Feature/license admin

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tempo-monorepo",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "private": true,
   "engines": {
     "node": ">=20.0.0"

packages/library/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magmacomputing/library",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "description": "Shared utility library for Tempo",
   "author": "Magma Computing Solutions",
   "license": "MIT",

packages/tempo/CHANGELOG.md

@@ -6,6 +6,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.7.1] - 2026-07-08
+
+### Fixed
+- **License Admin Isolation**: Restructured the commercial licensing JWT payload to isolate administrative privileges (like `tempo-adm`) into a dedicated root-level `role` claim. This prevents internal admin flags from polluting the `scopes` dictionary and erroneously surfacing as "uninstalled premium plugins" in the `Tempo.terms` registry UI.
+
 ## [3.7.0] - 2026-07-08
 
 ### Added

packages/tempo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magmacomputing/tempo",
-  "version": "3.7.0",
+  "version": "3.7.1",
   "engines": {
     "node": ">=20.0.0"
   },

packages/tempo/src/plugin/license/license.manager.ts

@@ -67,6 +67,8 @@ export function setLicense(state: Internal.State, key: string): void {
 		license.key = key;
 		license.status = LICENSE.Pending;
 		license.scopes = claims?.scopes || {};
+		if (claims?.role) license.role = claims.role;
+		else delete license.role;
 
 		if (claims?.exp) license.expires = claims.exp;
 		if (claims?.iat) license.issuedAt = claims.iat;
@@ -86,6 +88,8 @@ export function setLicense(state: Internal.State, key: string): void {
 				const isValidStatus = isSyncToken(res.status) || LICENSE.values().includes(res.status);
 				license.status = isValidStatus ? res.status : LICENSE.Invalid;
 				license.scopes = isObject(res.scopes) ? res.scopes : {};
+				if (res.role) license.role = res.role;
+				else delete license.role;
 				delete (license as any).error;
 				if (res.error) license.error = res.error;
 				if (res.expires) license.expires = res.expires;

packages/tempo/src/tempo.type.ts

@@ -377,6 +377,7 @@ export namespace Internal {
 	/** structure of the verified license reckoning */
 	export interface ValidationResult {
 		status: enums.LICENSE;
+		role?: string;
 		scopes: Record<string, Internal.LicenseScope>;
 		expires?: number | string;
 		issuedAt?: number;
@@ -396,6 +397,7 @@ export namespace Internal {
 	export interface LicenseState {
 		status: enums.LICENSE;
 		key?: string;
+		role?: string;
 		scopes: Record<string, Internal.LicenseScope>;
 		jws?: Pledge<Internal.ValidationResult>;
 		expires?: number | string;