@tera-system/pro 0.2.12 → 0.2.14

package/MANIFEST.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Build manifest for the Tera System Pro commercial plugin component (THIN mode — content served from teranoo.com signed bundle).",
   "compatibleEnvironments": [
     "opencode"
@@ -15,13 +15,13 @@
     "projectControlTemplates": 1,
     "assets": 49
   },
-  "bundleRef": "core-bundle-v0.2.11.signed.json (SHA256 B05E0A99811958BE44DFB162812366723D3080145122A3C3E0C345E37E2E51B2)",
-  "builtAt": "2026-08-28",
+  "bundleRef": "core-bundle-v0.2.14.signed.json (SHA256 CF02CA7939BE55DC73B71212B53F73D6CF4CB434C4F580613BFFF3448CBA23E9)",
+  "builtAt": "2026-08-30",
   "sha256": {
-    "agents": "9769b3acc15e44e8ae56e4d585f7b965f6c30eafceea509edd0dfe3ce1d83270",
-    "commands": "f8c91dab42e41d1f8362edfd816964ceabdbd95e8ebdd02e83ea36f7f805a259",
-    "core/tera-system": "f1436c0eafdebde6177d3fd9e7ccdcabd28430daaff188ae61d7ae3d30f229d1",
-    "tools": "1f96a2de662c50c5c0a4c62d27ec583671c690163a0b35add036bfdd2b3a1f1a",
+    "agents": "259904c525641511d80751a66926ca92d45eddea66adbaea2147c78807223adf",
+    "commands": "c541b6664c067fac5fb85d280448159b9854cf203ecb4112153a621edb94aa90",
+    "core/tera-system": "68a2b5536a4b76a367ecfe0cad2fbd07b17d54d9c3deee0b2ea339a9749c54e3",
+    "tools": "86ec41d886f42ae0faf0ee341abf73ab6abd29380c59246dedc47bcdbb1e7358",
     "core/project-control": "cb979181d50e54c9b9b9173ffc890ca021bfaefe9678b1cad4a2f67ceac3dfdd"
   }
 }

package/README.md

@@ -38,8 +38,8 @@ node scripts/install.js --target /path/to/workspace
 ط¨ط¹ط¯ ط§ظ„طھط«ط¨ظٹطھطŒ ظپط¹ظ‘ظ„ ط§ظ„ظ…ظپطھط§ط­:
 
 ```bash
-TERA_LICENSE_KEY=your-key npm run tera-license  # ط£ظˆ
-npm run tera-sync
+TERA_LICENSE_KEY=your-key npx tera-license  # ط£ظˆ
+npx tera-sync
 ```
 
 ط§ظ„طھط­ظ‚ظ‚ ظٹط¹ظ…ظ„ ط¹ط¨ط±: API ط§ظ„ط³ظٹط±ظپط± → fallback ط£ظˆظپظ„ط§ظٹظ† (Ed25519) → ظ†ط¨ط¶ ظ‚ظ„ط¨ ظƒظ„ 3 ط£ظٹط§ظ….

package/RELEASES.md

@@ -4,8 +4,37 @@
 
 ---
 
+## 0.2.14 (2026-08-30)
 
+### Buyable tool access: bin entries + npx commands + sync integrity fix (SCP-2026-08-30-004)
 
+**What changed:**
+- **package.json `bin` entries added** — `tera-license`, `tera-sync`, `tera-heartbeat`, `tera-preflight` are now real commands. Buyers run `npx tera-sync`, `npx tera-preflight`, `npx tera-license activate <key>` from their workspace root. Previously `npx` failed (E404 — not a bin) and `npm run` failed ("Missing script" — scripts live in the package, not the project root).
+- **tera-sync.mjs: integrity refresh after apply** — after applying the bundle, the integrity manifest is recreated. Previously a sync that changed bundle content left the install-time snapshot stale → preflight reported "modified files" → license gate BLOCKED. This would have broken existing buyers after a bundle update.
+- **license-gate.mjs runtime message** — activation instruction now `npx tera-license activate <key>` (was `npm run tera-license -- activate <key>`, which fails from the buyer's project root).
+- **TERA_LICENSE_GUARD.md** — same `npx` instruction in the Unlicensed block + preflight verification via `npx tera-preflight`.
+- **README.md** — activation commands use `npx`.
+
+**Why:**
+- First real buyer trial proved neither `npx` (E404) nor `npm run` (Missing script) reached the package tools — the entry door to the system was broken for every buyer.
+- Bundle content changed (guard text) — this release ships the updated signed bundle `core-bundle-v0.2.14.signed.json` (200 files, contentSha256 cf165c6cb0bc1af0b55c968ae0c493a415ca52a92712b731dc61a5f2a324dfa2) to the server.
+
+**Deployment order (corrected):** publish npm `0.2.14` FIRST, then update the server bundle. npm-first ensures existing buyers already have the integrity-refresh fix in tera-sync before the bundle content changes; server-first would cause a temporary "modified files" scare for existing buyers running sync with old scripts.
+
+
+
+
+
+## 0.2.13 (2026-08-30)
+
+### Revocation speed: periodic recheck 30d -> 3d (SCP-2026-08-30-002)
+
+**What changed (scripts only):**
+- license-gate.mjs: RECHECK_INTERVAL_DAYS 30 -> 3 - an active client now contacts the license server at least every 3 days, so a server-side revocation is detected within <=3 days of usage (instead of up to 30).
+
+**Why:**
+- Revocation of Saeed was live on the server, but the 30-day recheck interval meant an active client would not notice for up to 30 days. 3 days balances detection speed with server load.
+- Offline at recheck -> allowed (grace), no false blocking.
 
 ## 0.2.12 (2026-08-30)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tera-system/pro",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Tera System Pro — commercial edition (thin): system files are fetched from teranoo.com as a signed bundle; enforced license gate + heartbeat",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
@@ -19,7 +19,11 @@
   ],
   "bin": {
     "tera-restore": "scripts/install.js",
-    "tera-pro-restore": "scripts/install.js"
+    "tera-pro-restore": "scripts/install.js",
+    "tera-license": "scripts/tera-license.mjs",
+    "tera-sync": "scripts/tera-sync.mjs",
+    "tera-heartbeat": "scripts/tera-heartbeat.mjs",
+    "tera-preflight": "scripts/preflight.mjs"
   },
   "scripts": {
     "postinstall": "node scripts/install.js",

package/scripts/lib/license-gate.mjs

@@ -15,7 +15,7 @@ export const GATE_RESULTS = {
   DENY_NEEDS_RECHECK: "deny-needs-recheck",
 };
 
-const RECHECK_INTERVAL_DAYS = 30;
+const RECHECK_INTERVAL_DAYS = 3; // SCP-2026-08-30-002: revocation detection within <=3 days (was 30)
 const RECHECK_INTERVAL_MS = RECHECK_INTERVAL_DAYS * 86400000;
 
 /**
@@ -125,7 +125,7 @@ export async function enforceLicenseGate(target, options = {}) {
         "❌ Tera System License Required.\n" +
         "Current state: Unlicensed (trial mode).\n\n" +
         "Visit https://teranoo.com/pricing to obtain a license key.\n" +
-        "Then run: npm run tera-license -- activate <key>",
+        "Then run: npx tera-license activate <key>",
     };
   }
 

package/scripts/tera-sync.mjs

@@ -16,6 +16,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { verifyBundle, applyBundle } from "./lib/bundle.mjs";
+import { createIntegrityManifest, saveIntegrityManifest } from "./lib/integrity.mjs";
 
 const DEFAULT_URL = "https://teranoo.com/api/tera-system/bundle";
 
@@ -108,6 +109,17 @@ const syncStateFile = path.join(target, ".tera", "sync.state.json");
     syncedAt: new Date().toISOString(),
   }, null, 2));
 
+  // Refresh the integrity manifest AFTER applying files (SCP-2026-08-30-004).
+  // Without this, a sync that changes bundle content would leave the install-time
+  // snapshot stale and preflight would report "modified" → license gate BLOCKS.
+  try {
+    const integrityManifest = createIntegrityManifest(target);
+    saveIntegrityManifest(target, integrityManifest);
+    console.log(`✔ Integrity updated  : ${integrityManifest.fileCount} files tracked`);
+  } catch (err) {
+    console.log(`⚠ Integrity update failed: ${err.message} — run install again if preflight blocks`);
+  }
+
   console.log(`✔ Sync state       : .tera/sync.state.json`);
   console.log("\n✔ sync complete");
 })().catch((err) => {