@tera-system/core 0.1.4 → 0.1.5

package/MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/core",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Build manifest for the Tera System OpenCode Plugin component.",
   "compatibleEnvironments": [
     "opencode"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/core",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Tera System OpenCode Plugin — governance core, 20 agents, 10 commands, distribution tools",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",

package/scripts/install.js

@@ -213,23 +213,135 @@ fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
 fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
 
 /* ------------------- license state (non-blocking, never breaks install) ------------------- */
-try {
-  const stateFile = path.join(target, ".tera", "license.state.json");
-  let licenseKey = (readLicenseState(stateFile) || {}).licenseKey;
-  if (!licenseKey) licenseKey = process.env.TERA_LICENSE_KEY || undefined;
+
+/**
+ * License verification with API-first strategy + offline fallback.
+ *
+ * Flow:
+ *   1. Try online API verification (if API URL is configured)
+ *   2. On API failure → fallback to offline Ed25519 verification
+ *   3. Never blocks install — always continues
+ *
+ * Environment variables:
+ *   TERA_LICENSE_API  — API base URL (e.g. https://teranoo.com/api/license)
+ *   TERA_LICENSE_KEY  — Manual license key override
+ */
+const LICENSE_API_URL = process.env.TERA_LICENSE_API || "https://teranoo.com/api/license";
+const LICENSE_TIMEOUT_MS = 5000; // 5 seconds max for API call
+
+/**
+ * Verify license via remote API (online).
+ * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "api" }
+ */
+async function verifyViaAPI(licenseKey) {
+  if (!licenseKey) return { ok: false, state: "Unlicensed", reason: "no-key", source: "api" };
+
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), LICENSE_TIMEOUT_MS);
+
+    const res = await fetch(`${LICENSE_API_URL}/verify`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ licenseKey }),
+      signal: controller.signal,
+    });
+    clearTimeout(timeout);
+
+    if (!res.ok) {
+      return { ok: false, state: "Invalid", reason: `api-http-${res.status}`, source: "api" };
+    }
+
+    const data = await res.json();
+    return {
+      ok: data.valid === true,
+      state: data.state || "Invalid",
+      reason: data.reason || "api-response",
+      expiresAt: data.expiresAt || null,
+      source: "api",
+    };
+  } catch (err) {
+    // Network error, timeout, abort — fall through to offline
+    return { ok: false, state: "Unknown", reason: `api-error: ${err.message}`, source: "api-fallback" };
+  }
+}
+
+/**
+ * Verify license offline (Ed25519 signature check).
+ * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "offline" }
+ */
+function verifyOffline(licenseKey) {
   const state = assessLicenseState(licenseKey);
-  writeLicenseState(stateFile, {
+  return {
+    ok: state.state === "Active" || state.state === "Grace",
     state: state.state,
     reason: state.reason,
-    licenseKey: licenseKey || null,
     expiresAt: state.expiresAt || null,
-    checkedAt: new Date().toISOString(),
-  });
-  console.log(`  [license ] state=${state.state} (${state.reason})`);
-} catch (err) {
-  console.log(`  [license ] skipped (${err.message}) — install continues`);
+    graceUntil: state.graceUntil || null,
+    source: "offline",
+  };
 }
 
+/**
+ * Combined verification: API-first, offline fallback.
+ * Always returns a result — never throws.
+ */
+async function verifyLicense(licenseKey) {
+  // Step 1: Try API (unless explicitly disabled)
+  if (process.env.TERA_OFFLINE_ONLY === "1") {
+    return verifyOffline(licenseKey);
+  }
+
+  const apiResult = await verifyViaAPI(licenseKey);
+
+  // If API succeeded and gave a definitive answer, use it
+  if (apiResult.source === "api" && apiResult.ok !== undefined) {
+    return apiResult;
+  }
+
+  // Step 2: Fallback to offline
+  const offlineResult = verifyOffline(licenseKey);
+
+  // If offline confirms API's failure, use offline (more trusted)
+  if (!apiResult.ok && !offlineResult.ok) {
+    return offlineResult;
+  }
+
+  // If API failed but offline says active, trust offline (API might be down)
+  if (!apiResult.ok && offlineResult.ok) {
+    return { ...offlineResult, reason: `offline-verified (api-unavailable: ${apiResult.reason})` };
+  }
+
+  // Default: trust API
+  return apiResult;
+}
+
+// Run license check (async wrapper, non-blocking)
+(async () => {
+  try {
+    const stateFile = path.join(target, ".tera", "license.state.json");
+    let licenseKey = (readLicenseState(stateFile) || {}).licenseKey;
+    if (!licenseKey) licenseKey = process.env.TERA_LICENSE_KEY || undefined;
+
+    const result = await verifyLicense(licenseKey);
+
+    writeLicenseState(stateFile, {
+      state: result.state,
+      reason: result.reason,
+      licenseKey: licenseKey || null,
+      expiresAt: result.expiresAt || null,
+      graceUntil: result.graceUntil || null,
+      source: result.source,
+      checkedAt: new Date().toISOString(),
+    });
+
+    const sourceTag = result.source === "api" ? "☁️" : result.source === "offline" ? "🔒" : "🔄";
+    console.log(`  [license ] ${sourceTag} state=${result.state} (${result.reason})`);
+  } catch (err) {
+    console.log(`  [license ] skipped (${err.message}) — install continues`);
+  }
+})();
+
 console.log("\n  summary:");
 console.log(`    installed : ${stats.installed}`);
 console.log(`    updated   : ${stats.updated}`);