Editions & licensing
Open-core model — Community (Apache-2.0) vs Enterprise, and how licensing works.
Open core
kvellman is open core. The platform is open source under Apache-2.0; advanced features ship as commercial plugins (e.g. SSO, MFA) that activate only with a valid Enterprise license.
| Community | Enterprise | |
|---|---|---|
| License | Apache-2.0 | Commercial subscription |
| Users | Single / local accounts | Multi-user, RBAC |
| Auth | Local | SSO (OIDC) + MFA (TOTP) |
| Scale | Single node | High availability, edge nodes |
| Operations | Core | Approval workflow + audit, air-gapped, release scraper |
See pricing for the full comparison.
How licensing works
Enterprise features are gated by an offline, signature-based license — no activation server, so it works air-gapped:
- A license is an Ed25519-signed token issued by the vendor.
- The product ships only the public key and verifies the token locally.
- The token lists the customer and the active entitlements (e.g.
sso,mfa) and an expiry. - An admin pastes the token in the UI; matching plugins activate immediately — no restart, no internet required.
Because verification is local, even the full open-source code cannot forge a valid license without the vendor's private key.
Developer packages
The shared, public building blocks are on npm under Apache-2.0:
@kvellman/winget-contract— the winget REST/types contract shared by origin and nodes.@kvellman/plugin-sdk— types for building auth/entitlement plugins.