATE) LIMITED.

Support: support@wardenkit.com. Support is handled by email and read by an engineer.

Security reports: security@wardenkit.com.

Policies

The Refund Policy preserves non-waivable statutory rights, states the applicable refund-request window and adopts no fixed-period guarantee.