HF-307: wire the two commercial add-on tokens, strictly additively (6/8)

[marcin-kordas-hoc]

Wires the two commercial add-on tokens decided in the 12.08 packages meeting, strictly additively. Stacks on #1731; rebased onto its current head on 19.08 (the base moved during PR3/PR4's review passes, which had left this PR conflicting).

What changed

• spreadsheet (Spreadsheet Bundle add-on) now grants FeatureId.Crud, UndoRedo, Clipboard and Batching ("chyba też" batching — Kuba, 12.08).
• import_export grants FeatureId.ImportExport — a reserved grant: no public method is gated on it until HF-107 ships the feature it would gate.
• Additive only: a key naming neither add-on keeps every feature area it has today (the opt-in rule for keys carrying no feat:* tokens is untouched), so no real key can start throwing as a side effect. The open product question — does a package key without the bundle keep CRUD once packages go live — stays open and is documented as such in docs/guide/license-key.md.

Verification

Paired tests: hyperformula-tests@spike/hf307-addon-grants (6 assertions incl. the pin that a key without either add-on keeps all five pre-existing feature areas). Full license suite 212/212 under Jest (12 suites, unit/license + unit/helpers/licenseKeyValidator), re-measured after the 19.08 rebase onto the current #1731 (e9863f27) — the earlier 165/165 predated PR3's and PR4's review fixes, tsc --noEmit clean, eslint --quiet clean.

🤖 Generated with Claude Code

---

Note

Low Risk
License capability metadata and documentation only; runtime gating for current keys is unchanged because grants are additive and import/export has no gates yet.

Overview
Wires the spreadsheet and import_export commercial add-on tokens into CAPABILITY_TABLE, matching the 2026-08-12 packages meeting.

The spreadsheet (Spreadsheet Bundle) token now grants CRUD, undo/redo, clipboard, and batching — named expressions stay outside the bundle by design. import_export grants FeatureId.ImportExport as a reserved entitlement; nothing in the public API gates on it until HF-107 ships import/export.

Behavior for existing keys is additive: keys that name neither add-on keep every feature area they have today (the “no feat:* tokens ⇒ grant all features” rule is unchanged). Docs and the changelog spell out that add-on tokens describe what was sold rather than tightening access for keys issued today.

^{Reviewed by Cursor Bugbot for commit 3dbcbe6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hyperformula-docs	3dbcbe6	Commit Preview URL Branch Preview URL	Aug 26 2026, 03:43 AM

[qunabu]

Task linked: HF-107 Import/export files (XLSX, CSV)
Task linked: HF-307 Implement feature packages and add-ons in HF

[github-actions]

Performance comparison of head (3dbcbe6) vs base (db92bcd)

                                     testName |    base |    head | change
--------------------------------------------------------------------------
                                      Sheet A |  500.32 |  499.65 | -0.13%
                                      Sheet B |  162.01 |  161.54 | -0.29%
                                      Sheet T |  144.98 |  140.78 | -2.90%
                                Column ranges |  482.32 |  478.89 | -0.71%
                                Sorted lookup | 14106.3 | 15281.7 | +8.33%
Sheet A:  change value, add/remove row/column |   15.91 |   16.57 | +4.15%
 Sheet B: change value, add/remove row/column |   143.3 |  144.28 | +0.68%
                   Column ranges - add column |  156.57 |   157.2 | +0.40%
                Column ranges - without batch |  475.39 |  483.12 | +1.63%
                        Column ranges - batch |  122.76 |  119.23 | -2.88%

[marcin-kordas-hoc]

Paired tests PR: handsontable/hyperformula-tests#38 — merge it BEFORE this one.

[Tobiadefami]

Reviewed at 4ab3cc6 together with the paired tests at 26cd09d5. I checked the additive grant mapping, the exact Spreadsheet Bundle and reserved import/export feature sets, current-key fallback behavior, guide and changelog wording, current automated findings, and later stacked branches. The 13 focused license suites pass (223 tests), all current engine checks are green, and I found no material issue in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.38%. Comparing base (db92bcd) to head (3dbcbe6).

Additional details and impacted files

@@                    Coverage Diff                     @@
##           spike/hf307-notice-window    #1737   +/-   ##
==========================================================
  Coverage                      97.38%   97.38%           
==========================================================
  Files                            204      204           
  Lines                          16236    16236           
  Branches                        3493     3493           
==========================================================
  Hits                           15812    15812           
  Misses                           424      424           

Files with missing lines	Coverage Δ
src/license/LicenseEntitlement.ts	100.00% <ø> (ø)
src/license/capabilities.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.