thumbgate 1.27.19 → 1.28.0

package/scripts/verify-marketing-pages-deployed.js

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * verify-marketing-pages-deployed.js — post-deploy probe for top-level
+ * marketing pages.
+ *
+ * Reads `config/post-deploy-marketing-pages.json` and curls every entry
+ * against the live production URL (default
+ * https://thumbgate-production.up.railway.app, overridable via
+ * THUMBGATE_PROD_URL env or --prod-url=…). Each response body must
+ * contain the configured sentinel string and must not contain any configured
+ * `mustNotContain` strings. Any mismatch fails the run and the route is
+ * included in the failure summary.
+ *
+ * Intended to run as a workflow step in .github/workflows/deploy-verify.yml
+ * after the version sentinel check, so the marketing surface is verified
+ * in the same gate as /health and /dashboard. Adding a new marketing
+ * page? Add it to the JSON manifest — no workflow edit required.
+ *
+ * Modes:
+ *   --json    machine-readable report on stdout, suitable for piping
+ *             into the GitHub Actions PR comment step.
+ *   --quiet   suppress per-route lines; only print the final summary.
+ *
+ * Exit code is 0 when every page passes, 1 if any sentinel is missing
+ * or any route returns non-200.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_PROD_URL = 'https://thumbgate-production.up.railway.app';
+const DEFAULT_TIMEOUT_MS = 12000;
+const DEFAULT_MANIFEST_PATH = path.resolve(__dirname, '..', 'config', 'post-deploy-marketing-pages.json');
+
+function parseArgs(argv = []) {
+  const out = {
+    prodUrl: process.env.THUMBGATE_PROD_URL || DEFAULT_PROD_URL,
+    manifestPath: DEFAULT_MANIFEST_PATH,
+    json: false,
+    quiet: false,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+  };
+  for (const arg of argv) {
+    if (arg === '--json') out.json = true;
+    else if (arg === '--quiet') out.quiet = true;
+    else if (arg.startsWith('--prod-url=')) out.prodUrl = arg.slice('--prod-url='.length);
+    else if (arg.startsWith('--manifest=')) out.manifestPath = arg.slice('--manifest='.length);
+    else if (arg.startsWith('--timeout-ms=')) {
+      const n = Number(arg.slice('--timeout-ms='.length));
+      if (Number.isFinite(n) && n > 0) out.timeoutMs = n;
+    }
+  }
+  return out;
+}
+
+function loadManifest(manifestPath) {
+  const raw = fs.readFileSync(manifestPath, 'utf-8');
+  const parsed = JSON.parse(raw);
+  if (!Array.isArray(parsed.pages) || parsed.pages.length === 0) {
+    throw new Error(`Manifest has no pages: ${manifestPath}`);
+  }
+  for (const entry of parsed.pages) {
+    if (typeof entry.route !== 'string' || !entry.route.startsWith('/')) {
+      throw new Error(`Invalid route in manifest: ${JSON.stringify(entry)}`);
+    }
+    if (typeof entry.sentinel !== 'string' || entry.sentinel.length === 0) {
+      throw new Error(`Invalid sentinel for route ${entry.route}`);
+    }
+    if (entry.mustNotContain != null) {
+      if (!Array.isArray(entry.mustNotContain) || entry.mustNotContain.some((value) => typeof value !== 'string' || value.length === 0)) {
+        throw new Error(`Invalid mustNotContain for route ${entry.route}`);
+      }
+    }
+    if (entry.userAgent != null && (typeof entry.userAgent !== 'string' || entry.userAgent.length === 0)) {
+      throw new Error(`Invalid userAgent for route ${entry.route}`);
+    }
+  }
+  return parsed;
+}
+
+async function probePage({ prodUrl, route, sentinel, mustNotContain = [], userAgent, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+  if (typeof fetchImpl !== 'function') {
+    return { route, ok: false, error: 'fetch_unavailable' };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const url = `${prodUrl.replace(/\/$/, '')}${route}`;
+    const res = await fetchImpl(url, {
+      signal: controller.signal,
+      headers: {
+        // A real browser-shaped UA so bot-deflection interstitials do not
+        // trigger; this probe is meant to verify the buyer-facing surface.
+        'User-Agent': userAgent || 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
+        Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+      },
+    });
+    const body = await res.text().catch(() => '');
+    const sentinelPresent = body.includes(sentinel);
+    const forbiddenPresent = Array.isArray(mustNotContain)
+      ? mustNotContain.filter((value) => body.includes(value))
+      : [];
+    return {
+      route,
+      url,
+      status: res.status,
+      ok: res.ok && sentinelPresent && forbiddenPresent.length === 0,
+      sentinelPresent,
+      forbiddenPresent,
+      bytes: body.length,
+    };
+  } catch (error) {
+    return {
+      route,
+      ok: false,
+      error: error?.name === 'AbortError' ? `timeout_after_${timeoutMs}ms` : (error?.message || String(error)),
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function runVerification({ prodUrl, manifestPath, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  const manifest = loadManifest(manifestPath);
+  const results = [];
+  // Sequential is fine — manifest has <20 entries; parallelism would
+  // be over-engineered and would risk masking a per-route rate-limit signal.
+  for (const entry of manifest.pages) {
+    // eslint-disable-next-line no-await-in-loop
+    const result = await probePage({
+      prodUrl,
+      route: entry.route,
+      sentinel: entry.sentinel,
+      mustNotContain: entry.mustNotContain,
+      userAgent: entry.userAgent,
+      fetchImpl,
+      timeoutMs,
+    });
+    results.push({ ...result, sentinel: entry.sentinel, description: entry.description });
+  }
+  const passed = results.filter((r) => r.ok);
+  const failed = results.filter((r) => !r.ok);
+  return {
+    generatedAt: new Date().toISOString(),
+    prodUrl,
+    manifestVersion: manifest.version,
+    totalRoutes: results.length,
+    passedCount: passed.length,
+    failedCount: failed.length,
+    verdict: failed.length === 0 ? 'pass' : 'fail',
+    results,
+  };
+}
+
+function renderHuman(report, { quiet = false } = {}) {
+  const lines = [];
+  if (!quiet) {
+    for (const r of report.results) {
+      if (r.ok) {
+        lines.push(`✅ ${r.route.padEnd(20)}  HTTP ${r.status}  bytes=${r.bytes}  sentinel-OK`);
+      } else if (r.error) {
+        lines.push(`❌ ${r.route.padEnd(20)}  ERROR ${r.error}`);
+      } else if (!r.sentinelPresent) {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}  sentinel MISSING (expected: ${JSON.stringify(r.sentinel)})`);
+      } else if (Array.isArray(r.forbiddenPresent) && r.forbiddenPresent.length > 0) {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}  forbidden content PRESENT (${r.forbiddenPresent.map((value) => JSON.stringify(value)).join(', ')})`);
+      } else {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}`);
+      }
+    }
+  }
+  lines.push(`\nSummary: ${report.passedCount}/${report.totalRoutes} pages passed against ${report.prodUrl} (verdict: ${report.verdict.toUpperCase()})`);
+  return lines.join('\n');
+}
+
+async function main(argv) {
+  const args = parseArgs(argv);
+  let report;
+  try {
+    report = await runVerification({
+      prodUrl: args.prodUrl,
+      manifestPath: args.manifestPath,
+      timeoutMs: args.timeoutMs,
+    });
+  } catch (error) {
+    process.stderr.write(`verify-marketing-pages-deployed FAILED: ${error.message}\n`);
+    process.exit(2);
+  }
+  if (args.json) {
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  } else {
+    process.stdout.write(`${renderHuman(report, { quiet: args.quiet })}\n`);
+  }
+  process.exitCode = report.verdict === 'pass' ? 0 : 1;
+}
+
+module.exports = {
+  DEFAULT_PROD_URL,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MANIFEST_PATH,
+  parseArgs,
+  loadManifest,
+  probePage,
+  runVerification,
+  renderHuman,
+};
+
+if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
+  main(process.argv.slice(2));
+}

package/scripts/visitor-journey.js

@@ -0,0 +1,172 @@
+'use strict';
+
+const STAGE_ORDER = [
+  'landing',
+  'pricing',
+  'checkout_viewed',
+  'email_submitted',
+  'stripe_redirect',
+  'purchase',
+];
+
+function parseTimestamp(row) {
+  const raw = row && (row.timestamp || row.receivedAt || row.ts);
+  const ms = raw ? Date.parse(raw) : NaN;
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function pickText(...values) {
+  for (const value of values) {
+    const text = String(value || '').trim();
+    if (text) return text;
+  }
+  return '';
+}
+
+function extractSessionId(row) {
+  return pickText(
+    row.sessionId,
+    row.visitorSessionId,
+    row.visitor_session_id,
+    row.attribution && row.attribution.sessionId,
+    row.metadata && row.metadata.sessionId,
+    row.stripeSessionId,
+    row.traceId,
+    row.acquisitionId,
+  );
+}
+
+function extractVisitorId(row) {
+  return pickText(
+    row.visitorId,
+    row.visitor_id,
+    row.installId,
+    row.attribution && row.attribution.visitorId,
+    row.metadata && row.metadata.visitorId,
+  );
+}
+
+function extractPath(row) {
+  return pickText(
+    row.path,
+    row.page,
+    row.landingPath,
+    row.landing_path,
+    row.attribution && row.attribution.landingPath,
+  );
+}
+
+function classifyStage(row) {
+  const event = String(row.eventType || row.event || '').toLowerCase();
+  const stage = String(row.stage || '').toLowerCase();
+  const path = extractPath(row).toLowerCase();
+  const cta = String(row.ctaId || row.cta_id || '').toLowerCase();
+
+  if (/purchase|paid|checkout\.session\.completed/.test(event) || stage === 'purchase') return 'purchase';
+  if (/stripe_redirect|stripe redirect|redirect started/.test(event) || stage === 'stripe_redirect') return 'stripe_redirect';
+  if (/email_submitted|email submitted|checkout_interstitial_cta_clicked/.test(event)) return 'email_submitted';
+  if (/checkout/.test(path) || /checkout.*view|checkout pro viewed/.test(event)) return 'checkout_viewed';
+  if (/pricing/.test(path) || /pricing/.test(cta) || /pricing_cta/.test(event)) return 'pricing';
+  if (/landing|page_view|landing_page_view|discovery/.test(event) || stage === 'discovery') return 'landing';
+  return null;
+}
+
+function stageRank(stage) {
+  const index = STAGE_ORDER.indexOf(stage);
+  return index === -1 ? -1 : index;
+}
+
+function nextMissingStage(maxStage) {
+  const index = stageRank(maxStage);
+  if (index < 0) return 'unknown';
+  if (maxStage === 'purchase') return 'converted';
+  return STAGE_ORDER[index + 1] || 'unknown';
+}
+
+function buildVisitorJourneySummary({ telemetryRows = [], funnelRows = [], limit = 100 } = {}) {
+  const sessions = new Map();
+  const stageCounts = Object.fromEntries(STAGE_ORDER.map((stage) => [stage, 0]));
+
+  function ingest(row, source) {
+    const ts = parseTimestamp(row);
+    if (ts == null) return;
+    const sessionId = extractSessionId(row) || `anonymous:${extractVisitorId(row) || ts}`;
+    const visitorId = extractVisitorId(row) || null;
+    const stage = classifyStage(row);
+    const path = extractPath(row);
+    const existing = sessions.get(sessionId) || {
+      sessionId,
+      visitorId,
+      firstSeen: new Date(ts).toISOString(),
+      lastSeen: new Date(ts).toISOString(),
+      maxStage: null,
+      dropoffStage: 'unknown',
+      events: [],
+      paths: [],
+      ctas: [],
+      sources: [],
+      visitorType: row.visitorType || null,
+      utm: {},
+      referrerHost: pickText(row.referrerHost, row.referrer_host, row.referrer),
+    };
+
+    existing.visitorId = existing.visitorId || visitorId;
+    existing.firstSeen = new Date(Math.min(Date.parse(existing.firstSeen), ts)).toISOString();
+    existing.lastSeen = new Date(Math.max(Date.parse(existing.lastSeen), ts)).toISOString();
+    existing.sources.push(source);
+    if (stage) {
+      stageCounts[stage] += 1;
+      if (stageRank(stage) > stageRank(existing.maxStage)) existing.maxStage = stage;
+    }
+    if (path && !existing.paths.includes(path)) existing.paths.push(path);
+    const cta = pickText(row.ctaId, row.cta_id);
+    if (cta && !existing.ctas.includes(cta)) existing.ctas.push(cta);
+    for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term']) {
+      const value = pickText(row[key], row.attribution && row.attribution[key]);
+      if (value && !existing.utm[key]) existing.utm[key] = value;
+    }
+    existing.events.push({
+      timestamp: new Date(ts).toISOString(),
+      source,
+      eventType: pickText(row.eventType, row.event, row.stage, 'unknown'),
+      stage,
+      path: path || null,
+      ctaId: cta || null,
+    });
+    sessions.set(sessionId, existing);
+  }
+
+  for (const row of telemetryRows) ingest(row, 'telemetry');
+  for (const row of funnelRows) ingest(row, 'funnel');
+
+  const journeys = [...sessions.values()].map((session) => {
+    session.sources = [...new Set(session.sources)];
+    session.events.sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+    session.maxStage = session.maxStage || 'unknown';
+    session.dropoffStage = nextMissingStage(session.maxStage);
+    session.eventCount = session.events.length;
+    return session;
+  }).sort((a, b) => Date.parse(b.lastSeen) - Date.parse(a.lastSeen));
+
+  const dropoffCounts = {};
+  for (const journey of journeys) {
+    dropoffCounts[journey.dropoffStage] = (dropoffCounts[journey.dropoffStage] || 0) + 1;
+  }
+
+  return {
+    generatedAt: new Date().toISOString(),
+    sessionCount: journeys.length,
+    stageCounts,
+    dropoffCounts,
+    journeys: journeys.slice(0, Math.max(1, Math.min(Number(limit) || 100, 500))),
+    truncated: journeys.length > Math.max(1, Math.min(Number(limit) || 100, 500)),
+  };
+}
+
+module.exports = {
+  STAGE_ORDER,
+  buildVisitorJourneySummary,
+  classifyStage,
+  extractSessionId,
+  extractVisitorId,
+};

package/src/api/server.js

@@ -20,6 +20,7 @@ const POSTHOG_STATIC_PATH_PREFIX = '/static/';
 // Stripe catalog, with the per-tier thumbnails wired in. Re-run the
 // bootstrap workflow to regenerate; the new URLs surface in the workflow
 // summary log.
+const PRO_CHECKOUT_URL = 'https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f';
 const FIRST_FAILURE_RULE_CHECKOUT_URL = 'https://buy.stripe.com/7sY6oHaiEbTw6tP5e33sI3e';
 const QUICK_READ_CHECKOUT_URL = 'https://buy.stripe.com/5kQ7sL76s1eSaK55e33sI2H';
 const WORKFLOW_TEARDOWN_CHECKOUT_URL = 'https://buy.stripe.com/8x214n2Qc4r44lHayn3sI2I';
@@ -219,6 +220,10 @@ const oauthStore = mcpOauth.createStore();
 const pendingOauthAuthorizeRequests = new Map();
 const OAUTH_AUTHORIZE_REQUEST_TTL_MS = 10 * 60 * 1000;
 const resendMailer = require('../../scripts/mailer/resend-mailer');
+const {
+  fingerprintProKey,
+  sendProActivationAlert,
+} = require('../../scripts/pro-local-dashboard');
 const {
   buildContextFootprintReport,
 } = require('../../scripts/context-footprint');
@@ -1760,8 +1765,10 @@ function appendFeedbackListLines(lines, { entries, signal, intent }) {
     lines.push(`No ${signal || 'feedback'} entries found ${intent.windowLabel}.`);
     return;
   }
-  lines.push(`${FEEDBACK_LIST_LABELS[signal] || 'Recent feedback'} (${intent.windowLabel}):`);
-  lines.push(...entries.map(formatFeedbackEntry));
+  lines.push(
+    `${FEEDBACK_LIST_LABELS[signal] || 'Recent feedback'} (${intent.windowLabel}):`,
+    ...entries.map(formatFeedbackEntry)
+  );
 }
 
 function buildFeedbackSection({ ctx, intent, feedbackDir, approval, lessonPipeline }) {
@@ -2244,8 +2251,8 @@ a{display:block;text-decoration:none}a.secondary{border:1px solid #374151;color:
 <div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div>
 <h1>Start ThumbGate Pro</h1>
 <div class="price">$19<small>/mo</small></div>
-<p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p>
-<form action="https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f" method="GET" data-i="pro_checkout_confirmed">
+<p>The npm package runs your gates locally. <strong>Pro</strong> removes solo caps and adds personal recall, proof, exports, and adapter maintenance. Shared hosted lessons and org dashboards are Enterprise.</p>
+<form action="${PRO_CHECKOUT_URL}" method="GET" data-i="pro_checkout_confirmed">
 ${hiddenInputs}
 <input type="email" name="prefilled_email" value="${escapeHtmlAttribute(prefilledEmail)}" placeholder="you@company.com" autocomplete="email">
 <p class="email-note">Optional. Stripe can collect your email on the secure checkout page.</p>
@@ -2264,7 +2271,7 @@ ${hiddenInputs}
 </div>
 <div class="feedback-saved" id="feedback-saved">Feedback saved.</div>
 </div>
-<div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div>
+<div class="trust"><div class="trust-item">Personal recall and proof exports without free-tier caps</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode</div><div class="trust-item">Personal dashboard: gate stats, rule evidence, DPO export</div><div class="trust-item">Enterprise adds shared hosted lessons, org visibility, rollout support</div></div>
 <p class="back"><a href="/">← Back to thumbgate.ai</a></p>
 </main>
 <script>
@@ -2789,9 +2796,17 @@ function fillTemplate(template, replacements) {
 }
 
 function escapeHtmlAttribute(value) {
+  // Complete HTML-entity encoder for attribute contexts. Escapes single quotes
+  // and backticks in addition to & " < > so the output is safe in single- AND
+  // double-quoted attributes (and not just the double-quoted case). Fixes
+  // CodeQL js/reflected-xss #252 (search-param `email` reflected into the
+  // checkout page's value="..." attribute) — the prior version omitted ' which
+  // left it context-fragile and unrecognized as a sanitizer.
   return String(value)
     .replaceAll('&', '&amp;')
     .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;')
+    .replaceAll('`', '&#96;')
     .replaceAll('<', '&lt;')
     .replaceAll('>', '&gt;');
 }
@@ -5221,7 +5236,14 @@ function createApiServer() {
     if (req.method === 'POST' && pathname === '/api/event') {
       // Filter bots from analytics to keep Plausible data clean
       let _botDetector;
-      try { _botDetector = require('../../scripts/bot-detection'); } catch (_e) { _botDetector = null; }
+      try {
+        _botDetector = require('../../scripts/bot-detection');
+      } catch (err) {
+        _botDetector = null;
+        if (process.env.THUMBGATE_DEBUG_BOT_DETECTION === '1') {
+          console.warn(`Optional bot-detection module unavailable: ${err.message}`);
+        }
+      }
       if (_botDetector && _botDetector.shouldExcludeFromAnalytics(req)) {
         sendJson(res, 202, { status: 'filtered', reason: 'bot' });
         return;
@@ -6116,7 +6138,7 @@ async function addContext(){
         // THUMBGATE_CHECKOUT_PRO_STRIPE_URL is supported for future
         // price-link rotation without a redeploy.
         const bypassTarget = process.env.THUMBGATE_CHECKOUT_PRO_STRIPE_URL
-          || FIRST_FAILURE_RULE_CHECKOUT_URL;
+          || PRO_CHECKOUT_URL;
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType: 'checkout_interstitial_bypass_redirect',
           clientType: 'web',
@@ -6180,6 +6202,12 @@ async function addContext(){
           ? 'checkout_bot_deflected'
           : 'checkout_interstitial_view';
         const missingConfirmedEmail = hasConfirmFlag && !hasValidCustomerEmailHint;
+        let checkoutDeflectionReason = botClassification.reason;
+        if (missingConfirmedEmail) {
+          checkoutDeflectionReason = hasCustomerEmailHint
+            ? 'invalid_customer_email'
+            : 'missing_customer_email';
+        }
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType,
           clientType: 'web',
@@ -6203,9 +6231,7 @@ async function addContext(){
           isBot: botClassification.isBot ? 'true' : 'false',
           interstitialSampled: interstitialSampled ? 'true' : 'false',
           interstitialSampleRate,
-          reason: missingConfirmedEmail
-            ? (hasCustomerEmailHint ? 'invalid_customer_email' : 'missing_customer_email')
-            : botClassification.reason,
+          reason: checkoutDeflectionReason,
           confirmEmailRequired: missingConfirmedEmail ? 'true' : 'false',
         }, req.headers, eventType);
         const prefilledEmail = parsed?.searchParams?.get('customer_email') || '';
@@ -9206,6 +9232,48 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         return;
       }
 
+      // POST /v1/billing/pro-activation — customer key activation alert.
+      if (req.method === 'POST' && pathname === '/v1/billing/pro-activation') {
+        const token = extractBearerToken(req);
+        const validation = validateApiKey(token);
+        if (!validation.valid) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.UNAUTHORIZED,
+            title: 'Unauthorized',
+            status: 401,
+            detail: 'A valid API key is required to access this endpoint.',
+          });
+          return;
+        }
+
+        const body = await parseJsonBody(req);
+        const keyFingerprint = fingerprintProKey(token);
+        const alert = await sendProActivationAlert({
+          key: token,
+          source: body.source || 'hosted_pro_activation',
+          version: body.version || null,
+          customerId: validation.customerId,
+          installId: validation.installId,
+          usageCount: validation.usageCount,
+          env: process.env,
+        });
+
+        sendJson(res, 200, {
+          ok: true,
+          customerId: validation.customerId,
+          installId: validation.installId,
+          usageCount: validation.usageCount,
+          keyFingerprint,
+          keyFingerprintMatchesClient: body.keyFingerprint ? body.keyFingerprint === keyFingerprint : null,
+          alert: {
+            sent: Boolean(alert?.sent),
+            reason: alert?.reason || null,
+            id: alert?.id || null,
+          },
+        });
+        return;
+      }
+
       // POST /v1/billing/provision — manually provision key (admin)
       if (req.method === 'POST' && pathname === '/v1/billing/provision') {
         if (!isStaticAdminAuthorized(req, expectedApiKey)) {
@@ -9765,6 +9833,9 @@ module.exports = {
   createApiServer,
   startServer,
   __test__: {
+    PRO_CHECKOUT_URL,
+    escapeHtmlAttribute,
+    renderCheckoutIntentPage,
     buildCheckoutFallbackUrl,
     createPrivateCoreUnavailableError,
     buildPosthogProxyRequestOptions,

package/.claude-plugin/marketplace.json

@@ -1,85 +0,0 @@
-{
-  "name": "thumbgate-marketplace",
-  "version": "1.27.15",
-  "owner": {
-    "name": "Igor Ganapolsky",
-    "email": "ig5973700@gmail.com"
-  },
-  "plugins": [
-    {
-      "name": "thumbgate",
-      "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-      "longDescription": "ThumbGate is a tripwire, not a memory layer. When you thumbs-down an agent action — a force-push that overwrote a teammate's commit, a destructive SQL drop, a refactor you already rejected — ThumbGate captures the pattern, distills a one-sentence lesson, and installs it as a PreToolUse block. The next time the agent reaches for the same tool call shape, the hook fires before execution and Claude sees your own words back as the reason.\n\nThe enforcement lives in the hook, not in the model's context, so the agent cannot bypass it by forgetting, by being prompted around it, or by switching sessions. Same rule works in Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, and OpenCode.\n\n33 pre-action checks shipped (force-push, destructive SQL, mass-delete, npm publish from wrong branch, deploy without verification). Budget enforcement (action count + time limits) prevents runaway agent sessions. NIST / SOC2 / OWASP / CWE compliance tags on every rule for enterprise teams. DPO training-pair export for teams running their own fine-tunes.\n\nFree tier: 2 feedback captures/day, 10 total captures, 3 active auto-promoted prevention rules, fully offline. Pro ($19/mo): hosted sync across machines and agent runtimes, dashboard, audit export.",
-      "source": {
-        "source": "npm",
-        "package": "thumbgate"
-      },
-      "version": "1.27.15",
-      "author": {
-        "name": "Igor Ganapolsky",
-        "email": "ig5973700@gmail.com",
-        "url": "https://thumbgate.ai"
-      },
-      "homepage": "https://thumbgate.ai",
-      "repository": "https://github.com/IgorGanapolsky/ThumbGate",
-      "license": "MIT",
-      "category": "developer-tools",
-      "tags": [
-        "guardrails",
-        "pretooluse",
-        "hooks",
-        "feedback",
-        "rlhf",
-        "dpo",
-        "agent-safety",
-        "workflow-hardening"
-      ],
-      "keywords": [
-        "guardrails",
-        "pretooluse",
-        "hooks",
-        "feedback",
-        "rlhf",
-        "dpo",
-        "agent-safety",
-        "workflow-hardening",
-        "claude-desktop",
-        "desktop-extension",
-        "pre-action-checks",
-        "ai-agent-safety",
-        "mcp",
-        "memory"
-      ],
-      "capabilities": {
-        "skills": 2,
-        "commands": 5,
-        "agents": 1,
-        "hooks": 3,
-        "mcpServer": "thumbgate serve"
-      },
-      "installCommand": "/plugin install thumbgate@claude-plugins-official",
-      "metadata": {
-        "author": "Igor Ganapolsky",
-        "homepage": "https://thumbgate.ai",
-        "license": "MIT",
-        "keywords": [
-          "guardrails",
-          "pretooluse",
-          "hooks",
-          "feedback",
-          "rlhf",
-          "dpo",
-          "agent-safety",
-          "workflow-hardening",
-          "claude-desktop",
-          "desktop-extension",
-          "pre-action-checks",
-          "ai-agent-safety",
-          "mcp",
-          "memory"
-        ],
-        "category": "developer-tools"
-      }
-    }
-  ]
-}