Ship the Nutrient CLI and DWS authentication flow

[vladimir-tikhonov-nutrient]

Summary

Prepares @pspdfkit/pdf-to-markdown@0.6.0 for the account-enabled native CLI and replaces the previous license with explicit free Standard and paid premium terms. Standard conversion and query are free and unlimited for permitted uses, including noncompetitive SaaS integrations. CLI Vision and additional premium functionality require a DWS-issued license key with a paid CLI entitlement; free evaluation is available only through eligible hosted DWS offerings.

The existing wrapper changes add the nutrient account-management entry point, reject incompatible cached binaries for account commands, and preserve cached conversion commands during updates. Existing npm and shell-installer entry points remain available.

Commercial license

• Standard and query have no account, revenue, employee, document, page, or query-volume limit. Competitive use remains prohibited.
• Noncompetitive SaaS, hosted, internal, and automated integrations are permitted. Supplying the proprietary engine in a customer-operated product requires a separate OEM agreement.
• Free DWS premium access, including evaluation, development, and testing, excludes organizations with more than USD 1 million in annual gross revenue or more than 20 employees. Paid access remains available to organizations of any size.
• A free DWS evaluation allowance cannot authorize CLI Vision. Account sign-in or a legacy key alone does not supply the new standard CLI premium entitlement.
• The complete license addresses versioned acceptance, prior versions and negotiated agreements, DWS term precedence, local-document protection, telemetry disclosures, termination and cure, warranties, liability, forum, and third-party components.
• The liability cap is the greater of USD 100 or relevant preceding twelve-month fees, subject to the stated exceptions and controlling negotiated agreements. Material breaches generally have a thirty-day cure period.

The README and changelog use the same policy. Historical benchmark results and earlier release history are preserved.

Release dependencies

The licensing commit changes contract text and documentation. It does not implement or verify the native/DWS policy. Before release, complete the evidence listed in docs/licensing-release-review.md, including:

• Paid CLI feature/channel authorization, hosted evaluation eligibility, and rejection of free/guest/legacy-key bypasses under the new standard policy.
• Standard/query operation despite missing or invalid credentials, entitlement outages, or exhausted premium quotas.
• Correct license notice and acceptance before the relevant installation/account/upgrade actions; required privacy notice before identification and guest creation.
• Verified DWS and SDK telemetry disclosures, conversion-versus-settlement status, receipt retry behavior, and billing outcomes.
• Matching license text in the native binary, package, installer, account terms, website, and distributed skills; explicit treatment of prior-version and negotiated rights.
• Final legal review of the complete contract and coordinated publication approval.

Validation

For the licensing commit:

• npm run check — passed.
• npm test — all eight existing wrapper regression tests passed.
• shellcheck -s sh install.sh bin/nutrient bin/pdf-to-markdown bin/pdf-to-text bin/query — passed.
• npm run pack:dry-run — passed using an isolated temporary npm cache after the shared cache returned EPERM.
• npm pack and a byte-for-byte comparison of the archive's package/LICENSE.md with the reviewed source — passed.
• Independent contract/document consistency review and git diff --cached --check — passed.

The wrapper tests use fixture executables and do not prove native licensing enforcement, actual checkout, or billing behavior. No new native/DWS end-to-end test is claimed by this documentation change; those scenarios are specified in the release review for their owning implementations. See the PR checks for the current macOS and Ubuntu CI results.

Release coordination: https://linear.app/nutrient/issue/DWSL-494/publish-signednotarized-cli-artifacts-provenance-and-release-channels

[Copilot]

Pull request overview

This PR introduces a new top-level nutrient CLI entry point for account/auth management while keeping existing PDF conversion commands (pdf-to-markdown, pdf-to-text, query) intact and installable via the same npm/installer paths.

Changes:

• Added a nutrient launcher script and exposed it via npm bin, installer, and CI validation.
• Updated the pdf-to-markdown wrapper to support a nutrient verb mode (via NUTRIENT_WRAPPER_VERB) and to install/exec an appropriate verb symlink.
• Updated documentation and licensing text to describe account connection, plan credits, Vision entitlement, and privacy/usage metadata.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Documents the new nutrient auth … workflow, plan/credit model, and privacy/licensing details.
package.json	Exposes nutrient as an additional npm-installed executable and extends the check script.
LICENSE.md	Updates license terms to describe basic use, account plans, Vision eligibility, and usage metadata.
install.sh	Installs the new nutrient wrapper alongside existing command wrappers.
docs/benchmarks.md	Updates benchmark notes to reflect paid-plan Vision positioning and authentication requirements.
CHANGELOG.md	Adds an Unreleased entry summarizing the new nutrient entry point and auth/plan features.
bin/pdf-to-markdown	Adds verb selection for nutrient mode and adjusts update-check/link behavior accordingly.
bin/nutrient	New wrapper that routes nutrient … invocations through the existing pdf-to-markdown wrapper.
.github/workflows/validate.yml	Extends ShellCheck and install validation to include the new bin/nutrient wrapper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated no new comments.

[tomassurin]

Added guides on the intended flows that I operated with for OAuth and anonymous/guest organizations: https://github.com/PSPDFKit/PSPDFKit/blob/master/hosted/docs/guest/pdf-to-markdown-cli-oauth.md

Includes sections about fingerprinting (enforcement is WIP on hosted side).

If anything looks wrong, unclear or missing let me know - device auth and guest orgs are not used yet on production so we have a lot of leeway to change the direction at this point.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 11 changed files in this pull request and generated no new comments.