thumbgate 1.27.18 → 1.27.19

package/scripts/billing.js

@@ -51,6 +51,7 @@ const {
 } = require('./analytics-window');
 const { ensureParentDir } = require('./fs-utils');
 const mailer = require('./mailer');
+const { recordCheckoutFunnelEvent } = require('./plausible-server-events');
 
 function loadWorkflowSprintIntakeModule() {
   const modulePath = path.resolve(__dirname, 'workflow-sprint-intake.js');
@@ -138,6 +139,10 @@ const IS_TEST = !!(
   process.env.NODE_ENV === 'test'
 );
 
+function allowUnsignedStripeWebhooks() {
+  return IS_TEST && process.env.THUMBGATE_ALLOW_UNSIGNED_STRIPE_WEBHOOKS === '1';
+}
+
 function shouldMergeLegacyBillingData() {
   return process.env._TEST_INCLUDE_LEGACY_BILLING_DATA === '1'
     || process.env.THUMBGATE_INCLUDE_LEGACY_BILLING_DATA === '1';
@@ -444,6 +449,57 @@ function buildCheckoutProductData({ name, description, appOrigin, planId }) {
   };
 }
 
+/**
+ * Verify an ACTIVE Stripe product exists for the given plan name before
+ * we let buildSubscriptionPriceData create inline price_data under it.
+ *
+ * Stripe matches product_data by `name`. If only an archived product
+ * matches, new prices created via that path inherit active=false and the
+ * generated checkout URL renders "Something went wrong / The page you
+ * were looking for could not be found." for the buyer. Stripe Dashboard
+ * shows the session as `open` with no email captured — looks like the
+ * buyer abandoned, but they were never given a working page.
+ *
+ * Failing here surfaces the misconfiguration at the first checkout
+ * attempt instead of silently breaking every buyer for days.
+ *
+ * Verified incident: ThumbGate#2188 (May 2026) — 20 sessions abandoned in
+ * 7 days, all because the only product named "ThumbGate Pro" matching the
+ * inline product_data was archived (prod_UXxOHAfbDsPyRb), while an active
+ * product with the same name existed (prod_UW82THPxfNvwKT) that should
+ * have been used instead.
+ */
+async function verifyActiveProductForPlan(stripe, planId) {
+  const expectedName = planId === 'team' ? 'ThumbGate Team' : 'ThumbGate Pro';
+  let products;
+  try {
+    products = await stripe.products.list({ limit: 100 });
+  } catch (err) {
+    // Network/transient failures shouldn't block checkout creation.
+    // The original session.create call will surface real Stripe errors.
+    return;
+  }
+  const matching = (products && products.data ? products.data : [])
+    .filter((p) => p && p.name === expectedName);
+  if (matching.length === 0) {
+    // No product with this name exists; Stripe will create a new one when
+    // session.create fires with inline product_data. Safe path.
+    return;
+  }
+  const active = matching.find((p) => p.active === true);
+  if (!active) {
+    const archived = matching[0];
+    throw new Error(
+      `Refusing to create checkout session: Stripe product named "${expectedName}" ` +
+      `exists only in archived state (id=${archived.id}, active=false). New prices ` +
+      `created via inline product_data would inherit active=false, rendering ` +
+      `"page not found" on Stripe checkout for every buyer. Fix: reactivate the ` +
+      `archived product in Stripe Dashboard, or rename the active product to ` +
+      `match "${expectedName}". See ThumbGate#2188 for the May 2026 incident.`
+    );
+  }
+}
+
 function buildSubscriptionPriceData(checkoutSelection, appOrigin) {
   const isTeam = checkoutSelection.planId === 'team';
   const annual = checkoutSelection.billingCycle === 'annual';
@@ -2525,6 +2581,18 @@ async function createCheckoutSession({ successUrl, cancelUrl, customerEmail, ins
   }
 
   const stripe = getStripeClient();
+
+  // Defensive guard against ThumbGate#2188:
+  // When buildSubscriptionPriceData passes inline `product_data` to Stripe,
+  // Stripe name-matches existing products. If the only existing product with
+  // that name is ARCHIVED (active=false), the new price inherits active=false
+  // and every Stripe checkout page renders "page not found" for the buyer.
+  // That bug burnt 20+ silent abandoned sessions in May 2026. Fail fast
+  // instead of letting the broken page ship.
+  if (!packId) {
+    await verifyActiveProductForPlan(stripe, checkoutSelection.planId);
+  }
+
   const sessionPayload = buildCheckoutSessionPayload({
     successUrl,
     cancelUrl,
@@ -2837,7 +2905,7 @@ function disableCustomerKeys(customerId) {
 }
 
 function verifyWebhookSignature(rawBody, signature) {
-  if (!CONFIG.STRIPE_WEBHOOK_SECRET) return true;
+  if (!CONFIG.STRIPE_WEBHOOK_SECRET) return allowUnsignedStripeWebhooks();
   if (!signature || !rawBody) return false;
 
   // Stripe signature format: t=<timestamp>,v1=<hmac>,...
@@ -2867,6 +2935,13 @@ function verifyWebhookSignature(rawBody, signature) {
 
 async function handleWebhook(rawBody, signature) {
   if (LOCAL_MODE()) return { handled: false, reason: 'local_mode' };
+  if (!CONFIG.STRIPE_WEBHOOK_SECRET && !allowUnsignedStripeWebhooks()) {
+    return {
+      handled: false,
+      reason: 'invalid_signature',
+      error: 'STRIPE_WEBHOOK_SECRET is required before Stripe webhooks can be processed.',
+    };
+  }
   let event;
   try {
     if (CONFIG.STRIPE_WEBHOOK_SECRET) {
@@ -2975,6 +3050,22 @@ async function handleWebhook(rawBody, signature) {
           attribution,
         });
       }
+      // Fire Plausible purchase event so the funnel poller can measure
+      // end-to-end conversion: visitor → CTA → checkout → email → Stripe → purchase.
+      // Fire-and-forget (never blocks the webhook response).
+      void recordCheckoutFunnelEvent('purchase', {
+        page: '/success',
+        props: {
+          sessionId: session.id,
+          customerId,
+          traceId: traceId || '',
+          packId: packId || '',
+          amount: session.amount_total != null ? String(session.amount_total) : '',
+          currency: session.currency || '',
+          ...attribution,
+        },
+      });
+
       return {
         handled: true,
         action: 'provisioned_api_key',
@@ -3127,6 +3218,7 @@ module.exports = {
   _buildTrialActivationEmail: buildTrialActivationEmail,
   _sendTrialActivationEmail: sendTrialActivationEmail,
   _resolveSubscriptionCheckoutSelection: resolveSubscriptionCheckoutSelection,
+  _verifyActiveProductForPlan: verifyActiveProductForPlan,
   _API_KEYS_PATH: () => CONFIG.API_KEYS_PATH,
   _FUNNEL_LEDGER_PATH: () => CONFIG.FUNNEL_LEDGER_PATH,
   _REVENUE_LEDGER_PATH: () => CONFIG.REVENUE_LEDGER_PATH,

package/scripts/bot-detection.js

@@ -36,13 +36,18 @@ const BOT_PATTERNS = [
   /\bbaiduspider\b/i,
   /\bduckduckbot\b/i,
   /\bapplebot\b/i,
+  /slurp/i,
+  /petalbot/i,
+  /mediapartners/i,
   // LLM / AI crawlers — these started exploding in 2024+
   /\bgptbot\b/i,
-  /\bchatgpt-user\b/i,
+  /chatgpt/i,
   /\boai-searchbot\b/i,
-  /\bperplexitybot\b/i,
-  /\banthropic-ai\b/i,
+  /perplexity/i,
+  /anthropic/i,
   /\bclaude(?:bot|-web)\b/i,
+  /claude-searchbot/i,
+  /google-extended/i,
   /\bccbot\b/i,
   /\bcohere-ai\b/i,
   /\bbytespider\b/i,
@@ -86,6 +91,8 @@ const BOT_PATTERNS = [
   /\blibwww-perl\b/i,
   /\bjava\//i,
   /\bgo-http-client\b/i,
+  /scrapy/i,
+  /httpclient/i,
   /\bruby\b/i,
   // API/test tools
   /\bpostman(?:runtime)?\b/i,
@@ -158,8 +165,59 @@ function isProbablyBot(headers) {
   return classifyRequester(headers).isBot;
 }
 
+// --- Visitor classification (analytics filtering) ---------------------------
+// Classifies telemetry/analytics traffic as bot / owner / real_user.
+// Owner traffic is identified via the THUMBGATE_OWNER_EMAILS env var
+// (comma-separated, case-insensitive). There is no built-in default:
+// operators opt in via config, so the shipped artifact carries no
+// personal data.
+
+function getOwnerEmails(env = process.env) {
+  const raw = env.THUMBGATE_OWNER_EMAILS;
+  if (!raw) return [];
+  return raw
+    .split(',')
+    .map((entry) => entry.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function classifyVisitor(req) {
+  const ua = (req.headers && req.headers['user-agent']) || '';
+  const email = req.email || (req.query && req.query.email) || '';
+
+  for (const pattern of BOT_PATTERNS) {
+    if (pattern.test(ua)) {
+      return { type: 'bot', reason: `UA matches: ${pattern}`, userAgent: ua };
+    }
+  }
+  if (!ua || ua.length < 10) {
+    return { type: 'bot', reason: 'Empty or short user-agent', userAgent: ua };
+  }
+  if (email) {
+    const normalized = email.toLowerCase();
+    if (getOwnerEmails().some((ownerEmail) => normalized.includes(ownerEmail))) {
+      return { type: 'owner', reason: 'Email matches configured owner list', userAgent: ua };
+    }
+  }
+  return { type: 'real_user', reason: 'No bot pattern matched', userAgent: ua };
+}
+
+function shouldExcludeFromAnalytics(req) {
+  const classification = req.visitorClass || classifyVisitor(req);
+  return classification.type === 'bot';
+}
+
+function botFilterMiddleware(req, res, next) {
+  req.visitorClass = classifyVisitor(req);
+  next();
+}
+
 module.exports = {
   classifyRequester,
   isProbablyBot,
+  classifyVisitor,
+  shouldExcludeFromAnalytics,
+  botFilterMiddleware,
+  getOwnerEmails,
   BOT_PATTERNS,
 };

package/scripts/build-metadata.js

@@ -5,6 +5,11 @@ const PROJECT_ROOT = path.resolve(__dirname, '..');
 const DEFAULT_BUILD_METADATA_PATH = path.join(PROJECT_ROOT, 'config', 'build-metadata.json');
 const BUILD_SHA_ENV_KEY = 'THUMBGATE_BUILD_SHA';
 const BUILD_GENERATED_AT_ENV_KEY = 'THUMBGATE_BUILD_GENERATED_AT';
+// Railway injects this automatically for GitHub-connected deployments: the git
+// SHA of the commit that triggered the deploy. It is the ground truth for what
+// code is actually live, and unlike THUMBGATE_BUILD_SHA it cannot drift (Railway
+// sets it per deploy). https://docs.railway.com/reference/variables
+const RAILWAY_GIT_COMMIT_SHA_ENV_KEY = 'RAILWAY_GIT_COMMIT_SHA';
 
 function normalizeNullableText(value) {
   if (typeof value !== 'string') {
@@ -16,35 +21,69 @@ function normalizeNullableText(value) {
 }
 
 function resolveBuildMetadata({ env = process.env, filePath } = {}) {
+  // Precedence: immutable JSON file (baked into Docker image at build time, so it
+  // ALWAYS matches the deployed code) wins over runtime env vars. Env vars are
+  // mutable Railway/host config that can drift — they shadowed the freshly-stamped
+  // SHA in prod on 2026-05-20 and made /health lie about the deployed commit.
+  // Fall back to env vars only when the file is missing or its values are null,
+  // and require an explicit SHA env var (not just a stray GENERATED_AT) before
+  // trusting the env branch.
   const resolvedPath =
     normalizeNullableText(filePath) ||
     normalizeNullableText(env.THUMBGATE_BUILD_METADATA_PATH) ||
     DEFAULT_BUILD_METADATA_PATH;
   const envBuildSha = normalizeNullableText(env[BUILD_SHA_ENV_KEY]);
+  const railwayGitSha = normalizeNullableText(env[RAILWAY_GIT_COMMIT_SHA_ENV_KEY]);
   const envGeneratedAt = normalizeNullableText(env[BUILD_GENERATED_AT_ENV_KEY]);
 
-  if (envBuildSha || envGeneratedAt) {
+  let fileBuildSha = null;
+  let fileGeneratedAt = null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolvedPath, 'utf8'));
+    fileBuildSha = normalizeNullableText(parsed.buildSha);
+    fileGeneratedAt = normalizeNullableText(parsed.generatedAt);
+  } catch {
+    // file missing or unreadable — fall through to env branch
+  }
+
+  if (fileBuildSha) {
     return {
       path: resolvedPath,
-      buildSha: envBuildSha,
-      generatedAt: envGeneratedAt,
+      buildSha: fileBuildSha,
+      generatedAt: fileGeneratedAt || envGeneratedAt,
     };
   }
 
-  try {
-    const parsed = JSON.parse(fs.readFileSync(resolvedPath, 'utf8'));
+  // No SHA baked into the image. Prefer Railway's own per-deploy commit SHA over
+  // THUMBGATE_BUILD_SHA: the latter is set out-of-band by the deploy workflow and
+  // has drifted in prod (stuck reporting an old commit while newer code was live,
+  // because RAILWAY_SYNC_VARIABLES is off and `railway up` stamping is unreliable).
+  // RAILWAY_GIT_COMMIT_SHA is injected by Railway per deploy, so it always matches
+  // the code actually serving traffic on a GitHub-connected service.
+  if (railwayGitSha) {
     return {
       path: resolvedPath,
-      buildSha: normalizeNullableText(parsed.buildSha),
-      generatedAt: normalizeNullableText(parsed.generatedAt),
+      buildSha: railwayGitSha,
+      generatedAt: envGeneratedAt,
     };
-  } catch {
+  }
+
+  // Last resort: the workflow-managed env var. Only trust it when an explicit SHA
+  // is set. (Previously a bare GENERATED_AT with no SHA could short-circuit and
+  // return { buildSha: null }, losing both signals; now we require the SHA.)
+  if (envBuildSha) {
     return {
       path: resolvedPath,
-      buildSha: null,
-      generatedAt: null,
+      buildSha: envBuildSha,
+      generatedAt: envGeneratedAt,
     };
   }
+
+  return {
+    path: resolvedPath,
+    buildSha: null,
+    generatedAt: fileGeneratedAt || envGeneratedAt,
+  };
 }
 
 function writeBuildMetadataFile({ sha, outputPath, generatedAt = new Date().toISOString() }) {
@@ -105,6 +144,7 @@ if (require.main === module) {
 module.exports = {
   BUILD_GENERATED_AT_ENV_KEY,
   BUILD_SHA_ENV_KEY,
+  RAILWAY_GIT_COMMIT_SHA_ENV_KEY,
   DEFAULT_BUILD_METADATA_PATH,
   resolveBuildMetadata,
   writeBuildMetadataFile,

package/scripts/cli-feedback.js

@@ -88,11 +88,13 @@ function formatCliOutput(result) {
   if (result.feedbackResult && result.feedbackResult.accepted !== false) {
     lines.push(`${isDown ? R : G}${BD}${isDown ? '👎 Thumbs down recorded' : '👍 Thumbs up recorded'}${RST}`);
     const feedbackId = (result.feedbackResult.feedbackEvent && result.feedbackResult.feedbackEvent.id) || result.feedbackResult.id;
+    const memoryId = (result.feedbackResult.memoryRecord && result.feedbackResult.memoryRecord.id) || result.feedbackResult.memoryId;
     if (feedbackId) {
-      lines.push(`${D}  ID: ${feedbackId}${RST}`);
+      lines.push(`${D}  Feedback ID: ${feedbackId}${RST}`);
+      if (memoryId) lines.push(`${D}  Memory ID  : ${memoryId}${RST}`);
       // Echo feedback ID to stderr so it's visible directly in the terminal,
       // not hidden behind Claude Code's "ctrl+o to expand" MCP call collapse.
-      process.stderr.write(`✅ Feedback captured (${feedbackId})\n`);
+      process.stderr.write(`✅ Feedback captured (${feedbackId}${memoryId ? `, ${memoryId}` : ''})\n`);
     }
   } else {
     lines.push(`${R}Feedback not accepted: ${(result.feedbackResult && result.feedbackResult.reason) || 'unknown'}${RST}`);

package/scripts/cli-schema.js

@@ -51,6 +51,20 @@ const CLI_COMMANDS = [
       { name: 'json',            type: 'boolean', description: 'Output as JSON' },
     ],
   },
+  {
+    name: 'feedback-self-test',
+    aliases: ['dogfood'],
+    description: 'Prove thumbs feedback capture works in the current runtime',
+    group: 'capture',
+    mcpTool: 'capture_feedback',
+    flags: [
+      { name: 'feedback',     type: 'string',  description: 'Signal to test: up or down (default down)' },
+      { name: 'context',      type: 'string',  description: 'Context to store in the test capture' },
+      { name: 'persist',      type: 'boolean', description: 'Use the active ThumbGate store instead of an isolated test store' },
+      { name: 'feedback-dir', type: 'string',  description: 'Explicit feedback directory for the self-test' },
+      { name: 'json',         type: 'boolean', description: 'Output as JSON' },
+    ],
+  },
 
   // -------------------------------------------------------------------------
   // Discovery
@@ -80,6 +94,25 @@ const CLI_COMMANDS = [
       { name: 'remote',   type: 'boolean', description: 'Fetch from hosted Railway instance' },
     ],
   },
+  {
+    name: 'brain',
+    aliases: ['customer-brain', 'repo-brain'],
+    description: 'Scaffold, query, or build the governed customer/repo context brain',
+    group: 'discovery',
+    flags: [
+      { name: 'json',       type: 'boolean', description: 'Output as JSON' },
+      { name: 'task',       type: 'string',  description: 'Task description for routed context loading' },
+      { name: 'type',       type: 'string',  description: 'Memory type for remember: decision | pattern | feedback | log' },
+      { name: 'title',      type: 'string',  description: 'Title for a sourced memory entry' },
+      { name: 'content',    type: 'string',  description: 'Body for a sourced memory entry' },
+      { name: 'source',     type: 'string',  description: 'Required provenance for factual memory writes' },
+      { name: 'tags',       type: 'string',  description: 'Comma-separated memory tags' },
+      { name: 'text',       type: 'string',  description: 'Text/action to check against never-do rules' },
+      { name: 'stale-days', type: 'number',  description: 'Age threshold for cleanup report (default 60)' },
+      { name: 'write',      type: 'boolean', description: 'Save to .thumbgate/BRAIN.md (versioned, deterministic)' },
+      { name: 'limit',      type: 'number',  description: 'Max lessons to include (default 15)' },
+    ],
+  },
   {
     name: 'stats',
     description: 'Feedback analytics — approval rate, Revenue-at-Risk, recent trend',
@@ -337,6 +370,19 @@ const CLI_COMMANDS = [
       { name: 'high-risk-workflows', type: 'string', description: 'Comma-separated workflows touching money, prod, secrets, data, or publishing' },
     ],
   }),
+  discoveryCommand({
+    name: 'ai-inventory',
+    aliases: ['ai-component-inventory', 'ml-bom', 'mlbom'],
+    description: 'Scan AI/ML components and export enterprise ML-BOM evidence',
+    mcpTool: 'ai_component_inventory',
+    flags: [
+      jsonFlag(),
+      { name: 'root', type: 'string', description: 'Project root to scan' },
+      { name: 'format', type: 'string', description: 'summary, json, or cyclonedx' },
+      { name: 'output', type: 'string', description: 'Write evidence to this path' },
+      { name: 'max-files', type: 'number', description: 'Maximum files to scan' },
+    ],
+  }),
   discoveryCommand({
     name: 'long-running-agent-context-guardrails',
     aliases: ['agent-context-guardrails', 'slack-context-guardrails'],
@@ -459,6 +505,12 @@ const CLI_COMMANDS = [
     group: 'gates',
     flags: [],
   },
+  {
+    name: 'hermes-gate',
+    description: 'Hermes Agent pre_tool_call hook: gate runtime tool calls (incl. skill_manage) before they run',
+    group: 'gates',
+    flags: [],
+  },
   {
     name: 'force-gate',
     description: 'Immediately create a blocking gate from a pattern string',
@@ -525,6 +577,14 @@ const CLI_COMMANDS = [
       { name: 'json', type: 'boolean', description: 'Output as JSON' },
     ],
   },
+  {
+    name: 'audit',
+    description: 'Audit an agent transcript for repeat-mistake patterns and estimated token waste',
+    group: 'ops',
+    flags: [
+      { name: 'file', type: 'string', description: 'Path to the agent transcript to audit' },
+    ],
+  },
   {
     name: 'init',
     description: 'Scaffold .thumbgate/ config and wire agent hooks',
@@ -582,6 +642,43 @@ const CLI_COMMANDS = [
       { name: 'info',    type: 'boolean', description: 'Show Pro feature list' },
     ],
   },
+  {
+    name: 'diagnostic',
+    aliases: ['workflow-diagnostic', 'sprint-diagnostic'],
+    description: '$499 Workflow Hardening Diagnostic for one repeated AI-agent workflow failure',
+    group: 'ops',
+    flags: [],
+  },
+
+  {
+    name: 'workflow',
+    aliases: ['swarm'],
+    description: 'Execute a dynamic parallel workflow for security audit, benchmarking, or exploration',
+    group: 'ops',
+    mcpTool: 'parallel_workflow',
+    flags: [
+      { name: 'objective',   type: 'string',  required: true,  description: 'The objective to plan and execute (e.g. security audit, performance benchmark)' },
+      { name: 'concurrency', type: 'number',  description: 'Maximum parallel subtasks (default 3)' },
+      { name: 'timeoutMs',   type: 'number',  description: 'Timeout in milliseconds (default 60000)' },
+      { name: 'json',        type: 'boolean', description: 'Output results as JSON' },
+    ],
+  },
+  {
+    name: 'check-update',
+    aliases: ['upgrade-check'],
+    description: 'Check for newer versions of ThumbGate from npm or GitHub',
+    group: 'ops',
+    flags: [
+      { name: 'json', type: 'boolean', description: 'Output results as JSON' },
+    ],
+  },
+  {
+    name: 'self-update',
+    aliases: ['upgrade-cli'],
+    description: 'Automatically install the latest version of ThumbGate globally',
+    group: 'ops',
+    flags: [],
+  },
 ];
 
 /**

package/scripts/cli-telemetry.js

@@ -10,6 +10,9 @@ const _DEFAULT_TELEMETRY_HOST = 'https://thumbgate-production.up.railway.app';
 const TELEMETRY_ENDPOINT = `${process.env.THUMBGATE_API_URL || _DEFAULT_TELEMETRY_HOST}/v1/telemetry/ping`;
 const INSTALL_ID_PATH = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.thumbgate', 'install-id');
 
+// Session ID: random per process invocation. Groups all events from one CLI run.
+const SESSION_ID = crypto.randomUUID ? crypto.randomUUID() : crypto.randomBytes(16).toString('hex');
+
 /**
  * Get or create a stable anonymous install ID.
  * This is NOT tied to any personal info — it's a random UUID stored locally.
@@ -61,7 +64,9 @@ function trackEvent(eventType, metadata = {}) {
   const payload = JSON.stringify({
     eventType,
     installId: getInstallId(),
+    sessionId: SESSION_ID,
     visitorType: classifyInstall(),
+    clientType: 'cli',
     platform: os.platform(),
     arch: os.arch(),
     nodeVersion: process.version,
@@ -87,4 +92,4 @@ function trackEvent(eventType, metadata = {}) {
   } catch (_) {} // never crash the CLI
 }
 
-module.exports = { trackEvent, getInstallId, classifyInstall, INSTALL_ID_PATH };
+module.exports = { trackEvent, getInstallId, classifyInstall, INSTALL_ID_PATH, SESSION_ID };

package/scripts/commercial-offer.js

@@ -14,7 +14,12 @@ const TEAM_ANNUAL_PRICE_DOLLARS = 588;
 const TEAM_MIN_SEATS = 3;
 
 const PRO_PRICE_LABEL = '$19/mo or $149/yr (individual)';
-const TEAM_PRICE_LABEL = '$49/seat/mo — Agent governance for engineering teams';
+// Enterprise is the contact-sales tier (absorbs the former Team workflow + the
+// regulated-industry lane). Pricing is scoped after intake — no self-serve seat
+// price is surfaced. The dormant TEAM_* Stripe constants below remain only as
+// inert billing plumbing pending a dedicated cleanup; they are no longer a
+// customer-facing tier.
+const ENTERPRISE_PRICE_LABEL = 'Custom pricing, scoped after intake — Enterprise agent governance';
 
 function normalizePlanId(value) {
   const text = String(value || '').trim().toLowerCase();
@@ -35,6 +40,78 @@ function normalizeSeatCount(value, fallback = TEAM_MIN_SEATS) {
   return Math.max(TEAM_MIN_SEATS, Math.round(parsed));
 }
 
+function trackedProUrl(source = 'cli_receipt', content = 'value_receipt') {
+  try {
+    const url = new URL(PRO_MONTHLY_PAYMENT_LINK);
+    url.searchParams.set('utm_source', source);
+    url.searchParams.set('utm_medium', 'cli');
+    url.searchParams.set('utm_campaign', 'pro_conversion');
+    url.searchParams.set('utm_content', content);
+    return url.toString();
+  } catch (_) {
+    return PRO_MONTHLY_PAYMENT_LINK;
+  }
+}
+
+function pluralize(count, singular, plural = `${singular}s`) {
+  return Number(count) === 1 ? singular : plural;
+}
+
+function buildCaptureReceipt({ signal, feedbackId, memoryId, actionType } = {}) {
+  const normalizedSignal = String(signal || '').toUpperCase() || 'UNKNOWN';
+  const lines = [
+    '',
+    'Value receipt',
+    '─'.repeat(50),
+    `  Stored proof   : ${normalizedSignal} feedback${feedbackId ? ` (${feedbackId})` : ''}`,
+    memoryId ? `  Local memory   : ${memoryId}` : '  Local memory   : saved locally',
+    actionType ? `  Rule pressure  : ${actionType}` : '  Rule pressure  : available for promotion',
+    '  Free today     : this proof protects this local machine',
+    '  Pro sync       : keep this lesson, rule, and dashboard synced across machines and agent runtimes',
+    '  Next proof     : npx thumbgate stats',
+    '  Cost proof     : npx thumbgate cost',
+    '',
+    `  Solo Pro       : ${PRO_PRICE_LABEL} for hosted sync, search, dashboard, and exports`,
+    `  Upgrade        : ${trackedProUrl('cli_capture_receipt', actionType || normalizedSignal.toLowerCase())}`,
+    `  Enterprise     : ${ENTERPRISE_PRICE_LABEL}; start with one repeated workflow failure`,
+    '                   https://thumbgate.ai/#workflow-sprint-intake',
+    '',
+  ];
+  return lines.join('\n');
+}
+
+function buildStatsReceipt(stats = {}) {
+  const negatives = Number(stats.negatives || stats.totalNegative || 0);
+  const blocked = Number(stats.gatesBlocked || stats.blocked || 0);
+  const warned = Number(stats.gatesWarned || stats.warned || 0);
+  const gates = Number(stats.totalGates || 0);
+  const autoPromoted = Number(stats.autoPromotedGates || 0);
+  const hasFriction = negatives > 0 || blocked > 0 || warned > 0 || gates > 0;
+  if (!hasFriction) return '';
+
+  const interventions = blocked + warned;
+  const lines = [
+    '',
+    'Paid-intent next step',
+    '─'.repeat(50),
+  ];
+  if (interventions > 0) {
+    lines.push(`  Proof already seen : ${interventions} gate ${pluralize(interventions, 'intervention')}`);
+  }
+  if (gates > 0) {
+    lines.push(`  Active prevention  : ${gates} ${pluralize(gates, 'gate')} (${autoPromoted} auto-promoted)`);
+  }
+  if (negatives > 0) {
+    lines.push(`  Failure pressure   : ${negatives} negative ${pluralize(negatives, 'signal')}`);
+  }
+  lines.push('  Show the buyer     : npx thumbgate cost');
+  lines.push('  Pro sync value     : keep these lessons/rules visible across laptops, CI, containers, and agent runtimes');
+  lines.push(`  Solo Pro           : ${trackedProUrl('cli_stats_receipt', 'proof_seen')}`);
+  lines.push('  Enterprise         : https://thumbgate.ai/#workflow-sprint-intake');
+  lines.push('');
+  return lines.join('\n');
+}
+
 module.exports = {
   PRO_MONTHLY_PAYMENT_LINK,
   PRO_ANNUAL_PAYMENT_LINK,
@@ -47,8 +124,11 @@ module.exports = {
   TEAM_ANNUAL_PRICE_DOLLARS,
   TEAM_MIN_SEATS,
   PRO_PRICE_LABEL,
-  TEAM_PRICE_LABEL,
+  ENTERPRISE_PRICE_LABEL,
   normalizePlanId,
   normalizeBillingCycle,
   normalizeSeatCount,
+  buildCaptureReceipt,
+  buildStatsReceipt,
+  trackedProUrl,
 };