thumbgate 1.23.1 → 1.25.0

package/scripts/visitor-journey.js

@@ -0,0 +1,172 @@
+'use strict';
+
+const STAGE_ORDER = [
+  'landing',
+  'pricing',
+  'checkout_viewed',
+  'email_submitted',
+  'stripe_redirect',
+  'purchase',
+];
+
+function parseTimestamp(row) {
+  const raw = row && (row.timestamp || row.receivedAt || row.ts);
+  const ms = raw ? Date.parse(raw) : NaN;
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function pickText(...values) {
+  for (const value of values) {
+    const text = String(value || '').trim();
+    if (text) return text;
+  }
+  return '';
+}
+
+function extractSessionId(row) {
+  return pickText(
+    row.sessionId,
+    row.visitorSessionId,
+    row.visitor_session_id,
+    row.attribution && row.attribution.sessionId,
+    row.metadata && row.metadata.sessionId,
+    row.stripeSessionId,
+    row.traceId,
+    row.acquisitionId,
+  );
+}
+
+function extractVisitorId(row) {
+  return pickText(
+    row.visitorId,
+    row.visitor_id,
+    row.installId,
+    row.attribution && row.attribution.visitorId,
+    row.metadata && row.metadata.visitorId,
+  );
+}
+
+function extractPath(row) {
+  return pickText(
+    row.path,
+    row.page,
+    row.landingPath,
+    row.landing_path,
+    row.attribution && row.attribution.landingPath,
+  );
+}
+
+function classifyStage(row) {
+  const event = String(row.eventType || row.event || '').toLowerCase();
+  const stage = String(row.stage || '').toLowerCase();
+  const path = extractPath(row).toLowerCase();
+  const cta = String(row.ctaId || row.cta_id || '').toLowerCase();
+
+  if (/purchase|paid|checkout\.session\.completed/.test(event) || stage === 'purchase') return 'purchase';
+  if (/stripe_redirect|stripe redirect|redirect started/.test(event) || stage === 'stripe_redirect') return 'stripe_redirect';
+  if (/email_submitted|email submitted|checkout_interstitial_cta_clicked/.test(event)) return 'email_submitted';
+  if (/checkout/.test(path) || /checkout.*view|checkout pro viewed/.test(event)) return 'checkout_viewed';
+  if (/pricing/.test(path) || /pricing/.test(cta) || /pricing_cta/.test(event)) return 'pricing';
+  if (/landing|page_view|landing_page_view|discovery/.test(event) || stage === 'discovery') return 'landing';
+  return null;
+}
+
+function stageRank(stage) {
+  const index = STAGE_ORDER.indexOf(stage);
+  return index === -1 ? -1 : index;
+}
+
+function nextMissingStage(maxStage) {
+  const index = stageRank(maxStage);
+  if (index < 0) return 'unknown';
+  if (maxStage === 'purchase') return 'converted';
+  return STAGE_ORDER[index + 1] || 'unknown';
+}
+
+function buildVisitorJourneySummary({ telemetryRows = [], funnelRows = [], limit = 100 } = {}) {
+  const sessions = new Map();
+  const stageCounts = Object.fromEntries(STAGE_ORDER.map((stage) => [stage, 0]));
+
+  function ingest(row, source) {
+    const ts = parseTimestamp(row);
+    if (ts == null) return;
+    const sessionId = extractSessionId(row) || `anonymous:${extractVisitorId(row) || ts}`;
+    const visitorId = extractVisitorId(row) || null;
+    const stage = classifyStage(row);
+    const path = extractPath(row);
+    const existing = sessions.get(sessionId) || {
+      sessionId,
+      visitorId,
+      firstSeen: new Date(ts).toISOString(),
+      lastSeen: new Date(ts).toISOString(),
+      maxStage: null,
+      dropoffStage: 'unknown',
+      events: [],
+      paths: [],
+      ctas: [],
+      sources: [],
+      visitorType: row.visitorType || null,
+      utm: {},
+      referrerHost: pickText(row.referrerHost, row.referrer_host, row.referrer),
+    };
+
+    existing.visitorId = existing.visitorId || visitorId;
+    existing.firstSeen = new Date(Math.min(Date.parse(existing.firstSeen), ts)).toISOString();
+    existing.lastSeen = new Date(Math.max(Date.parse(existing.lastSeen), ts)).toISOString();
+    existing.sources.push(source);
+    if (stage) {
+      stageCounts[stage] += 1;
+      if (stageRank(stage) > stageRank(existing.maxStage)) existing.maxStage = stage;
+    }
+    if (path && !existing.paths.includes(path)) existing.paths.push(path);
+    const cta = pickText(row.ctaId, row.cta_id);
+    if (cta && !existing.ctas.includes(cta)) existing.ctas.push(cta);
+    for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term']) {
+      const value = pickText(row[key], row.attribution && row.attribution[key]);
+      if (value && !existing.utm[key]) existing.utm[key] = value;
+    }
+    existing.events.push({
+      timestamp: new Date(ts).toISOString(),
+      source,
+      eventType: pickText(row.eventType, row.event, row.stage, 'unknown'),
+      stage,
+      path: path || null,
+      ctaId: cta || null,
+    });
+    sessions.set(sessionId, existing);
+  }
+
+  for (const row of telemetryRows) ingest(row, 'telemetry');
+  for (const row of funnelRows) ingest(row, 'funnel');
+
+  const journeys = [...sessions.values()].map((session) => {
+    session.sources = [...new Set(session.sources)];
+    session.events.sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+    session.maxStage = session.maxStage || 'unknown';
+    session.dropoffStage = nextMissingStage(session.maxStage);
+    session.eventCount = session.events.length;
+    return session;
+  }).sort((a, b) => Date.parse(b.lastSeen) - Date.parse(a.lastSeen));
+
+  const dropoffCounts = {};
+  for (const journey of journeys) {
+    dropoffCounts[journey.dropoffStage] = (dropoffCounts[journey.dropoffStage] || 0) + 1;
+  }
+
+  return {
+    generatedAt: new Date().toISOString(),
+    sessionCount: journeys.length,
+    stageCounts,
+    dropoffCounts,
+    journeys: journeys.slice(0, Math.max(1, Math.min(Number(limit) || 100, 500))),
+    truncated: journeys.length > Math.max(1, Math.min(Number(limit) || 100, 500)),
+  };
+}
+
+module.exports = {
+  STAGE_ORDER,
+  buildVisitorJourneySummary,
+  classifyStage,
+  extractSessionId,
+  extractVisitorId,
+};

package/src/api/server.js

@@ -199,6 +199,10 @@ const {
 } = require('../../scripts/rate-limiter');
 const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
+const mcpOauth = require('../../scripts/mcp-oauth');
+// OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
+// (Claude Connectors Directory requires OAuth for authenticated services).
+const oauthStore = mcpOauth.createStore();
 const resendMailer = require('../../scripts/mailer/resend-mailer');
 const {
   buildContextFootprintReport,
@@ -748,16 +752,23 @@ function updateLessonRecord(feedbackDir, lessonId, updater) {
 function getPublicMcpTools() {
   return MCP_TOOLS.map((tool) => ({
     name: tool.name,
+    ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    // Serve the tool-registry annotations (readOnlyHint/destructiveHint). Required
+    // by the Claude Connectors Directory (missing annotations = the #1 rejection
+    // cause) and used by MCP clients for permission prompts. Was being dropped here.
+    ...(tool.annotations ? { annotations: tool.annotations } : {}),
   }));
 }
 
 function getServerCardTools() {
   return MCP_TOOLS.map((tool) => ({
     name: tool.name,
+    ...(tool.title ? { title: tool.title } : {}),
     description: tool.description,
     inputSchema: tool.inputSchema,
+    ...(tool.annotations ? { annotations: tool.annotations } : {}),
   }));
 }
 
@@ -1532,15 +1543,8 @@ function buildCheckoutIntentHref(baseUrl, metadata = {}, overrides = {}) {
   });
 }
 
-function renderCheckoutIntentPage({
-  workflowIntakeHref,
-  confirmHiddenParams,
-}) {
-  const safeWorkflowIntakeHref = escapeHtmlAttribute(workflowIntakeHref);
-  const hiddenFields = (confirmHiddenParams || [])
-    .map(([k, v]) => `<input type="hidden" name="${escapeHtmlAttribute(k)}" value="${escapeHtmlAttribute(v)}">`)
-    .join('');
-  return `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirm — ThumbGate Pro</title><style>body{background:#0a0a0a;color:#eee;font-family:system-ui,-apple-system,sans-serif;line-height:1.5}main{max-width:520px;margin:8vh auto;padding:0 20px}.brand{display:flex;align-items:center;gap:10px;margin-bottom:24px;font-size:14px;color:#94a3b8}.brand-mark{width:24px;height:24px;background:#22d3ee;border-radius:6px;display:inline-block}h1{font-size:24px;margin:0 0 8px;color:#fff}.price{font-size:32px;font-weight:700;color:#22d3ee;margin:8px 0 4px}.price small{font-size:14px;color:#94a3b8;font-weight:400}p{color:#cbd5e1;margin:8px 0}form{margin:0}input[type=email]{width:100%;box-sizing:border-box;padding:14px 16px;border:1px solid #374151;border-radius:8px;background:#111827;color:#fff;font-size:15px;margin:16px 0 0;outline:none}input[type=email]:focus{border-color:#22d3ee}input[type=email]::placeholder{color:#64748b}button.primary{background:#22d3ee;color:#000;padding:16px;text-align:center;border-radius:8px;font-weight:700;font-size:16px;margin:10px 0;border:none;cursor:pointer;width:100%}a{display:block;text-decoration:none}a.secondary{border:1px solid #374151;color:#cbd5e1;padding:12px;text-align:center;border-radius:8px;margin:8px 0 0;font-size:14px}.trust{margin:24px 0;padding:16px;border:1px solid #1f2937;border-radius:8px;background:#0f172a}.trust-item{font-size:13px;color:#cbd5e1;padding:4px 0;display:flex;gap:8px}.trust-item::before{content:"✓";color:#22d3ee;font-weight:700}.choice-note{font-size:13px;color:#94a3b8;margin-top:14px}.back{text-align:center;color:#64748b;font-size:12px;margin-top:24px}.back a{color:#64748b;display:inline}.email-note{font-size:12px;color:#64748b;margin:4px 0 0}</style><main><div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div><h1>Start ThumbGate Pro</h1><div class="price">$19<small>/mo</small></div><p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p><form action="/checkout/pro" method="GET" data-i="pro_checkout_confirmed">${hiddenFields}<input type="hidden" name="confirm" value="1"><input type="email" name="customer_email" placeholder="you@company.com" required autocomplete="email"><p class="email-note">Pre-fills your Stripe receipt. We only email if you ask.</p><button type="submit" class="primary">Pay $19/mo with Stripe →</button></form><a class="secondary" data-i="workflow_sprint_intake" href="${safeWorkflowIntakeHref}">Not sure yet? Send the workflow first</a><p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages.</p><div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div><p class="back"><a href="/">← Back to thumbgate.ai</a></p></main><script>document.querySelector('form').addEventListener('submit',e=>{if(navigator.sendBeacon)navigator.sendBeacon('/v1/telemetry/ping',new Blob([JSON.stringify({eventType:'checkout_interstitial_cta_clicked',clientType:'web',page:'/checkout/pro',ctaId:'pro_checkout_confirmed',ctaPlacement:'checkout_interstitial',customerEmail:document.querySelector('input[name=customer_email]').value})],{type:'application/json'}))})</script></html>`;
+function renderCheckoutIntentPage() {
+  return `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirm — ThumbGate Pro</title><script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.tagged-events.js"></script><script>window.plausible=window.plausible||function(){(window.plausible.q=window.plausible.q||[]).push(arguments)};</script><style>body{background:#0a0a0a;color:#eee;font-family:system-ui,-apple-system,sans-serif;line-height:1.5}main{max-width:520px;margin:8vh auto;padding:0 20px}.brand{display:flex;align-items:center;gap:10px;margin-bottom:24px;font-size:14px;color:#94a3b8}.brand-mark{width:24px;height:24px;background:#22d3ee;border-radius:6px;display:inline-block}h1{font-size:24px;margin:0 0 8px;color:#fff}.price{font-size:32px;font-weight:700;color:#22d3ee;margin:8px 0 4px}.price small{font-size:14px;color:#94a3b8;font-weight:400}p{color:#cbd5e1;margin:8px 0}form{margin:0}input[type=email]{width:100%;box-sizing:border-box;padding:14px 16px;border:1px solid #374151;border-radius:8px;background:#111827;color:#fff;font-size:15px;margin:16px 0 0;outline:none}input[type=email]:focus{border-color:#22d3ee}input[type=email]::placeholder{color:#64748b}button.primary{background:#22d3ee;color:#000;padding:16px;text-align:center;border-radius:8px;font-weight:700;font-size:16px;margin:10px 0;border:none;cursor:pointer;width:100%}a{display:block;text-decoration:none}a.secondary{border:1px solid #374151;color:#cbd5e1;padding:12px;text-align:center;border-radius:8px;margin:8px 0 0;font-size:14px}.trust{margin:24px 0;padding:16px;border:1px solid #1f2937;border-radius:8px;background:#0f172a}.trust-item{font-size:13px;color:#cbd5e1;padding:4px 0;display:flex;gap:8px}.trust-item::before{content:"✓";color:#22d3ee;font-weight:700}.choice-note{font-size:13px;color:#94a3b8;margin-top:14px}.back{text-align:center;color:#64748b;font-size:12px;margin-top:24px}.back a{color:#64748b;display:inline}.email-note{font-size:12px;color:#64748b;margin:4px 0 0}</style><main><div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div><h1>Start ThumbGate Pro</h1><div class="price">$19<small>/mo</small></div><p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p><form action="/checkout/pro" method="GET" data-i="pro_checkout_confirmed"><input type="hidden" name="confirm" value="1"><input type="email" name="customer_email" placeholder="you@company.com" required autocomplete="email"><p class="email-note">Pre-fills your Stripe receipt. We only email if you ask.</p><button type="submit" class="primary">Pay $19/mo with Stripe →</button></form><a class="secondary" data-i="workflow_sprint_intake" href="/#workflow-sprint-intake">Not sure yet? Send the workflow first</a><p class="choice-note">Cancel anytime. 7-day refund, no questions. Diagnostics and sprints have their own pages.</p><div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div><p class="back"><a href="/">← Back to thumbgate.ai</a></p></main><script>document.querySelector('form').addEventListener('submit',e=>{if(navigator.sendBeacon)navigator.sendBeacon('/v1/telemetry/ping',new Blob([JSON.stringify({eventType:'checkout_interstitial_cta_clicked',clientType:'web',page:'/checkout/pro',ctaId:'pro_checkout_confirmed',ctaPlacement:'checkout_interstitial',customerEmail:document.querySelector('input[name=customer_email]').value})],{type:'application/json'}));try{window.plausible&&window.plausible('Checkout Pro Email Submitted',{props:{page:'/checkout/pro',source:'interstitial'}})}catch(_){}})</script></html>`;
 }
 
 function buildCheckoutBootstrapBody(parsed, req, journeyState = resolveJourneyState(req, parsed)) {
@@ -2522,6 +2526,16 @@ function renderRobotsTxt(runtimeConfig) {
     'Disallow: /v1/billing/',
     '',
     '# AI crawler access — allow all major LLM crawlers',
+    'User-agent: OAI-SearchBot',
+    'Allow: /',
+    'Disallow: /checkout/',
+    'Disallow: /v1/billing/',
+    '',
+    'User-agent: ChatGPT-User',
+    'Allow: /',
+    'Disallow: /checkout/',
+    'Disallow: /v1/billing/',
+    '',
     'User-agent: GPTBot',
     'Allow: /',
     'Disallow: /checkout/',
@@ -2530,9 +2544,18 @@ function renderRobotsTxt(runtimeConfig) {
     'User-agent: ClaudeBot',
     'Allow: /',
     '',
+    'User-agent: Claude-SearchBot',
+    'Allow: /',
+    '',
+    'User-agent: Claude-User',
+    'Allow: /',
+    '',
     'User-agent: PerplexityBot',
     'Allow: /',
     '',
+    'User-agent: Perplexity-User',
+    'Allow: /',
+    '',
     'User-agent: Googlebot',
     'Allow: /',
     '',
@@ -2547,6 +2570,7 @@ function renderRobotsTxt(runtimeConfig) {
     '',
     '# LLM context document — clean declarative content for AI retrieval',
     `# ${runtimeConfig.appOrigin}/llm-context.md`,
+    `# ${runtimeConfig.appOrigin}/llms.txt`,
     '',
     `Sitemap: ${runtimeConfig.appOrigin}/sitemap.xml`,
   ].join('\n');
@@ -2562,6 +2586,15 @@ function renderSitemapXml(runtimeConfig) {
     { path: '/codex-enterprise', changefreq: 'weekly', priority: '0.85' },
     { path: '/agents-cost-savings', changefreq: 'weekly', priority: '0.85' },
     { path: '/ai-malpractice-prevention', changefreq: 'weekly', priority: '0.9' },
+    { path: '/learn/background-agent-control-layer', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/ac-dc-runtime-enforcement', changefreq: 'weekly', priority: '0.85' },
+    { path: '/learn/feedback-loop-vs-decision-layer', changefreq: 'weekly', priority: '0.9' },
+    { path: '/compare/claude-code-hooks', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/bumblebee', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/anthropic-containment', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/oak-and-sparrow-gatekeeper', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/arcjet', changefreq: 'weekly', priority: '0.85' },
+    { path: '/compare/anthropic-claude-for-legal', changefreq: 'weekly', priority: '0.9' },
     ...THUMBGATE_SEO_SITEMAP_ENTRIES,
   ];
   return [
@@ -2833,7 +2866,8 @@ function renderCheckoutSuccessPage(runtimeConfig) {
   </style>
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg">
-<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.tagged-events.js"></script>
+<script>window.plausible = window.plausible || function() { (window.plausible.q = window.plausible.q || []).push(arguments); };</script>
 </head>
 <body>
   <main>
@@ -3011,6 +3045,7 @@ function renderCheckoutSuccessPage(runtimeConfig) {
         }
 
         sendTelemetryOnce('checkout_paid_confirmed');
+        try { window.plausible && window.plausible('Checkout Pro Success Page Confirmed', { props: { sessionId: sessionId || '', traceId: traceId || '', source: 'success_page' } }); } catch (_) {}
         statusEl.textContent = 'ThumbGate Pro activated.';
         const resolvedTraceId = body.traceId || traceId || '';
         const emailStatus = body.trialEmail || {};
@@ -3836,12 +3871,56 @@ function createApiServer() {
                   tools: getPublicMcpTools(),
                 },
               });
+            } else if (msg.method === 'tools/call') {
+              // Authenticated tool execution. Accept either an OAuth 2.1 access
+              // token (audience-bound to this MCP server, RFC 8707) or a raw
+              // ThumbGate API key, both via the Bearer header.
+              const bearer = extractBearerToken(req);
+              const resourceUrl = buildPublicUrl(hostedConfig, '/mcp');
+              const oauthSession = mcpOauth.resolveAccessToken(oauthStore, bearer);
+              // OAuth path: token must resolve AND be audience-bound to this server
+              // (RFC 8707). Raw-key path: only an exact match to a configured
+              // operator/admin key — never "any non-empty bearer".
+              const adminKey = String(process.env.THUMBGATE_API_KEY || '').trim();
+              const operatorKey = String(process.env.THUMBGATE_OPERATOR_KEY || '').trim();
+              const rawKeyValid = Boolean(bearer) && ((adminKey && bearer === adminKey) || (operatorKey && bearer === operatorKey));
+              const authed = oauthSession
+                ? mcpOauth.tokenAudienceValid(oauthSession, resourceUrl)
+                : rawKeyValid;
+              if (!authed) {
+                res.writeHead(401, {
+                  'Content-Type': 'application/json',
+                  // RFC 9728: point unauthenticated clients at the resource metadata.
+                  'WWW-Authenticate': `Bearer resource_metadata="${buildPublicUrl(hostedConfig, '/.well-known/oauth-protected-resource')}"`,
+                });
+                res.end(JSON.stringify({
+                  jsonrpc: '2.0', id: msg.id,
+                  error: { code: -32001, message: 'Authentication required. Use OAuth 2.1 (see /.well-known/oauth-protected-resource) or a ThumbGate API key.' },
+                }));
+                return;
+              }
+              (async () => {
+                try {
+                  const { callTool } = require('../../adapters/mcp/server-stdio');
+                  const name = msg.params && msg.params.name;
+                  const args = (msg.params && msg.params.arguments) || {};
+                  const result = await callTool(name, args);
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    result: { content: [{ type: 'text', text: typeof result === 'string' ? result : JSON.stringify(result) }] },
+                  });
+                } catch (err) {
+                  sendJson(res, 200, {
+                    jsonrpc: '2.0', id: msg.id,
+                    result: { isError: true, content: [{ type: 'text', text: String(err && err.message || err) }] },
+                  });
+                }
+              })();
             } else {
-              // All other tool calls require auth — return method not found for unauthenticated
               sendJson(res, 200, {
                 jsonrpc: '2.0',
                 id: msg.id,
-                error: { code: -32601, message: 'Method requires authentication. Provide Bearer token.' },
+                error: { code: -32601, message: `Method not found: ${msg.method}` },
               });
             }
           } catch (_e) {
@@ -4118,7 +4197,7 @@ function createApiServer() {
       return;
     }
 
-    if (isGetLikeRequest && pathname === '/.well-known/llms.txt') {
+    if (isGetLikeRequest && (pathname === '/.well-known/llms.txt' || pathname === '/llms.txt')) {
       const llmsTxtPath = path.join(__dirname, '..', '..', '.well-known', 'llms.txt');
       try {
         const content = fs.readFileSync(llmsTxtPath, 'utf8');
@@ -4849,26 +4928,12 @@ async function addContext(){
           ctaId: analyticsMetadata.ctaId,
           ctaPlacement: analyticsMetadata.ctaPlacement,
           planId: analyticsMetadata.planId,
+          billingCycle: analyticsMetadata.billingCycle,
+          landingPath: analyticsMetadata.landingPath,
           isBot: botClassification.isBot ? 'true' : 'false',
           reason: botClassification.reason,
         }, req.headers, eventType);
-        const workflowIntakeHref = buildCheckoutIntentHref(`${hostedConfig.appOrigin}/#workflow-sprint-intake`, analyticsMetadata, {
-          utmMedium: 'checkout_interstitial_recovery',
-          utmCampaign: analyticsMetadata.utmCampaign || 'checkout_interstitial_workflow_sprint',
-          ctaId: 'checkout_interstitial_workflow_sprint_intake',
-          ctaPlacement: 'checkout_interstitial',
-          planId: 'team',
-        });
-        const confirmHiddenParams = [];
-        for (const [key, value] of parsed.searchParams.entries()) {
-          if (key !== 'confirm' && key !== 'customer_email') {
-            confirmHiddenParams.push([key, value]);
-          }
-        }
-        const html = renderCheckoutIntentPage({
-          workflowIntakeHref,
-          confirmHiddenParams,
-        });
+        const html = renderCheckoutIntentPage();
         sendHtml(res, 200, html, responseHeaders);
         return;
       }
@@ -5156,6 +5221,108 @@ async function addContext(){
       return;
     }
 
+    // OAuth 2.1 discovery metadata for the remote MCP connector (RFC 9728 / RFC 8414).
+    // Lets Claude discover how to authenticate before calling authenticated tools.
+    if (isGetLikeRequest && pathname === '/.well-known/oauth-protected-resource') {
+      sendJson(res, 200, mcpOauth.buildProtectedResourceMetadata(buildPublicUrl(hostedConfig, '')), {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+    if (isGetLikeRequest && (pathname === '/.well-known/oauth-authorization-server' || pathname === '/.well-known/openid-configuration')) {
+      sendJson(res, 200, mcpOauth.buildAuthServerMetadata(buildPublicUrl(hostedConfig, '')), {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    // --- OAuth 2.1 (PKCE) endpoints for the remote MCP connector ---
+    // RFC 7591 Dynamic Client Registration.
+    if (req.method === 'POST' && pathname === '/oauth/register') {
+      let body = '';
+      req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+      req.on('end', () => {
+        let parsed = {};
+        try { parsed = body ? JSON.parse(body) : {}; } catch { /* ignore */ }
+        const reg = mcpOauth.registerClient(oauthStore, parsed);
+        if (reg.error) { sendJson(res, 400, reg); return; }
+        sendJson(res, 201, reg);
+      });
+      return;
+    }
+    // Authorization endpoint: GET renders consent, POST issues the code.
+    if (pathname === '/oauth/authorize') {
+      if (isGetLikeRequest) {
+        const q = parsed.searchParams;
+        const fields = ['client_id', 'redirect_uri', 'code_challenge', 'code_challenge_method', 'scope', 'state', 'resource'];
+        const hidden = fields.map((f) => `<input type="hidden" name="${f}" value="${escapeHtmlAttribute(q.get(f) || '')}">`).join('\n');
+        const html = `<!doctype html><html><head><meta charset="utf-8"><title>Authorize ThumbGate</title>
+<style>body{font:15px system-ui;margin:0;background:#0b0b0c;color:#eee;display:flex;min-height:100vh;align-items:center;justify-content:center}
+.card{background:#161618;border:1px solid #2a2a2e;border-radius:12px;padding:28px;max-width:420px}
+input[type=password]{width:100%;padding:10px;margin:8px 0 16px;border-radius:8px;border:1px solid #2a2a2e;background:#0b0b0c;color:#eee}
+button{width:100%;padding:11px;border-radius:8px;border:0;background:#10b981;color:#04120c;font-weight:600;cursor:pointer}
+a{color:#8b9}</style></head><body><form class="card" method="post" action="/oauth/authorize">
+<h2>Authorize Claude → ThumbGate</h2>
+<p>Paste your ThumbGate API key to let this connector act as you. Get one with <code>npx thumbgate init</code> or from your <a href="/dashboard">dashboard</a>.</p>
+${hidden}
+<input type="password" name="api_key" placeholder="ThumbGate API key" autocomplete="off" required>
+<button type="submit" name="approve" value="yes">Approve</button>
+</form></body></html>`;
+        sendHtml(res, 200, html, {}, { headOnly: isHeadRequest });
+        return;
+      }
+      if (req.method === 'POST') {
+        let body = '';
+        req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+        req.on('end', () => {
+          const form = new URLSearchParams(body);
+          const redirectUri = form.get('redirect_uri') || '';
+          const state = form.get('state') || '';
+          const issued = mcpOauth.createAuthorizationCode(oauthStore, {
+            clientId: form.get('client_id') || '',
+            redirectUri,
+            codeChallenge: form.get('code_challenge') || '',
+            codeChallengeMethod: form.get('code_challenge_method') || '',
+            scope: form.get('scope') || undefined,
+            resource: form.get('resource') || buildPublicUrl(hostedConfig, '/mcp'),
+            boundKey: form.get('api_key') || '',
+            state,
+          });
+          if (issued.error) {
+            sendJson(res, 400, { error: issued.error, error_description: issued.error_description });
+            return;
+          }
+          const sep = redirectUri.includes('?') ? '&' : '?';
+          const loc = `${redirectUri}${sep}code=${encodeURIComponent(issued.code)}${state ? `&state=${encodeURIComponent(state)}` : ''}`;
+          res.writeHead(302, { Location: loc });
+          res.end();
+        });
+        return;
+      }
+    }
+    // Token endpoint (authorization_code + PKCE).
+    if (req.method === 'POST' && pathname === '/oauth/token') {
+      let body = '';
+      req.on('data', (c) => { body += c; if (body.length > 16384) req.destroy(); });
+      req.on('end', () => {
+        const form = new URLSearchParams(body);
+        if (form.get('grant_type') !== 'authorization_code') {
+          sendJson(res, 400, { error: 'unsupported_grant_type' });
+          return;
+        }
+        const tok = mcpOauth.exchangeCode(oauthStore, {
+          code: form.get('code') || '',
+          codeVerifier: form.get('code_verifier') || '',
+          clientId: form.get('client_id') || '',
+          redirectUri: form.get('redirect_uri') || '',
+          resource: form.get('resource') || undefined,
+        });
+        if (tok.error) { sendJson(res, 400, tok); return; }
+        sendJson(res, 200, tok, { 'Cache-Control': 'no-store' });
+      });
+      return;
+    }
+
     if (isGetLikeRequest && pathname === '/.well-known/mcp/tools.json') {
       sendJson(res, 200, {
         name: 'thumbgate',
@@ -5597,6 +5764,7 @@ async function addContext(){
         source,
         telemetry: { rows: [], truncated: false, totalAfterSince: 0 },
         funnel: { rows: [], truncated: false, totalAfterSince: 0 },
+        journeySummary: null,
       };
 
       function readJsonlSince(p) {
@@ -5644,6 +5812,19 @@ async function addContext(){
         result.funnel.truncated = all.length > limit;
       }
 
+      try {
+        const { buildVisitorJourneySummary } = require('../../scripts/visitor-journey');
+        result.journeySummary = buildVisitorJourneySummary({
+          telemetryRows: wantTelemetry ? result.telemetry.rows : [],
+          funnelRows: wantFunnel ? result.funnel.rows : [],
+          limit: Math.min(limit, 500),
+        });
+      } catch (err) {
+        result.journeySummary = {
+          error: err && err.message ? err.message : 'journey_summary_unavailable',
+        };
+      }
+
       sendJson(res, 200, result);
       return;
     }
@@ -6059,7 +6240,19 @@ async function addContext(){
 
     // Public OpenAPI spec — no auth required (needed for ChatGPT GPT Store import)
     if (isGetLikeRequest && (pathname === '/openapi.json' || pathname === '/openapi.yaml')) {
-      const specPath = path.join(__dirname, '../../adapters/chatgpt/openapi.yaml');
+      const specPath = [
+        path.join(__dirname, '../../openapi/openapi.yaml'),
+        path.join(__dirname, '../../adapters/chatgpt/openapi.yaml'),
+      ].find((candidate) => fs.existsSync(candidate));
+      if (!specPath) {
+        sendProblem(res, {
+          type: PROBLEM_TYPES.NOT_FOUND,
+          title: 'Not Found',
+          status: 404,
+          detail: 'OpenAPI spec not found.',
+        });
+        return;
+      }
       try {
         const yaml = renderOpenApiYamlForRequest(fs.readFileSync(specPath, 'utf8'), req);
         if (pathname === '/openapi.yaml') {
@@ -8036,6 +8229,8 @@ module.exports = {
     renderPackagedLessonsHtml,
     readOptionalPublicTemplate,
     resolveLocalPageBootstrap,
+    getPublicMcpTools,
+    getServerCardTools,
   },
 };