HF-307: wire the two commercial add-on tokens, strictly additively (6/8)

[marcin-kordas-hoc]

Wires the two commercial add-on tokens decided in the 12.08 packages meeting, strictly additively. Stacks on #1731; rebased onto its current head on 19.08 (the base moved during PR3/PR4's review passes, which had left this PR conflicting).

What changed

• spreadsheet (Spreadsheet Bundle add-on) now grants FeatureId.Crud, UndoRedo, Clipboard and Batching ("chyba też" batching — Kuba, 12.08).
• import_export grants FeatureId.ImportExport — a reserved grant: no public method is gated on it until HF-107 ships the feature it would gate.
• Additive only: a key naming neither add-on keeps every feature area it has today (the opt-in rule for keys carrying no feat:* tokens is untouched), so no real key can start throwing as a side effect. The open product question — does a package key without the bundle keep CRUD once packages go live — stays open and is documented as such in docs/guide/license-key.md.

Verification

Paired tests: hyperformula-tests@spike/hf307-addon-grants (6 assertions incl. the pin that a key without either add-on keeps all five pre-existing feature areas). Full license suite 212/212 under Jest (12 suites, unit/license + unit/helpers/licenseKeyValidator), re-measured after the 19.08 rebase onto the current #1731 (e9863f27) — the earlier 165/165 predated PR3's and PR4's review fixes, tsc --noEmit clean, eslint --quiet clean.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes commercial license entitlement resolution and console notification behavior for typed keys; incorrect grant wiring could wrongly gate CRUD-related API areas once package keys go live, though tests and additive opt-in rules aim to prevent regressions for keys without add-ons.

Overview
Wires the spreadsheet and import_export commercial add-on tokens per the 2026-08-12 packages meeting, and adds a usage-axis expiry notice for typed keys.

The spreadsheet token (Spreadsheet Bundle) now grants CRUD, undo/redo, clipboard, and batching via CAPABILITY_TABLE. import_export grants FeatureId.ImportExport as a reserved entitlement with no public API gate until HF-107. Keys that name neither add-on are unchanged in practice: the existing opt-in rule still injects all feat:* tokens when a key does not speak the feature vocabulary, so this release remains additive and does not strip CRUD or related areas from current keys.

resolveLicense evaluates expiryWithinNoticeWindow for valid, non-silent typed keys on the usage-until axis and calls notifyLicenseKeyNotice, which warns once per distinct key string (separate from the global invalid/missing/expired _notified flag). Per-key tracking is cleared in resetLicenseKeyNotificationForTests. Docs and changelog describe add-on semantics and note that missing add-ons still do not restrict anything in this release.

^{Reviewed by Cursor Bugbot for commit 9933ba3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hyperformula-docs	4ab3cc6	Commit Preview URL Branch Preview URL	Aug 20 2026, 12:58 PM

[qunabu]

Task linked: HF-107 Import/export files (XLSX, CSV)
Task linked: HF-307 Implement feature packages and add-ons in HF

[github-actions]

Performance comparison of head (4ab3cc6) vs base (aa835bf)

                                     testName |    base |    head | change
--------------------------------------------------------------------------
                                      Sheet A |  486.65 |  485.35 | -0.27%
                                      Sheet B |   155.2 |  153.24 | -1.26%
                                      Sheet T |  138.24 |  135.43 | -2.03%
                                Column ranges |  464.85 |   467.7 | +0.61%
                                Sorted lookup | 13709.1 | 13449.6 | -1.89%
Sheet A:  change value, add/remove row/column |   15.11 |   14.32 | -5.23%
 Sheet B: change value, add/remove row/column |  127.26 |  125.21 | -1.61%
                   Column ranges - add column |  146.35 |  151.95 | +3.83%
                Column ranges - without batch |  447.44 |  461.33 | +3.10%
                        Column ranges - batch |  109.98 |  117.25 | +6.61%

[marcin-kordas-hoc]

Paired tests PR: handsontable/hyperformula-tests#38 — merge it BEFORE this one.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.38%. Comparing base (aa835bf) to head (4ab3cc6).

Additional details and impacted files

@@                    Coverage Diff                     @@
##           spike/hf307-notice-window    #1737   +/-   ##
==========================================================
  Coverage                      97.38%   97.38%           
==========================================================
  Files                            204      204           
  Lines                          16236    16236           
  Branches                        3493     3493           
==========================================================
  Hits                           15812    15812           
  Misses                           424      424           

Files with missing lines	Coverage Δ
src/license/LicenseEntitlement.ts	100.00% <ø> (ø)
src/license/capabilities.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Tobiadefami]

Reviewed at 4ab3cc6 together with the paired tests at 26cd09d5. I checked the additive grant mapping, the exact Spreadsheet Bundle and reserved import/export feature sets, current-key fallback behavior, guide and changelog wording, current automated findings, and later stacked branches. The 13 focused license suites pass (223 tests), all current engine checks are green, and I found no material issue in this PR.