From a619c4e44eaf5b2721ea8195d8bb9f79427ed3e3 Mon Sep 17 00:00:00 2001 From: Michael McRae Date: Sun, 7 Jun 2026 21:00:35 +1000 Subject: [PATCH 01/13] chore(release): bump version to 3.0.1 and prime CHANGELOG --- package-lock.json | 10 +++++----- package.json | 2 +- packages/library/package.json | 2 +- packages/tempo/CHANGELOG.md | 6 ++++++ packages/tempo/package.json | 4 ++-- packages/tempo/src/tempo.class.ts | 14 -------------- 6 files changed, 15 insertions(+), 23 deletions(-) diff --git a/package-lock.json b/package-lock.json index ef001ee1..a6419e7b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "tempo-monorepo", - "version": "3.0.0", + "version": "3.0.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "tempo-monorepo", - "version": "3.0.0", + "version": "3.0.1", "workspaces": [ "packages/*" ], @@ -6818,7 +6818,7 @@ }, "packages/library": { "name": "@magmacomputing/library", - "version": "3.0.0", + "version": "3.0.1", "license": "MIT", "dependencies": { "tslib": "^2.8.1" @@ -6829,14 +6829,14 @@ }, "packages/tempo": { "name": "@magmacomputing/tempo", - "version": "3.0.0", + "version": "3.0.1", "license": "MIT", "dependencies": { "tslib": "^2.8.1" }, "devDependencies": { "@js-temporal/polyfill": "^0.5.1", - "@magmacomputing/library": "3.0.0", + "@magmacomputing/library": "3.0.1", "@rollup/plugin-alias": "^6.0.0", "javascript-obfuscator": "^5.4.3", "magic-string": "^0.30.21", diff --git a/package.json b/package.json index ca91a359..046ac376 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "tempo-monorepo", - "version": "3.0.0", + "version": "3.0.1", "private": true, "description": "Magma Computing Monorepo", "repository": { diff --git a/packages/library/package.json b/packages/library/package.json index 788bdde5..17ddf61d 100644 --- a/packages/library/package.json +++ b/packages/library/package.json @@ -1,6 +1,6 @@ { "name": "@magmacomputing/library", - "version": "3.0.0", + "version": "3.0.1", "description": "Shared utility library for Tempo", "author": "Magma Computing Solutions", "license": "MIT", diff --git a/packages/tempo/CHANGELOG.md b/packages/tempo/CHANGELOG.md index 5c99a46d..48e08281 100644 --- a/packages/tempo/CHANGELOG.md +++ b/packages/tempo/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [3.0.1] - 2026-06-07 + +### Fixed +- **Term Scope Isolation**: Fixed a bug where the `Tempo.terms` getter would inappropriately sweep all licensed scopes (including modules and extensions like `ticker`) into the Terms array. `Tempo.terms` now strictly returns only the registered, queryable Term plugins, while preserving raw scopes in `Tempo.license.scopes`. +- **Security Hardening**: Obfuscated the internal integrity hash terminology (`isSyncToken`) to prevent malicious actors from trivially identifying and bypassing the proprietary Open-Core Ghost-Trap architecture. + ## [3.0.0] - 2026-06-07 ### Changed (Breaking) diff --git a/packages/tempo/package.json b/packages/tempo/package.json index 514bc1a4..c50652b1 100644 --- a/packages/tempo/package.json +++ b/packages/tempo/package.json @@ -1,6 +1,6 @@ { "name": "@magmacomputing/tempo", - "version": "3.0.0", + "version": "3.0.1", "description": "The Tempo core library", "author": "Magma Computing Solutions", "license": "MIT", @@ -205,7 +205,7 @@ }, "devDependencies": { "@js-temporal/polyfill": "^0.5.1", - "@magmacomputing/library": "3.0.0", + "@magmacomputing/library": "3.0.1", "@rollup/plugin-alias": "^6.0.0", "javascript-obfuscator": "^5.4.3", "magic-string": "^0.30.21", diff --git a/packages/tempo/src/tempo.class.ts b/packages/tempo/src/tempo.class.ts index 8f864374..99492cf0 100644 --- a/packages/tempo/src/tempo.class.ts +++ b/packages/tempo/src/tempo.class.ts @@ -897,20 +897,6 @@ export class Tempo { return item; }); - // Also include "claimed" scopes that aren't yet registered as plugins - ownEntries(rt.license.scopes).forEach(([scope, meta]) => { - if (!list.some(t => t.key === scope)) { - list.push({ - key: scope, - scope, - status: resolveDisplayStatus(rt.license.status), - expires: meta.exp ?? rt.license.expires, - updated: meta.updated_at, - description: `Premium plugin (${scope})` - }); - } - }); - // treats `Tempo.terms` as array-like and indexable by key. return indexedArray(list, key => list.find(t => t.key === key || t.scope === key)) as unknown as Secure[]> & Record>; } From 03685f6c27566a264a9281927fd42a526bd7220f Mon Sep 17 00:00:00 2001 From: Michael McRae Date: Mon, 8 Jun 2026 17:26:17 +1000 Subject: [PATCH 02/13] PR hotfix --- packages/tempo/CHANGELOG.md | 1 - packages/tempo/bin/update-version.mjs | 32 ++++++++++ packages/tempo/doc/installation.md | 7 +-- packages/tempo/importmap.json | 7 +-- packages/tempo/package.json | 2 + packages/tempo/src/module/module.parse.ts | 24 ++++---- packages/tempo/src/plugin/plugin.util.ts | 15 ++--- packages/tempo/src/plugin/term/term.util.ts | 17 ++++-- packages/tempo/src/support/support.init.ts | 58 ++++++++++++++++++- .../tempo/src/support/support.register.ts | 6 +- packages/tempo/src/support/support.runtime.ts | 23 +++----- packages/tempo/src/tempo.class.ts | 50 ++++++++++++---- packages/tempo/src/tempo.type.ts | 1 + packages/tempo/src/tempo.version.ts | 8 +++ .../tempo/test/plugins/licensing.full.test.ts | 34 +++++++---- packages/tempo/vitest.config.ts | 3 + 16 files changed, 211 insertions(+), 77 deletions(-) create mode 100644 packages/tempo/bin/update-version.mjs create mode 100644 packages/tempo/src/tempo.version.ts diff --git a/packages/tempo/CHANGELOG.md b/packages/tempo/CHANGELOG.md index 48e08281..e0590f3e 100644 --- a/packages/tempo/CHANGELOG.md +++ b/packages/tempo/CHANGELOG.md @@ -9,7 +9,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - **Term Scope Isolation**: Fixed a bug where the `Tempo.terms` getter would inappropriately sweep all licensed scopes (including modules and extensions like `ticker`) into the Terms array. `Tempo.terms` now strictly returns only the registered, queryable Term plugins, while preserving raw scopes in `Tempo.license.scopes`. -- **Security Hardening**: Obfuscated the internal integrity hash terminology (`isSyncToken`) to prevent malicious actors from trivially identifying and bypassing the proprietary Open-Core Ghost-Trap architecture. ## [3.0.0] - 2026-06-07 diff --git a/packages/tempo/bin/update-version.mjs b/packages/tempo/bin/update-version.mjs new file mode 100644 index 00000000..bb0cff10 --- /dev/null +++ b/packages/tempo/bin/update-version.mjs @@ -0,0 +1,32 @@ +#!/usr/bin/env node +/** + * bin/update-version.mjs + * + * Reads the version from package.json and rewrites src/tempo.version.ts + * so that Tempo.version always reflects the current published version. + * + * Usage: node bin/update-version.mjs + * Called automatically by `npm run prebuild`. + */ +import pkg from '../package.json' with { type: 'json' }; +import { writeFileSync } from 'node:fs'; +import { resolve, dirname } from 'node:path'; +import { fileURLToPath } from 'node:url'; + +const { version } = pkg; +const __dirname = dirname(fileURLToPath(import.meta.url)); + +const versionFile = resolve(__dirname, '../src/tempo.version.ts'); +const content = `/** + * @internal + * Canonical version of the Tempo library. + * + * ⚠️ This file is auto-updated by \`npm run build:version\` (see \`bin/update-version.mjs\`). + * Do NOT edit manually — your changes will be overwritten on the next build. + */ +export const TEMPO_VERSION = '${version}'; +`; + +writeFileSync(versionFile, content, 'utf-8'); +console.log(`✅ Tempo version stamped: ${version}`); + diff --git a/packages/tempo/doc/installation.md b/packages/tempo/doc/installation.md index 570786fc..8edc3f8a 100644 --- a/packages/tempo/doc/installation.md +++ b/packages/tempo/doc/installation.md @@ -104,9 +104,8 @@ Add this to your `` to resolve the dependencies: @@ -134,7 +133,7 @@ If you aren't using ESM or just want a simple ` - +