thumbgate 1.27.20 → 1.28.1

package/src/api/server.js

@@ -10,6 +10,7 @@ const {
   createUnavailableAsyncOperation,
   loadOptionalModule,
 } = require('../../scripts/private-core-boundary');
+const { redactSecrets, redactSecretsDeep } = require('../../scripts/secret-redaction');
 
 const POSTHOG_API_PATHS = new Set(['/capture', '/batch', '/decide', '/e', '/engage']);
 const POSTHOG_INGEST_HOST = 'us.i.posthog.com';
@@ -20,11 +21,16 @@ const POSTHOG_STATIC_PATH_PREFIX = '/static/';
 // Stripe catalog, with the per-tier thumbnails wired in. Re-run the
 // bootstrap workflow to regenerate; the new URLs surface in the workflow
 // summary log.
+const PRO_CHECKOUT_URL = 'https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f';
 const FIRST_FAILURE_RULE_CHECKOUT_URL = 'https://buy.stripe.com/7sY6oHaiEbTw6tP5e33sI3e';
 const QUICK_READ_CHECKOUT_URL = 'https://buy.stripe.com/5kQ7sL76s1eSaK55e33sI2H';
 const WORKFLOW_TEARDOWN_CHECKOUT_URL = 'https://buy.stripe.com/8x214n2Qc4r44lHayn3sI2I';
-const SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/28E00j3Uge1E2dzgWL3sI2J';
-const WORKFLOW_SPRINT_CHECKOUT_URL = 'https://buy.stripe.com/6oU00j8aw2iWdWh9uj3sI2K';
+// Verified live amounts (2026-07-13): diagnostic Stripe page contains $499;
+// sprint code-default Stripe slug previously pointed at a $499 diagnostic product.
+// Production sprint rail is PayPal at $1500 — pin that as the code fallback so a
+// missing Railway env cannot silently charge $499 under a $1500 label.
+const SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/9B69ATbmI4r4aK5eOD3sI3k';
+const WORKFLOW_SPRINT_CHECKOUT_URL = 'https://www.paypal.com/ncp/payment/LTQFR7P9AR3QG';
 
 function getPosthogProxyPath(pathname) {
   return pathname.slice('/ingest'.length) || '/';
@@ -213,12 +219,17 @@ const {
 const { sendProblem, PROBLEM_TYPES } = require('../../scripts/problem-detail');
 const { TOOLS: MCP_TOOLS } = require('../../scripts/tool-registry');
 const mcpOauth = require('../../scripts/mcp-oauth');
+const { packCheckoutReference } = require('../../scripts/checkout-attribution-reference');
 // OAuth 2.1 (PKCE) authorization-server state for the remote MCP connector
 // (Claude Connectors Directory requires OAuth for authenticated services).
 const oauthStore = mcpOauth.createStore();
 const pendingOauthAuthorizeRequests = new Map();
 const OAUTH_AUTHORIZE_REQUEST_TTL_MS = 10 * 60 * 1000;
 const resendMailer = require('../../scripts/mailer/resend-mailer');
+const {
+  fingerprintProKey,
+  sendProActivationAlert,
+} = require('../../scripts/pro-local-dashboard');
 const {
   buildContextFootprintReport,
 } = require('../../scripts/context-footprint');
@@ -242,6 +253,7 @@ const FEDERAL_PAGE_PATH = path.resolve(__dirname, '../../public/federal.html');
 const PRICING_PAGE_PATH = path.resolve(__dirname, '../../public/pricing.html');
 const ABOUT_PAGE_PATH = path.resolve(__dirname, '../../public/about.html');
 const DIAGNOSTIC_PAGE_PATH = path.resolve(__dirname, '../../public/diagnostic.html');
+const PARTNER_INTAKE_PAGE_PATH = path.resolve(__dirname, '../../public/partner-intake.html');
 const INSTALL_PAGE_PATH = path.resolve(__dirname, '../../public/install.html');
 const LEARN_DIR = path.resolve(__dirname, '../../public/learn');
 const GUIDES_DIR = path.resolve(__dirname, '../../public/guides');
@@ -1426,7 +1438,6 @@ function buildCheckoutAttributionMetadata(body, req, traceId) {
     : 1;
 
   return {
-    ...rawMetadata,
     traceId,
     acquisitionId: pickFirstText(rawMetadata.acquisitionId, body.acquisitionId),
     visitorId: pickFirstText(rawMetadata.visitorId, body.visitorId),
@@ -1760,8 +1771,10 @@ function appendFeedbackListLines(lines, { entries, signal, intent }) {
     lines.push(`No ${signal || 'feedback'} entries found ${intent.windowLabel}.`);
     return;
   }
-  lines.push(`${FEEDBACK_LIST_LABELS[signal] || 'Recent feedback'} (${intent.windowLabel}):`);
-  lines.push(...entries.map(formatFeedbackEntry));
+  lines.push(
+    `${FEEDBACK_LIST_LABELS[signal] || 'Recent feedback'} (${intent.windowLabel}):`,
+    ...entries.map(formatFeedbackEntry)
+  );
 }
 
 function buildFeedbackSection({ ctx, intent, feedbackDir, approval, lessonPipeline }) {
@@ -2095,6 +2108,10 @@ function buildCheckoutFallbackUrl(baseUrl, metadata = {}) {
   appendQueryParam(url, 'seat_count', metadata.seatCount);
   appendQueryParam(url, 'landing_path', metadata.landingPath);
   appendQueryParam(url, 'referrer_host', metadata.referrerHost);
+  // External Stripe Payment Links drop utm_* query params but preserve
+  // client_reference_id — pack attribution into it so marketplace-attributed paid
+  // checkouts (e.g. utm_source=aiventyx) survive to the webhook and can be credited.
+  appendQueryParam(url, 'client_reference_id', packCheckoutReference(metadata));
   return restoreStripeCheckoutPlaceholder(url.toString());
 }
 
@@ -2244,8 +2261,8 @@ a{display:block;text-decoration:none}a.secondary{border:1px solid #374151;color:
 <div class="brand"><span class="brand-mark"></span><span>ThumbGate</span></div>
 <h1>Start ThumbGate Pro</h1>
 <div class="price">$19<small>/mo</small></div>
-<p>The npm package runs your gates locally. <strong>Pro</strong> is what keeps them working across every machine, every agent runtime, and every breaking-change week.</p>
-<form action="https://buy.stripe.com/8x2dR91M84r4cSd9uj3sI3f" method="GET" data-i="pro_checkout_confirmed">
+<p>The npm package runs your gates locally. <strong>Pro</strong> removes solo caps and adds personal recall, proof, exports, and adapter maintenance. Shared hosted lessons and org dashboards are Enterprise.</p>
+<form action="${PRO_CHECKOUT_URL}" method="GET" data-i="pro_checkout_confirmed">
 ${hiddenInputs}
 <input type="email" name="prefilled_email" value="${escapeHtmlAttribute(prefilledEmail)}" placeholder="you@company.com" autocomplete="email">
 <p class="email-note">Optional. Stripe can collect your email on the secure checkout page.</p>
@@ -2264,7 +2281,7 @@ ${hiddenInputs}
 </div>
 <div class="feedback-saved" id="feedback-saved">Feedback saved.</div>
 </div>
-<div class="trust"><div class="trust-item">Lessons synced across all your machines — no local SQLite to babysit</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode — version drift is our problem, not yours</div><div class="trust-item">Hosted dashboard: gate stats, DPO export, org-wide rule library</div><div class="trust-item">24×7 ops on the rule engine — SonarCloud regressions fixed in &lt;24h</div></div>
+<div class="trust"><div class="trust-item">Personal recall and proof exports without free-tier caps</div><div class="trust-item">Adapter matrix kept current for Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode</div><div class="trust-item">Personal dashboard: gate stats, rule evidence, DPO export</div><div class="trust-item">Enterprise adds shared hosted lessons, org visibility, rollout support</div></div>
 <p class="back"><a href="/">← Back to thumbgate.ai</a></p>
 </main>
 <script>
@@ -2539,10 +2556,18 @@ function serveTrackedLinkRedirect({ req, res, parsed, hostedConfig, isHeadReques
   const { FEEDBACK_DIR } = getFeedbackPaths();
   const journeyState = resolveJourneyState(req, parsed);
   const destinationUrl = buildTrackedLinkDestination(target, hostedConfig, parsed);
+  const attribution = buildTrackedLinkAttribution(target, parsed, req, journeyState, destinationUrl);
+  if (target.external) {
+    appendQueryParam(
+      destinationUrl,
+      'client_reference_id',
+      packCheckoutReference(attribution)
+    );
+  }
   if (!isHeadRequest) {
     appendBestEffortTelemetry(
       FEEDBACK_DIR,
-      buildTrackedLinkAttribution(target, parsed, req, journeyState, destinationUrl),
+      attribution,
       req.headers,
       `tracked_link_redirect:${target.slug}`
     );
@@ -2789,9 +2814,17 @@ function fillTemplate(template, replacements) {
 }
 
 function escapeHtmlAttribute(value) {
+  // Complete HTML-entity encoder for attribute contexts. Escapes single quotes
+  // and backticks in addition to & " < > so the output is safe in single- AND
+  // double-quoted attributes (and not just the double-quoted case). Fixes
+  // CodeQL js/reflected-xss #252 (search-param `email` reflected into the
+  // checkout page's value="..." attribute) — the prior version omitted ' which
+  // left it context-fragile and unrecognized as a sanitizer.
   return String(value)
     .replaceAll('&', '&amp;')
     .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;')
+    .replaceAll('`', '&#96;')
     .replaceAll('<', '&lt;')
     .replaceAll('>', '&gt;');
 }
@@ -2862,6 +2895,11 @@ function loadPublicMarketingTemplateHtml(templatePath, runtimeConfig, pageContex
     '__SERVER_SESSION_ID__': pageContext.serverSessionId || '',
     '__SERVER_ACQUISITION_ID__': pageContext.serverAcquisitionId || '',
     '__SERVER_TELEMETRY_CAPTURED__': pageContext.serverTelemetryCaptured ? 'true' : 'false',
+    '__SERVER_ATTRIBUTION_SOURCE__': escapeHtmlAttribute(pageContext.serverAttributionSource || 'partner'),
+    '__SERVER_UTM_SOURCE__': escapeHtmlAttribute(pageContext.serverUtmSource || 'partner'),
+    '__SERVER_UTM_MEDIUM__': escapeHtmlAttribute(pageContext.serverUtmMedium || 'partner'),
+    '__SERVER_UTM_CAMPAIGN__': escapeHtmlAttribute(pageContext.serverUtmCampaign || 'hosted_listing'),
+    '__SERVER_UTM_CONTENT__': escapeHtmlAttribute(pageContext.serverUtmContent || 'partner_intake'),
     '__VERIFICATION_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
     '__COMPATIBILITY_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
     '__AUTOMATION_REPORT_URL__': 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
@@ -2883,6 +2921,10 @@ function loadDiagnosticPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(DIAGNOSTIC_PAGE_PATH, runtimeConfig, pageContext);
 }
 
+function loadPartnerIntakePageHtml(runtimeConfig, pageContext = {}) {
+  return loadPublicMarketingTemplateHtml(PARTNER_INTAKE_PAGE_PATH, runtimeConfig, pageContext);
+}
+
 function loadInstallPageHtml(runtimeConfig, pageContext = {}) {
   return loadPublicMarketingTemplateHtml(INSTALL_PAGE_PATH, runtimeConfig, pageContext);
 }
@@ -3702,6 +3744,11 @@ function servePublicMarketingPage({
     serverSessionId: journeyState.sessionId,
     serverAcquisitionId: journeyState.acquisitionId,
     serverTelemetryCaptured: landingTelemetryCaptured,
+    serverAttributionSource: landingAttribution.source,
+    serverUtmSource: landingAttribution.utmSource,
+    serverUtmMedium: landingAttribution.utmMedium,
+    serverUtmCampaign: landingAttribution.utmCampaign,
+    serverUtmContent: landingAttribution.utmContent,
     requestHost,
   });
 
@@ -4506,6 +4553,19 @@ function normalizeLeadEmail(value) {
   return email.toLowerCase();
 }
 
+function buildIntakeAlertRateLimitKey(req, env = process.env) {
+  const transportPeer = String(req.socket?.remoteAddress || 'unknown');
+  const railwayRealIp = String(req.headers['x-real-ip'] || '').trim();
+  const runningBehindRailway = Boolean(env.RAILWAY_ENVIRONMENT_ID || env.RAILWAY_PROJECT_ID);
+  const hasValidRailwayIp = /^[0-9a-f:.]{3,64}$/i.test(railwayRealIp);
+  // Railway overwrites X-Real-IP at its ingress. Outside that explicit trust
+  // boundary, forwarding headers remain caller-controlled and are ignored.
+  const clientAddress = runningBehindRailway && hasValidRailwayIp
+    ? railwayRealIp
+    : transportPeer;
+  return crypto.createHash('sha256').update(clientAddress).digest('hex');
+}
+
 function normalizeHttpUrl(value, fieldName) {
   const raw = normalizeNullableText(value);
   if (!raw) throw createHttpError(400, `${fieldName} is required`);
@@ -5221,7 +5281,14 @@ function createApiServer() {
     if (req.method === 'POST' && pathname === '/api/event') {
       // Filter bots from analytics to keep Plausible data clean
       let _botDetector;
-      try { _botDetector = require('../../scripts/bot-detection'); } catch (_e) { _botDetector = null; }
+      try {
+        _botDetector = require('../../scripts/bot-detection');
+      } catch (err) {
+        _botDetector = null;
+        if (process.env.THUMBGATE_DEBUG_BOT_DETECTION === '1') {
+          console.warn(`Optional bot-detection module unavailable: ${err.message}`);
+        }
+      }
       if (_botDetector && _botDetector.shouldExcludeFromAnalytics(req)) {
         sendJson(res, 202, { status: 'filtered', reason: 'bot' });
         return;
@@ -5607,6 +5674,16 @@ async function addContext(){
       return;
     }
 
+    // /docs is a common buyer URL; route to the public setup guide instead of 404.
+    if (isGetLikeRequest && (pathname === '/docs' || pathname === '/docs/' || pathname === '/documentation' || pathname === '/documentation/')) {
+      res.writeHead(302, {
+        Location: '/guide',
+        'Cache-Control': 'public, max-age=300',
+      });
+      res.end();
+      return;
+    }
+
     if (isGetLikeRequest && (pathname === '/guide' || pathname === '/guide.html')) {
       try {
         servePublicMarketingPage({
@@ -5742,6 +5819,25 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && (pathname === '/partner-intake' || pathname === '/partner-intake.html')) {
+      try {
+        servePublicMarketingPage({
+          req,
+          res,
+          parsed,
+          hostedConfig,
+          isHeadRequest,
+          renderHtml: loadPartnerIntakePageHtml,
+          extraTelemetry: {
+            pageType: 'partner_intake',
+          },
+        });
+      } catch (err) {
+        sendText(res, 500, err.message || 'Partner intake page unavailable');
+      }
+      return;
+    }
+
     // Natural marketing URLs for the Workflow Hardening Diagnostic/Sprint.
     // High-intent outreach refers to "the diagnostic", "the sprint", or
     // "workflow hardening"; serve a focused buyer page instead of sending
@@ -6116,7 +6212,7 @@ async function addContext(){
         // THUMBGATE_CHECKOUT_PRO_STRIPE_URL is supported for future
         // price-link rotation without a redeploy.
         const bypassTarget = process.env.THUMBGATE_CHECKOUT_PRO_STRIPE_URL
-          || FIRST_FAILURE_RULE_CHECKOUT_URL;
+          || PRO_CHECKOUT_URL;
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType: 'checkout_interstitial_bypass_redirect',
           clientType: 'web',
@@ -6180,6 +6276,12 @@ async function addContext(){
           ? 'checkout_bot_deflected'
           : 'checkout_interstitial_view';
         const missingConfirmedEmail = hasConfirmFlag && !hasValidCustomerEmailHint;
+        let checkoutDeflectionReason = botClassification.reason;
+        if (missingConfirmedEmail) {
+          checkoutDeflectionReason = hasCustomerEmailHint
+            ? 'invalid_customer_email'
+            : 'missing_customer_email';
+        }
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType,
           clientType: 'web',
@@ -6203,9 +6305,7 @@ async function addContext(){
           isBot: botClassification.isBot ? 'true' : 'false',
           interstitialSampled: interstitialSampled ? 'true' : 'false',
           interstitialSampleRate,
-          reason: missingConfirmedEmail
-            ? (hasCustomerEmailHint ? 'invalid_customer_email' : 'missing_customer_email')
-            : botClassification.reason,
+          reason: checkoutDeflectionReason,
           confirmEmailRequired: missingConfirmedEmail ? 'true' : 'false',
         }, req.headers, eventType);
         const prefilledEmail = parsed?.searchParams?.get('customer_email') || '';
@@ -7411,7 +7511,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           ? await parseFormBody(req, 24 * 1024)
           : await parseJsonBody(req, 24 * 1024);
         const workflowSprintIntake = requirePrivateApiModule('workflowSprintIntake', 'Workflow sprint intake');
-        const lead = workflowSprintIntake.appendWorkflowSprintLead({
+        const leadPayload = {
           ...body,
           traceId: body.traceId || traceId,
           acquisitionId: body.acquisitionId || journeyState.acquisitionId,
@@ -7436,7 +7536,17 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           offerCode: body.offerCode || referrerAttribution.offerCode || null,
           referrerHost: body.referrerHost || referrerAttribution.referrerHost || null,
           referrer: body.referrer || referrerAttribution.referrer || null,
-        }, { feedbackDir: FEEDBACK_DIR });
+        };
+        const intakeReservation = workflowSprintIntake.reserveWorkflowSprintIntake(leadPayload, {
+          feedbackDir: FEEDBACK_DIR,
+          rateLimitKey: buildIntakeAlertRateLimitKey(req),
+        });
+        if (!intakeReservation.allowed) {
+          const error = new Error('Too many workflow-intake submissions. Try again later.');
+          error.statusCode = intakeReservation.statusCode || 429;
+          throw error;
+        }
+        const lead = workflowSprintIntake.appendWorkflowSprintLead(leadPayload, { feedbackDir: FEEDBACK_DIR });
 
         appendBestEffortTelemetry(FEEDBACK_DIR, {
           eventType: 'workflow_sprint_lead_submitted',
@@ -7467,6 +7577,11 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           referrer: lead.attribution.referrer,
         }, req.headers, 'workflow_sprint_lead_submitted');
 
+        const leadNotification = await workflowSprintIntake.notifyWorkflowSprintLead(lead, {
+          sendEmailImpl: resendMailer.sendEmail,
+          rateLimitKey: buildIntakeAlertRateLimitKey(req),
+        });
+
         if (isFormSubmission && !wantsJson(req, parsed)) {
           sendHtml(
             res,
@@ -7487,6 +7602,8 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           status: lead.status,
           offer: lead.offer,
           nextStep: 'review_proof_pack',
+          operatorAlertSent: leadNotification.sent === true,
+          operatorAlertReason: leadNotification.reason || null,
           proofPackUrl: 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md',
           sprintBriefUrl: 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/WORKFLOW_HARDENING_SPRINT.md',
         }, {
@@ -7494,7 +7611,7 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           ...(journeyState.setCookieHeaders.length ? { 'Set-Cookie': journeyState.setCookieHeaders } : {}),
         });
       } catch (err) {
-        appendBestEffortTelemetry(FEEDBACK_DIR, {
+        appendBestEffortTelemetry(FEEDBACK_DIR, redactSecretsDeep({
           eventType: 'workflow_sprint_lead_failed',
           clientType: 'web',
           traceId,
@@ -7517,10 +7634,10 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           page: referrerAttribution.page || '/#workflow-sprint-intake',
           landingPath: referrerAttribution.landingPath || '/',
           referrerHost: referrerAttribution.referrerHost,
-          referrer: referrerAttribution.referrer,
-          failureCode: err?.message ? err.message : 'workflow_sprint_lead_failed',
+          referrer: redactSecrets(referrerAttribution.referrer),
+          failureCode: redactSecrets(err?.message ? err.message : 'workflow_sprint_lead_failed'),
           httpStatus: err && err.statusCode ? err.statusCode : null,
-        }, req.headers, 'workflow_sprint_lead_failed');
+        }), redactSecretsDeep(req.headers), 'workflow_sprint_lead_failed');
         if (isFormSubmission && !wantsJson(req, parsed)) {
           sendHtml(
             res,
@@ -7806,6 +7923,15 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
           });
           return;
         }
+        if (result && result.retryable === true) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.INTERNAL,
+            title: 'Fulfillment temporarily unavailable',
+            status: 503,
+            detail: 'The payment was received but fulfillment did not complete. Stripe should retry this event.',
+          });
+          return;
+        }
         sendJson(res, 200, result);
 
       } catch (err) {
@@ -7938,16 +8064,24 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         }
 
         const resolvedTraceId = result.traceId || requestedTraceId;
+        const nextSteps = result.apiKey
+          ? {
+            env: `THUMBGATE_API_KEY=${result.apiKey}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
+            curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n+  -H 'Authorization: Bearer ${result.apiKey}' \\\n+  -H 'Content-Type: application/json' \\\n+  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
+          }
+          : result.offerKind === 'workflow_hardening_diagnostic'
+            ? { fulfillment: 'Payment confirmed. Diagnostic fulfillment is processing; an email will arrive when it completes.' }
+            : {};
 
         sendJson(res, 200, {
           ...result,
           traceId: resolvedTraceId || null,
           appOrigin: hostedConfig.appOrigin,
           apiBaseUrl: hostedConfig.billingApiBaseUrl,
-          nextSteps: {
+          nextSteps: result.apiKey ? {
             env: `THUMBGATE_API_KEY=${result.apiKey || ''}\nTHUMBGATE_API_BASE_URL=${hostedConfig.billingApiBaseUrl}`,
             curl: `curl -X POST ${hostedConfig.billingApiBaseUrl}/v1/feedback/capture \\\n  -H 'Authorization: Bearer ${result.apiKey || ''}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{"signal":"down","context":"example","whatWentWrong":"example","whatToChange":"example"}'`,
-          },
+          } : nextSteps,
         }, getPublicBillingHeaders(resolvedTraceId));
       } catch (err) {
         const requestedTraceId = parsed.searchParams.get('traceId') || '';
@@ -9206,6 +9340,48 @@ a{color:#8b9}</style></head><body><form class="card" method="post" action="/oaut
         return;
       }
 
+      // POST /v1/billing/pro-activation — customer key activation alert.
+      if (req.method === 'POST' && pathname === '/v1/billing/pro-activation') {
+        const token = extractBearerToken(req);
+        const validation = validateApiKey(token);
+        if (!validation.valid) {
+          sendProblem(res, {
+            type: PROBLEM_TYPES.UNAUTHORIZED,
+            title: 'Unauthorized',
+            status: 401,
+            detail: 'A valid API key is required to access this endpoint.',
+          });
+          return;
+        }
+
+        const body = await parseJsonBody(req);
+        const keyFingerprint = fingerprintProKey(token);
+        const alert = await sendProActivationAlert({
+          key: token,
+          source: body.source || 'hosted_pro_activation',
+          version: body.version || null,
+          customerId: validation.customerId,
+          installId: validation.installId,
+          usageCount: validation.usageCount,
+          env: process.env,
+        });
+
+        sendJson(res, 200, {
+          ok: true,
+          customerId: validation.customerId,
+          installId: validation.installId,
+          usageCount: validation.usageCount,
+          keyFingerprint,
+          keyFingerprintMatchesClient: body.keyFingerprint ? body.keyFingerprint === keyFingerprint : null,
+          alert: {
+            sent: Boolean(alert?.sent),
+            reason: alert?.reason || null,
+            id: alert?.id || null,
+          },
+        });
+        return;
+      }
+
       // POST /v1/billing/provision — manually provision key (admin)
       if (req.method === 'POST' && pathname === '/v1/billing/provision') {
         if (!isStaticAdminAuthorized(req, expectedApiKey)) {
@@ -9765,6 +9941,9 @@ module.exports = {
   createApiServer,
   startServer,
   __test__: {
+    PRO_CHECKOUT_URL,
+    escapeHtmlAttribute,
+    renderCheckoutIntentPage,
     buildCheckoutFallbackUrl,
     createPrivateCoreUnavailableError,
     buildPosthogProxyRequestOptions,
@@ -9786,6 +9965,7 @@ module.exports = {
     answerEnterpriseDataChat,
     answerEnterpriseDialogflowChat,
     buildLossAnalyticsResponse,
+    buildIntakeAlertRateLimitKey,
     sanitizeHtmlUnsafeJsonValue,
   },
 };