@tera-system/pro 0.1.0

package/core/tera-system/teranoo-ui/components/sidebar.tsx

@@ -0,0 +1,66 @@
+import * as React from "react"
+
+interface SidebarItem {
+  label: string
+  icon?: React.ReactNode
+  href?: string
+  active?: boolean
+  children?: SidebarItem[]
+}
+
+interface SidebarProps {
+  items: SidebarItem[]
+  collapsed?: boolean
+  onToggle?: () => void
+  footer?: React.ReactNode
+}
+
+export function Sidebar({ items, collapsed, onToggle, footer }: SidebarProps) {
+  return (
+    <aside
+      className={`flex flex-col border-l border-[var(--teranoo-border)] bg-[var(--teranoo-background)] transition-all duration-300 ${
+        collapsed ? "w-16" : "w-64"
+      }`}
+    >
+      <div className="flex items-center justify-between p-4 border-b border-[var(--teranoo-border)]">
+        {!collapsed && (
+          <span className="font-semibold text-lg">Teranoo</span>
+        )}
+        <button
+          onClick={onToggle}
+          className="p-1 rounded-md hover:bg-[var(--teranoo-muted)]"
+        >
+          {collapsed ? "→" : "←"}
+        </button>
+      </div>
+
+      <nav className="flex-1 p-2 space-y-1">
+        {items.map((item, i) => (
+          <SidebarLink key={i} item={item} collapsed={collapsed} />
+        ))}
+      </nav>
+
+      {footer && (
+        <div className="p-4 border-t border-[var(--teranoo-border)]">
+          {footer}
+        </div>
+      )}
+    </aside>
+  )
+}
+
+function SidebarLink({ item, collapsed }: { item: SidebarItem; collapsed?: boolean }) {
+  return (
+    <a
+      href={item.href || "#"}
+      className={`flex items-center gap-3 px-3 py-2 rounded-[var(--teranoo-radius)] text-sm transition-colors ${
+        item.active
+          ? "bg-[var(--teranoo-primary)] text-[var(--teranoo-primary-foreground)]"
+          : "text-[var(--teranoo-foreground)] hover:bg-[var(--teranoo-muted)]"
+      }`}
+    >
+      {item.icon && <span className="h-4 w-4">{item.icon}</span>}
+      {!collapsed && <span>{item.label}</span>}
+    </a>
+  )
+}

package/core/tera-system/teranoo-ui/components/stats-card.tsx

@@ -0,0 +1,37 @@
+import * as React from "react"
+import { Card, CardContent } from "./card"
+
+interface StatsCardProps {
+  label: string
+  value: string | number
+  description?: string
+  trend?: "up" | "down" | "neutral"
+}
+
+export function StatsCard({ label, value, description, trend }: StatsCardProps) {
+  const trendIcon = trend === "up" ? "↑" : trend === "down" ? "↓" : "→"
+  const trendColor = trend === "up"
+    ? "text-[var(--teranoo-success)]"
+    : trend === "down"
+    ? "text-[var(--teranoo-danger)]"
+    : "text-[var(--teranoo-muted-foreground)]"
+
+  return (
+    <Card>
+      <CardContent className="p-4">
+        <div className="space-y-1">
+          <p className="text-xs text-[var(--teranoo-muted-foreground)]">{label}</p>
+          <div className="flex items-baseline gap-2">
+            <p className="text-2xl font-bold">{value}</p>
+            {trend && (
+              <span className={`text-sm ${trendColor}`}>{trendIcon}</span>
+            )}
+          </div>
+          {description && (
+            <p className="text-xs text-[var(--teranoo-muted-foreground)]">{description}</p>
+          )}
+        </div>
+      </CardContent>
+    </Card>
+  )
+}

package/core/tera-system/teranoo-ui/registry.json

@@ -0,0 +1,77 @@
+{
+  "name": "teranoo-ui",
+  "description": "Teranoo UI Registry — مكونات Tera المعتمدة لتطبيقات الزبائن",
+  "version": "1.0.0",
+  "registry": [
+    {
+      "name": "button",
+      "type": "components:ui",
+      "description": "زر Tera الأساسي — يمتد shadcn button مع ثيم Tera",
+      "dependencies": ["@radix-ui/react-slot"],
+      "files": ["components/button.tsx"]
+    },
+    {
+      "name": "card",
+      "type": "components:ui",
+      "description": "بطاقة Tera — تعرض محتوى بحدود وظل موحدين",
+      "dependencies": [],
+      "files": ["components/card.tsx"]
+    },
+    {
+      "name": "dashboard-layout",
+      "type": "components:ui",
+      "description": "هيكل لوحة تحكم كامل — Sidebar + Header + Main",
+      "dependencies": [],
+      "files": ["components/dashboard-layout.tsx"]
+    },
+    {
+      "name": "data-table",
+      "type": "components:ui",
+      "description": "جدول بيانات متقدم — فرز، فلتر، بحث، Pagination",
+      "dependencies": ["@tanstack/react-table"],
+      "files": ["components/data-table.tsx"]
+    },
+    {
+      "name": "kpi-card",
+      "type": "components:ui",
+      "description": "بطاقة KPI — عنوان، قيمة، مؤشر تغيير، أيقونة",
+      "dependencies": [],
+      "files": ["components/kpi-card.tsx"]
+    },
+    {
+      "name": "sidebar",
+      "type": "components:ui",
+      "description": "قائمة جانبية — عناصر قائمة مع أيقونات، قابلة للطي",
+      "dependencies": ["@radix-ui/react-dialog"],
+      "files": ["components/sidebar.tsx"]
+    },
+    {
+      "name": "stats-card",
+      "type": "components:ui",
+      "description": "بطاقة إحصائية — رقم، وصف، رسم بياني صغير",
+      "dependencies": [],
+      "files": ["components/stats-card.tsx"]
+    },
+    {
+      "name": "page-header",
+      "type": "components:ui",
+      "description": "عنوان صفحة موحّد — عنوان، وصف، أزرار إجراءات",
+      "dependencies": [],
+      "files": ["components/page-header.tsx"]
+    },
+    {
+      "name": "search-input",
+      "type": "components:ui",
+      "description": "حقل بحث موحّد — أيقونة، كتابة، مسح",
+      "dependencies": [],
+      "files": ["components/search-input.tsx"]
+    },
+    {
+      "name": "empty-state",
+      "type": "components:ui",
+      "description": "حالة عدم وجود بيانات — أيقونة، رسالة، زر إجراء",
+      "dependencies": [],
+      "files": ["components/empty-state.tsx"]
+    }
+  ]
+}

package/core/tera-system/teranoo-ui/styles/teranoo-theme.css

@@ -0,0 +1,61 @@
+/* ============================================
+   Teranoo Theme — ألوان Tera الموحّدة
+   استخدم هذا الملف في أي مشروع Tera UI
+   ============================================ */
+
+:root {
+  /* الألوان الأساسية */
+  --teranoo-primary: #2563eb;
+  --teranoo-primary-foreground: #ffffff;
+  --teranoo-primary-hover: #1d4ed8;
+
+  --teranoo-secondary: #64748b;
+  --teranoo-secondary-foreground: #ffffff;
+
+  --teranoo-accent: #f59e0b;
+  --teranoo-accent-foreground: #1c1917;
+
+  --teranoo-success: #10b981;
+  --teranoo-warning: #f59e0b;
+  --teranoo-danger: #ef4444;
+  --teranoo-info: #3b82f6;
+
+  /* الخلفية والنص */
+  --teranoo-background: #ffffff;
+  --teranoo-foreground: #0f172a;
+  --teranoo-muted: #f1f5f9;
+  --teranoo-muted-foreground: #64748b;
+  --teranoo-border: #e2e8f0;
+  --teranoo-input: #e2e8f0;
+  --teranoo-ring: #2563eb;
+
+  /* الزوايا */
+  --teranoo-radius: 0.5rem;
+
+  /* الخطوط */
+  --teranoo-font-family: 'Cairo', 'Inter', sans-serif;
+  --teranoo-font-size-xs: 0.75rem;
+  --teranoo-font-size-sm: 0.875rem;
+  --teranoo-font-size-base: 1rem;
+  --teranoo-font-size-lg: 1.125rem;
+  --teranoo-font-size-xl: 1.25rem;
+  --teranoo-font-size-2xl: 1.5rem;
+
+  /* الظلال */
+  --teranoo-shadow-sm: 0 1px 2px 0 rgb(0 0 0 / 0.05);
+  --teranoo-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+  --teranoo-shadow-md: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
+  --teranoo-shadow-lg: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1);
+
+  /* RTL */
+  --teranoo-direction: rtl;
+}
+
+/* وضع الظلام (اختياري) */
+.dark {
+  --teranoo-primary: #3b82f6;
+  --teranoo-background: #0f172a;
+  --teranoo-foreground: #f8fafc;
+  --teranoo-muted: #1e293b;
+  --teranoo-border: #334155;
+}

package/opencode.tera.example.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "playwright": {
+      "type": "local",
+      "command": ["npx", "-y", "@playwright/mcp"],
+      "enabled": true
+    },
+    "semgrep": {
+      "type": "local",
+      "command": ["npx", "-y", "mcp-server-semgrep"],
+      "enabled": true
+    },
+    "structurizr": {
+      "type": "local",
+      "command": [
+        "uv",
+        "run",
+        "--directory",
+        "structurizr-mcp",
+        "structurizr-mcp"
+      ],
+      "enabled": false,
+      "env": {
+        "STRUCTURIZR_WORKSPACE_DIR": "../architecture",
+        "STRUCTURIZR_URL": "http://localhost:8081"
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@tera-system/pro",
+  "version": "0.1.0",
+  "description": "Tera System Pro — commercial edition with enforced license gate, server sync, and heartbeat verification",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "agents",
+    "commands",
+    "core",
+    "tools",
+    "scripts",
+    "MANIFEST.json",
+    "opencode.tera.example.json",
+    "WELCOME.md",
+    "README.md",
+    "LICENSE.md",
+    "RELEASES.md"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "tera-license": "node scripts/tera-license.mjs",
+    "tera-preflight": "node scripts/preflight.mjs",
+    "tera-sync": "node scripts/tera-sync.mjs",
+    "tera-heartbeat": "node scripts/tera-heartbeat.mjs",
+    "tera-bundle": "node scripts/build-bundle.mjs"
+  },
+  "keywords": [
+    "opencode",
+    "plugin",
+    "tera",
+    "governance",
+    "agents",
+    "commercial",
+    "license"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/build-bundle.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * @tera-system/pro — Signed Core Bundle Builder
+ * --------------------------------------------------------------
+ * Generates a signed bundle of all core content (agents, commands,
+ * tera-system, tools) that the remote server will host as a static
+ * artifact. The installer/sync module downloads it, verifies the
+ * Ed25519 signature, validates hashes, and applies files.
+ *
+ * Usage:
+ *   node scripts/build-bundle.mjs [--out artifacts/core-bundle.json]
+ *
+ * The private key is read from:
+ *   TERA_PRIVATE_KEY_PATH (env) or
+ *   ~/.tera/keys/production-private-key.pem
+ */
+import { createHash } from "node:crypto";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, "..");
+const ART = path.join(ROOT, "artifacts");
+
+const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8"));
+
+function walkFiles(dir, base = dir) {
+  const out = [];
+  if (!fs.existsSync(dir)) return out;
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) out.push(...walkFiles(full, base));
+    else if (e.isFile()) {
+      out.push({ abs: full, rel: path.relative(base, full).split(path.sep).join("/") });
+    }
+  }
+  return out;
+}
+
+function loadPrivateKey() {
+  const candidates = [
+    process.env.TERA_PRIVATE_KEY_PATH,
+    path.join(os.homedir(), ".tera", "keys", "production-private-key.pem"),
+    path.join(ROOT, "scripts", "lib", "dev-private-key.pem"),
+  ];
+  for (const c of candidates) {
+    if (c && fs.existsSync(c)) return fs.readFileSync(c, "utf8");
+  }
+  throw new Error("Private key not found. Set TERA_PRIVATE_KEY_PATH.");
+}
+
+const groups = [
+  { name: "agents", relDir: "agents" },
+  { name: "commands", relDir: "commands" },
+  { name: "tera-system", relDir: "core/tera-system" },
+  { name: "tools", relDir: "tools" },
+];
+
+// Collect all bundle files
+const files = [];
+for (const g of groups) {
+  const srcDir = path.join(ROOT, g.relDir);
+  for (const f of walkFiles(srcDir)) {
+    files.push({ path: `${g.name}/${f.rel}`, content: fs.readFileSync(f.abs, "utf8") });
+  }
+}
+
+// Build manifest of hashes
+const manifest = {};
+for (const f of files) {
+  manifest[f.path] = createHash("sha256").update(f.content).digest("hex");
+}
+
+// Canonical payload to sign: sorted manifest lines
+const canonical = Object.keys(manifest)
+  .sort()
+  .map((p) => `${p}:${manifest[p]}`)
+  .join("\n");
+const canonicalHash = createHash("sha256").update(canonical).digest("hex");
+
+const privateKey = loadPrivateKey();
+const signature = crypto.sign(null, Buffer.from(canonicalHash), privateKey).toString("base64url");
+
+const bundle = {
+  type: "tera-core-bundle",
+  schema: 1,
+  packageName: pkg.name,
+  packageVersion: pkg.version,
+  createdAt: new Date().toISOString(),
+  contentSha256: canonicalHash,
+  files: files.map((f) => ({ path: f.path, data: Buffer.from(f.content, "utf8").toString("base64url") })),
+  manifest,
+  signature,
+};
+
+const outPath = process.argv.includes("--out")
+  ? path.resolve(process.argv[process.argv.indexOf("--out") + 1])
+  : path.join(ART, `core-bundle-v${pkg.version}.signed.json`);
+
+fs.mkdirSync(path.dirname(outPath), { recursive: true });
+fs.writeFileSync(outPath, JSON.stringify(bundle, null, 2));
+
+// Also write a compact version (index + manifest only, files fetched separately)
+const compactPath = outPath.replace(/\.json$/, ".compact.json");
+fs.writeFileSync(
+  compactPath,
+  JSON.stringify({ ...bundle, files: undefined }, null, 0)
+);
+
+console.log(`✔ signed bundle (${files.length} files)`);
+console.log(`  contentSha256 : ${canonicalHash}`);
+console.log(`  signature     : ${signature.slice(0, 40)}...`);
+console.log(`  full          : ${outPath}`);
+console.log(`  compact       : ${compactPath}`);
+console.log(`  size(full)    : ${(fs.statSync(outPath).size / 1024).toFixed(1)} KB`);

package/scripts/build.mjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+/**
+ * @tera/core build script
+ * --------------------------------------------------------------
+ * Produces a repeatable, verifiable release artifact for the
+ * OpenCode addon. NON-DESTRUCTIVE: only (re)creates files under
+ * `artifacts/` and NEVER touches package source content.
+ *
+ * Steps:
+ *   1. Validate content counts against MANIFEST.json (self-check).
+ *   2. `npm pack` the current package -> artifacts/<name>-<version>.tgz
+ *   3. Compute per-content-group SHA256 + artifact SHA256.
+ *   4. Write artifacts/SHA256SUMS.txt (+ per-file group map).
+ *
+ * Usage:
+ *   node scripts/build.mjs            (default: version from package.json)
+ */
+import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, "..");
+const ART = path.join(ROOT, "artifacts");
+
+const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, "package.json"), "utf8"));
+const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, "MANIFEST.json"), "utf8"));
+
+const countFiles = (dir) =>
+  fs.existsSync(path.join(ROOT, dir))
+    ? (function walk(d) {
+        let n = 0;
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+          if (e.isDirectory()) n += walk(path.join(d, e.name));
+          else if (e.isFile()) n++;
+        }
+        return n;
+      })(path.join(ROOT, dir))
+    : 0;
+
+const groupSha = (dir) => {
+  if (!fs.existsSync(path.join(ROOT, dir))) return null;
+  const lines = [];
+  (function walk(d) {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      const full = path.join(d, e.name);
+      if (e.isDirectory()) walk(full);
+      else if (e.isFile()) {
+        const h = createHash("sha256").update(fs.readFileSync(full)).digest("hex");
+        lines.push(`${path.relative(ROOT, full).split(path.sep).join("/")}:${h}`);
+      }
+    }
+  })(path.join(ROOT, dir));
+  lines.sort();
+  return createHash("sha256").update(lines.join("\n")).digest("hex");
+};
+
+/* 1. self-check counts vs manifest */
+console.log("── self-check: content counts vs MANIFEST.json");
+const checks = [
+  ["agents", "agents"],
+  ["commands", "commands"],
+  ["core/tera-system", "coreFiles"],
+];
+let fail = false;
+for (const [dir, key] of checks) {
+  const n = countFiles(dir);
+  const expected = manifest.content[key];
+  const ok = n === expected;
+  console.log(`   ${dir.padEnd(16)} ${n} (manifest ${expected}) ${ok ? "OK" : "MISMATCH"}`);
+  if (!ok) fail = true;
+}
+if (fail) {
+  console.error("✖ Self-check failed — aborting build.");
+  process.exit(1);
+}
+
+/* 2. pack */
+console.log("── npm pack");
+fs.mkdirSync(ART, { recursive: true });
+const tarball = execSync(`npm pack ${JSON.stringify(ROOT)} --pack-destination ${JSON.stringify(ART)} --silent`, { cwd: ROOT, encoding: "utf8" }).trim();
+console.log(`   artifact: ${tarball}`);
+
+/* 3. hashes */
+const artPath = path.join(ART, tarball);
+const artHash = createHash("sha256").update(fs.readFileSync(artPath)).digest("hex");
+console.log(`   SHA256  : ${artHash}`);
+
+const groupHashes = {
+  agents: groupSha("agents"),
+  commands: groupSha("commands"),
+  "core/tera-system": groupSha("core/tera-system"),
+  tools: groupSha("tools"),
+  "core/project-control": groupSha("core/project-control"),
+};
+console.log("   group hashes:");
+for (const [g, h] of Object.entries(groupHashes)) console.log(`     ${g.padEnd(20)} ${h ?? "(n/a)"}`);
+
+/* 4. write SHA256SUMS + group map + sync MANIFEST.json (single source of truth) */
+fs.writeFileSync(path.join(ART, "SHA256SUMS.txt"), `${artHash}  ${tarball}\n`);
+fs.writeFileSync(path.join(ART, "GROUPS.json"), JSON.stringify({ version: pkg.version, builtAt: new Date().toISOString(), sha256: groupHashes }, null, 2));
+manifest.sha256 = groupHashes;
+manifest.version = pkg.version;
+manifest.builtAt = new Date().toISOString().slice(0, 10);
+fs.writeFileSync(path.join(ROOT, "MANIFEST.json"), JSON.stringify(manifest, null, 2) + "\n");
+console.log("   wrote SHA256SUMS.txt + GROUPS.json + synced MANIFEST.json");
+
+console.log("\n✔ build complete — artifact ready in artifacts/");

package/scripts/dev/mock-server.mjs

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+/**
+ * @tera-system/pro — Mock License & Bundle Server (dev/testing)
+ * --------------------------------------------------------------
+ * Simulates the teranoo.com backend locally so the whole sync +
+ * license flow can be verified WITHOUT the real website.
+ *
+ * Endpoints:
+ *   GET  /api/tera-system/bundle        → signed core bundle (JSON)
+ *   GET  /api/tera-system/health        → simple health check
+ *   POST /api/license/verify            → validate license key
+ *   POST /api/license/heartbeat         → heartbeat (ok if key valid)
+ *   POST /api/license/activate          → activate a key
+ *
+ * Usage:
+ *   node scripts/dev/mock-server.mjs [--port 3200] [--bundle path]
+ *
+ * Env:
+ *   TERA_MOCK_BUNDLE  — path to signed bundle JSON
+ *   TERA_MOCK_PORT    — port (default 3200)
+ */
+import fs from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseLicenseKey } from "../lib/license.mjs";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, "..", "..");
+
+const args = process.argv.slice(2);
+function argVal(name, def) {
+  const i = args.indexOf(name);
+  return i >= 0 && args[i + 1] ? args[i + 1] : def;
+}
+
+const PORT = Number(process.env.TERA_MOCK_PORT || argVal("--port", "3200"));
+const BUNDLE_PATH = path.resolve(
+  process.env.TERA_MOCK_BUNDLE || argVal("--bundle", "") || path.join(ROOT, "artifacts", "core-bundle-v0.1.0.signed.json")
+);
+
+// In-memory license store for mock
+const licenses = new Map();
+
+function licenseFromKey(key) {
+  const parsed = parseLicenseKey(key);
+  if (!parsed.ok) return { valid: false, reason: parsed.reason };
+  const t = parsed.payload;
+  const expires = new Date(t.expiresAt).getTime();
+  const now = Date.now();
+  if (now > expires) return { valid: false, reason: "expired", expiresAt: t.expiresAt };
+  return { valid: true, tier: t.tier, project: t.project, expiresAt: t.expiresAt, seats: t.seats };
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url, `http://localhost:${PORT}`);
+  const body = await new Promise((resolve) => {
+    let data = "";
+    req.on("data", (c) => (data += c));
+    req.on("end", () => resolve(data));
+  });
+  let json = {};
+  try {
+    json = body ? JSON.parse(body) : {};
+  } catch {}
+
+  const send = (code, obj) => {
+    res.writeHead(code, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(obj));
+  };
+
+  // ---- GET /api/tera-system/health ----
+  if (url.pathname === "/api/tera-system/health" || url.pathname === "/health") {
+    return send(200, { ok: true, service: "tera-mock", time: new Date().toISOString() });
+  }
+
+  // ---- GET /api/tera-system/bundle ----
+  if (url.pathname === "/api/tera-system/bundle" && req.method === "GET") {
+    if (!fs.existsSync(BUNDLE_PATH)) {
+      return send(404, { ok: false, error: `bundle not found: ${BUNDLE_PATH}` });
+    }
+    const bundle = JSON.parse(fs.readFileSync(BUNDLE_PATH, "utf8"));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(bundle));
+    return;
+  }
+
+  // ---- POST /api/license/verify ----
+  if (url.pathname === "/api/license/verify" && req.method === "POST") {
+    const result = licenseFromKey(json.licenseKey);
+    if (!result.valid) return send(200, { valid: false, state: "Invalid", reason: result.reason });
+    return send(200, { valid: true, state: "Active", ...result, reason: "active" });
+  }
+
+  // ---- POST /api/license/heartbeat ----
+  if (url.pathname === "/api/license/heartbeat" && req.method === "POST") {
+    const result = licenseFromKey(json.licenseKey);
+    if (!result.valid) return send(200, { valid: false, reason: result.reason, ok: false });
+    return send(200, { valid: true, ok: true, expiresAt: result.expiresAt, tier: result.tier });
+  }
+
+  // ---- POST /api/license/activate ----
+  if (url.pathname === "/api/license/activate" && req.method === "POST") {
+    const result = licenseFromKey(json.licenseKey);
+    if (!result.valid) return send(400, { ok: false, error: result.reason });
+    licenses.set(json.licenseKey, { activatedAt: new Date().toISOString(), ...result });
+    return send(200, { ok: true, state: "Active", ...result });
+  }
+
+  return send(404, { ok: false, error: `unknown endpoint: ${url.pathname}` });
+});
+
+server.listen(PORT, () => {
+  console.log(`\n✔ Mock server running on http://localhost:${PORT}`);
+  console.log(`  bundle : ${BUNDLE_PATH}`);
+  console.log(`  exists : ${fs.existsSync(BUNDLE_PATH)}`);
+  console.log(`  endpoints:`);
+  console.log(`    GET  /api/tera-system/bundle`);
+  console.log(`    GET  /api/tera-system/health`);
+  console.log(`    POST /api/license/verify`);
+  console.log(`    POST /api/license/heartbeat`);
+  console.log(`    POST /api/license/activate\n`);
+});