fullstackgtm 0.45.0 → 0.46.0

package/dist/cli.js

@@ -1,22 +1,14 @@
 import { activeProfile, listProfiles, setActiveProfile } from "./credentials.js";
-import { audit, healthCommand, reportCommand, rulesCommand, snapshotCommand } from "./cli/audit.js";
-import { doctorCommand, login, logout } from "./cli/auth.js";
 import { capabilitiesCommand, printCommandHelpJson, robotDocsCommand, unknownCommandEnvelope } from "./cli/capabilities.js";
-import { callCommand } from "./cli/call.js";
-import { draftCommand } from "./cli/draft.js";
-import { enrichCommand } from "./cli/enrich.js";
-import { bulkUpdateCommand, dedupeCommand, fixCommand, reassignCommand, resolveCommand, suggest } from "./cli/fix.js";
 import { BESPOKE_HELP, commandHelp, HELP, shortUsage, stylizeShortUsage, usage } from "./cli/help.js";
-import { icpCommand } from "./cli/icp.js";
-import { initCommand } from "./cli/init.js";
-import { marketCommand } from "./cli/market.js";
-import { apply, auditLogCommand, diffCommand, mergeCommand, plansCommand } from "./cli/plans.js";
-import { scheduleCommand } from "./cli/schedule.js";
 import { readPackageInfo } from "./cli/shared.js";
 import { correctedCommand, detectFlagTypo, suggestCommand, unknownFlagEnvelope } from "./cli/suggest.js";
 import { colorEnabled, paint } from "./cli/ui.js";
-import { signalsCommand } from "./cli/signals.js";
-import { tamCommand } from "./cli/tam.js";
+// Verb modules load lazily inside their dispatch branch below. The dispatcher
+// used to import all of them eagerly, so `--version` compiled the full
+// 78-module graph (audit, market, enrich, signals, schedule, …) before
+// printing one line. Each branch now `await import()`s only its own module;
+// help/typo/error paths and the exports above stay eager and byte-identical.
 /**
  * Pull the global `--profile <name>` flag out of argv (it may appear before
  * or after the command) and activate it. Stripping it keeps positional
@@ -126,95 +118,99 @@ export async function runCli(argv) {
         return;
     }
     if (command === "login") {
-        await login(args);
+        await (await import("./cli/auth.js")).login(args);
         return;
     }
     if (command === "logout") {
-        logout(args);
+        (await import("./cli/auth.js")).logout(args);
         return;
     }
     if (command === "snapshot") {
-        await snapshotCommand(args);
+        await (await import("./cli/audit.js")).snapshotCommand(args);
         return;
     }
     if (command === "audit") {
-        await audit(args);
+        await (await import("./cli/audit.js")).audit(args);
         return;
     }
     if (command === "report") {
-        await reportCommand(args);
+        await (await import("./cli/audit.js")).reportCommand(args);
         return;
     }
     if (command === "rules") {
-        await rulesCommand(args);
+        await (await import("./cli/audit.js")).rulesCommand(args);
         return;
     }
     if (command === "doctor") {
-        await doctorCommand(args);
+        await (await import("./cli/auth.js")).doctorCommand(args);
         return;
     }
     if (command === "health") {
-        healthCommand(args);
+        (await import("./cli/audit.js")).healthCommand(args);
         return;
     }
     if (command === "suggest") {
-        await suggest(args);
+        await (await import("./cli/fix.js")).suggest(args);
         return;
     }
     if (command === "call") {
-        await callCommand(args);
+        await (await import("./cli/call.js")).callCommand(args);
         return;
     }
     if (command === "resolve") {
-        await resolveCommand(args);
+        await (await import("./cli/fix.js")).resolveCommand(args);
         return;
     }
     if (command === "bulk-update") {
-        await bulkUpdateCommand(args);
+        await (await import("./cli/fix.js")).bulkUpdateCommand(args);
         return;
     }
     if (command === "dedupe") {
-        await dedupeCommand(args);
+        await (await import("./cli/fix.js")).dedupeCommand(args);
         return;
     }
     if (command === "reassign") {
-        await reassignCommand(args);
+        await (await import("./cli/fix.js")).reassignCommand(args);
         return;
     }
     if (command === "fix") {
-        await fixCommand(args);
+        await (await import("./cli/fix.js")).fixCommand(args);
         return;
     }
     if (command === "market") {
-        await marketCommand(args);
+        await (await import("./cli/market.js")).marketCommand(args);
         return;
     }
     if (command === "enrich") {
-        await enrichCommand(args);
+        await (await import("./cli/enrich.js")).enrichCommand(args);
+        return;
+    }
+    if (command === "backfill") {
+        await (await import("./cli/backfill.js")).backfillCommand(args);
         return;
     }
     if (command === "init") {
-        initCommand(args);
+        (await import("./cli/init.js")).initCommand(args);
         return;
     }
     if (command === "tam") {
-        await tamCommand(args);
+        await (await import("./cli/tam.js")).tamCommand(args);
         return;
     }
     if (command === "icp") {
-        await icpCommand(args);
+        await (await import("./cli/icp.js")).icpCommand(args);
         return;
     }
     if (command === "signals") {
-        await signalsCommand(args);
+        await (await import("./cli/signals.js")).signalsCommand(args);
         return;
     }
     if (command === "draft") {
-        await draftCommand(args);
+        await (await import("./cli/draft.js")).draftCommand(args);
         return;
     }
     if (command === "schedule") {
-        await scheduleCommand(args);
+        await (await import("./cli/schedule.js")).scheduleCommand(args);
         return;
     }
     if (command === "profiles") {
@@ -222,23 +218,23 @@ export async function runCli(argv) {
         return;
     }
     if (command === "diff") {
-        await diffCommand(args);
+        await (await import("./cli/plans.js")).diffCommand(args);
         return;
     }
     if (command === "merge") {
-        await mergeCommand(args);
+        await (await import("./cli/plans.js")).mergeCommand(args);
         return;
     }
     if (command === "plans") {
-        await plansCommand(args);
+        await (await import("./cli/plans.js")).plansCommand(args);
         return;
     }
     if (command === "audit-log") {
-        await auditLogCommand(args);
+        await (await import("./cli/plans.js")).auditLogCommand(args);
         return;
     }
     if (command === "apply") {
-        await apply(args);
+        await (await import("./cli/plans.js")).apply(args);
         return;
     }
     // Machine callers get a structured envelope with a did-you-mean hint

package/dist/connector.d.ts

@@ -1,3 +1,4 @@
+import { type ProgressEmitter } from "./progress.ts";
 import type { GtmConnector, PatchPlan, PatchPlanRun } from "./types.ts";
 export type ApplyPatchPlanOptions = {
     /**
@@ -31,6 +32,13 @@ export type ApplyPatchPlanOptions = {
      * full operation count.
      */
     onOperation?: (progress: ApplyProgress) => void;
+    /**
+     * Shared progress vocabulary (src/progress.ts): the run emits the
+     * APPLY_STAGES (preflight → operations → results), one `opResult` per
+     * resolved operation (id + status only — no values), and `items` over the
+     * plan's operations. Additive alongside `onOperation`; presentation only.
+     */
+    progress?: ProgressEmitter;
 };
 export type ApplyProgress = {
     completed: number;

package/dist/connector.js

@@ -1,4 +1,5 @@
 import { dedupeKey } from "./dedupe.js";
+import { APPLY_STAGES } from "./progress.js";
 import { requiresHumanInput } from "./rules.js";
 const IRREVERSIBLE_OPERATIONS = new Set(["merge_records", "archive_record"]);
 const IDENTITY_KEY_BY_TYPE = {
@@ -83,6 +84,8 @@ export async function applyPatchPlan(connector, plan, options) {
         throw new Error(`The ${connector.provider} connector is read-only.`);
     }
     const startedAt = new Date().toISOString();
+    const emitStage = (stage) => options.progress?.stage(stage, APPLY_STAGES.indexOf(stage), APPLY_STAGES.length);
+    emitStage("preflight");
     const approved = new Set(options.approvedOperationIds);
     const checkConflicts = options.checkConflicts ?? typeof connector.readField === "function";
     const results = [];
@@ -157,6 +160,7 @@ export async function applyPatchPlan(connector, plan, options) {
                     : "Operation was not approved.",
             });
         }
+        emitStage("results");
         return {
             planId: plan.id,
             provider: connector.provider,
@@ -260,7 +264,7 @@ export async function applyPatchPlan(connector, plan, options) {
     const resultsBefore = results.length;
     let lastNotified = results.length;
     const notifyProgress = () => {
-        if (!options.onOperation || results.length === lastNotified)
+        if ((!options.onOperation && !options.progress) || results.length === lastNotified)
             return;
         lastNotified = results.length;
         const last = results[results.length - 1];
@@ -272,17 +276,24 @@ export async function applyPatchPlan(connector, plan, options) {
             progressCounts.conflicts += 1;
         else
             progressCounts.skipped += 1;
-        try {
-            options.onOperation({
-                completed: results.length - resultsBefore,
-                total: plan.operations.length,
-                ...progressCounts,
-            });
-        }
-        catch {
-            // progress is presentation-only
+        // Shared vocabulary: operation id + status only — a conflict/failure
+        // detail can echo field values, which never leave the machine.
+        options.progress?.opResult(last.operationId, last.status);
+        options.progress?.items(results.length - resultsBefore, plan.operations.length);
+        if (options.onOperation) {
+            try {
+                options.onOperation({
+                    completed: results.length - resultsBefore,
+                    total: plan.operations.length,
+                    ...progressCounts,
+                });
+            }
+            catch {
+                // progress is presentation-only
+            }
         }
     };
+    emitStage("operations");
     for (const operation of plan.operations) {
         // Report the previous iteration's result (guarded: no-op if it pushed
         // nothing). One-iteration lag keeps this a two-line hook instead of a
@@ -377,6 +388,7 @@ export async function applyPatchPlan(connector, plan, options) {
         }
     }
     notifyProgress();
+    emitStage("results");
     return {
         planId: plan.id,
         provider: connector.provider,

package/dist/connectors/hubspot.d.ts

@@ -1,5 +1,6 @@
 import { type FieldMappings } from "../mappings.ts";
 import type { GtmConnector, SnapshotProgress } from "../types.ts";
+import { type ProgressEmitter } from "../progress.ts";
 export type HubspotConnectorOptions = {
     /** Returns a HubSpot access token (private app token or OAuth access token). */
     getAccessToken: () => string | Promise<string>;
@@ -10,6 +11,12 @@ export type HubspotConnectorOptions = {
     fetchImpl?: typeof fetch;
     /** Per-page snapshot-pull progress (presentation only — errors are swallowed). */
     onProgress?: (progress: SnapshotProgress) => void;
+    /**
+     * Shared progress vocabulary (src/progress.ts): the snapshot pull emits a
+     * `stage` per object type and an `items` heartbeat per page. Additive
+     * alongside the legacy `onProgress` callback; both are presentation-only.
+     */
+    progress?: ProgressEmitter;
 };
 /**
  * Reference connector for HubSpot.

package/dist/connectors/hubspot.js

@@ -1,4 +1,5 @@
 import { HUBSPOT_DEFAULT_FIELD_MAPPINGS, mappedField, mappedFields, readMappedValue, } from "../mappings.js";
+import { SNAPSHOT_PULL_STAGES } from "../progress.js";
 const DEFAULT_API_BASE_URL = "https://api.hubapi.com";
 const OBJECT_PATHS = {
     account: "companies",
@@ -10,6 +11,14 @@ const MAPPING_OBJECT_TYPES = {
     contact: "contacts",
     deal: "deals",
 };
+// SnapshotProgress object types → the shared SNAPSHOT_PULL_STAGES names, so
+// the CLI checklist and the app StageTimeline read the same stage labels.
+const PULL_STAGE_BY_TYPE = {
+    user: "owners",
+    account: "accounts",
+    contact: "contacts",
+    deal: "deals",
+};
 /**
  * Reference connector for HubSpot.
  *
@@ -30,6 +39,32 @@ export function createHubspotConnector(options) {
     // match value (email): HubSpot search is eventually consistent, so a contact
     // created earlier in this apply run is invisible to a later search.
     const createdContactsByMatch = new Map();
+    // Same-run dedup for `create_record` deal creates, keyed by
+    // matchKey:matchValue (e.g. stripe_invoice_id:in_123) — same
+    // eventual-consistency rationale as the contact cache.
+    const createdDealsByMatch = new Map();
+    // One /crm/v3/pipelines/deals read per connector lifetime (one apply run):
+    // pipeline/stage metadata doesn't change mid-run, and deal creates resolve
+    // the closed-won stage from it per operation.
+    let dealPipelinesCache;
+    // Custom deal dedupe properties ensured (or confirmed missing) this run.
+    const ensuredDealProperties = new Map();
+    // Per-page snapshot-pull progress: the legacy onProgress callback plus the
+    // shared emitter (stage on the first page of each object type, items per
+    // page). Both are presentation-only — callers already swallow errors.
+    let lastPullStage;
+    const pullProgress = (objectType, fetched) => {
+        options.onProgress?.({ objectType, fetched });
+        const emitter = options.progress;
+        if (!emitter)
+            return;
+        const stage = PULL_STAGE_BY_TYPE[objectType];
+        if (stage !== lastPullStage) {
+            lastPullStage = stage;
+            emitter.stage(stage, SNAPSHOT_PULL_STAGES.indexOf(stage), SNAPSHOT_PULL_STAGES.length);
+        }
+        emitter.items(fetched);
+    };
     async function request(path, init = {}) {
         const token = await options.getAccessToken();
         let response;
@@ -115,7 +150,7 @@ export function createHubspotConnector(options) {
         return results;
     }
     async function assembleSnapshot(fetchObjects) {
-        const owners = await list("/crm/v3/owners?limit=100", (fetched) => options.onProgress?.({ objectType: "user", fetched }));
+        const owners = await list("/crm/v3/owners?limit=100", (fetched) => pullProgress("user", fetched));
         const users = owners
             .filter((owner) => owner.id)
             .map((owner) => ({
@@ -228,6 +263,8 @@ export function createHubspotConnector(options) {
                 raw: deal,
             };
         });
+        // Deliver any throttled trailing items heartbeat before the pull returns.
+        options.progress?.flush();
         return {
             generatedAt: new Date().toISOString(),
             provider: "hubspot",
@@ -242,7 +279,7 @@ export function createHubspotConnector(options) {
     }
     async function fetchSnapshot() {
         const canonicalType = { companies: "account", contacts: "contact", deals: "deal" };
-        return assembleSnapshot((objectType, properties, withAssociations) => list(`/crm/v3/objects/${objectType}?limit=100&properties=${properties}${withAssociations ? "&associations=companies" : ""}`, (fetched) => options.onProgress?.({ objectType: canonicalType[objectType], fetched })));
+        return assembleSnapshot((objectType, properties, withAssociations) => list(`/crm/v3/objects/${objectType}?limit=100&properties=${properties}${withAssociations ? "&associations=companies" : ""}`, (fetched) => pullProgress(canonicalType[objectType], fetched)));
     }
     const MODIFIED_DATE_PROPERTIES = {
         companies: "hs_lastmodifieddate",
@@ -506,12 +543,199 @@ export function createHubspotConnector(options) {
         createdCompaniesByName.set(cacheKey, id);
         return id;
     }
+    /** Exact-value deal lookup (by any searchable property) for resolve-first creates. */
+    async function searchDealsBy(property, value) {
+        const data = await request(`/crm/v3/objects/deals/search`, {
+            method: "POST",
+            body: JSON.stringify({
+                filterGroups: [{ filters: [{ propertyName: property, operator: "EQ", value }] }],
+                properties: [property],
+                limit: 3,
+            }),
+        });
+        return (data?.results ?? []).map((row) => String(row.id));
+    }
     /**
-     * Create a NET-NEW record (a sourced lead). Resolve-first: re-checks the
-     * dedupe key against the live CRM (the plan-time snapshot can be stale) and
-     * creates ONLY on a confirmed miss — a record a concurrent writer already
-     * added is returned as `skipped`, never duplicated. Contacts can be linked
-     * to a resolved-or-created company in the same step.
+     * Make sure the deal dedupe property (e.g. "stripe_invoice_id") exists so
+     * both the resolve-first search and the stamped value are real. Best-effort
+     * create on a confirmed miss; returns false when the property can neither
+     * be read nor created — the caller must SKIP then (creating a deal without
+     * its dedupe key would make every replay a duplicate).
+     */
+    async function ensureDealProperty(name) {
+        const cached = ensuredDealProperties.get(name);
+        if (cached !== undefined)
+            return cached;
+        let ok;
+        try {
+            await request(`/crm/v3/properties/deals/${encodeURIComponent(name)}`);
+            ok = true;
+        }
+        catch {
+            // Missing (404) or unreadable — try to create it; a failure here means
+            // we cannot guarantee the dedupe key, so report false.
+            try {
+                await request(`/crm/v3/properties/deals`, {
+                    method: "POST",
+                    body: JSON.stringify({
+                        name,
+                        label: name,
+                        type: "string",
+                        fieldType: "text",
+                        groupName: "dealinformation",
+                        hasUniqueValue: false,
+                    }),
+                });
+                ok = true;
+            }
+            catch {
+                ok = false;
+            }
+        }
+        ensuredDealProperties.set(name, ok);
+        return ok;
+    }
+    /**
+     * Resolve the target pipeline and its closed-won stage from the portal's
+     * own pipeline metadata (one read per run). The pipeline is picked by id or
+     * case-insensitive label (`hint`), else the default (lowest displayOrder);
+     * the closed-won stage is the one whose metadata says isClosed with
+     * probability 1 — NEVER a substring guess against stage names. Returns null
+     * when either is unresolvable so the caller skips instead of guessing.
+     */
+    async function resolveClosedWonStage(hint) {
+        if (!dealPipelinesCache) {
+            dealPipelinesCache = request("/crm/v3/pipelines/deals").then((data) => (data?.results ?? []));
+            // A failed read must not poison the cache for the rest of the run.
+            dealPipelinesCache = dealPipelinesCache.catch(() => []);
+        }
+        const pipelines = await dealPipelinesCache;
+        if (pipelines.length === 0)
+            return null;
+        let pipeline;
+        if (hint) {
+            const wanted = hint.trim().toLowerCase();
+            pipeline = pipelines.find((candidate) => String(candidate?.id ?? "").toLowerCase() === wanted ||
+                String(candidate?.label ?? "").trim().toLowerCase() === wanted);
+            if (!pipeline)
+                return null; // an explicit hint that matches nothing is an error, not "use default"
+        }
+        else {
+            pipeline = [...pipelines].sort((a, b) => Number(a?.displayOrder ?? 0) - Number(b?.displayOrder ?? 0))[0];
+        }
+        if (!pipeline?.id)
+            return null;
+        const stage = (pipeline.stages ?? []).find((candidate) => {
+            const meta = candidate?.metadata ?? {};
+            return (candidate?.id &&
+                String(meta.isClosed).toLowerCase() === "true" &&
+                Number(meta.probability) === 1);
+        });
+        if (!stage)
+            return null;
+        return { pipelineId: String(pipeline.id), stageId: String(stage.id) };
+    }
+    /**
+     * Deal branch of create_record (backfill: one closed-won deal per paid
+     * invoice). Resolve-first on the custom dedupe property (ensured to exist
+     * first), stage resolved from pipeline metadata, company association
+     * best-effort — same contract as the contact branch.
+     */
+    async function createDealRecord(operation, payload, matchValue) {
+        const matchKey = String(payload.matchKey ?? "").trim();
+        if (!matchKey) {
+            return { operationId: operation.id, status: "skipped", detail: "create_record for deals needs a matchKey (the dedupe property, e.g. stripe_invoice_id)." };
+        }
+        const dedupeKey = `${matchKey}:${matchValue.toLowerCase()}`;
+        const alreadyCreated = createdDealsByMatch.get(dedupeKey);
+        if (alreadyCreated) {
+            return { operationId: operation.id, status: "skipped", detail: `Deal ${matchKey}=${matchValue} already created earlier in this run; not duplicating.`, providerData: { id: alreadyCreated, existing: true } };
+        }
+        // The dedupe property is usually CUSTOM — ensure it exists before the
+        // search; searching a property HubSpot doesn't have 400s, and creating a
+        // deal without the key stamped would defeat every future resolve-first.
+        const propertyOk = await ensureDealProperty(matchKey);
+        if (!propertyOk) {
+            return { operationId: operation.id, status: "skipped", detail: `Deal dedupe property "${matchKey}" does not exist and could not be created; refusing to create a deal without its dedupe key.` };
+        }
+        const existing = await searchDealsBy(matchKey, matchValue);
+        if (existing.length > 0) {
+            createdDealsByMatch.set(dedupeKey, existing[0]);
+            return { operationId: operation.id, status: "skipped", detail: `Deal ${matchKey}=${matchValue} already exists (${existing.join(", ")}); resolve-first declined to create.`, providerData: { id: existing[0], existing: true } };
+        }
+        // Stage: only the provider-neutral "closed_won" sentinel is understood,
+        // and it must resolve to a real stage id from pipeline metadata.
+        if (payload.dealStage !== "closed_won") {
+            return { operationId: operation.id, status: "skipped", detail: 'create_record for deals needs dealStage "closed_won" (the connector resolves the real stage id from pipeline metadata).' };
+        }
+        const resolved = await resolveClosedWonStage(payload.dealPipeline);
+        if (!resolved) {
+            return {
+                operationId: operation.id,
+                status: "skipped",
+                detail: payload.dealPipeline
+                    ? `Could not resolve pipeline "${payload.dealPipeline}" (by id or label) to a closed-won stage; not guessing a stage.`
+                    : "Could not resolve the default deal pipeline's closed-won stage (isClosed + probability 1) from pipeline metadata; not guessing a stage.",
+            };
+        }
+        const properties = {
+            ...payload.properties,
+            [matchKey]: matchValue,
+            pipeline: resolved.pipelineId,
+            dealstage: resolved.stageId,
+        };
+        if (payload.ownerId && !properties.hubspot_owner_id) {
+            properties.hubspot_owner_id = String(payload.ownerId);
+        }
+        let created;
+        try {
+            created = await request(`/crm/v3/objects/deals`, {
+                method: "POST",
+                body: JSON.stringify({ properties: { ...properties, hs_object_source_detail_2: `fullstackgtm backfill (${operation.id})` } }),
+            });
+        }
+        catch {
+            // Some portals reject writes to source-detail properties — the provenance
+            // stamp is best-effort, the create is not.
+            created = await request(`/crm/v3/objects/deals`, {
+                method: "POST",
+                body: JSON.stringify({ properties }),
+            });
+        }
+        const dealId = String(created.id);
+        createdDealsByMatch.set(dedupeKey, dealId);
+        let companyNote = "";
+        if (payload.associateCompanyName) {
+            try {
+                const companyId = await resolveOrCreateCompany(payload.associateCompanyName, payload.associateCompanyDomain, operation.id);
+                if (companyId) {
+                    await request(`/crm/v4/objects/deals/${encodeURIComponent(dealId)}/associations/default/companies/${encodeURIComponent(companyId)}`, { method: "PUT" });
+                    const domainNote = payload.associateCompanyDomain ? ` (${payload.associateCompanyDomain})` : "";
+                    companyNote = ` Linked to company "${payload.associateCompanyName}"${domainNote} (${companyId}).`;
+                }
+                else {
+                    companyNote = ` Company "${payload.associateCompanyName}" was ambiguous; left unlinked.`;
+                }
+            }
+            catch (error) {
+                // Association is best-effort — the deal create already succeeded.
+                companyNote = ` (company link failed: ${error instanceof Error ? error.message : String(error)})`;
+            }
+        }
+        return {
+            operationId: operation.id,
+            status: "applied",
+            detail: `Created deal ${matchKey}=${matchValue} (${dealId}) in stage ${resolved.stageId}.${companyNote}`,
+            providerData: { id: dealId, created: true, pipelineId: resolved.pipelineId, stageId: resolved.stageId },
+        };
+    }
+    /**
+     * Create a NET-NEW record (a sourced lead, or a backfilled deal).
+     * Resolve-first: re-checks the dedupe key against the live CRM (the
+     * plan-time snapshot can be stale) and creates ONLY on a confirmed miss — a
+     * record a concurrent writer already added is returned as `skipped`, never
+     * duplicated. Contacts and deals can be linked to a resolved-or-created
+     * company in the same step.
      */
     async function createRecord(operation) {
         const payload = operation.afterValue;
@@ -519,13 +743,16 @@ export function createHubspotConnector(options) {
             return { operationId: operation.id, status: "skipped", detail: "create_record needs a CreateRecordPayload afterValue." };
         }
         const objectPath = OBJECT_PATHS[operation.objectType];
-        if (operation.objectType !== "contact" && operation.objectType !== "account") {
-            return { operationId: operation.id, status: "skipped", detail: "create_record supports contacts and accounts." };
+        if (operation.objectType !== "contact" && operation.objectType !== "account" && operation.objectType !== "deal") {
+            return { operationId: operation.id, status: "skipped", detail: "create_record supports contacts, accounts, and deals." };
         }
         const matchValue = String(payload.matchValue ?? "").trim();
         if (!matchValue) {
             return { operationId: operation.id, status: "skipped", detail: "create_record needs a non-empty matchValue to resolve-first." };
         }
+        if (operation.objectType === "deal") {
+            return createDealRecord(operation, payload, matchValue);
+        }
         if (operation.objectType === "account") {
             const id = await resolveOrCreateCompany(matchValue, stringOrUndefined(payload.properties?.domain), operation.id);
             if (id === null) {

package/dist/connectors/hubspotAuth.js

@@ -1,4 +1,3 @@
-import { createServer } from "node:http";
 import { randomBytes } from "node:crypto";
 /**
  * HubSpot CLI authentication.
@@ -101,6 +100,11 @@ export async function runHubspotLoopbackLogin(options) {
     const log = options.log ?? ((message) => console.error(message));
     const redirectUri = `http://localhost:${port}/callback`;
     const state = randomBytes(16).toString("hex");
+    // Deferred: `node:http` transitively compiles node's bundled undici on
+    // import (~10ms+, 12% of a demo-audit run's CPU profile). This module is in
+    // the eager graph of every CLI invocation via help.ts/auth.ts, but the
+    // server is only needed during the interactive OAuth loopback login.
+    const { createServer } = await import("node:http");
     const code = await new Promise((resolve, reject) => {
         const server = createServer((request, response) => {
             const url = new URL(request.url ?? "/", `http://localhost:${port}`);