@tera-system/pro 0.1.2 → 0.1.4

package/MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Build manifest for the Tera System Pro commercial plugin component.",
   "compatibleEnvironments": [
     "opencode"
@@ -13,7 +13,7 @@
     "tools": 7,
     "projectControlTemplates": 1
   },
-  "builtAt": "2026-08-26",
+  "builtAt": "2026-08-27",
   "sha256": {
     "agents": "ef634a3bd0a1fb3739b59b74b1e58c150a6beed73c48ce48ac12416b15b6a6a6",
     "commands": "f8c91dab42e41d1f8362edfd816964ceabdbd95e8ebdd02e83ea36f7f805a259",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.1.2",
-  "description": "Tera System Pro — commercial edition with enforced license gate, server sync, and heartbeat verification",
+  "version": "0.1.4",
+  "description": "Tera System Pro ط£آ¢أ¢â€ڑآ¬أ¢â‚¬â€Œ commercial edition with enforced license gate, server sync, and heartbeat verification",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "engines": {

package/scripts/install.js

@@ -21,6 +21,7 @@
  */
 import { createHash } from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { assessLicenseState, readLicenseState, writeLicenseState } from "./lib/license.mjs";
@@ -32,6 +33,12 @@ const PKG_ROOT = path.resolve(__dirname, "..");
 const MANIFEST_NAME = "tera-core.manifest.json";
 const CONFIG_EXAMPLE = "opencode.tera.example.json";
 
+/** Generate a stable device id from hostname + target path. */
+function createDeviceId(target) {
+  const seed = `${os.hostname()}::${target}`;
+  return createHash("sha256").update(seed).digest("hex").slice(0, 16);
+}
+
 /* ---------------------------------- helpers ---------------------------------- */
 
 const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
@@ -243,10 +250,12 @@ const LICENSE_TIMEOUT_MS = 5000; // 5 seconds max for API call
 
 /**
  * Verify license via remote API (online).
+ * Requires BOTH licenseKey and accountEmail (the API validates both).
  * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "api" }
  */
-async function verifyViaAPI(licenseKey) {
+async function verifyViaAPI(licenseKey, accountEmail) {
   if (!licenseKey) return { ok: false, state: "Unlicensed", reason: "no-key", source: "api" };
+  if (!accountEmail) return { ok: false, state: "Unknown", reason: "no-account-email", source: "api-fallback" };
 
   try {
     const controller = new AbortController();
@@ -255,19 +264,23 @@ async function verifyViaAPI(licenseKey) {
     const res = await fetch(`${LICENSE_API_URL}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
 
     if (!res.ok) {
-      return { ok: false, state: "Invalid", reason: `api-http-${res.status}`, source: "api" };
+      // Server responded with an error status (e.g. 404 while the endpoint is
+      // not implemented yet, or 5xx). This is NOT a definitive license verdict —
+      // treat it as "API unavailable" so the offline Ed25519 fallback runs.
+      return { ok: false, state: "Unknown", reason: `api-http-${res.status}`, source: "api-fallback" };
     }
 
     const data = await res.json();
     return {
       ok: data.valid === true,
-      state: data.state || "Invalid",
+      // The API does not return a `state` field — derive it from `valid` + `reason`.
+      state: data.valid === true ? "Active" : data.state || "Invalid",
       reason: data.reason || "api-response",
       expiresAt: data.expiresAt || null,
       source: "api",
@@ -278,6 +291,29 @@ async function verifyViaAPI(licenseKey) {
   }
 }
 
+/**
+ * Try to ACTIVATE the license on this device (best-effort, never breaks install).
+ * Requires licenseKey + accountEmail + deviceId.
+ */
+async function activateViaAPI(licenseKey, accountEmail, deviceId) {
+  if (!licenseKey || !accountEmail || !deviceId) return null;
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), LICENSE_TIMEOUT_MS);
+    const res = await fetch(`${LICENSE_API_URL}/activate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ licenseKey, accountEmail, deviceId }),
+      signal: controller.signal,
+    });
+    clearTimeout(timeout);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Verify license offline (Ed25519 signature check).
  * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "offline" }
@@ -295,16 +331,16 @@ function verifyOffline(licenseKey) {
 }
 
 /**
- * Combined verification: API-first, offline fallback.
+ * Combined verification: API-first (with email), offline fallback.
  * Always returns a result — never throws.
  */
-async function verifyLicense(licenseKey) {
+async function verifyLicense(licenseKey, accountEmail) {
   // Step 1: Try API (unless explicitly disabled)
   if (process.env.TERA_OFFLINE_ONLY === "1") {
     return verifyOffline(licenseKey);
   }
 
-  const apiResult = await verifyViaAPI(licenseKey);
+  const apiResult = await verifyViaAPI(licenseKey, accountEmail);
 
   // If API succeeded and gave a definitive answer, use it
   if (apiResult.source === "api" && apiResult.ok !== undefined) {
@@ -376,17 +412,32 @@ async function tryServerSync() {
       console.log(`  [integrity] skipped (${err.message}) — install continues`);
     }
 
-    // Step 3: license verification (API-first, offline fallback)
+    // Step 3: license verification (API-first with email, offline fallback)
     const stateFile = path.join(target, ".tera", "license.state.json");
-    let licenseKey = (readLicenseState(stateFile) || {}).licenseKey;
+    const prevState = readLicenseState(stateFile) || {};
+    let licenseKey = prevState.licenseKey;
     if (!licenseKey) licenseKey = process.env.TERA_LICENSE_KEY || undefined;
+    let accountEmail = prevState.accountEmail;
+    if (!accountEmail) accountEmail = process.env.TERA_LICENSE_EMAIL || undefined;
+    const deviceId = prevState.deviceId || createDeviceId(target);
+
+    // 3a. best-effort activation (only when we have key + email and not activated yet)
+    if (licenseKey && accountEmail && !prevState.activated) {
+      const act = await activateViaAPI(licenseKey, accountEmail, deviceId);
+      if (act && act.ok === true) {
+        console.log(`  [license ] ✔ activated on this device (${act.tier} / ${act.project})`);
+      }
+    }
 
-    const result = await verifyLicense(licenseKey);
+    const result = await verifyLicense(licenseKey, accountEmail);
 
     writeLicenseState(stateFile, {
       state: result.state,
       reason: result.reason,
       licenseKey: licenseKey || null,
+      accountEmail: accountEmail || null,
+      deviceId,
+      activated: true,
       expiresAt: result.expiresAt || null,
       graceUntil: result.graceUntil || null,
       source: result.source,

package/scripts/lib/license-gate.mjs

@@ -22,15 +22,15 @@ const RECHECK_INTERVAL_MS = RECHECK_INTERVAL_DAYS * 86400000;
  * Try to verify license via API (online check).
  * Returns null if API unreachable.
  */
-async function verifyViaAPI(licenseKey, apiUrl) {
-  if (!licenseKey || !apiUrl) return null;
+async function verifyViaAPI(licenseKey, accountEmail, apiUrl) {
+  if (!licenseKey || !accountEmail || !apiUrl) return null;
   try {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 5000);
     const res = await fetch(`${apiUrl}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -200,7 +200,7 @@ export async function enforceLicenseGate(target, options = {}) {
   const recheck = checkRecheckDue(lic);
   if (recheck.due && !offlineOnly) {
     // Try API re-verification
-    const apiResult = await verifyViaAPI(lic.licenseKey, apiUrl);
+    const apiResult = await verifyViaAPI(lic.licenseKey, lic.accountEmail, apiUrl);
     if (apiResult && apiResult.valid === false) {
       return {
         allow: false,

package/scripts/tera-heartbeat.mjs

@@ -32,15 +32,15 @@ function resolveTarget() {
   return path.resolve(process.env.TERA_TARGET_DIR || process.env.INIT_CWD || process.cwd());
 }
 
-async function serverVerify(licenseKey) {
-  if (!licenseKey) return null;
+async function serverVerify(licenseKey, accountEmail) {
+  if (!licenseKey || !accountEmail) return null;
   try {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 8000);
     const res = await fetch(`${API_URL}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -81,7 +81,7 @@ const heartbeatFile = path.join(target, ".tera", "heartbeat.state.json");
   }
 
   console.log(`heartbeat due (last ${hb.lastHeartbeat || "never"}) — contacting server...`);
-  const server = await serverVerify(license.licenseKey);
+  const server = await serverVerify(license.licenseKey, license.accountEmail);
 
   if (!server) {
     console.log(`⚠ server unreachable — keeping current license state (will retry in ${HEARTBEAT_DAYS}d)`);