thumbgate 1.27.18 → 1.27.20

package/scripts/bot-detection.js

@@ -36,13 +36,18 @@ const BOT_PATTERNS = [
   /\bbaiduspider\b/i,
   /\bduckduckbot\b/i,
   /\bapplebot\b/i,
+  /slurp/i,
+  /petalbot/i,
+  /mediapartners/i,
   // LLM / AI crawlers — these started exploding in 2024+
   /\bgptbot\b/i,
-  /\bchatgpt-user\b/i,
+  /chatgpt/i,
   /\boai-searchbot\b/i,
-  /\bperplexitybot\b/i,
-  /\banthropic-ai\b/i,
+  /perplexity/i,
+  /anthropic/i,
   /\bclaude(?:bot|-web)\b/i,
+  /claude-searchbot/i,
+  /google-extended/i,
   /\bccbot\b/i,
   /\bcohere-ai\b/i,
   /\bbytespider\b/i,
@@ -86,6 +91,8 @@ const BOT_PATTERNS = [
   /\blibwww-perl\b/i,
   /\bjava\//i,
   /\bgo-http-client\b/i,
+  /scrapy/i,
+  /httpclient/i,
   /\bruby\b/i,
   // API/test tools
   /\bpostman(?:runtime)?\b/i,
@@ -158,8 +165,59 @@ function isProbablyBot(headers) {
   return classifyRequester(headers).isBot;
 }
 
+// --- Visitor classification (analytics filtering) ---------------------------
+// Classifies telemetry/analytics traffic as bot / owner / real_user.
+// Owner traffic is identified via the THUMBGATE_OWNER_EMAILS env var
+// (comma-separated, case-insensitive). There is no built-in default:
+// operators opt in via config, so the shipped artifact carries no
+// personal data.
+
+function getOwnerEmails(env = process.env) {
+  const raw = env.THUMBGATE_OWNER_EMAILS;
+  if (!raw) return [];
+  return raw
+    .split(',')
+    .map((entry) => entry.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function classifyVisitor(req) {
+  const ua = (req.headers && req.headers['user-agent']) || '';
+  const email = req.email || (req.query && req.query.email) || '';
+
+  for (const pattern of BOT_PATTERNS) {
+    if (pattern.test(ua)) {
+      return { type: 'bot', reason: `UA matches: ${pattern}`, userAgent: ua };
+    }
+  }
+  if (!ua || ua.length < 10) {
+    return { type: 'bot', reason: 'Empty or short user-agent', userAgent: ua };
+  }
+  if (email) {
+    const normalized = email.toLowerCase();
+    if (getOwnerEmails().some((ownerEmail) => normalized.includes(ownerEmail))) {
+      return { type: 'owner', reason: 'Email matches configured owner list', userAgent: ua };
+    }
+  }
+  return { type: 'real_user', reason: 'No bot pattern matched', userAgent: ua };
+}
+
+function shouldExcludeFromAnalytics(req) {
+  const classification = req.visitorClass || classifyVisitor(req);
+  return classification.type === 'bot';
+}
+
+function botFilterMiddleware(req, res, next) {
+  req.visitorClass = classifyVisitor(req);
+  next();
+}
+
 module.exports = {
   classifyRequester,
   isProbablyBot,
+  classifyVisitor,
+  shouldExcludeFromAnalytics,
+  botFilterMiddleware,
+  getOwnerEmails,
   BOT_PATTERNS,
 };

package/scripts/build-metadata.js

@@ -5,6 +5,11 @@ const PROJECT_ROOT = path.resolve(__dirname, '..');
 const DEFAULT_BUILD_METADATA_PATH = path.join(PROJECT_ROOT, 'config', 'build-metadata.json');
 const BUILD_SHA_ENV_KEY = 'THUMBGATE_BUILD_SHA';
 const BUILD_GENERATED_AT_ENV_KEY = 'THUMBGATE_BUILD_GENERATED_AT';
+// Railway injects this automatically for GitHub-connected deployments: the git
+// SHA of the commit that triggered the deploy. It is the ground truth for what
+// code is actually live, and unlike THUMBGATE_BUILD_SHA it cannot drift (Railway
+// sets it per deploy). https://docs.railway.com/reference/variables
+const RAILWAY_GIT_COMMIT_SHA_ENV_KEY = 'RAILWAY_GIT_COMMIT_SHA';
 
 function normalizeNullableText(value) {
   if (typeof value !== 'string') {
@@ -16,35 +21,69 @@ function normalizeNullableText(value) {
 }
 
 function resolveBuildMetadata({ env = process.env, filePath } = {}) {
+  // Precedence: immutable JSON file (baked into Docker image at build time, so it
+  // ALWAYS matches the deployed code) wins over runtime env vars. Env vars are
+  // mutable Railway/host config that can drift — they shadowed the freshly-stamped
+  // SHA in prod on 2026-05-20 and made /health lie about the deployed commit.
+  // Fall back to env vars only when the file is missing or its values are null,
+  // and require an explicit SHA env var (not just a stray GENERATED_AT) before
+  // trusting the env branch.
   const resolvedPath =
     normalizeNullableText(filePath) ||
     normalizeNullableText(env.THUMBGATE_BUILD_METADATA_PATH) ||
     DEFAULT_BUILD_METADATA_PATH;
   const envBuildSha = normalizeNullableText(env[BUILD_SHA_ENV_KEY]);
+  const railwayGitSha = normalizeNullableText(env[RAILWAY_GIT_COMMIT_SHA_ENV_KEY]);
   const envGeneratedAt = normalizeNullableText(env[BUILD_GENERATED_AT_ENV_KEY]);
 
-  if (envBuildSha || envGeneratedAt) {
+  let fileBuildSha = null;
+  let fileGeneratedAt = null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolvedPath, 'utf8'));
+    fileBuildSha = normalizeNullableText(parsed.buildSha);
+    fileGeneratedAt = normalizeNullableText(parsed.generatedAt);
+  } catch {
+    // file missing or unreadable — fall through to env branch
+  }
+
+  if (fileBuildSha) {
     return {
       path: resolvedPath,
-      buildSha: envBuildSha,
-      generatedAt: envGeneratedAt,
+      buildSha: fileBuildSha,
+      generatedAt: fileGeneratedAt || envGeneratedAt,
     };
   }
 
-  try {
-    const parsed = JSON.parse(fs.readFileSync(resolvedPath, 'utf8'));
+  // No SHA baked into the image. Prefer Railway's own per-deploy commit SHA over
+  // THUMBGATE_BUILD_SHA: the latter is set out-of-band by the deploy workflow and
+  // has drifted in prod (stuck reporting an old commit while newer code was live,
+  // because RAILWAY_SYNC_VARIABLES is off and `railway up` stamping is unreliable).
+  // RAILWAY_GIT_COMMIT_SHA is injected by Railway per deploy, so it always matches
+  // the code actually serving traffic on a GitHub-connected service.
+  if (railwayGitSha) {
     return {
       path: resolvedPath,
-      buildSha: normalizeNullableText(parsed.buildSha),
-      generatedAt: normalizeNullableText(parsed.generatedAt),
+      buildSha: railwayGitSha,
+      generatedAt: envGeneratedAt,
     };
-  } catch {
+  }
+
+  // Last resort: the workflow-managed env var. Only trust it when an explicit SHA
+  // is set. (Previously a bare GENERATED_AT with no SHA could short-circuit and
+  // return { buildSha: null }, losing both signals; now we require the SHA.)
+  if (envBuildSha) {
     return {
       path: resolvedPath,
-      buildSha: null,
-      generatedAt: null,
+      buildSha: envBuildSha,
+      generatedAt: envGeneratedAt,
     };
   }
+
+  return {
+    path: resolvedPath,
+    buildSha: null,
+    generatedAt: fileGeneratedAt || envGeneratedAt,
+  };
 }
 
 function writeBuildMetadataFile({ sha, outputPath, generatedAt = new Date().toISOString() }) {
@@ -105,6 +144,7 @@ if (require.main === module) {
 module.exports = {
   BUILD_GENERATED_AT_ENV_KEY,
   BUILD_SHA_ENV_KEY,
+  RAILWAY_GIT_COMMIT_SHA_ENV_KEY,
   DEFAULT_BUILD_METADATA_PATH,
   resolveBuildMetadata,
   writeBuildMetadataFile,

package/scripts/classifier-routing.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULT_CONFIG_PATH = path.join(__dirname, '..', 'config', 'gate-classifier-routing.json');
+
+function clamp01(value, fallback = 0) {
+  const number = Number(value);
+  if (!Number.isFinite(number)) return fallback;
+  return Math.min(1, Math.max(0, number));
+}
+
+function riskRank(risk) {
+  const normalized = String(risk || 'medium').toLowerCase();
+  if (['critical', 'block', 'regulated'].includes(normalized)) return 4;
+  if (['high', 'dangerous'].includes(normalized)) return 3;
+  if (['medium', 'warn'].includes(normalized)) return 2;
+  return 1;
+}
+
+function loadClassifierRoutingConfig(configPath = DEFAULT_CONFIG_PATH) {
+  return JSON.parse(fs.readFileSync(configPath, 'utf8'));
+}
+
+function lane(config, laneName, reason, input, overrides = {}) {
+  const laneConfig = (config.lanes && config.lanes[laneName]) || {};
+  return {
+    lane: laneName,
+    reason,
+    requiresEvidence: Boolean(laneConfig.requiresEvidence || overrides.requiresEvidence),
+    cloudAllowed: Boolean(laneConfig.cloudAllowed),
+    maxLatencyMs: laneConfig.maxLatencyMs,
+    risk: String(input.risk || 'medium').toLowerCase(),
+    ambiguity: clamp01(input.ambiguity),
+  };
+}
+
+function routeClassifier(input = {}, config = loadClassifierRoutingConfig()) {
+  const thresholds = config.thresholds || {};
+  const labelCount = Number(input.labelCount || input.examples || 0);
+  const latencyBudgetMs = Number(input.latencyBudgetMs || 0);
+  const ambiguity = clamp01(input.ambiguity);
+  const risk = riskRank(input.risk);
+  const largeBatch = Number(input.batchRows || 0) >= Number(thresholds.largeBatchRows || 50);
+  const privacySensitive = Boolean(input.privacySensitive || input.containsSecrets || input.customerData);
+  const allowCloud = Boolean(input.allowCloud);
+
+  if (input.hasHardRule || input.exactPolicyMatch) {
+    return lane(config, 'deterministic', 'exact hard rule or policy match; do not spend model tokens', input);
+  }
+
+  if (input.semanticCacheHit || input.equivalentRepeat) {
+    return lane(config, 'semantic_cache', 'semantically equivalent repeat; reuse the proven prior decision without a model call', input);
+  }
+
+  if (input.rubricFailed || input.missingEvidence || input.completionClaimWithoutProof) {
+    return lane(config, 'rubric_gate', 'rubric or completion evidence failed; block done claims until proof exists', input);
+  }
+
+  if (input.structuredDataset && (input.missingProvenance || input.missingSources)) {
+    return lane(config, 'rubric_gate', 'structured data claim is missing source provenance', input);
+  }
+
+  if (privacySensitive && !allowCloud && risk >= 3 && ambiguity >= Number(thresholds.mediumAmbiguity || 0.35)) {
+    return lane(config, 'human_review', 'private high-risk ambiguous action; keep data local and require approval', input);
+  }
+
+  if (labelCount >= Number(thresholds.classicalMinExamples || 40) && (largeBatch || latencyBudgetMs <= Number(thresholds.lowLatencyBudgetMs || 300)) && ambiguity < Number(thresholds.mediumAmbiguity || 0.35)) {
+    return lane(config, 'local_classical', 'enough examples and low ambiguity; use cheap local classification', input);
+  }
+
+  if (risk >= 3 && ambiguity >= Number(thresholds.highRiskAmbiguity || 0.65)) {
+    if (allowCloud && latencyBudgetMs >= Number(thresholds.llmMinLatencyBudgetMs || 2000)) {
+      return lane(config, 'llm_judge', 'high-risk semantic ambiguity; use a budget-capped LLM judge with evidence', input);
+    }
+    return lane(config, 'human_review', 'high-risk ambiguity without approved cloud/budget route', input);
+  }
+
+  if (labelCount < Number(thresholds.classicalMinExamples || 40) || ambiguity >= Number(thresholds.mediumAmbiguity || 0.35)) {
+    return lane(config, 'local_semantic', 'sparse labels or fuzzy intent; use local semantic recall before any LLM', input);
+  }
+
+  return lane(config, config.defaultLane || 'local_classical', 'default local route for routine gate classification', input);
+}
+
+function explainClassifierRoute(input = {}, config = loadClassifierRoutingConfig()) {
+  const decision = routeClassifier(input, config);
+  const laneConfig = (config.lanes && config.lanes[decision.lane]) || {};
+  return {
+    ...decision,
+    description: laneConfig.description || '',
+    useFor: laneConfig.useFor || [],
+  };
+}
+
+function parseArgs(argv) {
+  const input = {};
+  for (const arg of argv) {
+    if (arg === '--hard-rule') input.hasHardRule = true;
+    else if (arg === '--privacy-sensitive') input.privacySensitive = true;
+    else if (arg === '--allow-cloud') input.allowCloud = true;
+    else if (arg === '--customer-data') input.customerData = true;
+    else if (arg === '--semantic-cache-hit') input.semanticCacheHit = true;
+    else if (arg === '--equivalent-repeat') input.equivalentRepeat = true;
+    else if (arg === '--rubric-failed') input.rubricFailed = true;
+    else if (arg === '--missing-evidence') input.missingEvidence = true;
+    else if (arg === '--structured-dataset') input.structuredDataset = true;
+    else if (arg === '--missing-provenance') input.missingProvenance = true;
+    else if (arg.startsWith('--risk=')) input.risk = arg.slice('--risk='.length);
+    else if (arg.startsWith('--ambiguity=')) input.ambiguity = Number(arg.slice('--ambiguity='.length));
+    else if (arg.startsWith('--labels=')) input.labelCount = Number(arg.slice('--labels='.length));
+    else if (arg.startsWith('--latency-ms=')) input.latencyBudgetMs = Number(arg.slice('--latency-ms='.length));
+    else if (arg.startsWith('--batch-rows=')) input.batchRows = Number(arg.slice('--batch-rows='.length));
+  }
+  return input;
+}
+
+module.exports = {
+  DEFAULT_CONFIG_PATH,
+  explainClassifierRoute,
+  loadClassifierRoutingConfig,
+  routeClassifier,
+};
+
+if (require.main === module) {
+  const decision = explainClassifierRoute(parseArgs(process.argv.slice(2)));
+  process.stdout.write(`${JSON.stringify(decision, null, 2)}\n`);
+}

package/scripts/cli-feedback.js

@@ -88,11 +88,13 @@ function formatCliOutput(result) {
   if (result.feedbackResult && result.feedbackResult.accepted !== false) {
     lines.push(`${isDown ? R : G}${BD}${isDown ? '👎 Thumbs down recorded' : '👍 Thumbs up recorded'}${RST}`);
     const feedbackId = (result.feedbackResult.feedbackEvent && result.feedbackResult.feedbackEvent.id) || result.feedbackResult.id;
+    const memoryId = (result.feedbackResult.memoryRecord && result.feedbackResult.memoryRecord.id) || result.feedbackResult.memoryId;
     if (feedbackId) {
-      lines.push(`${D}  ID: ${feedbackId}${RST}`);
+      lines.push(`${D}  Feedback ID: ${feedbackId}${RST}`);
+      if (memoryId) lines.push(`${D}  Memory ID  : ${memoryId}${RST}`);
       // Echo feedback ID to stderr so it's visible directly in the terminal,
       // not hidden behind Claude Code's "ctrl+o to expand" MCP call collapse.
-      process.stderr.write(`✅ Feedback captured (${feedbackId})\n`);
+      process.stderr.write(`✅ Feedback captured (${feedbackId}${memoryId ? `, ${memoryId}` : ''})\n`);
     }
   } else {
     lines.push(`${R}Feedback not accepted: ${(result.feedbackResult && result.feedbackResult.reason) || 'unknown'}${RST}`);

package/scripts/cli-schema.js

@@ -51,6 +51,20 @@ const CLI_COMMANDS = [
       { name: 'json',            type: 'boolean', description: 'Output as JSON' },
     ],
   },
+  {
+    name: 'feedback-self-test',
+    aliases: ['dogfood'],
+    description: 'Prove thumbs feedback capture works in the current runtime',
+    group: 'capture',
+    mcpTool: 'capture_feedback',
+    flags: [
+      { name: 'feedback',     type: 'string',  description: 'Signal to test: up or down (default down)' },
+      { name: 'context',      type: 'string',  description: 'Context to store in the test capture' },
+      { name: 'persist',      type: 'boolean', description: 'Use the active ThumbGate store instead of an isolated test store' },
+      { name: 'feedback-dir', type: 'string',  description: 'Explicit feedback directory for the self-test' },
+      { name: 'json',         type: 'boolean', description: 'Output as JSON' },
+    ],
+  },
 
   // -------------------------------------------------------------------------
   // Discovery
@@ -80,6 +94,25 @@ const CLI_COMMANDS = [
       { name: 'remote',   type: 'boolean', description: 'Fetch from hosted Railway instance' },
     ],
   },
+  {
+    name: 'brain',
+    aliases: ['customer-brain', 'repo-brain'],
+    description: 'Scaffold, query, or build the governed customer/repo context brain',
+    group: 'discovery',
+    flags: [
+      { name: 'json',       type: 'boolean', description: 'Output as JSON' },
+      { name: 'task',       type: 'string',  description: 'Task description for routed context loading' },
+      { name: 'type',       type: 'string',  description: 'Memory type for remember: decision | pattern | feedback | log' },
+      { name: 'title',      type: 'string',  description: 'Title for a sourced memory entry' },
+      { name: 'content',    type: 'string',  description: 'Body for a sourced memory entry' },
+      { name: 'source',     type: 'string',  description: 'Required provenance for factual memory writes' },
+      { name: 'tags',       type: 'string',  description: 'Comma-separated memory tags' },
+      { name: 'text',       type: 'string',  description: 'Text/action to check against never-do rules' },
+      { name: 'stale-days', type: 'number',  description: 'Age threshold for cleanup report (default 60)' },
+      { name: 'write',      type: 'boolean', description: 'Save to .thumbgate/BRAIN.md (versioned, deterministic)' },
+      { name: 'limit',      type: 'number',  description: 'Max lessons to include (default 15)' },
+    ],
+  },
   {
     name: 'stats',
     description: 'Feedback analytics — approval rate, Revenue-at-Risk, recent trend',
@@ -337,6 +370,19 @@ const CLI_COMMANDS = [
       { name: 'high-risk-workflows', type: 'string', description: 'Comma-separated workflows touching money, prod, secrets, data, or publishing' },
     ],
   }),
+  discoveryCommand({
+    name: 'ai-inventory',
+    aliases: ['ai-component-inventory', 'ml-bom', 'mlbom'],
+    description: 'Scan AI/ML components and export enterprise ML-BOM evidence',
+    mcpTool: 'ai_component_inventory',
+    flags: [
+      jsonFlag(),
+      { name: 'root', type: 'string', description: 'Project root to scan' },
+      { name: 'format', type: 'string', description: 'summary, json, or cyclonedx' },
+      { name: 'output', type: 'string', description: 'Write evidence to this path' },
+      { name: 'max-files', type: 'number', description: 'Maximum files to scan' },
+    ],
+  }),
   discoveryCommand({
     name: 'long-running-agent-context-guardrails',
     aliases: ['agent-context-guardrails', 'slack-context-guardrails'],
@@ -459,6 +505,12 @@ const CLI_COMMANDS = [
     group: 'gates',
     flags: [],
   },
+  {
+    name: 'hermes-gate',
+    description: 'Hermes Agent pre_tool_call hook: gate runtime tool calls (incl. skill_manage) before they run',
+    group: 'gates',
+    flags: [],
+  },
   {
     name: 'force-gate',
     description: 'Immediately create a blocking gate from a pattern string',
@@ -525,6 +577,14 @@ const CLI_COMMANDS = [
       { name: 'json', type: 'boolean', description: 'Output as JSON' },
     ],
   },
+  {
+    name: 'audit',
+    description: 'Audit an agent transcript for repeat-mistake patterns and estimated token waste',
+    group: 'ops',
+    flags: [
+      { name: 'file', type: 'string', description: 'Path to the agent transcript to audit' },
+    ],
+  },
   {
     name: 'init',
     description: 'Scaffold .thumbgate/ config and wire agent hooks',
@@ -582,6 +642,43 @@ const CLI_COMMANDS = [
       { name: 'info',    type: 'boolean', description: 'Show Pro feature list' },
     ],
   },
+  {
+    name: 'diagnostic',
+    aliases: ['workflow-diagnostic', 'sprint-diagnostic'],
+    description: '$499 Workflow Hardening Diagnostic for one repeated AI-agent workflow failure',
+    group: 'ops',
+    flags: [],
+  },
+
+  {
+    name: 'workflow',
+    aliases: ['swarm'],
+    description: 'Execute a dynamic parallel workflow for security audit, benchmarking, or exploration',
+    group: 'ops',
+    mcpTool: 'parallel_workflow',
+    flags: [
+      { name: 'objective',   type: 'string',  required: true,  description: 'The objective to plan and execute (e.g. security audit, performance benchmark)' },
+      { name: 'concurrency', type: 'number',  description: 'Maximum parallel subtasks (default 3)' },
+      { name: 'timeoutMs',   type: 'number',  description: 'Timeout in milliseconds (default 60000)' },
+      { name: 'json',        type: 'boolean', description: 'Output results as JSON' },
+    ],
+  },
+  {
+    name: 'check-update',
+    aliases: ['upgrade-check'],
+    description: 'Check for newer versions of ThumbGate from npm or GitHub',
+    group: 'ops',
+    flags: [
+      { name: 'json', type: 'boolean', description: 'Output results as JSON' },
+    ],
+  },
+  {
+    name: 'self-update',
+    aliases: ['upgrade-cli'],
+    description: 'Automatically install the latest version of ThumbGate globally',
+    group: 'ops',
+    flags: [],
+  },
 ];
 
 /**

package/scripts/cli-telemetry.js

@@ -10,6 +10,9 @@ const _DEFAULT_TELEMETRY_HOST = 'https://thumbgate-production.up.railway.app';
 const TELEMETRY_ENDPOINT = `${process.env.THUMBGATE_API_URL || _DEFAULT_TELEMETRY_HOST}/v1/telemetry/ping`;
 const INSTALL_ID_PATH = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.thumbgate', 'install-id');
 
+// Session ID: random per process invocation. Groups all events from one CLI run.
+const SESSION_ID = crypto.randomUUID ? crypto.randomUUID() : crypto.randomBytes(16).toString('hex');
+
 /**
  * Get or create a stable anonymous install ID.
  * This is NOT tied to any personal info — it's a random UUID stored locally.
@@ -61,7 +64,9 @@ function trackEvent(eventType, metadata = {}) {
   const payload = JSON.stringify({
     eventType,
     installId: getInstallId(),
+    sessionId: SESSION_ID,
     visitorType: classifyInstall(),
+    clientType: 'cli',
     platform: os.platform(),
     arch: os.arch(),
     nodeVersion: process.version,
@@ -87,4 +92,4 @@ function trackEvent(eventType, metadata = {}) {
   } catch (_) {} // never crash the CLI
 }
 
-module.exports = { trackEvent, getInstallId, classifyInstall, INSTALL_ID_PATH };
+module.exports = { trackEvent, getInstallId, classifyInstall, INSTALL_ID_PATH, SESSION_ID };

package/scripts/commercial-offer.js

@@ -14,7 +14,12 @@ const TEAM_ANNUAL_PRICE_DOLLARS = 588;
 const TEAM_MIN_SEATS = 3;
 
 const PRO_PRICE_LABEL = '$19/mo or $149/yr (individual)';
-const TEAM_PRICE_LABEL = '$49/seat/mo — Agent governance for engineering teams';
+// Enterprise is the contact-sales tier (absorbs the former Team workflow + the
+// regulated-industry lane). Pricing is scoped after intake — no self-serve seat
+// price is surfaced. The dormant TEAM_* Stripe constants below remain only as
+// inert billing plumbing pending a dedicated cleanup; they are no longer a
+// customer-facing tier.
+const ENTERPRISE_PRICE_LABEL = 'Custom pricing, scoped after intake — Enterprise agent governance';
 
 function normalizePlanId(value) {
   const text = String(value || '').trim().toLowerCase();
@@ -35,6 +40,78 @@ function normalizeSeatCount(value, fallback = TEAM_MIN_SEATS) {
   return Math.max(TEAM_MIN_SEATS, Math.round(parsed));
 }
 
+function trackedProUrl(source = 'cli_receipt', content = 'value_receipt') {
+  try {
+    const url = new URL(PRO_MONTHLY_PAYMENT_LINK);
+    url.searchParams.set('utm_source', source);
+    url.searchParams.set('utm_medium', 'cli');
+    url.searchParams.set('utm_campaign', 'pro_conversion');
+    url.searchParams.set('utm_content', content);
+    return url.toString();
+  } catch (_) {
+    return PRO_MONTHLY_PAYMENT_LINK;
+  }
+}
+
+function pluralize(count, singular, plural = `${singular}s`) {
+  return Number(count) === 1 ? singular : plural;
+}
+
+function buildCaptureReceipt({ signal, feedbackId, memoryId, actionType } = {}) {
+  const normalizedSignal = String(signal || '').toUpperCase() || 'UNKNOWN';
+  const lines = [
+    '',
+    'Value receipt',
+    '─'.repeat(50),
+    `  Stored proof   : ${normalizedSignal} feedback${feedbackId ? ` (${feedbackId})` : ''}`,
+    memoryId ? `  Local memory   : ${memoryId}` : '  Local memory   : saved locally',
+    actionType ? `  Rule pressure  : ${actionType}` : '  Rule pressure  : available for promotion',
+    '  Free today     : this proof protects this local machine',
+    '  Pro sync       : keep this lesson, rule, and dashboard synced across machines and agent runtimes',
+    '  Next proof     : npx thumbgate stats',
+    '  Cost proof     : npx thumbgate cost',
+    '',
+    `  Solo Pro       : ${PRO_PRICE_LABEL} for hosted sync, search, dashboard, and exports`,
+    `  Upgrade        : ${trackedProUrl('cli_capture_receipt', actionType || normalizedSignal.toLowerCase())}`,
+    `  Enterprise     : ${ENTERPRISE_PRICE_LABEL}; start with one repeated workflow failure`,
+    '                   https://thumbgate.ai/#workflow-sprint-intake',
+    '',
+  ];
+  return lines.join('\n');
+}
+
+function buildStatsReceipt(stats = {}) {
+  const negatives = Number(stats.negatives || stats.totalNegative || 0);
+  const blocked = Number(stats.gatesBlocked || stats.blocked || 0);
+  const warned = Number(stats.gatesWarned || stats.warned || 0);
+  const gates = Number(stats.totalGates || 0);
+  const autoPromoted = Number(stats.autoPromotedGates || 0);
+  const hasFriction = negatives > 0 || blocked > 0 || warned > 0 || gates > 0;
+  if (!hasFriction) return '';
+
+  const interventions = blocked + warned;
+  const lines = [
+    '',
+    'Paid-intent next step',
+    '─'.repeat(50),
+  ];
+  if (interventions > 0) {
+    lines.push(`  Proof already seen : ${interventions} gate ${pluralize(interventions, 'intervention')}`);
+  }
+  if (gates > 0) {
+    lines.push(`  Active prevention  : ${gates} ${pluralize(gates, 'gate')} (${autoPromoted} auto-promoted)`);
+  }
+  if (negatives > 0) {
+    lines.push(`  Failure pressure   : ${negatives} negative ${pluralize(negatives, 'signal')}`);
+  }
+  lines.push('  Show the buyer     : npx thumbgate cost');
+  lines.push('  Pro sync value     : keep these lessons/rules visible across laptops, CI, containers, and agent runtimes');
+  lines.push(`  Solo Pro           : ${trackedProUrl('cli_stats_receipt', 'proof_seen')}`);
+  lines.push('  Enterprise         : https://thumbgate.ai/#workflow-sprint-intake');
+  lines.push('');
+  return lines.join('\n');
+}
+
 module.exports = {
   PRO_MONTHLY_PAYMENT_LINK,
   PRO_ANNUAL_PAYMENT_LINK,
@@ -47,8 +124,11 @@ module.exports = {
   TEAM_ANNUAL_PRICE_DOLLARS,
   TEAM_MIN_SEATS,
   PRO_PRICE_LABEL,
-  TEAM_PRICE_LABEL,
+  ENTERPRISE_PRICE_LABEL,
   normalizePlanId,
   normalizeBillingCycle,
   normalizeSeatCount,
+  buildCaptureReceipt,
+  buildStatsReceipt,
+  trackedProUrl,
 };