fullstackgtm 0.47.0 → 0.49.0

package/src/cli/suggest.ts

@@ -12,7 +12,14 @@
 // itself; this holds uniformly for read and write verbs, so a typo can never
 // silently change what a write-shaped invocation stages.
 
-import { HELP, usage } from "./help.ts";
+import {
+  COMMAND_FLAGS,
+  FLAGS_WITH_VALUES,
+  GLOBAL_FLAGS,
+  GLOBAL_SHORT_FLAGS,
+  HELP,
+  usage,
+} from "./help.ts";
 
 export function levenshtein(a: string, b: string): number {
   const dp = Array.from({ length: a.length + 1 }, () => Array<number>(b.length + 1).fill(0));
@@ -65,7 +72,7 @@ export function documentedFlags(): Set<string> {
 export type FlagTypo = {
   given: string;
   /** Human-readable correction, e.g. `--json` or `--rules missing-deal-owner`. */
-  suggestion: string;
+  suggestion: string | null;
   /** The argv tokens that replace `given` in the corrected command. */
   replacement: string[];
 };
@@ -108,6 +115,53 @@ export function detectFlagTypo(args: string[]): FlagTypo | null {
   return null;
 }
 
+function isFlagShaped(token: string): boolean {
+  return token !== "-" && token.startsWith("-");
+}
+
+function suggestCommandFlag(unknown: string, allowed: Set<string>): string | null {
+  const candidates = [...allowed].filter((flag) => flag.startsWith("--"));
+  const prefix = candidates
+    .filter((flag) => unknown.startsWith(`${flag}-`) || flag.startsWith(unknown))
+    .sort((a, b) => b.length - a.length)[0];
+  if (prefix) return prefix;
+  return nearest(unknown.toLowerCase().replace(/_/g, "-"), candidates, 3);
+}
+
+export function detectUnknownFlag(command: string, args: string[]): FlagTypo | null {
+  const commandFlags = COMMAND_FLAGS[command];
+  if (!commandFlags) return null;
+  const allowed = new Set([...GLOBAL_FLAGS, ...commandFlags]);
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--") break;
+    if (GLOBAL_SHORT_FLAGS.includes(token)) continue;
+    if (!token.startsWith("-")) continue;
+
+    if (!token.startsWith("--")) {
+      return { given: token, suggestion: null, replacement: [] };
+    }
+
+    const equalsIndex = token.indexOf("=");
+    const flag = equalsIndex === -1 ? token : token.slice(0, equalsIndex);
+    if (allowed.has(flag)) {
+      if (equalsIndex !== -1) {
+        const value = token.slice(equalsIndex + 1);
+        const replacement = value === "" ? [flag] : [flag, value];
+        return { given: token, suggestion: replacement.join(" "), replacement };
+      }
+      if (FLAGS_WITH_VALUES.has(flag) && args[index + 1] !== undefined && !isFlagShaped(args[index + 1])) {
+        index += 1;
+      }
+      continue;
+    }
+
+    const suggestion = suggestCommandFlag(flag, allowed);
+    return { given: flag, suggestion, replacement: suggestion ? [suggestion] : [] };
+  }
+  return null;
+}
+
 /** Nearest known command, derived from the same HELP table. */
 export function suggestCommand(command: string): string | null {
   if (!command) return null;
@@ -143,8 +197,8 @@ export function unknownFlagEnvelope(command: string, args: string[], typo: FlagT
       code: "UNKNOWN_FLAG" as const,
       message: `Unknown flag: ${typo.given}`,
       hints: [
-        `Did you mean: ${typo.suggestion}`,
-        `Try: ${correctedCommand(command, args, typo)}`,
+        ...(typo.suggestion ? [`Did you mean: ${typo.suggestion}`] : []),
+        ...(typo.replacement.length > 0 ? [`Try: ${correctedCommand(command, args, typo)}`] : []),
       ],
     },
   };

package/src/cli/ui.ts

@@ -449,6 +449,7 @@ export function severityWord(word: string, p: Paint): string {
 export function planStatusWord(status: string, p: Paint): string {
   if (status === "needs_approval") return p.yellow(status);
   if (status === "approved" || status === "applied") return p.green(status);
+  if (status === "applying") return p.yellow(status);
   if (status === "rejected") return p.red(status);
   return status;
 }

package/src/cli.ts

@@ -2,7 +2,7 @@ import { activeProfile, listProfiles, setActiveProfile } from "./credentials.ts"
 import { capabilitiesCommand, printCommandHelpJson, robotDocsCommand, unknownCommandEnvelope } from "./cli/capabilities.ts";
 import { BESPOKE_HELP, commandHelp, HELP, shortUsage, stylizeShortUsage, usage } from "./cli/help.ts";
 import { readPackageInfo } from "./cli/shared.ts";
-import { correctedCommand, detectFlagTypo, suggestCommand, unknownFlagEnvelope } from "./cli/suggest.ts";
+import { correctedCommand, detectFlagTypo, detectUnknownFlag, suggestCommand, unknownFlagEnvelope } from "./cli/suggest.ts";
 import { colorEnabled, paint } from "./cli/ui.ts";
 
 // Verb modules load lazily inside their dispatch branch below. The dispatcher
@@ -62,13 +62,19 @@ export async function runCli(argv: string[]) {
   }
   if (command === "help") {
     const [topic] = args;
-    if (topic && topic !== "--full" && !topic.startsWith("-")) {
+    if (topic && !topic.startsWith("-") && args.includes("--json")) {
       // `help <cmd> --json` → machine-readable help derived from the same
-      // HELP entry the plain text renders from. Plain output is unchanged.
-      if (args.includes("--json")) printCommandHelpJson(topic);
-      else console.log(commandHelp(topic));
+      // HELP entry the plain text renders from. JSON takes precedence over
+      // --full so automated callers get a stable shape.
+      printCommandHelpJson(topic);
+    } else if (args.includes("--full")) {
+      // --full is the global escape hatch to the complete reference, even
+      // when a topic is given (help <cmd> --full), unless --json is requested.
+      console.log(usage());
+    } else if (topic && !topic.startsWith("-")) {
+      console.log(commandHelp(topic));
     } else {
-      console.log(args.includes("--full") || topic === "--full" ? usage() : styledShortUsage());
+      console.log(styledShortUsage());
     }
     return;
   }
@@ -85,7 +91,7 @@ export async function runCli(argv: string[]) {
   }
   // Commands without bespoke help get focused per-command help on --help
   // instead of executing (audit used to silently run the sample audit) or
-  // dumping the whole surface. call/market/enrich/bulk-update/schedule print
+  // dumping the whole surface. call/market/enrich/schedule print
   // their own richer help. `--full` always escapes to the complete reference.
   if (!BESPOKE_HELP.includes(command) && (args.includes("--help") || args.includes("-h"))) {
     console.log(args.includes("--full") ? usage() : commandHelp(command));
@@ -94,19 +100,26 @@ export async function runCli(argv: string[]) {
 
   // Flag typos used to be silently dropped by the per-verb parsers —
   // `audit --demo --jsn` exited 0 and printed markdown where the agent asked
-  // for JSON. Near-miss unknown flags (≤ 1 edit from a flag documented in
-  // help.ts) now stop with the exact corrected command. Suggest-only: never
-  // auto-execute the correction, so a typo can never change what a
-  // write-shaped invocation stages.
+  // for JSON. Every flag-shaped token is now checked against the per-command
+  // registry in help.ts, so unknown flags fail closed instead of being ignored.
+  // Suggest-only: never auto-execute the correction, so a typo can never
+  // silently change what a write-shaped invocation stages.
   if (command in HELP) {
-    const typo = detectFlagTypo(args);
+    const typo = detectUnknownFlag(command, args);
     if (typo) {
       if (args.includes("--json")) {
         console.log(JSON.stringify(unknownFlagEnvelope(command, args, typo), null, 2));
       } else {
+        console.error(`Unknown flag for ${command}: ${typo.given}`);
+        // Keep the old near-miss shape too; existing agents key off it.
         console.error(`Unknown flag: ${typo.given}`);
-        console.error(`Did you mean: ${typo.suggestion}`);
-        console.error(`Try: ${correctedCommand(command, args, typo)}`);
+        if (typo.suggestion) {
+          console.error(`Did you mean ${typo.suggestion}?`);
+          console.error(`Did you mean: ${typo.suggestion}`);
+          if (typo.replacement.length > 0) {
+            console.error(`Try: ${correctedCommand(command, args, typo)}`);
+          }
+        }
       }
       process.exitCode = 1;
       return;
@@ -165,6 +178,18 @@ export async function runCli(argv: string[]) {
     await (await import("./cli/fix.ts")).resolveCommand(args);
     return;
   }
+  if (command === "route") {
+    await (await import("./cli/fix.ts")).routeCommand(args);
+    return;
+  }
+  if (command === "hierarchy") {
+    await (await import("./cli/fix.ts")).hierarchyCommand(args);
+    return;
+  }
+  if (command === "relationships") {
+    await (await import("./cli/fix.ts")).relationshipsCommand(args);
+    return;
+  }
   if (command === "bulk-update") {
     await (await import("./cli/fix.ts")).bulkUpdateCommand(args);
     return;

package/src/config.ts

@@ -35,6 +35,35 @@ export type LoadedConfig = {
   path: string;
 };
 
+export type RulePackageTrust = {
+  /** Execute rule-package modules. Only set after an explicit trust decision. */
+  allowRulePackages?: boolean;
+  /** Deliberately ignore rule packages while still applying declarative config. */
+  disableRulePackages?: boolean;
+};
+
+/**
+ * Translate the CLI's explicit trust flags into the library trust contract.
+ * Plugin execution requires both an explicit config path and --allow-plugins;
+ * discovering a config in the current directory is never a trust decision.
+ */
+export function rulePackageTrustFromCli(
+  args: string[],
+  explicitConfigPath?: string,
+): RulePackageTrust {
+  const allow = args.includes("--allow-plugins");
+  const disable = args.includes("--no-plugins");
+  if (allow && disable) {
+    throw new Error("--allow-plugins and --no-plugins cannot be used together.");
+  }
+  if (allow && !explicitConfigPath) {
+    throw new Error(
+      "--allow-plugins requires --config <path>. Plugin code is never trusted from an implicitly discovered config.",
+    );
+  }
+  return { allowRulePackages: allow, disableRulePackages: disable };
+}
+
 export function loadConfig(
   explicitPath?: string,
   cwd = process.cwd(),
@@ -73,10 +102,19 @@ export function mergePolicy(base: GtmPolicy, config?: FullstackgtmConfig): GtmPo
 export async function resolveConfiguredRules(
   loaded?: LoadedConfig | null,
   baseRules: GtmAuditRule[] = builtinAuditRules,
+  trust: RulePackageTrust = {},
 ): Promise<GtmAuditRule[]> {
   let rules = [...baseRules];
 
-  for (const specifier of loaded?.config.rulePackages ?? []) {
+  const packages = loaded?.config.rulePackages ?? [];
+  if (packages.length && !trust.allowRulePackages && !trust.disableRulePackages) {
+    throw new Error(
+      `Config ${loaded!.path} declares executable rulePackages. Refusing to load plugin code without explicit trust. ` +
+        "For the CLI, pass --config <path> --allow-plugins after reviewing the modules, or pass --no-plugins to use only declarative policy and built-in rules.",
+    );
+  }
+
+  for (const specifier of trust.disableRulePackages ? [] : packages) {
     const resolvedSpecifier =
       specifier.startsWith(".") || isAbsolute(specifier)
         ? pathToFileURL(resolve(dirname(loaded!.path), specifier)).href

package/src/connectors/hubspot.ts

@@ -24,6 +24,8 @@ import { SNAPSHOT_PULL_STAGES, type ProgressEmitter } from "../progress.ts";
 
 const DEFAULT_API_BASE_URL = "https://api.hubapi.com";
 
+export type HubspotWritableConnector = GtmConnector & Required<Pick<GtmConnector, "applyOperation" | "readField">>;
+
 export type HubspotConnectorOptions = {
   /** Returns a HubSpot access token (private app token or OAuth access token). */
   getAccessToken: () => string | Promise<string>;
@@ -71,7 +73,7 @@ const PULL_STAGE_BY_TYPE: Record<SnapshotProgress["objectType"], (typeof SNAPSHO
  * amountless deals — so audit rules can surface the gaps instead of hiding
  * them.
  */
-export function createHubspotConnector(options: HubspotConnectorOptions): GtmConnector {
+export function createHubspotConnector(options: HubspotConnectorOptions): HubspotWritableConnector {
   const baseUrl = (options.apiBaseUrl ?? DEFAULT_API_BASE_URL).replace(/\/$/, "");
   const fetchImpl = options.fetchImpl ?? fetch;
   const mappings = options.fieldMappings;

package/src/connectors/prospectSources.ts

@@ -14,6 +14,7 @@
  * env/credential store, never argv.
  */
 import type { CanonicalGtmSnapshot } from "../types.ts";
+import { ProviderHttpError } from "../providerError.ts";
 
 export type Prospect = {
   firstName?: string;
@@ -79,7 +80,7 @@ export async function fetchExploriumProspects(opts: {
     body: JSON.stringify({ mode: "full", size, page_size: size, page: 1, filters: opts.filters }),
   });
   if (!response.ok) {
-    throw new Error(`Explorium /v1/prospects failed: HTTP ${response.status} ${await safeText(response)}`);
+    throw new ProviderHttpError("Explorium", "prospect search", response.status);
   }
   const data = (await response.json()) as { data?: ExploriumRow[] };
   return (data.data ?? []).map((row) => ({
@@ -132,7 +133,7 @@ export async function fetchPipe0CrustdataProspects(opts: {
     }),
   });
   if (!response.ok) {
-    throw new Error(`pipe0 /v1/searches/run/sync failed: HTTP ${response.status} ${await safeText(response)}`);
+    throw new ProviderHttpError("pipe0", "prospect search", response.status);
   }
   const body = (await response.json()) as {
     results?: Array<Record<string, { value?: unknown }>>;
@@ -214,7 +215,7 @@ export async function probeExploriumBusinessCount(opts: {
     body: JSON.stringify({ mode: "full", page_size: 1, page: 1, filters: opts.filters }),
   });
   if (!response.ok) {
-    throw new Error(`Explorium /v1/businesses count failed: HTTP ${response.status} ${await safeText(response)}`);
+    throw new ProviderHttpError("Explorium", "business count", response.status);
   }
   const body = (await response.json()) as { total_results?: unknown };
   const total = body.total_results;
@@ -427,14 +428,6 @@ function fieldValue(field: Pipe0Field | undefined): string | undefined {
   return typeof v === "string" && v.trim() ? v : undefined;
 }
 
-async function safeText(response: Response): Promise<string> {
-  try {
-    return (await response.text()).slice(0, 300);
-  } catch {
-    return "";
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Pre-email dedup: identity keys shared between prospects and CRM contacts, so
 // we can drop already-in-CRM / already-seen people BEFORE paying for emails.

package/src/connectors/salesforce.ts

@@ -19,6 +19,7 @@ import type {
   PatchOperationResult,
   SnapshotProgress,
 } from "../types.ts";
+import { validateSalesforceOrigin } from "./salesforceAuth.ts";
 import { SNAPSHOT_PULL_STAGES, type ProgressEmitter } from "../progress.ts";
 
 const DEFAULT_API_VERSION = "v59.0";
@@ -29,6 +30,8 @@ export type SalesforceConnection = {
   instanceUrl: string;
 };
 
+export type SalesforceWritableConnector = GtmConnector & Required<Pick<GtmConnector, "applyOperation" | "readField">>;
+
 export type SalesforceConnectorOptions = {
   /** Returns an access token plus the instance URL it belongs to. */
   getConnection: () => SalesforceConnection | Promise<SalesforceConnection>;
@@ -86,7 +89,7 @@ const PULL_STAGE_BY_TYPE: Record<SnapshotProgress["objectType"], (typeof SNAPSHO
  */
 export function createSalesforceConnector(
   options: SalesforceConnectorOptions,
-): GtmConnector {
+): SalesforceWritableConnector {
   const apiVersion = options.apiVersion ?? DEFAULT_API_VERSION;
   const fetchImpl = options.fetchImpl ?? fetch;
   const mappings = options.fieldMappings;
@@ -150,13 +153,17 @@ export function createSalesforceConnector(
 
   async function request(path: string, init: RequestInit = {}): Promise<any> {
     const connection = await options.getConnection();
-    const url = path.startsWith("http")
-      ? path
-      : `${connection.instanceUrl.replace(/\/$/, "")}${path}`;
+    const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
+    const resolved = new URL(path, `${instanceUrl}/`);
+    if (resolved.origin !== instanceUrl) {
+      throw new Error("Salesforce response attempted to send credentials to a different origin.");
+    }
+    const url = resolved.href;
     let response: Response;
     try {
       response = await fetchImpl(url, {
         ...init,
+        redirect: "manual",
         headers: {
           Authorization: `Bearer ${connection.accessToken}`,
           "Content-Type": "application/json",
@@ -166,7 +173,7 @@ export function createSalesforceConnector(
     } catch (error) {
       const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
       throw new Error(
-        `Cannot reach Salesforce at ${connection.instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
+        `Cannot reach Salesforce at ${instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
       );
     }
     if (!response.ok) {
@@ -642,8 +649,9 @@ export function createSalesforceConnector(
     loserIds: string[],
   ): Promise<{ ok: boolean; detail?: string }> {
     const connection = await options.getConnection();
+    const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
     const version = apiVersion.replace(/^v/, ""); // SOAP path uses "59.0", not "v59.0"
-    const url = `${connection.instanceUrl.replace(/\/$/, "")}/services/Soap/u/${version}`;
+    const url = `${instanceUrl}/services/Soap/u/${version}`;
     const toMerge = loserIds.map((id) => `<urn:recordToMergeIds>${escapeXml(id)}</urn:recordToMergeIds>`).join("");
     const envelope =
       `<?xml version="1.0" encoding="UTF-8"?>` +
@@ -657,6 +665,7 @@ export function createSalesforceConnector(
     try {
       response = await fetchImpl(url, {
         method: "POST",
+        redirect: "manual",
         headers: { "Content-Type": "text/xml; charset=UTF-8", SOAPAction: '""' },
         body: envelope,
       });

package/src/connectors/salesforceAuth.ts

@@ -9,6 +9,41 @@
 
 const DEFAULT_LOGIN_URL = "https://login.salesforce.com";
 
+/**
+ * Normalize and validate a Salesforce credential-bearing origin.
+ *
+ * Salesforce API hosts are either the standard login/sandbox hosts or a
+ * Salesforce-owned instance/My Domain below salesforce.com.  Deliberately
+ * return an origin (not the input URL) so callers cannot accidentally retain
+ * paths, queries, credentials, or fragments from configuration.
+ */
+export function validateSalesforceOrigin(value: string, label = "Salesforce URL"): string {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${label} must be a valid HTTPS Salesforce URL.`);
+  }
+  if (url.protocol !== "https:") throw new Error(`${label} must use HTTPS.`);
+  if (url.username || url.password) throw new Error(`${label} must not contain user information.`);
+  if (url.hash) throw new Error(`${label} must not contain a fragment.`);
+  if (url.search) throw new Error(`${label} must not contain a query string.`);
+  if (url.pathname !== "/" && url.pathname !== "") throw new Error(`${label} must be an origin without a path.`);
+  if (url.port && url.port !== "443") throw new Error(`${label} must use the standard HTTPS port.`);
+
+  const hostname = url.hostname.toLowerCase();
+  const trusted =
+    hostname === "login.salesforce.com" ||
+    hostname === "test.salesforce.com" ||
+    (hostname.endsWith(".salesforce.com") && hostname.length > ".salesforce.com".length);
+  if (!trusted) {
+    throw new Error(
+      `${label} must use login.salesforce.com, test.salesforce.com, or a Salesforce instance/My Domain host.`,
+    );
+  }
+  return url.origin;
+}
+
 export type SalesforceTokenSet = {
   accessToken: string;
   refreshToken?: string;
@@ -27,7 +62,7 @@ export type SalesforceDeviceAuthorization = {
 const SESSION_TTL_MS = 2 * 60 * 60 * 1000;
 
 function tokenUrl(loginUrl: string) {
-  return `${loginUrl.replace(/\/$/, "")}/services/oauth2/token`;
+  return `${validateSalesforceOrigin(loginUrl, "Salesforce login URL")}/services/oauth2/token`;
 }
 
 /**
@@ -55,6 +90,7 @@ export async function startSalesforceDeviceLogin(options: {
   const fetchImpl = options.fetchImpl ?? fetch;
   const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
     method: "POST",
+    redirect: "manual",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       response_type: "device_code",
@@ -91,6 +127,7 @@ export async function pollSalesforceDeviceLogin(options: {
     await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
     const response = await fetchImpl(url, {
       method: "POST",
+      redirect: "manual",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams({
         grant_type: "device",
@@ -100,10 +137,11 @@ export async function pollSalesforceDeviceLogin(options: {
     });
     const data = await response.json().catch(() => ({}));
     if (response.ok && data.access_token && data.instance_url) {
+      const instanceUrl = validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url");
       return {
         accessToken: data.access_token,
         refreshToken: data.refresh_token,
-        instanceUrl: data.instance_url,
+        instanceUrl,
         expiresAt: Date.now() + SESSION_TTL_MS,
       };
     }
@@ -128,6 +166,7 @@ export async function refreshSalesforceToken(options: {
   const fetchImpl = options.fetchImpl ?? fetch;
   const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
     method: "POST",
+    redirect: "manual",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       grant_type: "refresh_token",
@@ -145,7 +184,7 @@ export async function refreshSalesforceToken(options: {
   return {
     accessToken: data.access_token,
     refreshToken: data.refresh_token ?? options.refreshToken,
-    instanceUrl: data.instance_url,
+    instanceUrl: validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url"),
     expiresAt: Date.now() + SESSION_TTL_MS,
   };
 }
@@ -155,17 +194,18 @@ export async function validateSalesforceToken(
   instanceUrl: string,
   fetchImpl: typeof fetch = fetch,
 ): Promise<{ ok: boolean; detail: string }> {
+  const trustedInstanceUrl = validateSalesforceOrigin(instanceUrl, "Salesforce instance URL");
   let response: Response;
   try {
     response = await fetchImpl(
-      `${instanceUrl.replace(/\/$/, "")}/services/oauth2/userinfo`,
-      { headers: { Authorization: `Bearer ${accessToken}` } },
+      `${trustedInstanceUrl}/services/oauth2/userinfo`,
+      { redirect: "manual", headers: { Authorization: `Bearer ${accessToken}` } },
     );
   } catch (error) {
     const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
     return {
       ok: false,
-      detail: `Cannot reach Salesforce at ${instanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
+      detail: `Cannot reach Salesforce at ${trustedInstanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
     };
   }
   if (response.ok) {

package/src/connectors/signalSources.ts

@@ -21,6 +21,7 @@
 
 import { readFileSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { FREE_EMAIL_DOMAINS } from "../freeEmailDomains.ts";
 import type { SignalBucket, StagedSignalRow } from "../signals.ts";
 import { SIGNAL_BUCKETS } from "../signals.ts";
 import { parseSpoolText, spoolFilesIn } from "../spoolFiles.ts";
@@ -294,21 +295,10 @@ function fieldValue(values: Array<{ name?: string; value?: string }> | undefined
   return "";
 }
 
-const FREE_MAIL = new Set([
-  "gmail.com",
-  "yahoo.com",
-  "hotmail.com",
-  "outlook.com",
-  "icloud.com",
-  "aol.com",
-  "proton.me",
-  "protonmail.com",
-]);
-
 /** Company domain from an email, or "" for free-mail / no email. */
 function corporateDomain(email: string): string {
   if (!email.includes("@")) return "";
   const domain = email.split("@").at(-1)!.trim().toLowerCase();
-  if (!domain || FREE_MAIL.has(domain)) return "";
+  if (!domain || FREE_EMAIL_DOMAINS.has(domain)) return "";
   return domain;
 }

package/src/connectors/theirstack.ts

@@ -17,6 +17,7 @@
  * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
  * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
  */
+import { ProviderHttpError } from "../providerError.ts";
 
 type FetchImpl = typeof fetch;
 
@@ -44,14 +45,6 @@ export function theirStackPullCost(companies: number, usdPerCredit?: number): Th
   };
 }
 
-async function safeText(res: { text(): Promise<string> }): Promise<string> {
-  try {
-    return (await res.text()).slice(0, 300);
-  } catch {
-    return "";
-  }
-}
-
 /** Firmographic + technographic filter for TheirStack company search. */
 export type TheirStackFilters = {
   /** technology slugs, OR-matched — e.g. ["salesforce","hubspot","pipedrive"]. */
@@ -136,7 +129,7 @@ export async function theirStackCountCompanies(opts: {
     body: buildBody(opts.filters, 1, 0, true),
   });
   if (!res.ok) {
-    throw new Error(`TheirStack count failed: HTTP ${res.status} ${await safeText(res)}`);
+    throw new ProviderHttpError("TheirStack", "count", res.status);
   }
   return readTheirStackTotal(await res.json());
 }
@@ -162,7 +155,7 @@ export async function theirStackSearchCompanies(opts: {
     body: buildBody(opts.filters, limit, opts.page ?? 0, true),
   });
   if (!res.ok) {
-    throw new Error(`TheirStack search failed: HTTP ${res.status} ${await safeText(res)}`);
+    throw new ProviderHttpError("TheirStack", "search", res.status);
   }
   const body = (await res.json()) as { data?: Array<Record<string, unknown>>; results?: Array<Record<string, unknown>> };
   const rows = body.data ?? body.results ?? [];