@tera-system/pro 0.1.3 → 0.2.0

package/MANIFEST.json

@@ -1,11 +1,12 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.1.3",
-  "description": "Build manifest for the Tera System Pro commercial plugin component.",
+  "version": "0.2.0",
+  "description": "Build manifest for the Tera System Pro commercial plugin component (THIN mode — content served from teranoo.com signed bundle).",
   "compatibleEnvironments": [
     "opencode"
   ],
   "minOpencodeVersion": "1.18.16",
+  "mode": "thin",
   "content": {
     "agents": 20,
     "commands": 11,
@@ -13,7 +14,8 @@
     "tools": 7,
     "projectControlTemplates": 1
   },
-  "builtAt": "2026-08-26",
+  "bundleRef": "core-bundle-v0.1.4.signed.json (SHA256 4C87BAB833AEC0ACE184A790819B51D58427C51F29124CE2B02DA3AAE98C3F13)",
+  "builtAt": "2026-08-27",
   "sha256": {
     "agents": "ef634a3bd0a1fb3739b59b74b1e58c150a6beed73c48ce48ac12416b15b6a6a6",
     "commands": "f8c91dab42e41d1f8362edfd816964ceabdbd95e8ebdd02e83ea36f7f805a259",

package/package.json

@@ -1,18 +1,15 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.1.3",
-  "description": "Tera System Pro أ¢â‚¬â€‌ commercial edition with enforced license gate, server sync, and heartbeat verification",
+  "version": "0.2.0",
+  "description": "Tera System Pro — commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "engines": {
     "node": ">=18"
   },
   "files": [
-    "agents",
-    "commands",
-    "core",
-    "tools",
     "scripts",
+    "core/project-control",
     "MANIFEST.json",
     "opencode.tera.example.json",
     "WELCOME.md",

package/scripts/build.mjs

@@ -57,8 +57,9 @@ const groupSha = (dir) => {
   return createHash("sha256").update(lines.join("\n")).digest("hex");
 };
 
-/* 1. self-check counts vs manifest */
+/* 1. self-check counts vs manifest (thin mode: content dirs absent is OK) */
 console.log("── self-check: content counts vs MANIFEST.json");
+const thinMode = manifest.mode === "thin";
 const checks = [
   ["agents", "agents"],
   ["commands", "commands"],
@@ -68,8 +69,8 @@ let fail = false;
 for (const [dir, key] of checks) {
   const n = countFiles(dir);
   const expected = manifest.content[key];
-  const ok = n === expected;
-  console.log(`   ${dir.padEnd(16)} ${n} (manifest ${expected}) ${ok ? "OK" : "MISMATCH"}`);
+  const ok = n === expected || (thinMode && n === 0);
+  console.log(`   ${dir.padEnd(16)} ${n} (manifest ${expected}) ${ok ? "OK" : "MISMATCH"}${thinMode && n === 0 ? " [thin — served via bundle]" : ""}`);
   if (!ok) fail = true;
 }
 if (fail) {

package/scripts/install.js

@@ -21,6 +21,7 @@
  */
 import { createHash } from "node:crypto";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { assessLicenseState, readLicenseState, writeLicenseState } from "./lib/license.mjs";
@@ -32,6 +33,12 @@ const PKG_ROOT = path.resolve(__dirname, "..");
 const MANIFEST_NAME = "tera-core.manifest.json";
 const CONFIG_EXAMPLE = "opencode.tera.example.json";
 
+/** Generate a stable device id from hostname + target path. */
+function createDeviceId(target) {
+  const seed = `${os.hostname()}::${target}`;
+  return createHash("sha256").update(seed).digest("hex").slice(0, 16);
+}
+
 /* ---------------------------------- helpers ---------------------------------- */
 
 const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
@@ -243,10 +250,12 @@ const LICENSE_TIMEOUT_MS = 5000; // 5 seconds max for API call
 
 /**
  * Verify license via remote API (online).
+ * Requires BOTH licenseKey and accountEmail (the API validates both).
  * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "api" }
  */
-async function verifyViaAPI(licenseKey) {
+async function verifyViaAPI(licenseKey, accountEmail) {
   if (!licenseKey) return { ok: false, state: "Unlicensed", reason: "no-key", source: "api" };
+  if (!accountEmail) return { ok: false, state: "Unknown", reason: "no-account-email", source: "api-fallback" };
 
   try {
     const controller = new AbortController();
@@ -255,7 +264,7 @@ async function verifyViaAPI(licenseKey) {
     const res = await fetch(`${LICENSE_API_URL}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -270,7 +279,8 @@ async function verifyViaAPI(licenseKey) {
     const data = await res.json();
     return {
       ok: data.valid === true,
-      state: data.state || "Invalid",
+      // The API does not return a `state` field — derive it from `valid` + `reason`.
+      state: data.valid === true ? "Active" : data.state || "Invalid",
       reason: data.reason || "api-response",
       expiresAt: data.expiresAt || null,
       source: "api",
@@ -281,6 +291,29 @@ async function verifyViaAPI(licenseKey) {
   }
 }
 
+/**
+ * Try to ACTIVATE the license on this device (best-effort, never breaks install).
+ * Requires licenseKey + accountEmail + deviceId.
+ */
+async function activateViaAPI(licenseKey, accountEmail, deviceId) {
+  if (!licenseKey || !accountEmail || !deviceId) return null;
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), LICENSE_TIMEOUT_MS);
+    const res = await fetch(`${LICENSE_API_URL}/activate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ licenseKey, accountEmail, deviceId }),
+      signal: controller.signal,
+    });
+    clearTimeout(timeout);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Verify license offline (Ed25519 signature check).
  * Returns: { ok: boolean, state: string, reason: string, expiresAt?: string, source: "offline" }
@@ -298,16 +331,16 @@ function verifyOffline(licenseKey) {
 }
 
 /**
- * Combined verification: API-first, offline fallback.
+ * Combined verification: API-first (with email), offline fallback.
  * Always returns a result — never throws.
  */
-async function verifyLicense(licenseKey) {
+async function verifyLicense(licenseKey, accountEmail) {
   // Step 1: Try API (unless explicitly disabled)
   if (process.env.TERA_OFFLINE_ONLY === "1") {
     return verifyOffline(licenseKey);
   }
 
-  const apiResult = await verifyViaAPI(licenseKey);
+  const apiResult = await verifyViaAPI(licenseKey, accountEmail);
 
   // If API succeeded and gave a definitive answer, use it
   if (apiResult.source === "api" && apiResult.ok !== undefined) {
@@ -337,7 +370,7 @@ const SYNC_URL = process.env.TERA_SYNC_URL || "https://teranoo.com/api/tera-syst
 /**
  * Attempt server sync (best-effort, never breaks install).
  * Downloads the signed bundle, verifies signature + hashes, and applies.
- * If unreachable/rejected → bundled content remains (thick mode).
+ * In THIN mode this is the only source of system files (required).
  */
 async function tryServerSync() {
   try {
@@ -346,20 +379,20 @@ async function tryServerSync() {
     const res = await fetch(SYNC_URL, { signal: controller.signal });
     clearTimeout(timeout);
     if (!res.ok) {
-      console.log(`  [sync    ] server HTTP ${res.status} — using bundled content`);
+      console.log(`  [sync    ] server HTTP ${res.status} — no files applied`);
       return false;
     }
     const bundle = await res.json();
     const v = verifyBundle(bundle);
     if (!v.ok) {
-      console.log(`  [sync    ] bundle rejected (${v.reason}) — using bundled content`);
+      console.log(`  [sync    ] bundle rejected (${v.reason}) — no files applied`);
       return false;
     }
     const r = applyBundle(bundle, target);
     console.log(`  [sync    ] server bundle applied — ${r.applied} files (signed & verified)`);
     return true;
   } catch {
-    console.log(`  [sync    ] server unreachable — using bundled content`);
+    console.log(`  [sync    ] server unreachable — no files applied`);
     return false;
   }
 }
@@ -367,8 +400,28 @@ async function tryServerSync() {
 // Run: sync → integrity manifest → license check (async wrapper, non-blocking)
 (async () => {
   try {
-    // Step 1: best-effort server sync (self-healing / fresh content)
-    await tryServerSync();
+    // Thin-mode detection: no bundled content → the server bundle is REQUIRED.
+    const thinMode = !fs.existsSync(path.join(PKG_ROOT, "agents"));
+
+    // Step 1: server sync (REQUIRED in thin mode; self-healing in thick mode)
+    const synced = await tryServerSync();
+    if (thinMode && !synced) {
+      // No local content and server unreachable → system cannot operate yet.
+      // Background retry per design: install completes, sync pending.
+      fs.mkdirSync(path.join(target, ".tera"), { recursive: true });
+      fs.writeFileSync(
+        path.join(target, ".tera", "sync.state.json"),
+        JSON.stringify({
+          status: "pending",
+          thinMode: true,
+          lastError: "server-unreachable-at-install",
+          lastAttempt: new Date().toISOString(),
+        }, null, 2)
+      );
+      console.log("  ⚠ [sync    ] THIN MODE — server unreachable at install.");
+      console.log("              No system files were installed. Run later:");
+      console.log("              npm run tera-sync   (or re-run install when online)");
+    }
 
     // Step 2: integrity manifest (after sync, covers server files too)
     try {
@@ -379,17 +432,32 @@ async function tryServerSync() {
       console.log(`  [integrity] skipped (${err.message}) — install continues`);
     }
 
-    // Step 3: license verification (API-first, offline fallback)
+    // Step 3: license verification (API-first with email, offline fallback)
     const stateFile = path.join(target, ".tera", "license.state.json");
-    let licenseKey = (readLicenseState(stateFile) || {}).licenseKey;
+    const prevState = readLicenseState(stateFile) || {};
+    let licenseKey = prevState.licenseKey;
     if (!licenseKey) licenseKey = process.env.TERA_LICENSE_KEY || undefined;
+    let accountEmail = prevState.accountEmail;
+    if (!accountEmail) accountEmail = process.env.TERA_LICENSE_EMAIL || undefined;
+    const deviceId = prevState.deviceId || createDeviceId(target);
+
+    // 3a. best-effort activation (only when we have key + email and not activated yet)
+    if (licenseKey && accountEmail && !prevState.activated) {
+      const act = await activateViaAPI(licenseKey, accountEmail, deviceId);
+      if (act && act.ok === true) {
+        console.log(`  [license ] ✔ activated on this device (${act.tier} / ${act.project})`);
+      }
+    }
 
-    const result = await verifyLicense(licenseKey);
+    const result = await verifyLicense(licenseKey, accountEmail);
 
     writeLicenseState(stateFile, {
       state: result.state,
       reason: result.reason,
       licenseKey: licenseKey || null,
+      accountEmail: accountEmail || null,
+      deviceId,
+      activated: true,
       expiresAt: result.expiresAt || null,
       graceUntil: result.graceUntil || null,
       source: result.source,

package/scripts/lib/license-gate.mjs

@@ -22,15 +22,15 @@ const RECHECK_INTERVAL_MS = RECHECK_INTERVAL_DAYS * 86400000;
  * Try to verify license via API (online check).
  * Returns null if API unreachable.
  */
-async function verifyViaAPI(licenseKey, apiUrl) {
-  if (!licenseKey || !apiUrl) return null;
+async function verifyViaAPI(licenseKey, accountEmail, apiUrl) {
+  if (!licenseKey || !accountEmail || !apiUrl) return null;
   try {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 5000);
     const res = await fetch(`${apiUrl}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -200,7 +200,7 @@ export async function enforceLicenseGate(target, options = {}) {
   const recheck = checkRecheckDue(lic);
   if (recheck.due && !offlineOnly) {
     // Try API re-verification
-    const apiResult = await verifyViaAPI(lic.licenseKey, apiUrl);
+    const apiResult = await verifyViaAPI(lic.licenseKey, lic.accountEmail, apiUrl);
     if (apiResult && apiResult.valid === false) {
       return {
         allow: false,

package/scripts/tera-heartbeat.mjs

@@ -32,15 +32,15 @@ function resolveTarget() {
   return path.resolve(process.env.TERA_TARGET_DIR || process.env.INIT_CWD || process.cwd());
 }
 
-async function serverVerify(licenseKey) {
-  if (!licenseKey) return null;
+async function serverVerify(licenseKey, accountEmail) {
+  if (!licenseKey || !accountEmail) return null;
   try {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 8000);
     const res = await fetch(`${API_URL}/verify`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey }),
+      body: JSON.stringify({ licenseKey, accountEmail }),
       signal: controller.signal,
     });
     clearTimeout(timeout);
@@ -81,7 +81,7 @@ const heartbeatFile = path.join(target, ".tera", "heartbeat.state.json");
   }
 
   console.log(`heartbeat due (last ${hb.lastHeartbeat || "never"}) — contacting server...`);
-  const server = await serverVerify(license.licenseKey);
+  const server = await serverVerify(license.licenseKey, license.accountEmail);
 
   if (!server) {
     console.log(`⚠ server unreachable — keeping current license state (will retry in ${HEARTBEAT_DAYS}d)`);