thumbgate 1.27.20 → 1.28.1

package/scripts/checkout-attribution-reference.js

@@ -0,0 +1,85 @@
+'use strict';
+
+// Attribution survival for EXTERNAL Stripe Payment Links.
+//
+// The $499 diagnostic and the sprint check out via raw `buy.stripe.com` Payment
+// Links. Payment Links DROP appended utm_* query params and carry NO session
+// metadata — but they DO preserve `client_reference_id` into
+// `checkout.session.completed`. Without packing attribution into that field, a
+// marketplace-attributed paid checkout (e.g. utm_source=aiventyx) is recorded as
+// source=unknown, so it can neither be credited to the marketplace partner nor
+// reported. This module packs/parses a compact, URL- and Stripe-safe reference.
+//
+// Current format: `tg2<source><traceId><acquisitionId><planId>`, with every
+// field encoded as a two-digit length followed by the cleaned value. The
+// parser remains backward-compatible with the original three-field `tg1`
+// format. Stripe accepts only [A-Za-z0-9_-], so punctuation delimiters are
+// invalid. Length-prefixing preserves valid hyphens and underscores without
+// introducing an unsupported delimiter and keeps the value under Stripe's
+// 200-character limit.
+
+const CURRENT_PREFIX = 'tg2';
+const LEGACY_PREFIX = 'tg1';
+const MAX_FIELD = 45;
+
+function cleanField(value, maxLength = MAX_FIELD) {
+  return String(value == null ? '' : value)
+    .replace(/[^A-Za-z0-9_-]/g, '')
+    .slice(0, maxLength);
+}
+
+function encodeField(value) {
+  const field = cleanField(value);
+  return `${String(field.length).padStart(2, '0')}${field}`;
+}
+
+// Build a Stripe `client_reference_id` from checkout metadata. Returns null when
+// there is no attributable source (so callers append nothing).
+function packCheckoutReference(metadata = {}) {
+  const source = cleanField(metadata.utmSource || metadata.source);
+  if (!source) return null;
+  const traceId = cleanField(metadata.traceId);
+  const acquisitionId = cleanField(metadata.acquisitionId);
+  const planId = cleanField(metadata.planId || metadata.plan_id);
+  return `${CURRENT_PREFIX}${encodeField(source)}${encodeField(traceId)}${encodeField(acquisitionId)}${encodeField(planId)}`;
+}
+
+// Parse a `client_reference_id` produced by packCheckoutReference. Returns null
+// for anything that is not a recognized tg1 reference with a real source.
+function parseCheckoutReference(clientReferenceId) {
+  const raw = String(clientReferenceId == null ? '' : clientReferenceId);
+  const prefix = raw.startsWith(CURRENT_PREFIX)
+    ? CURRENT_PREFIX
+    : raw.startsWith(LEGACY_PREFIX)
+      ? LEGACY_PREFIX
+      : null;
+  if (!prefix) return null;
+  const fieldCount = prefix === CURRENT_PREFIX ? 4 : 3;
+  const maxFieldLength = prefix === CURRENT_PREFIX ? MAX_FIELD : 60;
+
+  const fields = [];
+  let cursor = prefix.length;
+  for (let index = 0; index < fieldCount; index += 1) {
+    const lengthToken = raw.slice(cursor, cursor + 2);
+    if (!/^\d{2}$/.test(lengthToken)) return null;
+    const fieldLength = Number(lengthToken);
+    if (fieldLength > maxFieldLength) return null;
+    cursor += 2;
+    const field = raw.slice(cursor, cursor + fieldLength);
+    if (field.length !== fieldLength || cleanField(field, maxFieldLength) !== field) return null;
+    fields.push(field);
+    cursor += fieldLength;
+  }
+  if (cursor !== raw.length) return null;
+
+  const [source, traceId, acquisitionId, planId] = fields;
+  if (!source) return null;
+  return {
+    source,
+    traceId: traceId || null,
+    acquisitionId: acquisitionId || null,
+    planId: planId || null,
+  };
+}
+
+module.exports = { packCheckoutReference, parseCheckoutReference };

package/scripts/claude-feedback-sync.js

@@ -5,11 +5,12 @@ const fs = require('fs');
 const path = require('path');
 const {
   captureFeedback,
+  buildFeedbackSourceIdentity,
   getFeedbackPaths,
   readJSONL,
   analyzeFeedback,
 } = require('./feedback-loop');
-const { normalizeFeedbackText } = require('./feedback-quality');
+const { detectFeedbackSignal, normalizeFeedbackText } = require('./feedback-quality');
 const {
   resolveFeedbackDir,
   resolveProjectDir,
@@ -126,10 +127,8 @@ function parseHistoryTimestamp(value) {
 }
 
 function detectSignal(text) {
-  const normalized = String(text || '').toLowerCase();
-  if (/(thumbs?\s*down|that failed|that was wrong|fix this)/i.test(normalized)) return 'down';
-  if (/(thumbs?\s*up|that worked|looks good|nice work|perfect|good job)/i.test(normalized)) return 'up';
-  return null;
+  const detected = detectFeedbackSignal(text);
+  return detected ? detected.signal : null;
 }
 
 function extractPromptText(entry) {
@@ -179,6 +178,9 @@ function toHistoryCandidate(entry, options = {}) {
     promptText,
     signal,
     timestampMs: parseHistoryTimestamp(entry.timestamp),
+    sessionId: entry.sessionId || entry.session_id || null,
+    promptId: entry.promptId || entry.prompt_id || null,
+    projectDir: entry.project || entry.cwd || null,
   };
 }
 
@@ -261,15 +263,30 @@ function syncClaudeHistoryFeedback(options = {}) {
         continue;
       }
 
+      const sourceEvent = buildFeedbackSourceIdentity({
+        signal: candidate.signal,
+        promptText: candidate.promptText,
+        sessionId: candidate.sessionId,
+        promptId: candidate.promptId,
+        projectDir: candidate.projectDir,
+        timestamp: candidate.timestampMs,
+        source: 'claude-history',
+      });
       const captureResult = captureFeedback({
         signal: candidate.signal,
         context: candidate.promptText,
         whatWentWrong: candidate.signal === 'down' ? candidate.promptText : undefined,
         whatWorked: candidate.signal === 'up' ? candidate.promptText : undefined,
         tags: ['claude-history-sync', 'auto-capture-fallback'],
+        sourceEvent,
       });
 
-      if (captureResult && captureResult.feedbackEvent) {
+      if (captureResult?.duplicate) {
+        processedIds.add(candidate.externalId);
+        skippedCount += 1;
+        continue;
+      }
+      if (captureResult?.feedbackEvent) {
         existingEntries.push(captureResult.feedbackEvent);
       }
       processedIds.add(candidate.externalId);

package/scripts/cli-feedback.js

@@ -29,6 +29,7 @@ const G = '\x1b[32m';
 const R = '\x1b[31m';
 const C = '\x1b[36m';
 const M = '\x1b[35m';
+const Y = '\x1b[33m';
 const D = '\x1b[90m';
 const BD = '\x1b[1m';
 const RST = '\x1b[0m';
@@ -43,9 +44,10 @@ const RST = '\x1b[0m';
  * @param {Array} [opts.chatHistory] - Conversation messages for distillation
  * @param {string} [opts.whatWentWrong] - For thumbs down
  * @param {string} [opts.whatWorked] - For thumbs up
+ * @param {Object} [opts.sourceEvent] - Hashed source identity for idempotent hook capture
  * @returns {Object} Result with feedback + lesson + stats
  */
-function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, whatWorked } = {}) {
+function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, whatWorked, sourceEvent } = {}) {
   const isDown = signal === 'down' || signal === 'negative';
 
   // 1. Capture the feedback
@@ -56,6 +58,7 @@ function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, wh
       context: context || (isDown ? 'Thumbs down from CLI' : 'Thumbs up from CLI'),
       whatWentWrong: whatWentWrong || undefined,
       whatWorked: whatWorked || undefined,
+      sourceEvent,
     });
   } catch (err) {
     feedbackResult = { accepted: false, reason: err.message };
@@ -73,7 +76,15 @@ function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, wh
   const recentLesson = getRecentLesson();
   const stats = getLessonStats();
 
-  return { feedbackResult, distillResult, recentLesson, stats };
+  // 4. If the user wrote an explicit "never …" / "always …" directive, surface
+  //    an OFFER (never auto-act): "never" on a thumbs-down → offer force-gate now.
+  let forceGateHint = null;
+  try {
+    const { suggestForceGate } = require('./imperative-detector');
+    forceGateHint = suggestForceGate({ signal, text: whatWentWrong || whatWorked || context });
+  } catch { /* detector optional; never block capture on it */ }
+
+  return { feedbackResult, distillResult, recentLesson, stats, forceGateHint };
 }
 
 /**
@@ -81,23 +92,37 @@ function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, wh
  */
 function formatCliOutput(result) {
   const lines = [];
-  const feedbackSignal = result.feedbackResult?.signal || result.feedbackResult?.feedbackEvent?.signal;
+  const feedbackResult = result.feedbackResult;
+  const feedbackSignal = feedbackResult?.signal || feedbackResult?.feedbackEvent?.signal;
   const isDown = ['down', 'negative', 'thumbs_down'].includes(feedbackSignal);
 
   // Header
-  if (result.feedbackResult && result.feedbackResult.accepted !== false) {
+  if (feedbackResult?.duplicate) {
+    lines.push(`${Y}${BD}Feedback already captured${RST}`);
+    const feedbackId = feedbackResult.feedbackEvent?.id;
+    const memoryId = feedbackResult.memoryRecord?.id;
+    if (feedbackId) lines.push(`${D}  Feedback ID: ${feedbackId}${RST}`);
+    if (memoryId) lines.push(`${D}  Memory ID  : ${memoryId}${RST}`);
+  } else if (feedbackResult && feedbackResult.accepted !== false) {
     lines.push(`${isDown ? R : G}${BD}${isDown ? '👎 Thumbs down recorded' : '👍 Thumbs up recorded'}${RST}`);
-    const feedbackId = (result.feedbackResult.feedbackEvent && result.feedbackResult.feedbackEvent.id) || result.feedbackResult.id;
-    const memoryId = (result.feedbackResult.memoryRecord && result.feedbackResult.memoryRecord.id) || result.feedbackResult.memoryId;
+    const feedbackId = feedbackResult.feedbackEvent?.id || feedbackResult.id;
+    const memoryId = feedbackResult.memoryRecord?.id || feedbackResult.memoryId;
     if (feedbackId) {
       lines.push(`${D}  Feedback ID: ${feedbackId}${RST}`);
       if (memoryId) lines.push(`${D}  Memory ID  : ${memoryId}${RST}`);
       // Echo feedback ID to stderr so it's visible directly in the terminal,
       // not hidden behind Claude Code's "ctrl+o to expand" MCP call collapse.
-      process.stderr.write(`✅ Feedback captured (${feedbackId}${memoryId ? `, ${memoryId}` : ''})\n`);
+      const capturedIds = memoryId ? `${feedbackId}, ${memoryId}` : feedbackId;
+      process.stderr.write(`✅ Feedback captured (${capturedIds})\n`);
     }
   } else {
-    lines.push(`${R}Feedback not accepted: ${(result.feedbackResult && result.feedbackResult.reason) || 'unknown'}${RST}`);
+    lines.push(`${R}Feedback not accepted: ${feedbackResult?.reason || 'unknown'}${RST}`);
+  }
+
+  // Explicit-directive offer (e.g. "never …" → offer immediate force-gate).
+  if (result.forceGateHint?.message) {
+    const color = result.forceGateHint.kind === 'force-gate-offer' ? Y : D;
+    lines.push('', `${color}💡 ${result.forceGateHint.message}${RST}`);
   }
 
   // Distilled lesson (if thumbs down)

package/scripts/commercial-offer.js

@@ -67,11 +67,11 @@ function buildCaptureReceipt({ signal, feedbackId, memoryId, actionType } = {})
     memoryId ? `  Local memory   : ${memoryId}` : '  Local memory   : saved locally',
     actionType ? `  Rule pressure  : ${actionType}` : '  Rule pressure  : available for promotion',
     '  Free today     : this proof protects this local machine',
-    '  Pro sync       : keep this lesson, rule, and dashboard synced across machines and agent runtimes',
+    '  Pro recall     : keep this lesson searchable, exportable, and visible',
     '  Next proof     : npx thumbgate stats',
     '  Cost proof     : npx thumbgate cost',
     '',
-    `  Solo Pro       : ${PRO_PRICE_LABEL} for hosted sync, search, dashboard, and exports`,
+    `  Solo Pro       : ${PRO_PRICE_LABEL} for recall, dashboard, adapters, and exports`,
     `  Upgrade        : ${trackedProUrl('cli_capture_receipt', actionType || normalizedSignal.toLowerCase())}`,
     `  Enterprise     : ${ENTERPRISE_PRICE_LABEL}; start with one repeated workflow failure`,
     '                   https://thumbgate.ai/#workflow-sprint-intake',
@@ -105,7 +105,7 @@ function buildStatsReceipt(stats = {}) {
     lines.push(`  Failure pressure   : ${negatives} negative ${pluralize(negatives, 'signal')}`);
   }
   lines.push('  Show the buyer     : npx thumbgate cost');
-  lines.push('  Pro sync value     : keep these lessons/rules visible across laptops, CI, containers, and agent runtimes');
+  lines.push('  Pro recall value   : keep lessons/rules searchable, exportable, and visible');
   lines.push(`  Solo Pro           : ${trackedProUrl('cli_stats_receipt', 'proof_seen')}`);
   lines.push('  Enterprise         : https://thumbgate.ai/#workflow-sprint-intake');
   lines.push('');

package/scripts/entitlement.js

@@ -0,0 +1,250 @@
+'use strict';
+
+/**
+ * entitlement.js — signed license entitlements for ThumbGate's paid tier.
+ *
+ * Replaces the old bypassable `tg_`/`tg_pro_` prefix check in license.js with a
+ * cryptographically-verifiable, offline-checkable license token.
+ *
+ * Token format (compact JWS-like, Ed25519 / "EdDSA"):
+ *     base64url(header) "." base64url(payload) "." base64url(signature)
+ *   header  = { alg: "EdDSA", kid }          // kid selects the public key
+ *   payload = { tier, features[], exp, iat, customerId, keyId }
+ *   sig     = Ed25519 over `${b64url(header)}.${b64url(payload)}`
+ *
+ * The PRIVATE signing key lives only in the hosted billing service (or a local
+ * gitignored dev path). Only PUBLIC keys ship, in config/entitlement-public-keys.json,
+ * so any client can verify a license offline without contacting a server.
+ *
+ * Enforcement is opt-in via THUMBGATE_ENFORCE_ENTITLEMENTS so paid features can be
+ * gated without breaking existing users during rollout:
+ *   - advisory (default): requireEntitlement returns {entitled:false, reason} and
+ *     the caller may warn but proceed.
+ *   - enforced (flag set): requireEntitlement throws EntitlementError when not entitled.
+ *
+ * LIMITATION — read before overselling this. This gate runs CLIENT-SIDE in an
+ * MIT, open-source, un-compiled package. It makes a license UN-FORGEABLE (you
+ * cannot mint a valid token without the private key), but it does NOT make the
+ * check UN-BYPASSABLE: anyone with the source can monkey-patch requireEntitlement
+ * or delete the gate. So this protects against fake keys and honest free-riding,
+ * and it is the correct authorization primitive for the HOSTED service — but the
+ * only real, un-bypassable protection for the crown-jewel intelligence is to run
+ * it SERVER-SIDE (client sends inputs, gets outputs, never sees the code/weights),
+ * with these tokens as the auth. Client-side gating is a speed bump, not a wall.
+ * See docs/COMMERCIALIZATION_STRATEGY.md.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const TIER_FEATURES = {
+  free: [],
+  pro: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models'],
+  team: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models', 'org-visibility'],
+  enterprise: ['recall', 'lesson-search', 'unlimited-rules', 'data-export', 'hosted-dashboard', 'hosted-sync', 'learned-models', 'org-visibility', 'sso', 'audit-log', 'compliance-export'],
+};
+
+class EntitlementError extends Error {
+  constructor(message, code = 'entitlement_denied') {
+    super(message);
+    this.name = 'EntitlementError';
+    this.code = code;
+  }
+}
+
+const advisoryWarnings = new Set();
+
+function b64urlEncode(buf) {
+  return Buffer.from(buf).toString('base64url');
+}
+function b64urlDecodeJson(str) {
+  return JSON.parse(Buffer.from(str, 'base64url').toString('utf8'));
+}
+
+function isTrueEnv(value) {
+  if (!value) return false;
+  const v = String(value).trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+function isEnforced(env = process.env) {
+  return isTrueEnv(env.THUMBGATE_ENFORCE_ENTITLEMENTS);
+}
+
+/** Load the shipped public keyset ({ activeKid, keys: {kid: pem} }). */
+function loadTrustedKeys(root = path.resolve(__dirname, '..')) {
+  try {
+    const p = path.join(root, 'config', 'entitlement-public-keys.json');
+    const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return raw.keys || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Verify a license token offline. Returns a normalized result — never throws on
+ * bad input (returns { valid:false, reason }).
+ * @param {string} token
+ * @param {{ trustedKeys?: Record<string,string>, now?: number }} [opts]
+ */
+function verifyLicense(token, opts = {}) {
+  const trustedKeys = opts.trustedKeys || loadTrustedKeys();
+  const now = opts.now || Math.floor(nowMs() / 1000);
+  if (typeof token !== 'string' || !token.trim()) {
+    return { valid: false, reason: 'missing_token' };
+  }
+  // Reject the legacy bypassable prefix keys outright.
+  if (/^tg_/.test(token.trim())) {
+    return { valid: false, reason: 'legacy_prefix_key_not_a_signed_license' };
+  }
+  const parts = token.trim().split('.');
+  if (parts.length !== 3) return { valid: false, reason: 'malformed_token' };
+  const [h, p, s] = parts;
+  let header;
+  let payload;
+  try {
+    header = b64urlDecodeJson(h);
+    payload = b64urlDecodeJson(p);
+  } catch {
+    return { valid: false, reason: 'undecodable_token' };
+  }
+  if (header.alg !== 'EdDSA' || !header.kid) return { valid: false, reason: 'bad_header' };
+  const pubPem = trustedKeys[header.kid];
+  if (!pubPem) return { valid: false, reason: 'unknown_key_id' };
+
+  let signatureOk = false;
+  try {
+    signatureOk = crypto.verify(
+      null,
+      Buffer.from(`${h}.${p}`),
+      crypto.createPublicKey(pubPem),
+      Buffer.from(s, 'base64url')
+    );
+  } catch {
+    return { valid: false, reason: 'signature_verify_error' };
+  }
+  if (!signatureOk) return { valid: false, reason: 'bad_signature' };
+
+  if (typeof payload.exp === 'number' && payload.exp < now) {
+    return { valid: false, reason: 'expired', tier: payload.tier };
+  }
+  const tier = payload.tier || 'free';
+  const features = Array.isArray(payload.features) && payload.features.length
+    ? payload.features
+    : (TIER_FEATURES[tier] || []);
+  return {
+    valid: true,
+    tier,
+    features,
+    customerId: payload.customerId || null,
+    keyId: header.kid,
+    exp: payload.exp || null,
+  };
+}
+
+/**
+ * Sign a license token. PRIVATE-key operation — runs in the hosted billing
+ * service (or a local dev/setup script), never in the shipped client at runtime.
+ * @param {string} privateKeyPem
+ * @param {{ tier:string, features?:string[], customerId?:string, kid:string, expSeconds?:number, iat?:number, exp?:number }} claims
+ */
+function issueLicense(privateKeyPem, claims) {
+  const header = { alg: 'EdDSA', kid: claims.kid };
+  const iat = claims.iat || Math.floor(nowMs() / 1000);
+  const exp = claims.exp || (claims.expSeconds ? iat + claims.expSeconds : undefined);
+  const payload = {
+    tier: claims.tier,
+    features: claims.features || TIER_FEATURES[claims.tier] || [],
+    customerId: claims.customerId || null,
+    keyId: claims.kid,
+    iat,
+    ...(exp ? { exp } : {}),
+  };
+  const h = b64urlEncode(JSON.stringify(header));
+  const p = b64urlEncode(JSON.stringify(payload));
+  const sig = crypto.sign(null, Buffer.from(`${h}.${p}`), crypto.createPrivateKey(privateKeyPem));
+  return `${h}.${p}.${b64urlEncode(sig)}`;
+}
+
+/** Resolve the active license token from env or the local config file. */
+function resolveLicenseToken(env = process.env) {
+  if (env.THUMBGATE_LICENSE && env.THUMBGATE_LICENSE.trim()) return env.THUMBGATE_LICENSE.trim();
+  try {
+    const p = path.join(os.homedir(), '.config', 'thumbgate', 'license.json');
+    const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
+    if (raw.license || raw.token) return String(raw.license || raw.token).trim();
+  } catch { /* no local license */ }
+  return null;
+}
+
+/**
+ * Gate a paid feature. Advisory by default; throws EntitlementError only when
+ * THUMBGATE_ENFORCE_ENTITLEMENTS is set. Returns { entitled, tier, reason }.
+ * @param {string} feature
+ * @param {{ env?: NodeJS.ProcessEnv, trustedKeys?: object, token?: string }} [opts]
+ */
+function requireEntitlement(feature, opts = {}) {
+  const env = opts.env || process.env;
+  const token = opts.token !== undefined ? opts.token : resolveLicenseToken(env);
+  const result = verifyLicense(token, { trustedKeys: opts.trustedKeys });
+  const entitled = result.valid && result.features.includes(feature);
+  const decision = {
+    entitled,
+    tier: result.valid ? result.tier : 'free',
+    feature,
+    reason: entitled ? 'entitled' : (result.valid ? 'feature_not_in_tier' : result.reason),
+    enforced: isEnforced(env),
+  };
+  if (!entitled && decision.enforced) {
+    throw new EntitlementError(
+      `ThumbGate: "${feature}" requires a paid license (current tier: ${decision.tier}, reason: ${decision.reason}). `
+      + `Get a license at https://thumbgate.ai/pricing, then set THUMBGATE_LICENSE or ~/.config/thumbgate/license.json.`,
+      decision.reason
+    );
+  }
+  return decision;
+}
+
+/**
+ * Shared paid-feature wrapper for commercial entrypoints. In advisory mode it
+ * emits one warning per feature/label and lets the caller continue; in enforced
+ * mode `requireEntitlement()` throws before this function returns.
+ */
+function requirePaidFeature(feature, opts = {}) {
+  const decision = requireEntitlement(feature, opts);
+  const label = opts.label || feature;
+  const warningKey = `${feature}:${label}`;
+  if (!decision.entitled && !opts.silent && !advisoryWarnings.has(warningKey)) {
+    advisoryWarnings.add(warningKey);
+    console.error(`⚠️ ThumbGate: ${label} requires a paid license (tier: ${decision.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
+  return decision;
+}
+
+function requireLearnedModelsEntitlement(opts = {}) {
+  return requirePaidFeature('learned-models', {
+    ...opts,
+    label: opts.label || 'learned-models intelligence',
+  });
+}
+
+// Injectable clock (Date.now is fine at runtime; kept in one place for testability).
+function nowMs() {
+  return Date.now();
+}
+
+module.exports = {
+  verifyLicense,
+  issueLicense,
+  requireEntitlement,
+  requirePaidFeature,
+  requireLearnedModelsEntitlement,
+  resolveLicenseToken,
+  loadTrustedKeys,
+  isEnforced,
+  TIER_FEATURES,
+  EntitlementError,
+};

package/scripts/export-databricks-bundle.js

@@ -129,6 +129,11 @@ function timestampSlug() {
 }
 
 function exportDatabricksBundle(feedbackDir = getDefaultFeedbackDir(), outputPath, options = {}) {
+  // Paid-feature gate (advisory by default; enforced via THUMBGATE_ENFORCE_ENTITLEMENTS=1).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: Databricks bundle export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const resolvedFeedbackDir = path.resolve(feedbackDir || getDefaultFeedbackDir());
   const resolvedProofDir = path.resolve(options.proofDir || DEFAULT_PROOF_DIR);
   const exportedAt = new Date().toISOString();

package/scripts/export-dpo-pairs.js

@@ -180,6 +180,12 @@ function toJSONL(pairs) {
 }
 
 function exportDpoFromMemories(memories) {
+  // Paid-feature gate: DPO export is a commercial (Pro+) capability. Advisory by
+  // default; enforced when THUMBGATE_ENFORCE_ENTITLEMENTS=1 (then this throws).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: DPO export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const errors = memories.filter((m) => m.category === 'error');
   const learnings = memories.filter((m) => m.category === 'learning');
   const result = buildDpoPairs(errors, learnings);

package/scripts/export-hf-dataset.js

@@ -177,6 +177,11 @@ function buildDatasetInfo({ traceCount, preferenceCount, exportedAt }) {
  * @returns {Object} Export summary
  */
 function exportHfDataset(options = {}) {
+  // Paid-feature gate (advisory by default; enforced via THUMBGATE_ENFORCE_ENTITLEMENTS=1).
+  const _ent = require('./entitlement').requireEntitlement('data-export');
+  if (!_ent.entitled) {
+    console.error(`⚠️ ThumbGate: HuggingFace dataset export is a paid feature (tier: ${_ent.tier}). Advisory mode — set THUMBGATE_ENFORCE_ENTITLEMENTS=1 to enforce. License: https://thumbgate.ai/pricing`);
+  }
   const feedbackDir = options.feedbackDir || resolveFeedbackDir();
   const outputDir = options.outputDir || path.join(feedbackDir, 'hf-dataset');
   const includeProvenance = options.includeProvenance !== false;