@hraness/peopleblade 0.4.0 → 0.4.1

package/README.md

@@ -15,7 +15,7 @@ Installation includes the pinned runtime dependencies Zod 4.4.3 and Effect 3.22.
 ## Install
 
 ```bash
-bun add --global @hraness/peopleblade@0.4.0
+bun add --global @hraness/peopleblade@0.4.1
 peopleblade --version
 peopleblade init
 peopleblade stats --json
@@ -51,7 +51,7 @@ execution runtime.
 path. When both variables are set, they must name the same executable. The
 bridge still requires exact Ghostget 0.18.13 before invoking a provider operation.
 
-PeopleBlade 0.4.0 contains the reviewed Ghostget-backed Beeper, Google, and WhatsApp
+PeopleBlade 0.4.1 contains the reviewed Ghostget-backed Beeper, Google, and WhatsApp
 live sync commands. Running them requires the separately installed public
 `@hraness/ghostget` 0.18.13 package. Beeper support is bounded to account-aware
 `contacts.list@3` reads, `contacts.search@1`, `messaging.search@2`, and the separate
@@ -155,20 +155,29 @@ The envelope binds this database and its current identity evidence. The strict
 legacy three-field input remains supported. JSON-mode errors are one structured
 `peopleblade.error.v1` object on stderr; successful results stay on stdout.
 
-### Optional Hunter reverse enrichment
+### Optional Hunter enrichment
 
 Hunter customers can reverse-enrich contacts that have a business email but no
-LinkedIn profile. Each explicit invocation is capped at 100 contacts, skips terminal
-prior attempts, and prints aggregate outcomes only:
+LinkedIn profile, verify stored email deliverability, or find a professional email
+for contacts that have none. Each explicit invocation is capped at 100 contacts,
+skips terminal prior attempts, and prints aggregate outcomes only:
 
 ```bash
 HUNTER_API_KEY=... peopleblade hunter reverse-enrich \
   --limit 100 --non-webmail --json
+peopleblade hunter verify --limit 100 --key-file /private/path/hunter-key --json
+peopleblade hunter find-emails --limit 100 --key-file /private/path/hunter-key --json
 ```
 
-The command promotes a LinkedIn profile only after exact returned-email,
-compatible-name, safe-URL, and local-ownership checks pass. It uses the caller's
-Hunter account directly and is separate from PeopleBlade cloud credits.
+`hunter reverse-enrich` promotes a LinkedIn profile only after exact returned-email,
+compatible-name, safe-URL, and local-ownership checks pass. `hunter verify` records
+the verdict, score, flags, and sources on the existing address without replacing it;
+a Hunter privacy rejection removes the address from identity matching.
+`hunter find-emails` starts from a trusted LinkedIn profile or usable stored name and
+organization, then adds a returned email only when its syntax, name compatibility,
+and local ownership pass. The commands use the caller's Hunter account directly
+and are separate from PeopleBlade cloud credits. `--key-file` requires a private
+regular file owned by the current user; `HUNTER_API_KEY` is the alternative.
 
 ## Privacy boundary
 

package/dist/peopleblade.js

@@ -34483,14 +34483,880 @@ async function hunterReverseEnrich(database, options) {
   };
 }
 
+// src/local/providers/hunter-verify.ts
+import { randomUUID as randomUUID5 } from "crypto";
+var PROVIDER12 = "hunter";
+var ACCOUNT_KEY4 = "hunter.io";
+var MODE9 = "email-verification";
+function allRows8(database, sql, ...bindings) {
+  return database.query(sql).all(...bindings);
+}
+function run9(database, sql, ...bindings) {
+  return database.run(sql, bindings);
+}
+function insertedId10(value) {
+  return Number(value.lastInsertRowid);
+}
+var TERMINAL_STATUSES = [
+  "valid",
+  "invalid",
+  "accept_all",
+  "webmail",
+  "disposable",
+  "unknown",
+  "claimed",
+  "invalid_email"
+];
+var VERDICTS = new Set(["valid", "invalid", "accept_all", "webmail", "disposable", "unknown"]);
+function fetchCandidates2(database, limit) {
+  const terminal = TERMINAL_STATUSES.map((status) => `'${status}'`).join(",");
+  const rows = allRows8(database, `SELECT cm.id, cm.person_id, cm.value, cm.normalized_value
+     FROM contact_methods cm
+     WHERE cm.kind = 'email' AND cm.active = 1
+       AND NOT EXISTS (
+         SELECT 1
+         FROM source_records sr
+         JOIN source_runs source_run ON source_run.id = sr.run_id
+           AND source_run.provider = 'hunter'
+           AND source_run.mode = 'email-verification'
+         JOIN contact_methods prior ON prior.person_id = sr.person_id
+           AND prior.kind = 'email'
+           AND prior.normalized_value = cm.normalized_value
+         WHERE json_extract(sr.projection_json, '$.status') IN (${terminal})
+       )
+     ORDER BY (
+       SELECT COALESCE(SUM(interaction_count), 0) FROM interaction_metrics im WHERE im.person_id = cm.person_id
+     ) DESC, cm.person_id, cm.is_primary DESC,
+       CASE cm.confidence WHEN 'exact' THEN 0 WHEN 'likely' THEN 1 WHEN 'possible' THEN 2 ELSE 3 END,
+       cm.id`);
+  const unique = new Map;
+  for (const row of rows) {
+    if (unique.has(row.normalized_value))
+      continue;
+    unique.set(row.normalized_value, {
+      contact_method_id: row.id,
+      person_id: row.person_id,
+      email: row.value,
+      normalized: row.normalized_value
+    });
+  }
+  const values = [...unique.values()];
+  return limit === undefined ? values : values.slice(0, limit);
+}
+var HUNTER_MAX_RESPONSE_BYTES2 = 2 * 1024 * 1024;
+
+class HunterHttpError2 extends Error {
+  status;
+  constructor(status) {
+    super(`HUNTER_HTTP_${status}`);
+    this.status = status;
+  }
+}
+
+class HunterResponseError2 extends Error {
+  constructor() {
+    super("HUNTER_INVALID_RESPONSE");
+  }
+}
+
+class HunterPending extends Error {
+  constructor() {
+    super("HUNTER_PENDING");
+  }
+}
+function optionalBoolean(value) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value !== "boolean")
+    throw new HunterResponseError2;
+  return value;
+}
+function optionalBoundedText(value, maximum) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > maximum)
+    throw new HunterResponseError2;
+  return value;
+}
+function parseVerifyResponse(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new HunterResponseError2;
+  const root = value;
+  const data = root["data"];
+  if (data === null || typeof data !== "object" || Array.isArray(data))
+    throw new HunterResponseError2;
+  const record9 = data;
+  const status = optionalBoundedText(record9["status"], 32);
+  const score = record9["score"];
+  if (score !== undefined && score !== null && (typeof score !== "number" || !Number.isFinite(score) || score < 0 || score > 100)) {
+    throw new HunterResponseError2;
+  }
+  const sources = record9["sources"];
+  const sourceCount = Array.isArray(sources) ? Math.min(sources.length, 100) : 0;
+  return {
+    status,
+    score: score === undefined || score === null ? null : score,
+    regexp: optionalBoolean(record9["regexp"]),
+    gibberish: optionalBoolean(record9["gibberish"]),
+    disposable: optionalBoolean(record9["disposable"]),
+    webmail: optionalBoolean(record9["webmail"]),
+    mx_records: optionalBoolean(record9["mx_records"]),
+    smtp_server: optionalBoolean(record9["smtp_server"]),
+    smtp_check: optionalBoolean(record9["smtp_check"]),
+    accept_all: optionalBoolean(record9["accept_all"]),
+    block: optionalBoolean(record9["block"]),
+    sources: sourceCount
+  };
+}
+async function hunterVerifyRequest(apiKey, email3) {
+  const url = `https://api.hunter.io/v2/email-verifier?email=${encodeURIComponent(email3)}&api_key=${encodeURIComponent(apiKey)}`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: { Accept: "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  if (response.status === 202)
+    throw new HunterPending;
+  if (!response.ok)
+    throw new HunterHttpError2(response.status);
+  if (!(response.headers.get("content-type") ?? "").toLowerCase().includes("application/json"))
+    throw new HunterResponseError2;
+  const declaredLength = Number(response.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declaredLength) && declaredLength > HUNTER_MAX_RESPONSE_BYTES2)
+    throw new HunterResponseError2;
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > HUNTER_MAX_RESPONSE_BYTES2)
+    throw new HunterResponseError2;
+  try {
+    return parseVerifyResponse(JSON.parse(new TextDecoder().decode(bytes)));
+  } catch (error) {
+    if (error instanceof HunterResponseError2)
+      throw error;
+    throw new HunterResponseError2;
+  }
+}
+async function hunterVerifyEmail(apiKey, email3) {
+  for (let attempt = 0;attempt < 3; attempt += 1) {
+    try {
+      return await hunterVerifyRequest(apiKey, email3);
+    } catch (error) {
+      if (error instanceof HunterPending) {
+        await new Promise((resolve8) => setTimeout(resolve8, 3000));
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw new HunterPending;
+}
+function hunterErrorStatus2(error) {
+  if (error.status === 400)
+    return "invalid_email";
+  if (error.status === 401 || error.status === 403)
+    return "authentication_failed";
+  if (error.status === 429)
+    return "rate_limited";
+  if (error.status === 451)
+    return "claimed";
+  if (error.status === 222)
+    return "smtp_failed";
+  return "provider_error";
+}
+function applyVerificationMetadata(database, candidate, runId, status, score) {
+  run9(database, `UPDATE contact_methods
+     SET metadata_json = json_patch(metadata_json, json(?))
+     WHERE kind = 'email' AND normalized_value = ?`, JSON.stringify({ hunter_verification: { status, score, run_id: runId } }), candidate.normalized);
+  if (status === "claimed") {
+    run9(database, `UPDATE contact_methods SET identity_eligible = 0
+       WHERE kind = 'email' AND normalized_value = ?`, candidate.normalized);
+  }
+}
+function verificationDetail(verification, status) {
+  return {
+    status,
+    score: verification.score,
+    flags: {
+      regexp: verification.regexp,
+      gibberish: verification.gibberish,
+      disposable: verification.disposable,
+      webmail: verification.webmail,
+      mx_records: verification.mx_records,
+      smtp_server: verification.smtp_server,
+      smtp_check: verification.smtp_check,
+      accept_all: verification.accept_all,
+      block: verification.block
+    },
+    sources: verification.sources
+  };
+}
+function createSourceRun2(database, startedAt, completedAt, attempted, total, verified, outcomes) {
+  const sha2 = sha256(`hunter-email-verification:${startedAt}:${randomUUID5()}`);
+  const locatorSha = sha256("hunter-email-verification-local-command");
+  const source = run9(database, `INSERT INTO source_runs(
+      provider, account_key, mode, source_sha256, source_locator_sha256,
+      completeness, result_json, started_at, completed_at
+    ) VALUES (?,?,?,?,?,?,?,?,?)`, PROVIDER12, ACCOUNT_KEY4, MODE9, sha2, locatorSha, attempted === total ? "complete" : "partial", canonicalJson2({ attempted, total, verified, outcomes }), startedAt, completedAt);
+  return insertedId10(source);
+}
+async function hunterVerifyEmails(database, options) {
+  if (options.apiKey.trim().length < 8)
+    throw new Error("HUNTER_NOT_CONFIGURED");
+  if (options.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100)) {
+    throw new Error("HUNTER_LIMIT_INVALID");
+  }
+  const delayMs = options.delayMs ?? 500;
+  const startedAt = new Date().toISOString();
+  const candidates = fetchCandidates2(database, options.limit);
+  const total = candidates.length;
+  const outcomes = {
+    valid: 0,
+    invalid: 0,
+    accept_all: 0,
+    webmail: 0,
+    disposable: 0,
+    unknown: 0,
+    claimed: 0,
+    invalid_email: 0,
+    pending: 0,
+    smtp_failed: 0,
+    rate_limited: 0,
+    authentication_failed: 0,
+    provider_error: 0,
+    network_error: 0
+  };
+  const internalRecords = [];
+  let attempted = 0;
+  let verified = 0;
+  for (const candidate of candidates) {
+    attempted += 1;
+    let status = "network_error";
+    let score = null;
+    let errorDetail = null;
+    let verification;
+    try {
+      const data = await hunterVerifyEmail(options.apiKey, candidate.email);
+      verification = data;
+      score = data.score;
+      if (data.status !== null && VERDICTS.has(data.status)) {
+        status = data.status;
+        verified += 1;
+      } else {
+        status = "provider_error";
+        errorDetail = "HUNTER_UNKNOWN_STATUS";
+      }
+    } catch (error) {
+      if (error instanceof HunterPending) {
+        status = "pending";
+      } else if (error instanceof HunterHttpError2) {
+        status = hunterErrorStatus2(error);
+        errorDetail = { httpStatus: error.status };
+      } else if (error instanceof HunterResponseError2) {
+        status = "provider_error";
+        errorDetail = error.message;
+      } else {
+        status = "network_error";
+        errorDetail = "HUNTER_NETWORK_ERROR";
+      }
+    }
+    outcomes[status] += 1;
+    internalRecords.push({
+      record: {
+        contact_method_id: candidate.contact_method_id,
+        person_id: candidate.person_id,
+        status,
+        score,
+        error: errorDetail
+      },
+      candidate,
+      ...verification === undefined ? {} : { verification }
+    });
+    options.onProgress?.(attempted, total);
+    if (status === "authentication_failed" || status === "rate_limited")
+      break;
+    if (attempted < total)
+      await new Promise((resolve8) => setTimeout(resolve8, delayMs));
+  }
+  const completedAt = new Date().toISOString();
+  let runId = 0;
+  database.exec("BEGIN");
+  try {
+    runId = createSourceRun2(database, startedAt, completedAt, attempted, total, verified, outcomes);
+    internalRecords.forEach(({ record: record9, candidate, verification }, index) => {
+      let detail;
+      if (verification !== undefined) {
+        detail = verificationDetail(verification, record9.status);
+        applyVerificationMetadata(database, candidate, runId, record9.status, verification.score);
+      } else {
+        detail = { status: record9.status, error: record9.error };
+        if (record9.status === "claimed")
+          applyVerificationMetadata(database, candidate, runId, record9.status, null);
+      }
+      const errorText = ["provider_error", "network_error", "rate_limited", "authentication_failed"].includes(record9.status) ? JSON.stringify(record9.error) : null;
+      const resolution = VERDICTS.has(record9.status) ? "matched" : "skipped";
+      run9(database, `INSERT INTO source_records(
+          run_id, ordinal, record_kind, record_sha256, person_id,
+          provider_resource_id, resolution, projection_json, error_text
+        ) VALUES (?,?,?,?,?,?,?,?,?)`, runId, index + 1, MODE9, sha256(JSON.stringify({ ordinal: index + 1, run: runId, detail })), record9.person_id, null, resolution, JSON.stringify(detail), errorText);
+    });
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
+  return {
+    attempted,
+    verified,
+    run_id: runId,
+    outcomes,
+    records: internalRecords.map(({ record: record9 }) => record9)
+  };
+}
+
+// src/local/providers/hunter-find-emails.ts
+import { randomUUID as randomUUID6 } from "crypto";
+var PROVIDER13 = "hunter";
+var LINKEDIN_PROVIDER2 = "linkedin";
+var ACCOUNT_KEY5 = "hunter.io";
+var MODE10 = "email-finder";
+function allRows9(database, sql, ...bindings) {
+  return database.query(sql).all(...bindings);
+}
+function run10(database, sql, ...bindings) {
+  return database.run(sql, bindings);
+}
+function insertedId11(value) {
+  return Number(value.lastInsertRowid);
+}
+var TERMINAL_STATUSES2 = [
+  "accepted",
+  "already_known",
+  "conflict",
+  "name_rejected",
+  "not_found",
+  "claimed",
+  "invalid_request"
+];
+var JUNK_ORGANIZATIONS = new Set([
+  "n/a",
+  "na",
+  "none",
+  "self",
+  "self-employed",
+  "self employed",
+  "freelance",
+  "freelancer",
+  "unemployed",
+  "retired",
+  "student",
+  "home",
+  "private",
+  "me",
+  "myself",
+  "unknown",
+  "various",
+  "personal",
+  "independent",
+  "consultant",
+  "consulting",
+  "-",
+  "--",
+  "."
+]);
+function usableOrganization(value) {
+  if (value === null)
+    return null;
+  const trimmed = value.trim();
+  if (trimmed.length < 3 || trimmed.length > 100)
+    return null;
+  if (!/[A-Za-z]/u.test(trimmed))
+    return null;
+  if (JUNK_ORGANIZATIONS.has(trimmed.toLowerCase()))
+    return null;
+  return trimmed;
+}
+function extractLinkedInHandle(username3, profileUrl2, resourceId) {
+  const fromUsername = username3?.trim();
+  if (fromUsername !== undefined && /^[A-Za-z0-9_-]{3,100}$/u.test(fromUsername))
+    return fromUsername;
+  const candidates = [profileUrl2, resourceId];
+  for (const raw of candidates) {
+    if (raw === null || raw === undefined)
+      continue;
+    const value = raw.trim();
+    const urlText = value.startsWith("http://") || value.startsWith("https://") ? value : null;
+    if (urlText === null) {
+      if (/^[A-Za-z0-9_-]{3,100}$/u.test(value))
+        return value;
+      continue;
+    }
+    try {
+      const url = new URL(urlText);
+      if (url.protocol !== "https:" || !["linkedin.com", "www.linkedin.com"].includes(url.hostname.toLowerCase()))
+        continue;
+      const match = /^\/in\/([^/]+)\/?$/u.exec(url.pathname);
+      if (match === null)
+        continue;
+      const handle = decodeURIComponent(match[1] ?? "");
+      if (handle.length >= 1 && handle.length <= 128 && !/\s/u.test(handle))
+        return handle;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function finderSuppression() {
+  const terminal = TERMINAL_STATUSES2.map((status) => `'${status}'`).join(",");
+  return `NOT EXISTS (
+    SELECT 1
+    FROM source_records sr
+    JOIN source_runs source_run ON source_run.id = sr.run_id
+      AND source_run.provider = 'hunter'
+      AND source_run.mode = 'email-finder'
+    WHERE sr.person_id = p.id
+      AND json_extract(sr.projection_json, '$.status') IN (${terminal})
+  )`;
+}
+function fetchCandidates3(database, limit) {
+  const linkedinRows = allRows9(database, `SELECT p.id, p.display_name, p.given_name, p.family_name, p.organization,
+            pr.username, pr.profile_url, pr.resource_id AS pr_resource_id
+     FROM people p
+     JOIN provider_resources pr ON pr.person_id = p.id AND pr.provider = 'linkedin' AND pr.active = 1
+     WHERE p.do_not_contact = 0
+       AND NOT EXISTS (
+         SELECT 1 FROM contact_methods cm WHERE cm.person_id = p.id AND cm.kind = 'email' AND cm.active = 1
+       )
+       AND ${finderSuppression()}
+     ORDER BY (
+       SELECT COALESCE(SUM(interaction_count), 0) FROM interaction_metrics im WHERE im.person_id = p.id
+     ) DESC, p.id, pr.id`);
+  const companyRows = allRows9(database, `SELECT p.id, p.display_name, p.given_name, p.family_name, p.organization
+     FROM people p
+     WHERE p.do_not_contact = 0
+       AND p.organization IS NOT NULL AND p.organization <> ''
+       AND NOT EXISTS (
+         SELECT 1 FROM contact_methods cm WHERE cm.person_id = p.id AND cm.kind = 'email' AND cm.active = 1
+       )
+       AND ${finderSuppression()}
+     ORDER BY (
+       SELECT COALESCE(SUM(interaction_count), 0) FROM interaction_metrics im WHERE im.person_id = p.id
+     ) DESC, p.id`);
+  const unique = new Map;
+  for (const row of linkedinRows) {
+    if (unique.has(row.id))
+      continue;
+    const handle = extractLinkedInHandle(row.username, row.profile_url, row.pr_resource_id);
+    if (handle === null)
+      continue;
+    unique.set(row.id, {
+      person_id: row.id,
+      display_name: row.display_name,
+      given_name: row.given_name,
+      family_name: row.family_name,
+      organization: row.organization,
+      anchor: "linkedin",
+      linkedin_handle: handle
+    });
+  }
+  for (const row of companyRows) {
+    if (unique.has(row.id))
+      continue;
+    if (usableOrganization(row.organization) === null)
+      continue;
+    const hasSplitName = (row.given_name?.trim() ?? "") !== "" && (row.family_name?.trim() ?? "") !== "";
+    const hasFullName = (row.display_name?.trim() ?? "").split(/\s+/u).filter(Boolean).length >= 2;
+    if (!hasSplitName && !hasFullName)
+      continue;
+    unique.set(row.id, {
+      person_id: row.id,
+      display_name: row.display_name,
+      given_name: row.given_name,
+      family_name: row.family_name,
+      organization: row.organization,
+      anchor: "company",
+      linkedin_handle: null
+    });
+  }
+  const values = [...unique.values()];
+  return limit === undefined ? values : values.slice(0, limit);
+}
+var HUNTER_MAX_RESPONSE_BYTES3 = 2 * 1024 * 1024;
+
+class HunterHttpError3 extends Error {
+  status;
+  constructor(status) {
+    super(`HUNTER_HTTP_${status}`);
+    this.status = status;
+  }
+}
+
+class HunterResponseError3 extends Error {
+  constructor() {
+    super("HUNTER_INVALID_RESPONSE");
+  }
+}
+function optionalBoundedText2(value, maximum) {
+  if (value === undefined || value === null)
+    return null;
+  if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > maximum)
+    throw new HunterResponseError3;
+  return value;
+}
+function parseFinderResponse(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new HunterResponseError3;
+  const root = value;
+  const data = root["data"];
+  if (data === null || data === undefined) {
+    return {
+      email: null,
+      score: null,
+      domain: null,
+      first_name: null,
+      last_name: null,
+      company: null,
+      position: null,
+      linkedin_url: null,
+      verification_status: null,
+      verification_date: null,
+      sources: 0
+    };
+  }
+  if (typeof data !== "object" || Array.isArray(data))
+    throw new HunterResponseError3;
+  const record9 = data;
+  const score = record9["score"];
+  if (score !== undefined && score !== null && (typeof score !== "number" || !Number.isFinite(score) || score < 0 || score > 100)) {
+    throw new HunterResponseError3;
+  }
+  const verification = record9["verification"];
+  let verificationStatus = null;
+  let verificationDate = null;
+  if (verification !== undefined && verification !== null) {
+    if (typeof verification !== "object" || Array.isArray(verification))
+      throw new HunterResponseError3;
+    const verificationRecord = verification;
+    verificationStatus = optionalBoundedText2(verificationRecord["status"], 32);
+    verificationDate = optionalBoundedText2(verificationRecord["date"], 64);
+  }
+  const sources = record9["sources"];
+  const sourceCount = Array.isArray(sources) ? Math.min(sources.length, 100) : 0;
+  return {
+    email: optionalBoundedText2(record9["email"], 320),
+    score: score === undefined || score === null ? null : score,
+    domain: optionalBoundedText2(record9["domain"], 255),
+    first_name: optionalBoundedText2(record9["first_name"], 256),
+    last_name: optionalBoundedText2(record9["last_name"], 256),
+    company: optionalBoundedText2(record9["company"], 512),
+    position: optionalBoundedText2(record9["position"], 512),
+    linkedin_url: optionalBoundedText2(record9["linkedin_url"], 2048),
+    verification_status: verificationStatus,
+    verification_date: verificationDate,
+    sources: sourceCount
+  };
+}
+function finderUrl(apiKey, candidate) {
+  const params = new URLSearchParams;
+  if (candidate.anchor === "linkedin") {
+    params.set("linkedin_handle", candidate.linkedin_handle ?? "");
+  } else {
+    params.set("company", usableOrganization(candidate.organization) ?? "");
+    const given = candidate.given_name?.trim() ?? "";
+    const family = candidate.family_name?.trim() ?? "";
+    if (given !== "" && family !== "") {
+      params.set("first_name", given);
+      params.set("last_name", family);
+    } else {
+      params.set("full_name", candidate.display_name?.trim() ?? "");
+    }
+  }
+  params.set("api_key", apiKey);
+  return `https://api.hunter.io/v2/email-finder?${params.toString()}`;
+}
+async function hunterFindEmail(apiKey, candidate) {
+  const response = await fetch(finderUrl(apiKey, candidate), {
+    method: "GET",
+    headers: { Accept: "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(45000)
+  });
+  if (!response.ok)
+    throw new HunterHttpError3(response.status);
+  if (!(response.headers.get("content-type") ?? "").toLowerCase().includes("application/json"))
+    throw new HunterResponseError3;
+  const declaredLength = Number(response.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declaredLength) && declaredLength > HUNTER_MAX_RESPONSE_BYTES3)
+    throw new HunterResponseError3;
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > HUNTER_MAX_RESPONSE_BYTES3)
+    throw new HunterResponseError3;
+  try {
+    return parseFinderResponse(JSON.parse(new TextDecoder().decode(bytes)));
+  } catch (error) {
+    if (error instanceof HunterResponseError3)
+      throw error;
+    throw new HunterResponseError3;
+  }
+}
+function hunterErrorStatus3(error) {
+  if (error.status === 400)
+    return "invalid_request";
+  if (error.status === 401 || error.status === 403)
+    return "authentication_failed";
+  if (error.status === 404)
+    return "not_found";
+  if (error.status === 429)
+    return "rate_limited";
+  if (error.status === 451)
+    return "claimed";
+  return "provider_error";
+}
+function normalizedNameTokens2(value) {
+  return value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/gu, " ").trim().split(/\s+/u).filter(Boolean);
+}
+function returnedNameConflicts(candidate, result) {
+  const returnedTokens = normalizedNameTokens2(`${result.first_name ?? ""} ${result.last_name ?? ""}`);
+  if (returnedTokens.length < 2)
+    return false;
+  const localTokens = normalizedNameTokens2([candidate.given_name, candidate.family_name].filter((part) => (part?.trim() ?? "") !== "").join(" ") || (candidate.display_name ?? ""));
+  if (localTokens.length < 2)
+    return false;
+  return !localTokens.some((token3) => token3.length >= 2 && returnedTokens.includes(token3));
+}
+function usableEmail(value) {
+  if (value === null)
+    return null;
+  const trimmed = value.trim();
+  if (trimmed.length > 320)
+    return null;
+  if (!/^[^@\s]{1,64}@[^@\s]{1,255}$/u.test(trimmed))
+    return null;
+  const domain = trimmed.split("@").pop() ?? "";
+  if (!domain.includes("."))
+    return null;
+  return trimmed;
+}
+function emailOwner(database, normalized) {
+  const row = database.query(`SELECT person_id FROM contact_methods WHERE kind='email' AND normalized_value=? AND active=1 LIMIT 1`).get(normalized);
+  return row?.person_id ?? null;
+}
+function linkedInHandleFromUrl(rawUrl) {
+  return extractLinkedInHandle(null, rawUrl, null);
+}
+function linkedInResourceConflicts2(database, personId, handle) {
+  const profileUrl2 = `https://www.linkedin.com/in/${handle}/`;
+  const profileUrlWithoutSlash = profileUrl2.slice(0, -1);
+  const profileUrlWithoutWww = `https://linkedin.com/in/${handle}`;
+  const rows = database.query(`SELECT DISTINCT person_id FROM provider_resources
+     WHERE provider='linkedin' AND active=1
+       AND (lower(resource_id) IN (?,?,?,?) OR lower(profile_url) IN (?,?,?))`).all(handle.toLowerCase(), profileUrl2.toLowerCase(), profileUrlWithoutSlash.toLowerCase(), profileUrlWithoutWww.toLowerCase(), profileUrl2.toLowerCase(), profileUrlWithoutSlash.toLowerCase(), profileUrlWithoutWww.toLowerCase());
+  return rows.some((row) => row.person_id !== personId);
+}
+function insertFoundEmail(database, candidate, result, email3, runId) {
+  const normalized = email3.toLowerCase();
+  const confidence = result.verification_status === "valid" ? "likely" : "possible";
+  const metadata3 = canonicalJson2({
+    source: "hunter-email-finder",
+    anchor: candidate.anchor,
+    score: result.score,
+    domain: result.domain,
+    verification_status: result.verification_status,
+    verification_date: result.verification_date
+  });
+  run10(database, `INSERT INTO contact_methods(
+      person_id, kind, value, normalized_value, label, confidence,
+      first_seen_run_id, last_seen_run_id, metadata_json, active, identity_eligible
+    ) VALUES (?,'email',?,?, '', ?, ?, ?, ?, 1, 1)
+    ON CONFLICT(person_id, kind, normalized_value, label) DO UPDATE SET
+      active=1,
+      confidence=excluded.confidence,
+      last_seen_run_id=excluded.last_seen_run_id,
+      metadata_json=excluded.metadata_json`, candidate.person_id, email3, normalized, confidence, runId, runId, metadata3);
+}
+function insertLinkedInResource2(database, personId, handle, result, runId) {
+  const profileUrl2 = `https://www.linkedin.com/in/${handle}/`;
+  const displayName2 = [result.first_name, result.last_name].filter((part) => part !== null && part !== "").join(" ") || null;
+  run10(database, `INSERT INTO provider_resources(
+      provider, account_key, resource_type, resource_id, person_id,
+      username, profile_url, display_name, active,
+      first_seen_run_id, last_seen_run_id, metadata_json,
+      profile_url_identity_eligible, name_identity_eligible
+    ) VALUES (?,?,?,?,?,?,?,?,1,?,?,?,1,1)
+    ON CONFLICT(provider, account_key, resource_type, resource_id) DO UPDATE SET
+      username=excluded.username,
+      profile_url=excluded.profile_url,
+      display_name=excluded.display_name,
+      active=1,
+      last_seen_run_id=excluded.last_seen_run_id,
+      metadata_json=excluded.metadata_json,
+      profile_url_identity_eligible=1,
+      name_identity_eligible=1`, LINKEDIN_PROVIDER2, ACCOUNT_KEY5, "profile", handle, personId, handle, profileUrl2, displayName2, runId, runId, canonicalJson2({
+    source: "hunter-email-finder",
+    company: result.company,
+    position: result.position,
+    first_name: result.first_name,
+    last_name: result.last_name
+  }));
+  const resource = database.query(`SELECT id FROM provider_resources
+     WHERE provider=? AND account_key=? AND resource_type='profile' AND resource_id=?`).get(LINKEDIN_PROVIDER2, ACCOUNT_KEY5, handle);
+  if (resource === null)
+    throw new Error("HUNTER_LINKEDIN_RESOURCE_MISSING");
+  return resource.id;
+}
+function createSourceRun3(database, startedAt, completedAt, attempted, total, found, outcomes) {
+  const sha2 = sha256(`hunter-email-finder:${startedAt}:${randomUUID6()}`);
+  const locatorSha = sha256("hunter-email-finder-local-command");
+  const source = run10(database, `INSERT INTO source_runs(
+      provider, account_key, mode, source_sha256, source_locator_sha256,
+      completeness, result_json, started_at, completed_at
+    ) VALUES (?,?,?,?,?,?,?,?,?)`, PROVIDER13, ACCOUNT_KEY5, MODE10, sha2, locatorSha, attempted === total ? "complete" : "partial", canonicalJson2({ attempted, total, emails_found: found, outcomes }), startedAt, completedAt);
+  return insertedId11(source);
+}
+async function hunterFindEmails(database, options) {
+  if (options.apiKey.trim().length < 8)
+    throw new Error("HUNTER_NOT_CONFIGURED");
+  if (options.limit !== undefined && (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100)) {
+    throw new Error("HUNTER_LIMIT_INVALID");
+  }
+  const delayMs = options.delayMs ?? 500;
+  const startedAt = new Date().toISOString();
+  const candidates = fetchCandidates3(database, options.limit);
+  const total = candidates.length;
+  const outcomes = {
+    accepted: 0,
+    already_known: 0,
+    conflict: 0,
+    name_rejected: 0,
+    not_found: 0,
+    claimed: 0,
+    invalid_request: 0,
+    rate_limited: 0,
+    authentication_failed: 0,
+    provider_error: 0,
+    network_error: 0
+  };
+  const internalRecords = [];
+  let attempted = 0;
+  let found = 0;
+  const batchClaimed = new Map;
+  for (const candidate of candidates) {
+    attempted += 1;
+    let status = "network_error";
+    let errorDetail = null;
+    let finderResult;
+    let foundEmail;
+    try {
+      const data = await hunterFindEmail(options.apiKey, candidate);
+      finderResult = data;
+      const email3 = usableEmail(data.email);
+      if (email3 === null) {
+        status = "not_found";
+      } else {
+        const normalized = email3.toLowerCase();
+        const owner = emailOwner(database, normalized) ?? batchClaimed.get(normalized) ?? null;
+        if (owner === candidate.person_id) {
+          status = "already_known";
+          batchClaimed.set(normalized, candidate.person_id);
+          found += 1;
+        } else if (owner !== null) {
+          status = "conflict";
+        } else if (returnedNameConflicts(candidate, data)) {
+          status = "name_rejected";
+        } else {
+          status = "accepted";
+          foundEmail = email3;
+          batchClaimed.set(normalized, candidate.person_id);
+          found += 1;
+        }
+      }
+    } catch (error) {
+      if (error instanceof HunterHttpError3) {
+        status = hunterErrorStatus3(error);
+        errorDetail = { httpStatus: error.status };
+      } else if (error instanceof HunterResponseError3) {
+        status = "provider_error";
+        errorDetail = error.message;
+      } else {
+        status = "network_error";
+        errorDetail = "HUNTER_NETWORK_ERROR";
+      }
+    }
+    outcomes[status] += 1;
+    internalRecords.push({
+      record: {
+        person_id: candidate.person_id,
+        status,
+        anchor: candidate.anchor,
+        error: errorDetail
+      },
+      candidate,
+      ...finderResult === undefined ? {} : { result: finderResult },
+      ...foundEmail === undefined ? {} : { email: foundEmail }
+    });
+    options.onProgress?.(attempted, total);
+    if (status === "authentication_failed" || status === "rate_limited")
+      break;
+    if (attempted < total)
+      await new Promise((resolve8) => setTimeout(resolve8, delayMs));
+  }
+  const completedAt = new Date().toISOString();
+  let runId = 0;
+  database.exec("BEGIN");
+  try {
+    runId = createSourceRun3(database, startedAt, completedAt, attempted, total, found, outcomes);
+    internalRecords.forEach(({ record: record9, candidate, result, email: email3 }, index) => {
+      let detail;
+      let providerResourceId = null;
+      if (record9.status === "accepted" && email3 !== undefined && result !== undefined) {
+        insertFoundEmail(database, candidate, result, email3, runId);
+        const bonusHandle = candidate.anchor === "company" ? linkedInHandleFromUrl(result.linkedin_url) : null;
+        if (bonusHandle !== null && !linkedInResourceConflicts2(database, candidate.person_id, bonusHandle)) {
+          providerResourceId = insertLinkedInResource2(database, candidate.person_id, bonusHandle, result, runId);
+        }
+        detail = {
+          status: record9.status,
+          anchor: candidate.anchor,
+          score: result.score,
+          domain: result.domain,
+          verification_status: result.verification_status,
+          sources: result.sources
+        };
+      } else if (record9.status === "claimed") {
+        run10(database, `UPDATE people SET do_not_contact = 1 WHERE id = ?`, candidate.person_id);
+        detail = { status: record9.status, anchor: candidate.anchor };
+      } else {
+        detail = { status: record9.status, anchor: candidate.anchor, error: record9.error };
+      }
+      const errorText = ["provider_error", "network_error", "rate_limited", "authentication_failed"].includes(record9.status) ? JSON.stringify(record9.error) : null;
+      const resolution = record9.status === "accepted" ? "imported" : record9.status === "already_known" ? "matched" : record9.status === "conflict" ? "conflict" : "skipped";
+      run10(database, `INSERT INTO source_records(
+          run_id, ordinal, record_kind, record_sha256, person_id,
+          provider_resource_id, resolution, projection_json, error_text
+        ) VALUES (?,?,?,?,?,?,?,?,?)`, runId, index + 1, MODE10, sha256(JSON.stringify({ ordinal: index + 1, run: runId, detail })), record9.person_id, providerResourceId, resolution, JSON.stringify(detail), errorText);
+    });
+    database.exec("COMMIT");
+  } catch (error) {
+    database.exec("ROLLBACK");
+    throw error;
+  }
+  return {
+    attempted,
+    emails_found: found,
+    run_id: runId,
+    outcomes,
+    records: internalRecords.map(({ record: record9 }) => record9)
+  };
+}
+
 // src/local/providers/linkedin-contact-info.ts
 var LINKEDIN_CONTACT_INFO_ADAPTER_ID = "linkedin-web";
 var LINKEDIN_CONTACT_INFO_OPERATION_ID = "contacts.read";
 var LINKEDIN_CONTACT_INFO_ADAPTER_VERSION = "1.23.0";
 var LINKEDIN_CONTACT_INFO_CONTRACT_SHA256 = "8f80c234ca2b7706a49a5000012a11da78a36d38f3023c21854a240e16a13f43";
 var DEFAULT_LINKEDIN_AUTH = "linkedin-main";
-var PROVIDER12 = "linkedin";
-var MODE9 = "ghostget-contact-info";
+var PROVIDER14 = "linkedin";
+var MODE11 = "ghostget-contact-info";
 var RECORD_KIND = "contact-info";
 var OBSERVATION_BASIS2 = "linkedin-contact-info";
 var OBSERVATION_PRIORITY2 = 720;
@@ -34507,13 +35373,13 @@ var AUTH_ID3 = /^[a-z0-9][a-z0-9._:-]{0,255}$/u;
 function getRow9(database, sql, ...bindings) {
   return database.query(sql).get(...bindings);
 }
-function allRows8(database, sql, ...bindings) {
+function allRows10(database, sql, ...bindings) {
   return database.query(sql).all(...bindings);
 }
-function run9(database, sql, ...bindings) {
+function run11(database, sql, ...bindings) {
   return database.run(sql, bindings);
 }
-function insertedId10(value) {
+function insertedId12(value) {
   return Number(value.lastInsertRowid);
 }
 function record9(value, label) {
@@ -34604,7 +35470,7 @@ function parseFields(value, label) {
 function projectLinkedInContactInfo(value, expectedProfileUrl) {
   const output = record9(value, "Ghostget LinkedIn contact output");
   exact4(output, ["schemaVersion", "provider", "profile", "viewer", "observedAt", "completeness", "contact"], "contact output");
-  if (output.schemaVersion !== 1 || output.provider !== PROVIDER12)
+  if (output.schemaVersion !== 1 || output.provider !== PROVIDER14)
     throw new Error("Ghostget LinkedIn contact semantics drifted");
   const profile = record9(output.profile, "contact output.profile");
   exact4(profile, ["vanity", "profileUrn", "url", "relationship"], "contact output.profile");
@@ -34692,9 +35558,9 @@ function readLinkedInContactInfo(database, options) {
   const auth = authId2(options.authId);
   if (!Number.isSafeInteger(options.personId) || options.personId < 1)
     throw new Error("person ID is invalid");
-  const resources = allRows8(database, `SELECT id,person_id,profile_url,resource_id,metadata_json FROM provider_resources
+  const resources = allRows10(database, `SELECT id,person_id,profile_url,resource_id,metadata_json FROM provider_resources
      WHERE provider=? AND account_key=? AND resource_type='profile' AND active=1 AND person_id=?
-     ORDER BY id`, PROVIDER12, account, options.personId);
+     ORDER BY id`, PROVIDER14, account, options.personId);
   if (resources.length === 0) {
     throw new Error("This person has no active LinkedIn profile in that account; import the official LinkedIn export first");
   }
@@ -34705,7 +35571,7 @@ function readLinkedInContactInfo(database, options) {
   const profileUrl2 = canonicalLinkedInProfileUrl(resource.profile_url ?? resource.resource_id, "stored LinkedIn profile URL");
   if (profileUrl2 === null)
     throw new Error("stored LinkedIn profile resource lacks an exact profile URL");
-  const owner = getRow9(database, "SELECT owner_key FROM archive_accounts WHERE provider=? AND account_key=?", PROVIDER12, account);
+  const owner = getRow9(database, "SELECT owner_key FROM archive_accounts WHERE provider=? AND account_key=?", PROVIDER14, account);
   if (owner !== null && owner.owner_key === profileUrl2) {
     throw new Error("Contact info is read for connections, not the account owner's own profile");
   }
@@ -34740,19 +35606,19 @@ function readLinkedInContactInfo(database, options) {
   };
   database.exec("BEGIN IMMEDIATE");
   try {
-    const cached = getRow9(database, "SELECT id,result_json FROM source_runs WHERE provider=? AND account_key=? AND mode=? AND source_sha256=?", PROVIDER12, account, MODE9, sourceSha256);
+    const cached = getRow9(database, "SELECT id,result_json FROM source_runs WHERE provider=? AND account_key=? AND mode=? AND source_sha256=?", PROVIDER14, account, MODE11, sourceSha256);
     if (cached !== null) {
       database.exec("COMMIT");
       return { ...storedResultFromJson(cached.result_json), run_id: cached.id, replayed: true };
     }
-    const runId = insertedId10(run9(database, `INSERT INTO source_runs(
+    const runId = insertedId12(run11(database, `INSERT INTO source_runs(
       provider,account_key,mode,source_sha256,source_locator_sha256,completeness,result_json,started_at,completed_at
-    ) VALUES (?,?,?,?,?,?,?,?,?)`, PROVIDER12, account, MODE9, sourceSha256, sha256(profileUrl2), projection2.completeness, canonicalJson2(stored), execution.startedAt, execution.finishedAt));
+    ) VALUES (?,?,?,?,?,?,?,?,?)`, PROVIDER14, account, MODE11, sourceSha256, sha256(profileUrl2), projection2.completeness, canonicalJson2(stored), execution.startedAt, execution.finishedAt));
     const methodLabel = `${OBSERVATION_BASIS2}:${sha256(profileUrl2).slice(0, 16)}`;
     const methodMetadata = canonicalJson2({ observedIn: OBSERVATION_BASIS2, observedAt: projection2.observedAt });
-    run9(database, "UPDATE contact_methods SET active=0 WHERE provider_resource_id=? AND label=?", resourceId, methodLabel);
+    run11(database, "UPDATE contact_methods SET active=0 WHERE provider_resource_id=? AND label=?", resourceId, methodLabel);
     if (projection2.contact.email !== null) {
-      run9(database, `INSERT INTO contact_methods(
+      run11(database, `INSERT INTO contact_methods(
         person_id,kind,value,normalized_value,label,confidence,first_seen_run_id,last_seen_run_id,
         metadata_json,provider_resource_id,active,identity_eligible
       ) VALUES (?,'email',?,?,?,'exact',?,?,?,?,1,1)
@@ -34763,7 +35629,7 @@ function readLinkedInContactInfo(database, options) {
     for (const { phone, normalized } of resolvedPhones) {
       if (normalized === null)
         continue;
-      run9(database, `INSERT INTO contact_methods(
+      run11(database, `INSERT INTO contact_methods(
         person_id,kind,value,normalized_value,label,confidence,first_seen_run_id,last_seen_run_id,
         metadata_json,provider_resource_id,active,identity_eligible
       ) VALUES (?,'phone',?,?,?,'exact',?,?,?,?,1,1)
@@ -34772,7 +35638,7 @@ function readLinkedInContactInfo(database, options) {
         provider_resource_id=excluded.provider_resource_id,active=1,identity_eligible=1`, personId, phone, normalized, methodLabel, runId, runId, methodMetadata, resourceId);
     }
     for (const site of projection2.contact.websites) {
-      run9(database, `INSERT INTO contact_methods(
+      run11(database, `INSERT INTO contact_methods(
         person_id,kind,value,normalized_value,label,confidence,first_seen_run_id,last_seen_run_id,
         metadata_json,provider_resource_id,active,identity_eligible
       ) VALUES (?,'url',?,?,?,'exact',?,?,?,?,1,0)
@@ -34780,14 +35646,14 @@ function readLinkedInContactInfo(database, options) {
         value=excluded.value,last_seen_run_id=excluded.last_seen_run_id,metadata_json=excluded.metadata_json,
         provider_resource_id=excluded.provider_resource_id,active=1,identity_eligible=0`, personId, site, normalizedWebsite(site), methodLabel, runId, runId, methodMetadata, resourceId);
     }
-    run9(database, "UPDATE person_field_observations SET active=0 WHERE provider_resource_id=? AND basis=?", resourceId, OBSERVATION_BASIS2);
+    run11(database, "UPDATE person_field_observations SET active=0 WHERE provider_resource_id=? AND basis=?", resourceId, OBSERVATION_BASIS2);
     if (projection2.contact.birthday !== null) {
-      run9(database, `INSERT INTO person_field_observations(
+      run11(database, `INSERT INTO person_field_observations(
         provider_resource_id,field,value,basis,priority,active,first_seen_run_id,last_seen_run_id,metadata_json
       ) VALUES (?,'birthday',?,?,?,1,?,?,'{}')
       ON CONFLICT(provider_resource_id,field,value,basis) DO UPDATE SET
         priority=excluded.priority,active=1,last_seen_run_id=excluded.last_seen_run_id`, resourceId, projection2.contact.birthday, OBSERVATION_BASIS2, OBSERVATION_PRIORITY2, runId, runId);
-      run9(database, "UPDATE people SET birthday=coalesce(birthday,?) WHERE id=?", projection2.contact.birthday, personId);
+      run11(database, "UPDATE people SET birthday=coalesce(birthday,?) WHERE id=?", projection2.contact.birthday, personId);
     }
     const resourceMetadata = {
       ...metadata3(resource.metadata_json),
@@ -34799,12 +35665,12 @@ function readLinkedInContactInfo(database, options) {
         runId
       }
     };
-    run9(database, "UPDATE provider_resources SET last_seen_run_id=?,metadata_json=? WHERE id=?", runId, canonicalJson2(resourceMetadata), resourceId);
-    run9(database, `INSERT INTO source_records(
+    run11(database, "UPDATE provider_resources SET last_seen_run_id=?,metadata_json=? WHERE id=?", runId, canonicalJson2(resourceMetadata), resourceId);
+    run11(database, `INSERT INTO source_records(
       run_id,ordinal,record_kind,record_sha256,person_id,provider_resource_id,resolution,projection_json,error_text
     ) VALUES (?,1,?,?,?,?,'matched',?,NULL)`, runId, RECORD_KIND, sourceSha256, personId, resourceId, canonicalJson2(projection2));
     ledgerPeopleBladeGhostgetInvocation(database, {
-      provider: PROVIDER12,
+      provider: PROVIDER14,
       accountKey: account,
       capability: "contact_info",
       execution,
@@ -34839,15 +35705,15 @@ var DEVICE_LID_JID = /^([0-9]{5,32}):[0-9]{1,5}@lid$/u;
 var GROUP_JID = /^[0-9]{5,32}(?:-[0-9]{5,20})?@g\.us$/u;
 var OTHER_JID = /^(?:0@s\.whatsapp\.net|[0-9]{5,32}@newsletter|(?:status|[0-9]{5,32})@broadcast)$/u;
 var MESSAGE_ID = /^[A-Za-z0-9._~:-]{1,256}$/u;
-var PROVIDER13 = "whatsapp";
+var PROVIDER15 = "whatsapp";
 var STREAM2 = "messages";
 function getRow10(database, sql, ...values) {
   return database.query(sql).get(...values);
 }
-function run10(database, sql, ...values) {
+function run12(database, sql, ...values) {
   return database.run(sql, values);
 }
-function insertedId11(value) {
+function insertedId13(value) {
   return Number(value.lastInsertRowid);
 }
 function record10(value, label) {
@@ -35204,27 +36070,27 @@ function generationSha256(value) {
 }
 function ensureResource2(database, account, sourceRealmId, jid, name, basis, runId) {
   const existing = getRow10(database, `SELECT id,person_id,source_realm_id FROM provider_resources
-    WHERE provider=? AND account_key=? AND resource_type='jid' AND resource_id=?`, PROVIDER13, account, jid);
+    WHERE provider=? AND account_key=? AND resource_type='jid' AND resource_id=?`, PROVIDER15, account, jid);
   if (existing !== null) {
     if (existing.source_realm_id !== null && existing.source_realm_id !== sourceRealmId) {
       throw new Error("WhatsApp contact resource crossed its bound account realm");
     }
-    run10(database, `UPDATE provider_resources SET source_realm_id=?,display_name=coalesce(?,display_name),active=1,last_seen_run_id=?,
+    run12(database, `UPDATE provider_resources SET source_realm_id=?,display_name=coalesce(?,display_name),active=1,last_seen_run_id=?,
       metadata_json=? WHERE id=?`, sourceRealmId, name, runId, stableJson6({ jidKind: USER_JID.test(jid) ? "user" : "lid", displayNameBasis: basis }), existing.id);
     if (name !== null)
-      run10(database, "UPDATE people SET display_name=coalesce(display_name,?) WHERE id=?", name, existing.person_id);
+      run12(database, "UPDATE people SET display_name=coalesce(display_name,?) WHERE id=?", name, existing.person_id);
     return { personId: existing.person_id, resourceId: existing.id, imported: false };
   }
-  const personId = insertedId11(run10(database, "INSERT INTO people(stable_key,display_name,metadata_json) VALUES (?,?,?)", `whatsapp:${sha2569(`${account}\x00${jid}`)}`, name, stableJson6({ createdBy: "exact-whatsapp-jid" })));
+  const personId = insertedId13(run12(database, "INSERT INTO people(stable_key,display_name,metadata_json) VALUES (?,?,?)", `whatsapp:${sha2569(`${account}\x00${jid}`)}`, name, stableJson6({ createdBy: "exact-whatsapp-jid" })));
   const phone = phoneForJid(jid);
   if (phone !== null)
-    run10(database, `INSERT INTO contact_methods(
+    run12(database, `INSERT INTO contact_methods(
     person_id,kind,value,normalized_value,label,confidence,first_seen_run_id,last_seen_run_id,metadata_json
   ) VALUES (?,'phone',?,?,'whatsapp','exact',?,?,?)`, personId, phone, phone, runId, runId, stableJson6({ derivedFromJid: true }));
-  const resourceId = insertedId11(run10(database, `INSERT INTO provider_resources(
+  const resourceId = insertedId13(run12(database, `INSERT INTO provider_resources(
     provider,account_key,source_realm_id,resource_type,resource_id,person_id,display_name,active,
     first_seen_run_id,last_seen_run_id,metadata_json
-  ) VALUES (?,?,?,'jid',?,?,?,1,?,?,?)`, PROVIDER13, account, sourceRealmId, jid, personId, name, runId, runId, stableJson6({ jidKind: USER_JID.test(jid) ? "user" : "lid", displayNameBasis: basis })));
+  ) VALUES (?,?,?,'jid',?,?,?,1,?,?,?)`, PROVIDER15, account, sourceRealmId, jid, personId, name, runId, runId, stableJson6({ jidKind: USER_JID.test(jid) ? "user" : "lid", displayNameBasis: basis })));
   return { personId, resourceId, imported: true };
 }
 function parseStoredGeneration(value) {
@@ -35238,12 +36104,12 @@ function databaseCheckpoint(database, auth) {
   const row = getRow10(database, `SELECT checkpoint.cursor,checkpoint.cursor_anchor_sha256,checkpoint.metadata_json
     FROM provider_accounts account JOIN provider_checkpoints checkpoint
       ON checkpoint.provider=account.provider AND checkpoint.account_key=account.account_key
-    WHERE account.provider=? AND account.auth_id=? AND checkpoint.stream_key=?`, PROVIDER13, auth, STREAM2);
+    WHERE account.provider=? AND account.auth_id=? AND checkpoint.stream_key=?`, PROVIDER15, auth, STREAM2);
   return row === null ? { cursor: "0", anchor: null } : { cursor: row.cursor, anchor: row.cursor_anchor_sha256, generation: parseStoredGeneration(row.metadata_json) };
 }
 function refreshMetrics2(database, account, runId) {
-  run10(database, "DELETE FROM interaction_metrics WHERE provider=? AND account_key=?", PROVIDER13, account);
-  run10(database, `INSERT INTO interaction_metrics(
+  run12(database, "DELETE FROM interaction_metrics WHERE provider=? AND account_key=?", PROVIDER15, account);
+  run12(database, `INSERT INTO interaction_metrics(
     provider,account_key,person_id,sent_count,received_count,interaction_count,conversation_count,
     first_interaction_at,last_interaction_at,reciprocal,completeness,last_seen_run_id,metadata_json
   ) SELECT ?,?,person_id,sum(direction='outgoing'),sum(direction='incoming'),count(*),
@@ -35251,7 +36117,7 @@ function refreshMetrics2(database, account, runId) {
     CASE WHEN sum(direction='outgoing')>0 AND sum(direction='incoming')>0 THEN 1 ELSE 0 END,
     'lower-bound',?,'{"coverage":"local-insert-rowid-scan"}'
     FROM interaction_events WHERE provider=? AND account_key=? AND resolution='matched' AND person_id IS NOT NULL
-    GROUP BY person_id`, PROVIDER13, account, runId, PROVIDER13, account);
+    GROUP BY person_id`, PROVIDER15, account, runId, PROVIDER15, account);
 }
 function resultFromJson2(value) {
   const parsed = record10(JSON.parse(value), "stored WhatsApp result");
@@ -35306,18 +36172,18 @@ function importWhatsAppSnapshot(database, snapshot) {
   }));
   database.exec("BEGIN IMMEDIATE");
   try {
-    const byAuth = getRow10(database, "SELECT account_key,auth_sha256 FROM provider_accounts WHERE provider=? AND auth_id=?", PROVIDER13, snapshot.authId);
-    const byAccount = getRow10(database, "SELECT auth_id,auth_sha256 FROM provider_accounts WHERE provider=? AND account_key=?", PROVIDER13, account);
+    const byAuth = getRow10(database, "SELECT account_key,auth_sha256 FROM provider_accounts WHERE provider=? AND auth_id=?", PROVIDER15, snapshot.authId);
+    const byAccount = getRow10(database, "SELECT auth_id,auth_sha256 FROM provider_accounts WHERE provider=? AND account_key=?", PROVIDER15, account);
     if (byAuth !== null && (byAuth.account_key !== account || byAuth.auth_sha256 !== firstExecution.authSha256) || byAccount !== null && (byAccount.auth_id !== snapshot.authId || byAccount.auth_sha256 !== firstExecution.authSha256)) {
       throw new Error("WhatsApp durable auth-to-account binding drifted");
     }
     if (byAuth === null)
-      run10(database, `INSERT INTO provider_accounts(provider,auth_id,account_key,auth_sha256,first_seen_at,last_seen_at)
-      VALUES (?,?,?,?,?,?)`, PROVIDER13, snapshot.authId, account, firstExecution.authSha256, firstExecution.startedAt, lastExecution.finishedAt);
+      run12(database, `INSERT INTO provider_accounts(provider,auth_id,account_key,auth_sha256,first_seen_at,last_seen_at)
+      VALUES (?,?,?,?,?,?)`, PROVIDER15, snapshot.authId, account, firstExecution.authSha256, firstExecution.startedAt, lastExecution.finishedAt);
     else
-      run10(database, "UPDATE provider_accounts SET last_seen_at=? WHERE provider=? AND auth_id=?", lastExecution.finishedAt, PROVIDER13, snapshot.authId);
+      run12(database, "UPDATE provider_accounts SET last_seen_at=? WHERE provider=? AND auth_id=?", lastExecution.finishedAt, PROVIDER15, snapshot.authId);
     const sourceRealmId = bindProviderAccountRealm(database, {
-      provider: PROVIDER13,
+      provider: PROVIDER15,
       authId: snapshot.authId,
       accountKey: account,
       authSha256: firstExecution.authSha256,
@@ -35325,7 +36191,7 @@ function importWhatsAppSnapshot(database, snapshot) {
       lastSeenAt: lastExecution.finishedAt
     }).id;
     const storedCheckpoint = getRow10(database, `SELECT cursor,cursor_anchor_sha256,generation_sha256,metadata_json
-      FROM provider_checkpoints WHERE provider=? AND account_key=? AND stream_key=?`, PROVIDER13, account, STREAM2);
+      FROM provider_checkpoints WHERE provider=? AND account_key=? AND stream_key=?`, PROVIDER15, account, STREAM2);
     if (storedCheckpoint === null) {
       if (snapshot.startCheckpoint.cursor !== "0" || snapshot.startCheckpoint.anchor !== null || snapshot.startCheckpoint.generation !== undefined)
         throw new Error("WhatsApp initial scan must start at zero");
@@ -35336,7 +36202,7 @@ function importWhatsAppSnapshot(database, snapshot) {
       }
     }
     const existingRun = getRow10(database, `SELECT result_json FROM source_runs
-      WHERE provider=? AND account_key=? AND mode='linked-device-sync' AND source_sha256=?`, PROVIDER13, account, sourceDigest);
+      WHERE provider=? AND account_key=? AND mode='linked-device-sync' AND source_sha256=?`, PROVIDER15, account, sourceDigest);
     if (existingRun !== null) {
       database.exec("COMMIT");
       return resultFromJson2(existingRun.result_json);
@@ -35354,7 +36220,7 @@ function importWhatsAppSnapshot(database, snapshot) {
           continue;
         }
         const exists = getRow10(database, `SELECT 1 FROM provider_resources
-        WHERE provider=? AND account_key=? AND resource_type='jid' AND resource_id=?`, PROVIDER13, account, contact.providerId) !== null;
+        WHERE provider=? AND account_key=? AND resource_type='jid' AND resource_id=?`, PROVIDER15, account, contact.providerId) !== null;
         if (exists)
           expectedContactsMatched += 1;
         else
@@ -35387,11 +36253,11 @@ function importWhatsAppSnapshot(database, snapshot) {
       counts_complete: false,
       counts_lower_bound: true
     };
-    const runInsert = run10(database, `INSERT INTO source_runs(
+    const runInsert = run12(database, `INSERT INTO source_runs(
       provider,account_key,mode,source_sha256,source_locator_sha256,completeness,
       result_json,started_at,completed_at
-    ) VALUES (?,?,'linked-device-sync',?,?,'lower-bound',?,?,?)`, PROVIDER13, account, sourceDigest, sha2569(snapshot.authId), stableJson6(expectedResult), firstExecution.startedAt, lastExecution.finishedAt);
-    const runId = insertedId11(runInsert);
+    ) VALUES (?,?,'linked-device-sync',?,?,'lower-bound',?,?,?)`, PROVIDER15, account, sourceDigest, sha2569(snapshot.authId), stableJson6(expectedResult), firstExecution.startedAt, lastExecution.finishedAt);
+    const runId = insertedId13(runInsert);
     let ordinal = 0;
     let contactsSeen = 0;
     let contactsImported = 0;
@@ -35404,7 +36270,7 @@ function importWhatsAppSnapshot(database, snapshot) {
         if (contact.providerId === owner) {
           contactsSkippedSelf += 1;
           const item2 = stableJson6({ type: "contact", ...contact, resolution: "skipped-self" });
-          run10(database, `INSERT INTO source_records(run_id,ordinal,record_kind,record_sha256,resolution,projection_json,error_text)
+          run12(database, `INSERT INTO source_records(run_id,ordinal,record_kind,record_sha256,resolution,projection_json,error_text)
           VALUES (?,?,'contact',?,'skipped',?,'owner-self-contact')`, runId, ordinal, sha2569(item2), item2);
           continue;
         }
@@ -35414,7 +36280,7 @@ function importWhatsAppSnapshot(database, snapshot) {
         else
           contactsMatched += 1;
         const item = stableJson6({ type: "contact", ...contact });
-        run10(database, `INSERT INTO source_records(
+        run12(database, `INSERT INTO source_records(
         run_id,ordinal,record_kind,record_sha256,person_id,provider_resource_id,resolution,projection_json
       ) VALUES (?,?,'contact',?,?,?,?,?)`, runId, ordinal, sha2569(item), identity.personId, identity.resourceId, identity.imported ? "imported" : "matched", item);
       }
@@ -35458,13 +36324,13 @@ function importWhatsAppSnapshot(database, snapshot) {
           reason
         };
         const evidenceJson = stableJson6(evidence);
-        run10(database, `INSERT INTO source_records(
+        run12(database, `INSERT INTO source_records(
         run_id,ordinal,record_kind,record_sha256,person_id,provider_resource_id,resolution,projection_json,error_text
       ) VALUES (?,?,'message',?,?,?,?,?,?)`, runId, ordinal, sha2569(evidenceJson), personId, resourceId, resolution, evidenceJson, resolution === "matched" ? null : reason);
-        run10(database, `INSERT INTO interaction_events(
+        run12(database, `INSERT INTO interaction_events(
         provider,account_key,external_id,person_id,occurred_at,direction,conversation_sha256,
         event_kind,resolution,run_id,metadata_json
-      ) VALUES (?,?,?,?,?,?,?,'message',?,?,?)`, PROVIDER13, account, `row:${message.rowid}`, personId, message.timestamp, direction, conversationHash, resolution, runId, stableJson6({ conversationKind, reason, messageIdSha256: sha2569(message.messageId) }));
+      ) VALUES (?,?,?,?,?,?,?,'message',?,?,?)`, PROVIDER15, account, `row:${message.rowid}`, personId, message.timestamp, direction, conversationHash, resolution, runId, stableJson6({ conversationKind, reason, messageIdSha256: sha2569(message.messageId) }));
         messagesInserted += 1;
       }
     refreshMetrics2(database, account, runId);
@@ -35487,7 +36353,7 @@ function importWhatsAppSnapshot(database, snapshot) {
     if (stableJson6(result) !== stableJson6(expectedResult))
       throw new Error("WhatsApp applied counts drifted from the reviewed snapshot");
     const metadata4 = stableJson6({ generation: scanGeneration, coverage: "local-insert-rowid-scan" });
-    run10(database, `INSERT INTO provider_checkpoints(
+    run12(database, `INSERT INTO provider_checkpoints(
       provider,account_key,source_realm_id,stream_key,source_locator_sha256,schema_sha256,generation_sha256,
       cursor,cursor_anchor_sha256,last_run_id,metadata_json
     ) VALUES (?,?,?,?,?,?,?,?,?,?,?)
@@ -35495,7 +36361,7 @@ function importWhatsAppSnapshot(database, snapshot) {
       source_realm_id=excluded.source_realm_id,source_locator_sha256=excluded.source_locator_sha256,schema_sha256=excluded.schema_sha256,
       generation_sha256=excluded.generation_sha256,cursor=excluded.cursor,
       cursor_anchor_sha256=excluded.cursor_anchor_sha256,last_run_id=excluded.last_run_id,
-      metadata_json=excluded.metadata_json,updated_at=CURRENT_TIMESTAMP`, PROVIDER13, account, sourceRealmId, STREAM2, sha2569(snapshot.authId), CONTACTS_CONTRACT_SHA2562, generationSha256(scanGeneration), end2.cursor, end2.anchor, runId, metadata4);
+      metadata_json=excluded.metadata_json,updated_at=CURRENT_TIMESTAMP`, PROVIDER15, account, sourceRealmId, STREAM2, sha2569(snapshot.authId), CONTACTS_CONTRACT_SHA2562, generationSha256(scanGeneration), end2.cursor, end2.anchor, runId, metadata4);
     database.exec("COMMIT");
     return result;
   } catch (error) {
@@ -35510,7 +36376,7 @@ function syncWhatsAppRelationships(database, options = {}) {
   const snapshot = ghostgetWhatsAppSnapshot({ ...options, authId: auth, checkpoint: databaseCheckpoint(database, auth) });
   for (const page of [...snapshot.contactPages, ...snapshot.interactionPages]) {
     ledgerPeopleBladeGhostgetInvocation(database, {
-      provider: PROVIDER13,
+      provider: PROVIDER15,
       accountKey: snapshot.accountSubject,
       capability: "contact_interactions",
       execution: page.execution,
@@ -35524,7 +36390,7 @@ function syncWhatsAppRelationships(database, options = {}) {
 }
 
 // src/cli/version.ts
-var peoplebladeVersion = "0.4.0";
+var peoplebladeVersion = "0.4.1";
 
 // src/cli/intro.ts
 function terminalIntro(terminal) {
@@ -35609,6 +36475,10 @@ Enrichment (local):
   hunter reverse-enrich [--limit N] [--non-webmail]
                                     Reverse-enrich emails to LinkedIn profiles via Hunter
     [--key-file PATH]               Read HUNTER_API_KEY from file instead of env
+  hunter verify [--limit N]         Verify email deliverability via Hunter
+    [--key-file PATH]               Read HUNTER_API_KEY from file instead of env
+  hunter find-emails [--limit N]    Find professional emails via Hunter
+    [--key-file PATH]               Read HUNTER_API_KEY from file instead of env
 
 Cloud (optional):
   cloud signin                      Register/sign in through your browser
@@ -36830,6 +37700,52 @@ ${verification}`) });
       print({ attempted: result.attempted, linkedin_found: result.linkedin_found, run_id: result.run_id, outcomes: result.outcomes }, asJson);
       return;
     }
+    if (command === "hunter" && subcommand === "verify") {
+      const options = [...rest];
+      const limitValue = valueAfter(options, "--limit");
+      const keyFile = valueAfter(options, "--key-file");
+      if (options.length)
+        fail3(`Unknown argument: ${options[0]}`);
+      let apiKey = process.env.HUNTER_API_KEY;
+      if (apiKey === undefined && keyFile !== undefined)
+        apiKey = readHunterApiKeyFile(keyFile);
+      if (apiKey === undefined || apiKey.trim().length < 8)
+        fail3("Set a valid HUNTER_API_KEY or use --key-file PATH.");
+      const limit = positive(limitValue, "--limit", 100, 100);
+      const result = await hunterVerifyEmails(database, {
+        apiKey: apiKey.trim(),
+        limit,
+        onProgress: (done, total) => {
+          if (!asJson)
+            console.log(`[${done}/${total}]`);
+        }
+      });
+      print({ attempted: result.attempted, verified: result.verified, run_id: result.run_id, outcomes: result.outcomes }, asJson);
+      return;
+    }
+    if (command === "hunter" && subcommand === "find-emails") {
+      const options = [...rest];
+      const limitValue = valueAfter(options, "--limit");
+      const keyFile = valueAfter(options, "--key-file");
+      if (options.length)
+        fail3(`Unknown argument: ${options[0]}`);
+      let apiKey = process.env.HUNTER_API_KEY;
+      if (apiKey === undefined && keyFile !== undefined)
+        apiKey = readHunterApiKeyFile(keyFile);
+      if (apiKey === undefined || apiKey.trim().length < 8)
+        fail3("Set a valid HUNTER_API_KEY or use --key-file PATH.");
+      const limit = positive(limitValue, "--limit", 100, 100);
+      const result = await hunterFindEmails(database, {
+        apiKey: apiKey.trim(),
+        limit,
+        onProgress: (done, total) => {
+          if (!asJson)
+            console.log(`[${done}/${total}]`);
+        }
+      });
+      print({ attempted: result.attempted, emails_found: result.emails_found, run_id: result.run_id, outcomes: result.outcomes }, asJson);
+      return;
+    }
     if (command === "x" && subcommand === "import") {
       const options = [...rest];
       const archive = options.shift();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/peopleblade",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Local-first, source-aware contact intelligence for people and agents",
   "type": "module",
   "bin": {