@materia-technologies-inc/chameleon-grant

Build-time license grant tooling for Chameleon. Your build asks the licensing service for a signed grant and stamps it into the page; Chameleon's components read it at runtime.

Without a grant, Chameleon components render watermarked and disabled. Install this before your first build.

• Node 20 or later
• No runtime dependencies
• A Vite plugin, a Rollup plugin and a command line — pick whichever fits your build

Install

npm install --save-dev @materia-technologies-inc/chameleon-grant

Set your organization's build token in the environment the build runs in:

export CHAMELEON_LICENSE_TOKEN="…"

It must reach a non-interactive shell. A token exported from ~/.bashrc or ~/.zshrc works when you type a command and vanishes when a script runs the same one — put it in ~/.zshenv, your CI's secret store, or wherever your shell reads for every invocation.

Pick a route

Vite

// vite.config.ts
import { chameleonGrant } from "@materia-technologies-inc/chameleon-grant/vite";

export default {
  plugins: [chameleonGrant()],
};

The grant is written into your page's <head> through transformIndexHtml, in dev and build alike.

Refuses a config that sets build.lib. Vite already knows that means a library, and a grant inside a published library is handed to everyone who installs it.

Needs an HTML page of its own, so it stamps nothing where a server renders the pages — a Blazor host, for instance, generates its own App.razor and the plugin has nothing to write into. Use the Rollup plugin there; a banner needs no page.

Rollup

// rollup.config.mjs
import { chameleonGrant } from "@materia-technologies-inc/chameleon-grant/rollup";

export default {
  plugins: [chameleonGrant({ target: "application" })],
};

The grant rides inside the bundle, as a banner at the top of each entry chunk.

target: "application" is required. Rollup cannot tell an application from a library — same inputs, same hooks, same output shape — so it asks rather than guesses, and the default is to refuse.

Command line

chameleon-grant stamp --out ./dist

Writes chameleon.grant.js. Load it from your HTML before the Chameleon bundle.

--out <directory>     Where to write the grant script (required)
--filename <name>     Output filename (default: chameleon.grant.js)
--audience <value>    Forensic project/domain identifier for the grant's aud claim
--endpoint <url>      Licensing endpoint override (development and sandbox use)

The emitted file contains a live grant: deploy it, do not commit it.

Custom integrations

Where neither plugin fits, it is two calls:

import { grantModuleCode, obtainGrant } from "@materia-technologies-inc/chameleon-grant";

const { grant } = await obtainGrant(); // the same three-tier ladder the plugins climb
const code = grantModuleCode(grant); // the line that installs it

Where the grant comes from

Your build asks for a grant down a three-tier ladder and stops at the first tier that answers:

| | | | :-- | :-- | | 1 · Service | the licensing endpoint at chameleonui.io | | 2 · Edge | when the service cannot be reached | | 3 · Cache | a grant already on this machine, up to 15 days old |

Only two things stop a build: the service answering no, and every tier being exhausted — which means offline for over a fortnight. A service that is merely unreachable does not.

There is no opt-out and no anonymous fallback, deliberately. A build that failed quietly would ship an application whose components render blank, found by whoever opens it rather than by the person who built it. Failing at the build is the louder end of the same fact.

Environment

| Variable | | | :-- | :-- | | CHAMELEON_LICENSE_TOKEN | Required. Your organization's build token. | | CHAMELEON_LICENSE_AUDIENCE | Optional. Forensic project or domain identifier. | | CHAMELEON_GRANT_ENDPOINT | Optional. Endpoint override, for development and sandbox use. Leave it unset in normal use — unset means the compiled default. |

License

See License.md.