@endo-ui/license 1.0.1 → 1.0.2

package/README.md

@@ -1,40 +1,44 @@
 # @endo-ui/license
 
-Private Node-only activation and Angular 22 build enforcement for EndoUI. Nothing in this
+Public Node-only activation and Angular 22 build enforcement for EndoUI. Nothing in this
 package is imported into the browser application or its production runtime.
 
-## Configure an Angular workspace
+## Local activation
 
-After installing `@endo-ui/core` and this package from the private `@endo-ui` namespace:
+Install the public activation package in the customer project first:
 
 ```bash
-npx ng add @endo-ui/license
+npm install --save-dev @endo-ui/license
 ```
 
-The schematic replaces Angular's application and development-server builders with EndoUI
-wrappers. The wrappers verify a signed local authorization before delegating to Angular's
-official builders.
-
-## Developer activation
+Then provide the npm read token through an approved local environment/secret mechanism and run
+the project-local CLI:
 
 ```bash
+export NPM_TOKEN="<customer npm read token>"
 npx endoui-license activate \
+  --license-id "<license-id>" \
   --developer "jane@customer.com"
 ```
 
-The command securely prompts for the customer license key. The email identifies the named
-developer Seat; it is not an EndoUI login account. The customer license key is sent only to
-ECAP's licensing service and is not cached by this package. For non-interactive environments,
-provide it through the protected `ENDOUI_LICENSE_KEY` environment variable.
+If `NPM_TOKEN` is absent, an interactive terminal securely prompts for it. `--npm-token` is also
+supported for controlled automation. Command-line secrets can be exposed through shell history or
+process inspection, so `NPM_TOKEN` is preferred. The token is validated but never persisted or
+printed. Activation
+validates the named developer Seat, creates the signed local lease, manages the project `.npmrc`,
+configures Angular's licensed builders, generates CI bootstrap scripts, and finally installs the
+private `@endo-ui/core` package.
 
-## CI activation
+Local activation fails before validation or project mutation when `@endo-ui/license` is not
+already installed in the project. CI uses the generated isolated exact-version bootstrap instead.
 
-Store `ENDOUI_LICENSE_KEY` in the CI provider's protected secret storage, then run:
+## CI activation
 
-```bash
-npx endoui-license ci-activate
-npx ng build
-```
+Commit the generated `scripts/endoui-license-ci.sh` and `scripts/endoui-license-ci.ps1` files.
+Store `NPM_TOKEN` and `ENDOUI_LICENSE_ID` in the CI provider's protected secret storage, then run
+the platform-appropriate generated script immediately after checkout and before dependency
+installation.
 
-CI authorization does not consume a human Seat. The signed authorization is cached outside the
-application source and remains valid for its bounded offline period.
+CI authorization does not consume a human Seat. The scripts bootstrap the exact license-tool
+version that generated them, validate npm and ECAP access, and cache a signed authorization for
+the bounded build period. They contain no credentials.

package/bin/activation.js

@@ -0,0 +1,77 @@
+import { activateCi, activateDeveloper } from "./api.js";
+import { configureAngularWorkspace } from "./angular-config.js";
+import { generateCiScripts } from "./ci-scripts.js";
+import { installCore } from "./core-install.js";
+import { verifyLease } from "./lease.js";
+import { validateNpmAccess } from "./npm-access.js";
+import { ensureEndoUiNpmrc } from "./npmrc.js";
+import { resolveNpmToken } from "./npm-token.js";
+import { resolveLicensePackageVersion } from "./package-version.js";
+import { writeLease } from "./storage.js";
+const defaults = {
+    version: resolveLicensePackageVersion,
+    resolveToken: explicitToken => resolveNpmToken({
+        explicitToken,
+        environmentToken: process.env["NPM_TOKEN"]
+    }),
+    validateNpm: validateNpmAccess,
+    developerLease: activateDeveloper,
+    ciLease: activateCi,
+    verify: verifyLease,
+    writeLease,
+    npmrc: ensureEndoUiNpmrc,
+    angular: configureAngularWorkspace,
+    scripts: generateCiScripts,
+    install: installCore
+};
+export function resolveCiInputs(environment) {
+    const npmToken = environment["NPM_TOKEN"]?.trim();
+    if (!npmToken)
+        throw new Error("CI activation requires NPM_TOKEN.");
+    const licenseId = environment["ENDOUI_LICENSE_ID"]?.trim();
+    if (!licenseId)
+        throw new Error("CI activation requires ENDOUI_LICENSE_ID.");
+    return { npmToken, licenseId };
+}
+function major(version) {
+    const value = Number(version.split(".", 1)[0]);
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`EndoUI package version ${version} is not eligible for activation.`);
+    }
+    return value;
+}
+function assertLicense(lease, licenseId, kind) {
+    if (lease.licenseId !== licenseId || lease.kind !== kind) {
+        throw new Error("The signed EndoUI authorization does not match this activation request.");
+    }
+}
+export async function activateLocal(input, overrides = {}) {
+    const dependencies = { ...defaults, ...overrides };
+    const cwd = input.cwd ?? process.cwd();
+    const version = dependencies.version();
+    const npmToken = await dependencies.resolveToken(input.npmToken);
+    // All external authorization checks complete before the first project or lease mutation.
+    await dependencies.validateNpm(npmToken, version);
+    const signedLease = await dependencies.developerLease(input.licenseId, input.developer, version);
+    const lease = dependencies.verify(signedLease, version);
+    assertLicense(lease, input.licenseId, "developer");
+    if (lease.user !== input.developer) {
+        throw new Error("The signed EndoUI authorization does not match the named developer.");
+    }
+    await dependencies.npmrc(cwd);
+    await dependencies.angular(cwd);
+    await dependencies.scripts({ packageVersion: version, customer: lease.customer, licenseId: input.licenseId }, cwd);
+    await dependencies.install(cwd, version, npmToken);
+    await dependencies.writeLease(major(version), signedLease);
+    return { version, lease };
+}
+export async function activateForCi(input, overrides = {}) {
+    const dependencies = { ...defaults, ...overrides };
+    const version = dependencies.version();
+    await dependencies.validateNpm(input.npmToken, version);
+    const signedLease = await dependencies.ciLease(input.licenseId, version);
+    const lease = dependencies.verify(signedLease, version);
+    assertLicense(lease, input.licenseId, "ci");
+    await dependencies.writeLease(major(version), signedLease);
+    return { version, lease };
+}

package/bin/angular-config.js

@@ -0,0 +1,47 @@
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+function configureTarget(target, expected, replacement) {
+    if (!target)
+        return false;
+    if (target.builder === replacement)
+        return false;
+    if (target.builder !== expected && !target.builder?.startsWith("@endo-ui/license:")) {
+        throw new Error(`Cannot replace custom Angular builder ${target.builder ?? "(missing)"}.`);
+    }
+    target.builder = replacement;
+    return true;
+}
+export function configureAngularWorkspaceObject(workspace) {
+    let found = false;
+    let changed = false;
+    for (const project of Object.values(workspace.projects ?? {})) {
+        if (project.projectType !== "application")
+            continue;
+        const targets = project.architect ?? project.targets;
+        if (!targets)
+            continue;
+        if (targets["build"] || targets["serve"])
+            found = true;
+        changed = configureTarget(targets["build"], "@angular/build:application", "@endo-ui/license:application") || changed;
+        changed = configureTarget(targets["serve"], "@angular/build:dev-server", "@endo-ui/license:dev-server") || changed;
+    }
+    if (!found)
+        throw new Error("No Angular 22 application build or serve targets were found.");
+    return changed;
+}
+export async function configureAngularWorkspace(cwd = process.cwd()) {
+    const file = path.join(cwd, "angular.json");
+    let workspace;
+    try {
+        workspace = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new Error("angular.json is not valid JSON.");
+        throw error;
+    }
+    const changed = configureAngularWorkspaceObject(workspace);
+    if (changed)
+        await writeFile(file, `${JSON.stringify(workspace, null, 2)}\n`, "utf8");
+    return changed;
+}

package/bin/api.js

@@ -1,12 +1,11 @@
 const DEFAULT_SERVICE_URL = "https://license.ecapsoftware.com";
-async function requestLease(pathname, licenseKey, body) {
+async function requestLease(pathname, body) {
     const baseUrl = process.env['ENDOUI_LICENSE_URL'] ?? DEFAULT_SERVICE_URL;
     const response = await fetch(new URL(pathname, baseUrl), {
         method: "POST",
         headers: {
             Accept: "application/json",
-            "Content-Type": "application/json",
-            Authorization: `License ${licenseKey}`
+            "Content-Type": "application/json"
         },
         body: JSON.stringify(body)
     });
@@ -23,12 +22,13 @@ async function requestLease(pathname, licenseKey, body) {
     }
     return value.lease;
 }
-export function activateDeveloper(licenseKey, developerEmail, packageVersion) {
-    return requestLease("/v1/endoui/leases/developer", licenseKey, {
+export function activateDeveloper(licenseId, developerEmail, packageVersion) {
+    return requestLease("/v1/endoui/leases/developer", {
+        licenseId,
         developerEmail,
         packageVersion
     });
 }
-export function activateCi(licenseKey, packageVersion) {
-    return requestLease("/v1/endoui/leases/ci", licenseKey, { packageVersion });
+export function activateCi(licenseId, packageVersion) {
+    return requestLease("/v1/endoui/leases/ci", { licenseId, packageVersion });
 }

package/bin/builders/verify-authorization.js

@@ -1,8 +1,8 @@
 import { resolveEndoUiVersion } from "../package-version.js";
 import { verifyLease } from "../lease.js";
 import { readLease } from "../storage.js";
-export async function verifyAuthorization() {
-    const version = resolveEndoUiVersion();
+export async function verifyAuthorization(overrides = {}) {
+    const version = (overrides.resolveVersion ?? resolveEndoUiVersion)();
     const major = Number(version.split(".", 1)[0]);
-    verifyLease(await readLease(major), version);
+    (overrides.verify ?? verifyLease)(await (overrides.read ?? readLease)(major), version);
 }

package/bin/ci-scripts.js

@@ -0,0 +1,79 @@
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+export function maskLicenseId(_licenseId) {
+    return "********";
+}
+function safeComment(value) {
+    return value.replace(/[\r\n]+/g, " ").trim();
+}
+function header(metadata) {
+    const generated = (metadata.generatedAt ?? new Date()).toISOString().slice(0, 10);
+    return [
+        `# Generated by @endo-ui/license@${metadata.packageVersion}`,
+        `# Customer: ${safeComment(metadata.customer)}`,
+        `# License ID: ${maskLicenseId(metadata.licenseId)}`,
+        `# Generated: ${generated}`,
+        "#",
+        "# Do not edit manually. Re-run EndoUI activation to regenerate."
+    ].join("\n");
+}
+export function createShellCiScript(metadata) {
+    const version = metadata.packageVersion;
+    return `#!/usr/bin/env sh
+set -eu
+
+${header(metadata)}
+
+if [ -z "\${NPM_TOKEN:-}" ]; then
+  echo "EndoUI CI activation requires NPM_TOKEN." >&2
+  exit 1
+fi
+if [ -z "\${ENDOUI_LICENSE_ID:-}" ]; then
+  echo "EndoUI CI activation requires ENDOUI_LICENSE_ID." >&2
+  exit 1
+fi
+
+BOOTSTRAP_DIR="\${TMPDIR:-/tmp}/endoui-license-$$"
+cleanup() { rm -rf "$BOOTSTRAP_DIR"; }
+trap cleanup EXIT HUP INT TERM
+mkdir -p "$BOOTSTRAP_DIR"
+npm install --prefix "$BOOTSTRAP_DIR" --no-save "@endo-ui/license@${version}"
+node "$BOOTSTRAP_DIR/node_modules/@endo-ui/license/bin/cli.js" ci-activate
+`;
+}
+export function createPowerShellCiScript(metadata) {
+    const version = metadata.packageVersion;
+    return `$ErrorActionPreference = "Stop"
+
+${header(metadata)}
+
+if ([string]::IsNullOrWhiteSpace($env:NPM_TOKEN)) {
+  throw "EndoUI CI activation requires NPM_TOKEN."
+}
+if ([string]::IsNullOrWhiteSpace($env:ENDOUI_LICENSE_ID)) {
+  throw "EndoUI CI activation requires ENDOUI_LICENSE_ID."
+}
+
+$bootstrapDirectory = Join-Path ([System.IO.Path]::GetTempPath()) ("endoui-license-" + [guid]::NewGuid())
+try {
+  New-Item -ItemType Directory -Path $bootstrapDirectory | Out-Null
+  npm install --prefix $bootstrapDirectory --no-save "@endo-ui/license@${version}"
+  if ($LASTEXITCODE -ne 0) { throw "Unable to bootstrap @endo-ui/license." }
+  node (Join-Path $bootstrapDirectory "node_modules/@endo-ui/license/bin/cli.js") ci-activate
+  if ($LASTEXITCODE -ne 0) { throw "EndoUI CI activation failed." }
+} finally {
+  if (Test-Path -LiteralPath $bootstrapDirectory) {
+    Remove-Item -LiteralPath $bootstrapDirectory -Recurse -Force
+  }
+}
+`;
+}
+export async function generateCiScripts(metadata, cwd = process.cwd()) {
+    const directory = path.join(cwd, "scripts");
+    await mkdir(directory, { recursive: true });
+    const shellPath = path.join(directory, "endoui-license-ci.sh");
+    await writeFile(shellPath, createShellCiScript(metadata), { encoding: "utf8", mode: 0o755 });
+    await writeFile(path.join(directory, "endoui-license-ci.ps1"), createPowerShellCiScript(metadata), "utf8");
+    if (process.platform !== "win32")
+        await chmod(shellPath, 0o755);
+}

package/bin/cli.js

@@ -1,13 +1,22 @@
 #!/usr/bin/env node
-import { activateCi, activateDeveloper } from "./api.js";
-import { createInterface } from "node:readline/promises";
-import { Writable } from "node:stream";
+import { activateForCi, activateLocal, resolveCiInputs } from "./activation.js";
 import { verifyLease } from "./lease.js";
-import { resolveEndoUiVersion } from "./package-version.js";
-import { readLease, writeLease } from "./storage.js";
+import { resolveEndoUiVersion, resolveInstalledLicenseVersion, resolveLicensePackageVersion } from "./package-version.js";
+import { readLease } from "./storage.js";
 function argument(name) {
     const index = process.argv.indexOf(name);
-    return index >= 0 ? process.argv[index + 1] : undefined;
+    if (index < 0)
+        return undefined;
+    const value = process.argv[index + 1];
+    if (!value || value.startsWith("--"))
+        throw new Error(`${name} requires a value.`);
+    return value;
+}
+function required(value, message) {
+    const normalized = value?.trim();
+    if (!normalized)
+        throw new Error(message);
+    return normalized;
 }
 function packageMajor(version) {
     const major = Number(version.split(".", 1)[0]);
@@ -16,64 +25,54 @@ function packageMajor(version) {
     }
     return major;
 }
-async function licenseCredential() {
-    const configured = process.env['ENDOUI_LICENSE_KEY'];
-    if (configured)
-        return configured;
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new Error("ENDOUI_LICENSE_KEY is required in non-interactive environments.");
-    }
-    let muted = false;
-    const output = new Writable({
-        write(chunk, encoding, callback) {
-            if (!muted)
-                process.stdout.write(chunk, encoding);
-            callback();
-        }
-    });
-    const prompt = createInterface({ input: process.stdin, output, terminal: true });
-    try {
-        const answer = prompt.question("Customer license key: ");
-        muted = true;
-        const value = (await answer).trim();
-        process.stdout.write("\n");
-        if (!value)
-            throw new Error("A customer license key is required.");
-        return value;
-    }
-    finally {
-        prompt.close();
-    }
-}
 async function activate() {
-    const licenseKey = await licenseCredential();
-    const developerEmail = argument("--developer") ?? process.env['ENDOUI_DEVELOPER_EMAIL'];
-    if (!developerEmail) {
-        throw new Error("Activation requires --developer.");
+    const installedVersion = resolveInstalledLicenseVersion();
+    const runningVersion = resolveLicensePackageVersion();
+    if (installedVersion !== runningVersion) {
+        throw new Error(`The project has @endo-ui/license@${installedVersion}, but activation is running ` +
+            `@endo-ui/license@${runningVersion}. Run the project-local command with npx endoui-license.`);
     }
-    const normalizedEmail = developerEmail.trim().toLowerCase();
-    const version = resolveEndoUiVersion();
-    const major = packageMajor(version);
-    const lease = await activateDeveloper(licenseKey, normalizedEmail, version);
-    verifyLease(lease, version);
-    await writeLease(major, lease);
-    console.log(`EndoUI ${major}.x activated for ${normalizedEmail}.`);
+    const licenseId = required(argument("--license-id"), "Activation requires --license-id.");
+    const developer = required(argument("--developer") ?? process.env["ENDOUI_DEVELOPER_EMAIL"], "Activation requires --developer.").toLowerCase();
+    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(developer)) {
+        throw new Error("--developer must be a valid email address.");
+    }
+    await activateLocal({
+        licenseId,
+        developer,
+        npmToken: argument("--npm-token")
+    });
+    console.log(`
+EndoUI activation successful.
+
+✓ npm access verified
+✓ EndoUI license verified
+✓ Developer authorization created
+✓ Angular licensed builders configured
+✓ .npmrc configured
+✓ CI activation scripts generated
+✓ @endo-ui/core installed
+
+Commit the generated CI scripts and .npmrc changes to your repository.
+
+Keep NPM_TOKEN out of source control. Provide it through your approved
+local secret mechanism and your CI secret store.
+
+CI must provide:
+  NPM_TOKEN
+  ENDOUI_LICENSE_ID
+
+Run the generated EndoUI CI activation script immediately after checkout
+and before npm ci/npm install.`);
 }
 async function activateBuild() {
-    const licenseKey = process.env['ENDOUI_LICENSE_KEY'];
-    if (!licenseKey)
-        throw new Error("CI activation requires ENDOUI_LICENSE_KEY.");
-    const version = resolveEndoUiVersion();
-    const major = packageMajor(version);
-    const lease = await activateCi(licenseKey, version);
-    verifyLease(lease, version);
-    await writeLease(major, lease);
-    console.log(`EndoUI ${version} CI authorization activated.`);
+    const { npmToken, licenseId } = resolveCiInputs(process.env);
+    const result = await activateForCi({ licenseId, npmToken });
+    console.log(`EndoUI ${result.version} CI authorization activated.`);
 }
 async function check() {
     const version = resolveEndoUiVersion();
-    const major = packageMajor(version);
-    const lease = verifyLease(await readLease(major), version);
+    const lease = verifyLease(await readLease(packageMajor(version)), version);
     const refreshNotice = Math.floor(Date.now() / 1000) >= lease.refreshAfter
         ? " Refresh activation when connectivity is available."
         : "";
@@ -92,7 +91,7 @@ async function main() {
             return;
         default:
             console.log("Usage: endoui-license <activate|ci-activate|verify> " +
-                "[--developer <email>]");
+                "[--license-id <id>] [--developer <email>] [--npm-token <token>]");
     }
 }
 main().catch((error) => {

package/bin/core-install.js

@@ -0,0 +1,44 @@
+import { spawn } from "node:child_process";
+const MAX_STDERR_LENGTH = 65_536;
+function redact(value, npmToken) {
+    return npmToken ? value.split(npmToken).join("[REDACTED]") : value;
+}
+export function npmInstallFailure(specification, exitCode, stderr, npmToken, signal) {
+    const reason = redact(stderr.trim(), npmToken) ||
+        (signal ? `npm was terminated by signal ${signal}.` : "npm did not provide error output.");
+    return new Error(`Failed to install ${specification}.\n` +
+        `npm exit code: ${exitCode ?? "unknown"}\n` +
+        `Reason:\n${reason}`);
+}
+export async function installCore(cwd = process.cwd(), version, npmToken) {
+    const command = process.platform === "win32" ? "npm.cmd" : "npm";
+    await new Promise((resolve, reject) => {
+        const specification = version ? `@endo-ui/core@${version}` : "@endo-ui/core";
+        let stderr = "";
+        const child = spawn(command, ["install", specification], {
+            cwd,
+            env: {
+                ...process.env,
+                ...(npmToken ? { NPM_TOKEN: npmToken } : {})
+            },
+            stdio: ["inherit", "inherit", "pipe"],
+            shell: false
+        });
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", (chunk) => {
+            stderr = `${stderr}${chunk}`.slice(-MAX_STDERR_LENGTH);
+        });
+        child.once("error", error => reject(new Error(`Unable to start npm while installing ${specification}. ${error.message}`)));
+        child.once("exit", (code, signal) => {
+            const safeStderr = redact(stderr, npmToken);
+            if (code === 0) {
+                if (safeStderr)
+                    process.stderr.write(safeStderr);
+                resolve();
+            }
+            else {
+                reject(npmInstallFailure(specification, code, stderr, npmToken, signal));
+            }
+        });
+    });
+}

package/bin/lease.js

@@ -26,6 +26,8 @@ export function verifyLease(token, packageVersion, now = Date.now(), trust = {
     const major = Number(packageVersion.split(".", 1)[0]);
     if (lease.iss !== trust.issuer || lease.aud !== "@endo-ui/license" || lease.product !== "endoui" || lease.package !== "@endo-ui/core" || lease.majorVersion !== major || lease.entitlement !== `endoui-v${major}`)
         throw new Error("The authorization does not cover this EndoUI package.");
+    if (typeof lease.licenseId !== "string" || !lease.licenseId || typeof lease.customer !== "string" || !lease.customer)
+        throw new Error("The authorization is missing required customer details.");
     if (!Number.isSafeInteger(lease.nbf) || !Number.isSafeInteger(lease.exp))
         throw new Error("The authorization has invalid timestamps.");
     if (seconds < lease.nbf)

package/bin/npm-access.js

@@ -0,0 +1,34 @@
+export async function validateNpmAccess(token, version, request = fetch) {
+    let response;
+    try {
+        response = await request("https://registry.npmjs.org/@endo-ui%2Fcore", {
+            headers: {
+                Accept: "application/vnd.npm.install-v1+json",
+                Authorization: `Bearer ${token}`
+            }
+        });
+    }
+    catch {
+        throw new Error("Unable to contact npm to validate access to @endo-ui/core.");
+    }
+    if (response.ok) {
+        let metadata;
+        try {
+            metadata = await response.json();
+        }
+        catch {
+            throw new Error("npm returned invalid package metadata for @endo-ui/core.");
+        }
+        if (!metadata.versions?.[version]) {
+            throw new Error(`@endo-ui/core@${version} is not available to this npm token.`);
+        }
+        return;
+    }
+    if (response.status === 401) {
+        throw new Error("The npm token is invalid, expired, or revoked.");
+    }
+    if (response.status === 403 || response.status === 404) {
+        throw new Error("The npm token does not have read access to @endo-ui/core.");
+    }
+    throw new Error(`npm access validation failed with HTTP ${response.status}.`);
+}

package/bin/npm-token.js

@@ -0,0 +1,37 @@
+import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+async function securePrompt() {
+    let muted = false;
+    const output = new Writable({
+        write(chunk, encoding, callback) {
+            if (!muted)
+                process.stdout.write(chunk, encoding);
+            callback();
+        }
+    });
+    const prompt = createInterface({ input: process.stdin, output, terminal: true });
+    try {
+        const answer = prompt.question("npm token: ");
+        muted = true;
+        const value = (await answer).trim();
+        process.stdout.write("\n");
+        return value;
+    }
+    finally {
+        prompt.close();
+    }
+}
+export async function resolveNpmToken(options = {}) {
+    const explicit = options.explicitToken?.trim();
+    if (explicit)
+        return explicit;
+    const environment = options.environmentToken?.trim();
+    if (environment)
+        return environment;
+    if (options.interactive ?? (process.stdin.isTTY && process.stdout.isTTY)) {
+        const prompted = (await (options.prompt ?? securePrompt)()).trim();
+        if (prompted)
+            return prompted;
+    }
+    throw new Error("An npm token is required. Set NPM_TOKEN or provide --npm-token in an approved automation environment.");
+}

package/bin/npmrc.js

@@ -0,0 +1,40 @@
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+export const NPMRC_BEGIN = "# BEGIN ENDOUI MANAGED CONFIG";
+export const NPMRC_END = "# END ENDOUI MANAGED CONFIG";
+export const NPMRC_REGION = `${NPMRC_BEGIN}\n@endo-ui:registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=\${NPM_TOKEN}\n${NPMRC_END}`;
+export function updateNpmrcContent(content) {
+    const begins = [...content.matchAll(new RegExp(NPMRC_BEGIN, "g"))];
+    const ends = [...content.matchAll(new RegExp(NPMRC_END, "g"))];
+    if (begins.length === 0 && ends.length === 0) {
+        const separator = content.length === 0 ? "" : content.endsWith("\n") ? "\n" : "\n\n";
+        return { content: `${content}${separator}${NPMRC_REGION}\n`, changed: true };
+    }
+    if (begins.length !== 1 || ends.length !== 1 || begins[0].index >= ends[0].index) {
+        throw new Error("The EndoUI managed .npmrc markers are malformed or ambiguous.");
+    }
+    const start = begins[0].index;
+    const end = ends[0].index + NPMRC_END.length;
+    const existing = content.slice(start, end);
+    if (existing === NPMRC_REGION)
+        return { content, changed: false };
+    return {
+        content: `${content.slice(0, start)}${NPMRC_REGION}${content.slice(end)}`,
+        changed: true
+    };
+}
+export async function ensureEndoUiNpmrc(cwd = process.cwd()) {
+    const file = path.join(cwd, ".npmrc");
+    let original = "";
+    try {
+        original = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    const updated = updateNpmrcContent(original);
+    if (updated.changed)
+        await writeFile(file, updated.content, "utf8");
+    return updated.changed;
+}

package/bin/package-version.js

@@ -1,9 +1,37 @@
 import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
 import path from "node:path";
-export function resolveEndoUiVersion(cwd = process.cwd()) { const require = createRequire(path.join(cwd, "package.json")); let file; try {
-    file = require.resolve("@endo-ui/core/package.json");
+function packageVersion(packageName, cwd) {
+    const require = createRequire(path.join(cwd, "package.json"));
+    let file;
+    try {
+        file = require.resolve(`${packageName}/package.json`);
+    }
+    catch {
+        throw new Error(`Unable to find ${packageName} from the current project.`);
+    }
+    const value = require(file);
+    if (value.name !== packageName || typeof value.version !== "string") {
+        throw new Error(`${packageName} has invalid package metadata.`);
+    }
+    return value.version;
+}
+export function resolveEndoUiVersion(cwd = process.cwd()) {
+    return packageVersion("@endo-ui/core", cwd);
+}
+export function resolveInstalledLicenseVersion(cwd = process.cwd()) {
+    try {
+        return packageVersion("@endo-ui/license", cwd);
+    }
+    catch {
+        throw new Error("Install @endo-ui/license in this project before activation: " +
+            "npm install --save-dev @endo-ui/license");
+    }
+}
+export function resolveLicensePackageVersion() {
+    const value = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+    if (value.name !== "@endo-ui/license" || typeof value.version !== "string") {
+        throw new Error("@endo-ui/license has invalid package metadata.");
+    }
+    return value.version;
 }
-catch {
-    throw new Error("Unable to find @endo-ui/core from the current project.");
-} const value = require(file); if (value.name !== "@endo-ui/core" || typeof value.version !== "string")
-    throw new Error("@endo-ui/core has invalid package metadata."); return value.version; }

package/bin/schematics/ng-add/index.js

@@ -1,4 +1,5 @@
 import { SchematicsException } from "@angular-devkit/schematics";
+import { configureAngularWorkspaceObject } from "../../angular-config.js";
 export default function ngAdd() {
     return (tree) => {
         const workspaceFile = tree.get("angular.json");
@@ -6,26 +7,14 @@ export default function ngAdd() {
             throw new SchematicsException("This project does not contain angular.json.");
         }
         const workspace = JSON.parse(workspaceFile.content.toString("utf8"));
-        let configured = false;
-        for (const project of Object.values(workspace.projects ?? {})) {
-            if (project.projectType !== "application")
-                continue;
-            const targets = project.architect ?? project.targets;
-            if (!targets)
-                continue;
-            if (targets['build']?.builder === "@angular/build:application") {
-                targets['build'].builder = "@endo-ui/license:application";
-                configured = true;
-            }
-            if (targets['serve']?.builder === "@angular/build:dev-server") {
-                targets['serve'].builder = "@endo-ui/license:dev-server";
-                configured = true;
-            }
+        try {
+            const changed = configureAngularWorkspaceObject(workspace);
+            if (changed)
+                tree.overwrite("angular.json", `${JSON.stringify(workspace, null, 2)}\n`);
         }
-        if (!configured) {
-            throw new SchematicsException("No Angular 22 application build or serve targets were found to configure.");
+        catch (error) {
+            throw new SchematicsException(error instanceof Error ? error.message : "Unable to configure Angular.");
         }
-        tree.overwrite("angular.json", `${JSON.stringify(workspace, null, 2)}\n`);
         return tree;
     };
 }

package/bin/storage.js

@@ -1,14 +1,27 @@
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-function target(major) { const override = process.env['ENDOUI_LICENSE_CACHE']?.trim(); return override ? path.resolve(override) : path.join(os.homedir(), ".endoui", `endoui-v${major}.jwt`); }
-export async function readLease(major) { try {
-    return (await readFile(target(major), "utf8")).trim();
+export function leasePath(major, environment = process.env, homeDirectory = os.homedir()) {
+    const override = environment["ENDOUI_LICENSE_CACHE"]?.trim();
+    return override
+        ? path.resolve(override)
+        : path.join(homeDirectory, ".endoui", `endoui-v${major}.jwt`);
+}
+export async function readLease(major) {
+    try {
+        return (await readFile(leasePath(major), "utf8")).trim();
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            throw new Error("EndoUI is not activated. Run `endoui-license activate`.");
+        }
+        throw error;
+    }
+}
+export async function writeLease(major, lease, environment = process.env, homeDirectory = os.homedir()) {
+    const file = leasePath(major, environment, homeDirectory);
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await writeFile(file, `${lease}\n`, { encoding: "utf8", mode: 0o600 });
+    if (process.platform !== "win32")
+        await chmod(file, 0o600);
 }
-catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT")
-        throw new Error("EndoUI is not activated. Run `endoui-license activate`.");
-    throw error;
-} }
-export async function writeLease(major, lease) { const file = target(major); await mkdir(path.dirname(file), { recursive: true, mode: 0o700 }); await writeFile(file, `${lease}\n`, { encoding: "utf8", mode: 0o600 }); if (process.platform !== "win32")
-    await chmod(file, 0o600); }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@endo-ui/license",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Developer and CI license activation for EndoUI.",
   "license": "SEE LICENSE IN LICENSE.md",
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "type": "module",
   "builders": "./builders.json",