thumbgate 1.27.19 → 1.28.0

package/scripts/dashboard-chat.js

@@ -0,0 +1,332 @@
+'use strict';
+
+// scripts/dashboard-chat.js
+// -----------------------------------------------------------------------------
+// "Chat with your data" — the dashboard chat backend. Local-first RAG over
+// this install's ThumbGate data (lessons, raw feedback memories via LanceDB
+// vectors, receipts, gate stats). Retrieval is local (lesson search + optional
+// vector-store.searchSimilar). Generation uses your configured LLM: a local
+// OpenAI-compatible endpoint first, then Gemini or Perplexity when explicitly
+// configured.
+//
+// Dialogflow/Google is not the dashboard chatbot brain. It remains an optional
+// guard-adapter path for buyers who already run their own Google agent tenancy.
+// -----------------------------------------------------------------------------
+
+const path = require('path');
+
+const GEMINI_ENDPOINT = 'https://generativelanguage.googleapis.com/v1beta/models';
+const PERPLEXITY_ENDPOINT = 'https://api.perplexity.ai/chat/completions';
+const DEFAULT_MODEL = 'gemini-2.5-flash';
+const MAX_QUESTION_CHARS = 2000;
+const MAX_CONTEXT_LESSONS = 8;
+
+// Allowlist the model so a user-supplied `model` cannot route the call to an
+// arbitrary / unexpected (or more expensive) endpoint. Anything not on the list
+// falls back to the default.
+const ALLOWED_MODELS = new Set([
+  'gemini-2.5-flash', 'gemini-2.5-flash-lite', 'gemini-2.5-pro',
+  'gemini-2.0-flash', 'gemini-2.0-flash-lite',
+  'gemini-flash-latest', 'gemini-flash-lite-latest', 'gemini-pro-latest',
+]);
+
+function resolveModel(requested) {
+  const r = String(requested || '').trim();
+  if (r && ALLOWED_MODELS.has(r)) return r;
+  const envModel = String(process.env.THUMBGATE_GEMINI_MODEL || '').trim();
+  if (envModel && ALLOWED_MODELS.has(envModel)) return envModel;
+  return DEFAULT_MODEL;
+}
+
+function resolveApiKey(opts = {}) {
+  let key = '';
+  if (Object.hasOwn(opts, 'apiKey')) {
+    key = opts.apiKey || '';
+  } else {
+    key = opts.apiKey || process.env.GEMINI_API_KEY || process.env.THUMBGATE_GEMINI_API_KEY || process.env.GOOGLE_API_KEY || process.env.PERPLEXITY_API_KEY || process.env.THUMBGATE_PERPLEXITY_API_KEY || '';
+  }
+  if (!key) return '';
+  return key.trim().replace(/^["']|["']$/g, '');
+}
+
+function debugChatFallback(label, err) {
+  if (process.env.THUMBGATE_DEBUG_CHAT !== '1') return;
+  const detail = err?.message ? err.message : String(err);
+  console.warn(`[dashboard-chat] ${label}: ${detail}`);
+}
+
+function loadLessonSearcher() {
+  try {
+    return require(path.join(__dirname, 'lesson-search')).searchLessons;
+  } catch (err) {
+    debugChatFallback('lesson search unavailable', err);
+    return null;
+  }
+}
+
+function lessonToContextItem(lesson) {
+  return {
+    id: lesson.id,
+    signal: lesson.signal || lesson.feedback || '',
+    title: (lesson.title || '').replace(/^(?:MISTAKE|SUCCESS):\s*/i, '').slice(0, 160),
+    content: String(lesson.content || lesson.context || '').replace(/\s+/g, ' ').trim().slice(0, 600),
+    tags: lesson.tags || [],
+    source: 'lessons',
+  };
+}
+
+function vectorMatchToContextItem(match, index) {
+  return {
+    id: match.id || `vec-${index}`,
+    signal: match.signal || '',
+    title: String(match.context || match.text || '').slice(0, 100),
+    content: match.text || match.context || '',
+    tags: match.tags ? String(match.tags).split(',').filter(Boolean) : [],
+    source: 'lancedb-vector',
+  };
+}
+
+function dedupeContextItems(items, limit = MAX_CONTEXT_LESSONS + 3) {
+  const seen = new Set();
+  return items.filter((item) => {
+    if (!(item.content || item.title)) return false;
+    const key = item.id || item.content.slice(0, 80);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).slice(0, limit);
+}
+
+function retrieveLessonContext(question, opts = {}) {
+  const searchLessons = loadLessonSearcher();
+  if (!searchLessons) return [];
+  try {
+    const res = searchLessons(String(question || ''), {
+      limit: MAX_CONTEXT_LESSONS,
+      feedbackDir: opts.feedbackDir,
+    });
+    const rows = res?.results || res?.lessons || [];
+    return rows.slice(0, MAX_CONTEXT_LESSONS).map(lessonToContextItem);
+  } catch (err) {
+    debugChatFallback('lesson retrieval failed', err);
+    return [];
+  }
+}
+
+async function retrieveVectorContext(question, opts = {}) {
+  if (opts.useVectorSearch === false) return [];
+  try {
+    const vectorStore = require(path.join(__dirname, 'vector-store'));
+    const vecResults = vectorStore.searchSimilar
+      ? await vectorStore.searchSimilar(String(question || ''), opts.vectorLimit || 4)
+      : [];
+    return vecResults
+      .filter((match) => match?.text)
+      .map(vectorMatchToContextItem);
+  } catch (err) {
+    debugChatFallback('vector retrieval failed', err);
+    return [];
+  }
+}
+
+// Live numeric snapshot from gate-stats + feedback analyzer. Always injected
+// (~120 tokens) so the LLM can answer count/quantity questions like
+// "how many were blocked today" without hallucinating.
+function retrieveMetricsContext() {
+  const snapshot = {};
+  try {
+    const gs = require(path.join(__dirname, 'gate-stats'));
+    const s = gs.calculateStats();
+    snapshot.gates = {
+      total: s.totalGates,
+      blockRules: s.blockGates,
+      warnRules: s.warnGates,
+      totalBlockedEvents: s.totalBlocked,
+      totalWarnedEvents: s.totalWarned,
+      estimatedHoursSaved: s.estimatedHoursSaved,
+      topBlockedTrigger: s.topBlocked?.trigger || null,
+      topBlockedOccurrences: s.topBlocked?.occurrences || 0,
+    };
+  } catch (err) {
+    debugChatFallback('gate-stats unavailable', err);
+  }
+  try {
+    const fl = require(path.join(__dirname, 'feedback-loop'));
+    const a = fl.analyzeFeedback();
+    snapshot.feedback = {
+      total: a.total,
+      positive: a.totalPositive,
+      negative: a.totalNegative,
+      approvalRate: a.approvalRate,
+      last7d: a.windows?.['7d'],
+      last30d: a.windows?.['30d'],
+      trend: a.trend,
+    };
+  } catch (err) {
+    debugChatFallback('feedback-loop analyze unavailable', err);
+  }
+  return snapshot;
+}
+
+// Retrieve relevant stored lessons and optional raw feedback vector matches.
+async function retrieveContext(question, opts = {}) {
+  const lessons = retrieveLessonContext(question, opts);
+  const vectors = await retrieveVectorContext(question, opts);
+  return dedupeContextItems([...lessons, ...vectors]);
+}
+
+// Build a grounded RAG prompt. Pure function (testable).
+function buildChatPrompt(question, lessons, metrics) {
+  const q = String(question || '').slice(0, MAX_QUESTION_CHARS).trim();
+  const context = (lessons || []).map((l, i) => {
+    const mark = /pos|up/i.test(l.signal) ? 'WORKED' : (/neg|down/i.test(l.signal) ? 'MISTAKE' : 'NOTE');
+    const tags = (l.tags || []).length ? ` [tags: ${l.tags.join(', ')}]` : '';
+    return `(${i + 1}) [${mark}] ${l.title || ''}${tags}\n    ${l.content}`;
+  }).join('\n');
+
+  const metricsBlock = metrics && Object.keys(metrics).length
+    ? `\n=== Live numeric snapshot (your data, current) ===\n${JSON.stringify(metrics, null, 2)}\n`
+    : '';
+
+  const system = [
+    'You are ThumbGate\'s "chat with your data" assistant. Answer the user\'s question',
+    'using ONLY the captured lessons and the live numeric snapshot below (this team\'s real data).',
+    'For count/quantity questions ("how many X", "what\'s our rate"), use the numeric snapshot.',
+    'For pattern/why questions, cite the lesson numbers like [1], [3].',
+    'If neither source contains the answer, say so plainly — do not invent facts.',
+  ].join(' ');
+
+  return `${system}\n\n=== Captured lessons (your data) ===\n${context || '(no relevant lessons found)'}\n${metricsBlock}\n=== Question ===\n${q}`;
+}
+
+// Parse the Gemini generateContent response into plain text. Pure (testable).
+function parseGeminiAnswer(body) {
+  const parts = body?.candidates?.[0]?.content?.parts;
+  if (!Array.isArray(parts)) return '';
+  return parts.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join('').trim();
+}
+
+function buildOpenAiChatPayload(prompt, model) {
+  return JSON.stringify({
+    model,
+    messages: [{ role: 'user', content: prompt }],
+    temperature: 0.2,
+    max_tokens: 1024,
+  });
+}
+
+function parseOpenAiChatAnswer(json) {
+  return json?.choices?.[0]?.message?.content || '';
+}
+
+function parseModelError(json, status) {
+  return json?.error?.message ? String(json.error.message).split('\n')[0] : `HTTP ${status}`;
+}
+
+function trimTrailingSlashes(value) {
+  let text = String(value || '');
+  while (text.endsWith('/')) {
+    text = text.slice(0, -1);
+  }
+  return text;
+}
+
+async function callLocalOpenAiEndpoint({ endpoint, apiKey, model, prompt, fetchImpl, sources }) {
+  const url = endpoint.includes('/chat/completions')
+    ? endpoint
+    : `${trimTrailingSlashes(endpoint)}/chat/completions`;
+  const res = await fetchImpl(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'Authorization': `Bearer ${apiKey || 'local'}`
+    },
+    body: buildOpenAiChatPayload(prompt, model),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'local_llm_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseOpenAiChatAnswer(json);
+  return { ok: true, answer: answer.trim() || '(no answer returned)', sources, model: json.model || model };
+}
+
+async function callPerplexityEndpoint({ apiKey, prompt, fetchImpl, sources }) {
+  const res = await fetchImpl(PERPLEXITY_ENDPOINT, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'Authorization': `Bearer ${apiKey}` },
+    body: buildOpenAiChatPayload(prompt, 'sonar'),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'perplexity_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseOpenAiChatAnswer(json);
+  return { ok: true, answer: answer.trim() || '(no answer returned)', sources, model: json.model || 'perplexity-hybrid' };
+}
+
+async function callGeminiEndpoint({ apiKey, model, prompt, fetchImpl, sources }) {
+  const res = await fetchImpl(`${GEMINI_ENDPOINT}/${encodeURIComponent(model)}:generateContent`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-goog-api-key': apiKey },
+    body: JSON.stringify({
+      contents: [{ role: 'user', parts: [{ text: prompt }] }],
+      generationConfig: { temperature: 0.2, maxOutputTokens: 1024 },
+    }),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'gemini_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseGeminiAnswer(json);
+  return { ok: true, answer: answer || '(no answer returned)', sources, model: json.modelVersion || model };
+}
+
+// Answer a question grounded in this install's lessons. Returns
+// { ok, answer, sources, model } or { ok:false, error, ... }.
+async function answerDataQuestion(question, opts = {}) {
+  const q = String(question || '').trim();
+  if (!q) return { ok: false, error: 'empty_question', message: 'Ask a question about your data.' };
+  if (q.length > MAX_QUESTION_CHARS) {
+    return { ok: false, error: 'question_too_long', message: `Question exceeds ${MAX_QUESTION_CHARS} characters.` };
+  }
+
+  const localEndpoint = opts.localEndpoint || process.env.THUMBGATE_LOCAL_LLM_ENDPOINT || '';
+  const localModel = opts.localModel || process.env.THUMBGATE_LOCAL_LLM_MODEL || 'llama3';
+  const apiKey = resolveApiKey(opts);
+  const lessons = await retrieveContext(q, opts);
+  const sources = lessons.map((l) => ({ id: l.id, title: l.title, signal: l.signal }));
+
+  if (!apiKey && !localEndpoint) {
+    return {
+      ok: false,
+      error: 'no_api_key',
+      message: 'Chat is not configured. Set a valid GEMINI_API_KEY, PERPLEXITY_API_KEY, or THUMBGATE_LOCAL_LLM_ENDPOINT in the project .env.',
+      sources,
+    };
+  }
+
+  const model = resolveModel(opts.model);
+  const metrics = retrieveMetricsContext();
+  const prompt = buildChatPrompt(q, lessons, metrics);
+  const fetchImpl = opts.fetch || globalThis.fetch;
+  const isPerplexity = apiKey && (apiKey.startsWith('pplx-') || apiKey.includes('perplexity'));
+
+  try {
+    if (localEndpoint) return await callLocalOpenAiEndpoint({ endpoint: localEndpoint, apiKey, model: localModel, prompt, fetchImpl, sources });
+    if (isPerplexity) return await callPerplexityEndpoint({ apiKey, prompt, fetchImpl, sources });
+    return await callGeminiEndpoint({ apiKey, model, prompt, fetchImpl, sources });
+  } catch (err) {
+    const safeMessage = (err && err.message) ? String(err.message).split('\n')[0].slice(0, 100) : 'An unexpected error occurred.';
+    return { ok: false, error: 'network', message: safeMessage, sources };
+  }
+}
+
+module.exports = {
+  answerDataQuestion,
+  buildChatPrompt,
+  parseGeminiAnswer,
+  retrieveContext,
+  DEFAULT_MODEL,
+  MAX_QUESTION_CHARS,
+};

package/scripts/entitlement.js

@@ -0,0 +1,250 @@
+'use strict';
+
+/**
+ * entitlement.js — signed license entitlements for ThumbGate's paid tier.
+ *
+ * Replaces the old bypassable `tg_`/`tg_pro_` prefix check in license.js with a
+ * cryptographically-verifiable, offline-checkable license token.
+ *
+ * Token format (compact JWS-like, Ed25519 / "EdDSA"):
+ *     base64url(header) "." base64url(payload) "." base64url(signature)
+ *   header  = { alg: "EdDSA", kid }          // kid selects the public key
+ *   payload = { tier, features[], exp, iat, customerId, keyId }
+ *   sig     = Ed25519 over `${b64url(header)}.${b64url(payload)}`
+ *
+ * The PRIVATE signing key lives only in the hosted billing service (or a local
+ * gitignored dev path). Only PUBLIC keys ship, in config/entitlement-public-keys.json,
+ * so any client can verify a license offline without contacting a server.
+ *
+ * Enforcement is opt-in via THUMBGATE_ENFORCE_ENTITLEMENTS so paid features can be
+ * gated without breaking existing users during rollout:
+ *   - advisory (default): requireEntitlement returns {entitled:false, reason} and
+ *     the caller may warn but proceed.
+ *   - enforced (flag set): requireEntitlement throws EntitlementError when not entitled.
+ *
+ * LIMITATION — read before overselling this. This gate runs CLIENT-SIDE in an
+ * MIT, open-source, un-compiled package. It makes a license UN-FORGEABLE (you
+ * cannot mint a valid token without the private key), but it does NOT make the
+ * check UN-BYPASSABLE: anyone with the source can monkey-patch requireEntitlement
+ * or delete the gate. So this protects against fake keys and honest free-riding,
+ * and it is the correct authorization primitive for the HOSTED service — but the
+ * only real, un-bypassable protection for the crown-jewel intelligence is to run
+ * it SERVER-SIDE (client sends inputs, gets outputs, never sees the code/weights),
+ * with these tokens as the auth. Client-side gating is a speed bump, not a wall.
+ * See docs/COMMERCIALIZATION_STRATEGY.md.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TIER_FEATURES = {
+  free: [],
+  pro: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models'],
+  team: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models', 'org-visibility'],
+  enterprise: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models', 'org-visibility', 'sso', 'audit-log', 'compliance-export'],
+};
+
+class EntitlementError extends Error {
+  constructor(message, code = 'entitlement_denied') {
+    super(message);
+    this.name = 'EntitlementError';
+    this.code = code;
+  }
+}
+
+const advisoryWarnings = new Set();
+
+function b64urlEncode(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+function b64urlDecodeJson(str) {
+  return JSON.parse(Buffer.from(str, 'base64url').toString('utf8'));
+}
+
+function isTrueEnv(value) {
+  if (!value) return false;
+  const v = String(value).trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+function isEnforced(env = process.env) {
+  return isTrueEnv(env.THUMBGATE_ENFORCE_ENTITLEMENTS);
+}
+
+/** Load the shipped public keyset ({ activeKid, keys: {kid: pem} }). */
+function loadTrustedKeys(root = path.resolve(__dirname, '..')) {
+  try {
+    const p = path.join(root, 'config', 'entitlement-public-keys.json');
+    const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return raw.keys || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Verify a license token offline. Returns a normalized result — never throws on
+ * bad input (returns { valid:false, reason }).
+ * @param {string} token
+ * @param {{ trustedKeys?: Record<string,string>, now?: number }} [opts]
+ */
+function verifyLicense(token, opts = {}) {
+  const trustedKeys = opts.trustedKeys || loadTrustedKeys();
+  const now = opts.now || Math.floor(nowMs() / 1000);
+  if (typeof token !== 'string' || !token.trim()) {
+    return { valid: false, reason: 'missing_token' };
+  }
+  // Reject the legacy bypassable prefix keys outright.
+  if (/^tg_/.test(token.trim())) {
+    return { valid: false, reason: 'legacy_prefix_key_not_a_signed_license' };
+  }
+  const parts = token.trim().split('.');
+  if (parts.length !== 3) return { valid: false, reason: 'malformed_token' };
+  const [h, p, s] = parts;
+  let header;
+  let payload;
+  try {
+    header = b64urlDecodeJson(h);
+    payload = b64urlDecodeJson(p);
+  } catch {
+    return { valid: false, reason: 'undecodable_token' };
+  }
+  if (header.alg !== 'EdDSA' || !header.kid) return { valid: false, reason: 'bad_header' };
+  const pubPem = trustedKeys[header.kid];
+  if (!pubPem) return { valid: false, reason: 'unknown_key_id' };
+
+  let signatureOk = false;
+  try {
+    signatureOk = crypto.verify(
+      null,
+      Buffer.from(`${h}.${p}`),
+      crypto.createPublicKey(pubPem),
+      Buffer.from(s, 'base64url')
+    );
+  } catch {
+    return { valid: false, reason: 'signature_verify_error' };
+  }
+  if (!signatureOk) return { valid: false, reason: 'bad_signature' };
+
+  if (typeof payload.exp === 'number' && payload.exp < now) {
+    return { valid: false, reason: 'expired', tier: payload.tier };
+  }
+  const tier = payload.tier || 'free';
+  const features = Array.isArray(payload.features) && payload.features.length
+    ? payload.features
+    : (TIER_FEATURES[tier] || []);
+  return {
+    valid: true,
+    tier,
+    features,
+    customerId: payload.customerId || null,
+    keyId: header.kid,
+    exp: payload.exp || null,
+  };
+}
+
+/**
+ * Sign a license token. PRIVATE-key operation — runs in the hosted billing
+ * service (or a local dev/setup script), never in the shipped client at runtime.
+ * @param {string} privateKeyPem
+ * @param {{ tier:string, features?:string[], customerId?:string, kid:string, expSeconds?:number, iat?:number, exp?:number }} claims
+ */
+function issueLicense(privateKeyPem, claims) {
+  const header = { alg: 'EdDSA', kid: claims.kid };
+  const iat = claims.iat || Math.floor(nowMs() / 1000);
+  const exp = claims.exp || (claims.expSeconds ? iat + claims.expSeconds : undefined);
+  const payload = {
+    tier: claims.tier,
+    features: claims.features || TIER_FEATURES[claims.tier] || [],
+    customerId: claims.customerId || null,
+    keyId: claims.kid,
+    iat,
+    ...(exp ? { exp } : {}),
+  };
+  const h = b64urlEncode(JSON.stringify(header));
+  const p = b64urlEncode(JSON.stringify(payload));
+  const sig = crypto.sign(null, Buffer.from(`${h}.${p}`), crypto.createPrivateKey(privateKeyPem));
+  return `${h}.${p}.${b64urlEncode(sig)}`;
+}
+
+/** Resolve the active license token from env or the local config file. */
+function resolveLicenseToken(env = process.env) {
+  if (env.THUMBGATE_LICENSE && env.THUMBGATE_LICENSE.trim()) return env.THUMBGATE_LICENSE.trim();
+  try {
+    const p = path.join(os.homedir(), '.config', 'thumbgate', 'license.json');
+    const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+    if (raw.license || raw.token) return String(raw.license || raw.token).trim();
+  } catch { /* no local license */ }
+  return null;
+}
+
+/**
+ * Gate a paid feature. Advisory by default; throws EntitlementError only when
+ * THUMBGATE_ENFORCE_ENTITLEMENTS is set. Returns { entitled, tier, reason }.
+ * @param {string} feature
+ * @param {{ env?: NodeJS.ProcessEnv, trustedKeys?: object, token?: string }} [opts]
+ */
+function requireEntitlement(feature, opts = {}) {
+  const env = opts.env || process.env;
+  const token = opts.token !== undefined ? opts.token : resolveLicenseToken(env);
+  const result = verifyLicense(token, { trustedKeys: opts.trustedKeys });
+  const entitled = result.valid && result.features.includes(feature);
+  const decision = {
+    entitled,
+    tier: result.valid ? result.tier : 'free',
+    feature,
+    reason: entitled ? 'entitled' : (result.valid ? 'feature_not_in_tier' : result.reason),
+    enforced: isEnforced(env),
+  };
+  if (!entitled && decision.enforced) {
+    throw new EntitlementError(
+      `ThumbGate: "${feature}" requires a paid license (current tier: ${decision.tier}, reason: ${decision.reason}). `
+      + `Get a license at https://thumbgate.ai/pricing, then set THUMBGATE_LICENSE or ~/.config/thumbgate/license.json.`,
+      decision.reason
+    );
+  }
+  return decision;
+}
+
+/**
+ * Shared paid-feature wrapper for commercial entrypoints. In advisory mode it
+ * emits one warning per feature/label and lets the caller continue; in enforced
+ * mode `requireEntitlement()` throws before this function returns.
+ */
+function requirePaidFeature(feature, opts = {}) {
+  const decision = requireEntitlement(feature, opts);
+  const label = opts.label || feature;
+  const warningKey = `${feature}:${label}`;
+  if (!decision.entitled && !opts.silent && !advisoryWarnings.has(warningKey)) {
+    advisoryWarnings.add(warningKey);
+    console.error(`⚠️ ThumbGate: ${label} requires a paid license (tier: ${decision.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
+  return decision;
+}
+
+function requireLearnedModelsEntitlement(opts = {}) {
+  return requirePaidFeature('learned-models', {
+    ...opts,
+    label: opts.label || 'learned-models intelligence',
+  });
+}
+
+// Injectable clock (Date.now is fine at runtime; kept in one place for testability).
+function nowMs() {
+  return Date.now();
+}
+
+module.exports = {
+  verifyLicense,
+  issueLicense,
+  requireEntitlement,
+  requirePaidFeature,
+  requireLearnedModelsEntitlement,
+  resolveLicenseToken,
+  loadTrustedKeys,
+  isEnforced,
+  TIER_FEATURES,
+  EntitlementError,
+};

package/scripts/export-databricks-bundle.js

@@ -129,6 +129,11 @@ function timestampSlug() {
 }
 
 function exportDatabricksBundle(feedbackDir = getDefaultFeedbackDir(), outputPath, options = {}) {
+  // Paid-feature gate (advisory by default; enforced via THUMBGATE_ENFORCE_ENTITLEMENTS=1).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: Databricks bundle export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const resolvedFeedbackDir = path.resolve(feedbackDir || getDefaultFeedbackDir());
   const resolvedProofDir = path.resolve(options.proofDir || DEFAULT_PROOF_DIR);
   const exportedAt = new Date().toISOString();

package/scripts/export-dpo-pairs.js

@@ -180,6 +180,12 @@ function toJSONL(pairs) {
 }
 
 function exportDpoFromMemories(memories) {
+  // Paid-feature gate: DPO export is a commercial (Pro+) capability. Advisory by
+  // default; enforced when THUMBGATE_ENFORCE_ENTITLEMENTS=1 (then this throws).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: DPO export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const errors = memories.filter((m) => m.category === 'error');
   const learnings = memories.filter((m) => m.category === 'learning');
   const result = buildDpoPairs(errors, learnings);

package/scripts/export-hf-dataset.js

@@ -177,6 +177,11 @@ function buildDatasetInfo({ traceCount, preferenceCount, exportedAt }) {
  * @returns {Object} Export summary
  */
 function exportHfDataset(options = {}) {
+  // Paid-feature gate (advisory by default; enforced via THUMBGATE_ENFORCE_ENTITLEMENTS=1).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: HuggingFace dataset export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const feedbackDir = options.feedbackDir || resolveFeedbackDir();
   const outputDir = options.outputDir || path.join(feedbackDir, 'hf-dataset');
   const includeProvenance = options.includeProvenance !== false;