@endo-ui/license

About EndoUI

EndoUI is an Angular component library for building enterprise applications with accessible, themeable, and composable UI controls. It provides components such as a data grid, forms and selection controls, navigation, dialogs, notifications, and more. EndoUI supports Angular 22, with design-system-neutral theming and an optional Bootstrap 5 adapter.

Explore the components, live examples, and documentation at endoui.com.

What this package does

@endo-ui/license is the public developer and CI activation package for EndoUI. It validates license and package access, configures Angular build integration, and installs the matching private @endo-ui/core component package for authorized customers. It is not the component library itself. Nothing in this Node-only licensing package is imported into the browser application or its production runtime.

Local activation

Install the public activation package in the customer project first:

npm install --save-dev @endo-ui/license

Then provide the npm read token through an approved local environment/secret mechanism and run the project-local CLI:

export NPM_TOKEN="<customer npm read token>"
npx endoui-license activate \
  --license-id "<license-id>" \
  --developer "[email protected]"

If NPM_TOKEN is absent, an interactive terminal securely prompts for it. --npm-token is also supported for controlled automation. Command-line secrets can be exposed through shell history or process inspection, so NPM_TOKEN is preferred. The token is validated but never persisted or printed. Activation validates the named developer Seat, creates the signed local lease, manages the project .npmrc, configures Angular's licensed builders, generates CI bootstrap scripts, and finally installs the private @endo-ui/core package.

Local activation fails before validation or project mutation when @endo-ui/license is not already installed in the project. CI uses the generated isolated exact-version bootstrap instead.

Enterprise HTTP/HTTPS proxies

EndoUI supports approved forward HTTP/HTTPS egress proxies for npm access. npm package-access validation runs through the npm CLI in an isolated temporary project so npm can honor its normal proxy, certificate-authority, and environment configuration. The temporary configuration still pins the @endo-ui scope and NPM_TOKEN authentication to https://registry.npmjs.org/; the token is never written into that temporary file.

Configure an approved proxy with normal npm settings, for example:

npm config set --location=user proxy http://proxy.example:8080
npm config set --location=user https-proxy http://proxy.example:8080
# If the approved proxy uses an enterprise CA:
npm config set --location=user cafile /path/to/company-ca.pem

Or provide standard proxy environment variables. PowerShell example:

$env:HTTP_PROXY = "http://proxy.example:8080"
$env:HTTPS_PROXY = "http://proxy.example:8080"

A forward network proxy is different from an internal npm repository or package mirror such as Artifactory, Nexus, Azure Artifacts, or Verdaccio. EndoUI does not redirect NPM_TOKEN to an alternate registry and does not recommend storing the customer EndoUI npm credential in a third-party or contractor-controlled repository manager. If organizational policy blocks registry.npmjs.org entirely instead of allowing it through an approved egress proxy, contact EndoUI Support rather than copying the customer npm credential into that repository.

If an approved proxy performs TLS interception, the organization operating that trusted proxy can observe HTTPS request contents, including registry authorization headers. Use only proxy infrastructure approved to handle the customer's EndoUI package credential. Configure the organization's trusted CA instead of disabling npm or Node.js TLS verification.

Upgrade

Once EndoUI is activated, use Angular's update workflow rather than uninstalling and reinstalling Core. @endo-ui/core and @endo-ui/license publish together and declare the same Angular update package group. Routine updates should stay within the licensed major (v1 shown here):

ng update @endo-ui/core@^1

Use ng update @endo-ui/core@<version> when an exact release is required. Keep NPM_TOKEN available because the configured project .npmrc resolves the private Core package with that environment variable. Existing 1.3.x consumers should cross the package-group transition with:

ng update @endo-ui/[email protected] @endo-ui/[email protected]

After 1.4.0 is installed, future v1 updates can target Core alone. Same-major updates keep the existing developer authorization; after a major-version update, run local activation again to validate the new entitlement and regenerate the exact-version CI bootstrap scripts.

Automatic developer lease refresh

Developer leases are verified locally during ng serve and ng build. The licensed builders delegate to Angular's application and dev-server builders and expose the same Angular CLI options. Existing Angular commands therefore continue to work after activation, including:

ng serve --proxy-config proxy.conf.json
ng serve --port 4300
ng serve --ssl
ng serve --open

The checked-in application and dev-server schemas are synchronized directly from the installed @angular/build package, and release validation fails if either schema drifts from Angular.

When five days or less remain, the licensed builder attempts a five-second online refresh through ECAP. A successful response is signature-verified and atomically replaces the existing lease.

Temporary network or ECAP service failures do not stop a build while the existing signed lease is valid. Refresh retries use a six-hour backoff and report the remaining authorization period. Definitive authorization failures, such as suspension, removed Seat assignment, or missing major entitlement, stop the build immediately. CI leases are freshly issued by the generated bootstrap script and are not automatically refreshed.

CI activation

Commit the generated scripts/endoui-license-ci.sh and scripts/endoui-license-ci.ps1 files. Store NPM_TOKEN and ENDOUI_LICENSE_ID in the CI provider's protected secret storage, then run the platform-appropriate generated script immediately after checkout and before dependency installation. When CI requires an HTTP/HTTPS egress proxy, provide the same approved npm proxy configuration or HTTP_PROXY / HTTPS_PROXY environment variables to both the EndoUI activation step and the dependency-install step.

CI authorization does not consume a human Seat. The scripts bootstrap the exact license-tool version that generated them, validate npm and ECAP access, and cache a signed authorization for the bounded build period. They contain no credentials.