fullstackgtm 0.47.0 → 0.49.0

package/src/credentials.ts

@@ -3,17 +3,20 @@ import {
   existsSync,
   mkdirSync,
   readdirSync,
-  readFileSync,
-  statSync,
   unlinkSync,
-  writeFileSync,
 } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshHubspotToken } from "./connectors/hubspotAuth.ts";
-import { refreshSalesforceToken } from "./connectors/salesforceAuth.ts";
+import { refreshSalesforceToken, validateSalesforceOrigin } from "./connectors/salesforceAuth.ts";
 import { detectKeychainBackend } from "./keychain.ts";
+import {
+  assertNoSymlinkComponents,
+  readSecureRegularFile,
+  UnsafeManagedPathError,
+  writeSecureFileAtomic,
+} from "./secureFile.ts";
 
 /**
  * Local CLI credential store: ~/.fullstackgtm/credentials.json (0600), or
@@ -126,7 +129,9 @@ export function ensureSecureHomeDir(): string {
   const levels =
     dir === baseHomeDir() ? [dir] : [baseHomeDir(), join(baseHomeDir(), "profiles"), dir];
   for (const level of levels) {
+    assertNoSymlinkComponents(level);
     mkdirSync(level, { recursive: true, mode: 0o700 });
+    assertNoSymlinkComponents(level);
     try {
       chmodSync(level, 0o700);
     } catch {
@@ -138,12 +143,7 @@ export function ensureSecureHomeDir(): string {
 
 /** Write a 0600 file under the home, enforcing the mode even on rewrite. */
 export function writeSecureFile(path: string, contents: string) {
-  writeFileSync(path, contents, { mode: 0o600 });
-  try {
-    chmodSync(path, 0o600);
-  } catch {
-    // Non-POSIX filesystems ignore chmod.
-  }
+  writeSecureFileAtomic(path, contents);
 }
 
 /**
@@ -153,19 +153,14 @@ export function writeSecureFile(path: string, contents: string) {
  * mode on read too — re-tighten to 0600 and warn once — so a world-readable
  * credential store can't sit there silently leaking the token to other users.
  */
-function enforceCredentialFileMode(path: string): void {
-  try {
-    const mode = statSync(path).mode & 0o777;
-    if ((mode & 0o077) !== 0) {
-      chmodSync(path, 0o600);
-      console.error(
-        `fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
-          "(it was readable or writable by other users).",
-      );
-    }
-  } catch {
-    // Missing file or non-POSIX filesystem: nothing to enforce.
-  }
+function readCredentialFile(path: string): string {
+  return readSecureRegularFile(path, {
+    tightenMode: 0o600,
+    onModeTightened: (mode) => console.error(
+      `fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
+        "(it was readable or writable by other users).",
+    ),
+  });
 }
 
 /**
@@ -190,7 +185,7 @@ function activeKeychain(): { account: string; backend: NonNullable<ReturnType<ty
 function migratePlaintextToKeychain(keychain: NonNullable<ReturnType<typeof activeKeychain>>): void {
   if (!existsSync(credentialsPath())) return;
   try {
-    const fileParsed = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+    const fileParsed = JSON.parse(readCredentialFile(credentialsPath()));
     if (fileParsed && fileParsed.version === 1 && fileParsed.providers) {
       const current = keychain.backend.get(keychain.account);
       const existing = current ? (JSON.parse(current).providers ?? {}) : {};
@@ -209,14 +204,15 @@ function readFile(): CredentialsFile {
   const keychain = activeKeychain();
   if (keychain) migratePlaintextToKeychain(keychain);
   try {
-    const raw = keychain ? keychain.backend.get(keychain.account) : (enforceCredentialFileMode(credentialsPath()), readFileSync(credentialsPath(), "utf8"));
+    const raw = keychain ? keychain.backend.get(keychain.account) : readCredentialFile(credentialsPath());
     if (raw) {
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed === "object" && parsed.version === 1 && parsed.providers) {
         return parsed as CredentialsFile;
       }
     }
-  } catch {
+  } catch (error) {
+    if (error instanceof UnsafeManagedPathError) throw error;
     // Missing or unreadable store falls through to an empty one.
   }
   return { version: 1, providers: {} };
@@ -238,6 +234,18 @@ export function getCredential(provider: string): StoredCredential | null {
 }
 
 export function storeCredential(provider: string, credential: StoredCredential) {
+  if (provider === "salesforce") {
+    if (!credential.instanceUrl) {
+      throw new Error("Salesforce credentials require an instance URL.");
+    }
+    credential = {
+      ...credential,
+      instanceUrl: validateSalesforceOrigin(credential.instanceUrl, "Salesforce credential instance URL"),
+      ...(credential.loginUrl
+        ? { loginUrl: validateSalesforceOrigin(credential.loginUrl, "Salesforce credential login URL") }
+        : {}),
+    };
+  }
   const file = readFile();
   file.providers[provider] = credential;
   persist(file);
@@ -315,12 +323,19 @@ export async function resolveSalesforceConnection(
         "Stored Salesforce credential has no instance URL. Run `fullstackgtm login salesforce` again.",
       );
     }
+    const instanceUrl = validateSalesforceOrigin(
+      credential.instanceUrl,
+      "Stored Salesforce credential instance URL",
+    );
+    if (credential.loginUrl) {
+      validateSalesforceOrigin(credential.loginUrl, "Stored Salesforce credential login URL");
+    }
     const needsRefresh =
       credential.kind === "oauth" &&
       credential.expiresAt !== undefined &&
       Date.now() > credential.expiresAt - REFRESH_SKEW_MS;
     if (!needsRefresh) {
-      return { accessToken: credential.accessToken, instanceUrl: credential.instanceUrl };
+      return { accessToken: credential.accessToken, instanceUrl };
     }
     if (!credential.refreshToken || !credential.clientId) {
       throw new Error(
@@ -349,9 +364,13 @@ export async function resolveSalesforceConnection(
   if (!minted.instanceUrl) {
     throw new Error("The hosted deployment returned no Salesforce instance URL.");
   }
+  const instanceUrl = validateSalesforceOrigin(
+    minted.instanceUrl,
+    "Hosted Salesforce credential instance URL",
+  );
   return {
     accessToken: minted.accessToken,
-    instanceUrl: minted.instanceUrl,
+    instanceUrl,
     fieldMappings: minted.fieldMappings,
   };
 }

package/src/format.ts

@@ -1,10 +1,9 @@
 import type { PatchPlan, PatchPlanRun } from "./types.ts";
 
-// `summary: true` renders only the header + the Findings-by-Rule table + an
-// operation count, for read verbs like `audit` where the full per-operation
-// dump (1,400+ lines on a real portal) buries the signal. Defaults to the full
-// view so write-preview callers (bulk-update, fix, dedupe, plans show, MCP) —
-// where you approve specific operations — keep every operation's detail.
+// `summary: true` renders the compact audit view: header, findings summary,
+// assumptions/open questions, and an operation count. Defaults to the full view
+// so write-preview callers (bulk-update, fix, dedupe, plans show, MCP) — where
+// you approve specific operations — keep every operation's detail.
 export function patchPlanToMarkdown(plan: PatchPlan, opts: { summary?: boolean } = {}) {
   const lines = [
     `# ${plan.title}`,
@@ -29,6 +28,8 @@ export function patchPlanToMarkdown(plan: PatchPlan, opts: { summary?: boolean }
     lines.push("");
   }
 
+  appendAssumptionsAndDecisionPoints(lines, plan);
+
   if (opts.summary) {
     const ops = plan.operations.length;
     lines.push(
@@ -155,6 +156,33 @@ export function formatPatchPlanRun(run: PatchPlanRun) {
   return `${lines.join("\n")}\n`;
 }
 
+
+function appendAssumptionsAndDecisionPoints(lines: string[], plan: PatchPlan) {
+  const assumptions = [...(plan.assumptions ?? [])].sort((left, right) => {
+    if (left.confidence === "guess" && right.confidence !== "guess") return -1;
+    if (left.confidence !== "guess" && right.confidence === "guess") return 1;
+    return 0;
+  });
+  const openQuestions = plan.openQuestions ?? [];
+  if (assumptions.length === 0 && openQuestions.length === 0) return;
+
+  lines.push("## Assumptions & decision points", "");
+  for (const assumption of assumptions) {
+    const warning = assumption.confidence === "guess" ? "⚠️ " : "";
+    lines.push(`- ${warning}${assumption.text}${assumption.source ? ` _(source: ${assumption.source})_` : ""}`);
+  }
+
+  if (openQuestions.length > 0) {
+    if (assumptions.length > 0) lines.push("");
+    lines.push("### Open questions", "");
+    for (const question of openQuestions) {
+      lines.push(`- ${question}`);
+    }
+  }
+
+  lines.push("");
+}
+
 function formatValue(value: unknown) {
   if (value === undefined || value === null || value === "") return "unset";
   if (typeof value === "string") return value;

package/src/freeEmailDomains.ts

@@ -0,0 +1,14 @@
+// Shared free-mail domains that should never be treated as company domains.
+export const FREE_EMAIL_DOMAINS = new Set([
+  "gmail.com",
+  "googlemail.com",
+  "yahoo.com",
+  "outlook.com",
+  "hotmail.com",
+  "live.com",
+  "icloud.com",
+  "me.com",
+  "aol.com",
+  "proton.me",
+  "protonmail.com",
+]);

package/src/hierarchy.ts

@@ -0,0 +1,185 @@
+import { normalizeDomain } from "./merge.ts";
+import type { CanonicalAccount, CanonicalGtmSnapshot } from "./types.ts";
+
+export type AccountHierarchyNode = {
+  accountId: string;
+  name: string;
+  domain?: string;
+  parentAccountId?: string;
+  parentReason?: string;
+  children: AccountHierarchyNode[];
+};
+
+export type AccountHierarchyConflict = {
+  type: "duplicate_domain" | "ambiguous_parent" | "cycle";
+  accountIds: string[];
+  key: string;
+  detail: string;
+};
+
+export type AccountHierarchyReport = {
+  generatedAt: string;
+  roots: AccountHierarchyNode[];
+  orphanAccounts: string[];
+  conflicts: AccountHierarchyConflict[];
+  counts: { accounts: number; roots: number; linkedChildren: number; conflicts: number };
+};
+
+function rawString(account: CanonicalAccount, keys: string[]): string | undefined {
+  if (!account.raw || typeof account.raw !== "object") return undefined;
+  const raw = account.raw as Record<string, unknown>;
+  for (const key of keys) {
+    const value = raw[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+    if (value && typeof value === "object") {
+      const nested = value as Record<string, unknown>;
+      for (const nestedKey of ["id", "value", "name"]) {
+        if (typeof nested[nestedKey] === "string" && String(nested[nestedKey]).trim()) return String(nested[nestedKey]).trim();
+      }
+    }
+  }
+  return undefined;
+}
+
+function parentHint(account: CanonicalAccount): string | undefined {
+  return rawString(account, ["parentAccountId", "parent_account_id", "ParentId", "parentCompanyId", "hs_parent_company_id"]);
+}
+
+function cloneNode(account: CanonicalAccount): AccountHierarchyNode {
+  return { accountId: String(account.id), name: account.name, ...(account.domain ? { domain: account.domain } : {}), children: [] };
+}
+
+function looksLikePublicSuffix(domain: string): boolean {
+  const parts = domain.split(".");
+  if (parts.length !== 2) return false;
+  const [label, tld] = parts;
+  return tld.length === 2 && ["ac", "co", "com", "edu", "gov", "net", "org"].includes(label);
+}
+
+function domainParent(childDomain: string, domains: Map<string, CanonicalAccount[]>): CanonicalAccount | "ambiguous" | null {
+  const parts = childDomain.split(".");
+  for (let i = 1; i < parts.length - 1; i++) {
+    const candidate = parts.slice(i).join(".");
+    if (candidate.split(".").length < 2 || looksLikePublicSuffix(candidate)) continue;
+    const unique = new Map((domains.get(candidate) ?? []).map((account) => [String(account.id), account]));
+    if (unique.size > 1) return "ambiguous";
+    if (unique.size === 1) return [...unique.values()][0];
+  }
+  return null;
+}
+
+function detectCycles(parentByChild: Map<string, { parentId: string; reason: string }>): { accountIds: Set<string>; cycles: string[][] } {
+  const cyclic = new Set<string>();
+  const cycles: string[][] = [];
+  const emitted = new Set<string>();
+
+  for (const start of parentByChild.keys()) {
+    const path: string[] = [];
+    const indexById = new Map<string, number>();
+    let cursor: string | undefined = start;
+    while (cursor && parentByChild.has(cursor)) {
+      const seenAt = indexById.get(cursor);
+      if (seenAt !== undefined) {
+        const cycle = path.slice(seenAt);
+        for (const id of cycle) cyclic.add(id);
+        const key = [...cycle].sort().join("|");
+        if (!emitted.has(key)) {
+          emitted.add(key);
+          cycles.push(cycle);
+        }
+        break;
+      }
+      indexById.set(cursor, path.length);
+      path.push(cursor);
+      cursor = parentByChild.get(cursor)?.parentId;
+    }
+  }
+
+  return { accountIds: cyclic, cycles };
+}
+
+export function buildAccountHierarchy(snapshot: CanonicalGtmSnapshot): AccountHierarchyReport {
+  const byId = new Map(snapshot.accounts.map((account) => [String(account.id), account]));
+  const accounts = [...byId.values()];
+  const domains = new Map<string, CanonicalAccount[]>();
+  for (const account of accounts) {
+    const domain = normalizeDomain(account.domain);
+    if (domain) domains.set(domain, [...(domains.get(domain) ?? []), account]);
+  }
+
+  const conflicts: AccountHierarchyConflict[] = [];
+  for (const [domain, accounts] of domains) {
+    const ids = [...new Set(accounts.map((account) => String(account.id)))];
+    if (ids.length > 1) conflicts.push({ type: "duplicate_domain", accountIds: ids.sort(), key: domain, detail: `${ids.length} accounts share domain ${domain}; hierarchy inference will not choose between them.` });
+  }
+
+  const nodes = new Map(accounts.map((account) => [String(account.id), cloneNode(account)]));
+  const parentByChild = new Map<string, { parentId: string; reason: string }>();
+  for (const account of accounts) {
+    const id = String(account.id);
+    const hint = parentHint(account);
+    if (hint && byId.has(hint) && hint !== id) {
+      parentByChild.set(id, { parentId: hint, reason: "provider-parent" });
+      continue;
+    }
+    const domain = normalizeDomain(account.domain);
+    if (!domain) continue;
+    const inferred = domainParent(domain, domains);
+    if (inferred === "ambiguous") conflicts.push({ type: "ambiguous_parent", accountIds: [id], key: domain, detail: `Multiple possible parent accounts found for ${domain}; leaving account as a root.` });
+    else if (inferred && String(inferred.id) !== id) parentByChild.set(id, { parentId: String(inferred.id), reason: "domain-subdomain" });
+  }
+
+  const cyclicAccounts = detectCycles(parentByChild);
+  for (const cycle of cyclicAccounts.cycles) {
+    const ordered = [...cycle].sort();
+    const key = ordered.join(" -> ");
+    conflicts.push({
+      type: "cycle",
+      accountIds: ordered,
+      key,
+      detail: `Cyclic parent hints detected among ${ordered.join(", ")}; leaving those accounts as roots instead of hiding them in a loop.`,
+    });
+  }
+  for (const accountId of cyclicAccounts.accountIds) parentByChild.delete(accountId);
+
+  const roots: AccountHierarchyNode[] = [];
+  const orphanAccounts: string[] = [];
+  const linkedChildren = new Set<string>();
+  for (const account of accounts) {
+    const id = String(account.id);
+    const node = nodes.get(id)!;
+    const parent = parentByChild.get(id);
+    if (parent && nodes.has(parent.parentId)) {
+      node.parentAccountId = parent.parentId;
+      node.parentReason = parent.reason;
+      nodes.get(parent.parentId)!.children.push(node);
+      linkedChildren.add(id);
+    } else {
+      roots.push(node);
+      if (!account.domain && !parentHint(account)) orphanAccounts.push(id);
+    }
+  }
+  const sortTree = (list: AccountHierarchyNode[]) => {
+    list.sort((a, b) => a.name.localeCompare(b.name) || a.accountId.localeCompare(b.accountId));
+    for (const node of list) sortTree(node.children);
+  };
+  sortTree(roots);
+  return { generatedAt: snapshot.generatedAt, roots, orphanAccounts: orphanAccounts.sort(), conflicts, counts: { accounts: accounts.length, roots: roots.length, linkedChildren: linkedChildren.size, conflicts: conflicts.length } };
+}
+
+export function accountHierarchyToMarkdown(report: AccountHierarchyReport): string {
+  const lines = ["# Account hierarchy", "", `${report.counts.accounts} account(s), ${report.counts.roots} root(s), ${report.counts.linkedChildren} inferred child link(s), ${report.counts.conflicts} conflict(s).`, ""];
+  const walk = (nodes: AccountHierarchyNode[], depth: number) => {
+    for (const node of nodes) {
+      const suffix = [node.domain, node.parentReason ? `via ${node.parentReason}` : undefined].filter(Boolean).join("; ");
+      lines.push(`${"  ".repeat(depth)}- ${node.name} (${node.accountId}${suffix ? ` — ${suffix}` : ""})`);
+      walk(node.children, depth + 1);
+    }
+  };
+  walk(report.roots, 0);
+  if (report.conflicts.length) {
+    lines.push("", "## Conflicts");
+    for (const conflict of report.conflicts) lines.push(`- ${conflict.type} ${conflict.key}: ${conflict.detail}`);
+  }
+  return lines.join("\n");
+}

package/src/index.ts

@@ -12,13 +12,36 @@ export {
 export { buildBulkUpdatePlan, isFilterableField, parseWhere, type BulkUpdateOptions } from "./bulkUpdate.ts";
 export { buildDedupePlan, dedupeKey, type DedupeOptions } from "./dedupe.ts";
 export { buildReassignPlans, type ReassignObjectType, type ReassignOptions } from "./reassign.ts";
+export {
+  buildLeadRoutePlan,
+  type LeadRouteCounts,
+  type LeadRouteOptions,
+  type LeadRouteResult,
+} from "./route.ts";
+export {
+  accountHierarchyToMarkdown,
+  buildAccountHierarchy,
+  type AccountHierarchyConflict,
+  type AccountHierarchyNode,
+  type AccountHierarchyReport,
+} from "./hierarchy.ts";
+export {
+  buildRelationshipMap,
+  relationshipMapToMarkdown,
+  type RelationshipMap,
+  type StakeholderNode,
+  type StakeholderRole,
+  type StakeholderSentiment,
+} from "./relationships.ts";
 export {
   CONFIG_FILE_NAME,
   loadConfig,
   mergePolicy,
   resolveConfiguredRules,
+  rulePackageTrustFromCli,
   type FullstackgtmConfig,
   type LoadedConfig,
+  type RulePackageTrust,
 } from "./config.ts";
 export { applyPatchPlan, type ApplyPatchPlanOptions } from "./connector.ts";
 export {
@@ -55,6 +78,7 @@ export {
   pollSalesforceDeviceLogin,
   refreshSalesforceToken,
   startSalesforceDeviceLogin,
+  validateSalesforceOrigin,
   validateSalesforceToken,
   type SalesforceDeviceAuthorization,
   type SalesforceTokenSet,
@@ -209,6 +233,7 @@ export {
   type AuditLogExport,
   type AuditLogVerification,
 } from "./auditLog.ts";
+export { FREE_EMAIL_DOMAINS } from "./freeEmailDomains.ts";
 export { formatPatchPlanRun, patchPlanToMarkdown } from "./format.ts";
 export {
   computeHealth,
@@ -236,6 +261,7 @@ export {
   buildSnapshotIndex,
   builtinAuditRules,
   closingSoonInactiveRule,
+  isFindingsOnlyRule,
   duplicateAccountDomainRule,
   duplicateContactEmailRule,
   duplicateOpenDealRule,
@@ -540,6 +566,8 @@ export type {
   PatchOperationResult,
   PatchOperationType,
   PatchPlan,
+  PatchPlanAssumption,
+  PatchPlanAssumptionConfidence,
   PatchPlanRun,
   PatchPlanRunStatus,
   PatchVerification,
@@ -550,3 +578,4 @@ export type {
   RiskLevel,
   SourceFreshness,
 } from "./types.ts";
+export { ProviderHttpError } from "./providerError.ts";

package/src/market.ts

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
-import { lookup } from "node:dns/promises";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { isIP } from "node:net";
 import { join } from "node:path";
 import { credentialsDir } from "./credentials.ts";
 import { MARKET_CAPTURE_STAGES, nullProgressEmitter, type ProgressEmitter } from "./progress.ts";
 import type { GtmEvidence } from "./types.ts";
+import { assertPublicUrl, publicHttpGet } from "./publicHttp.ts";
+export { assertPublicUrl } from "./publicHttp.ts";
 
 /**
  * The Market Map: a live model of the competitive category a company sells
@@ -328,121 +328,17 @@ export type FetchPage = (url: string) => Promise<{ status: number; body: string
  * any host that is or resolves to a private/loopback/link-local/metadata
  * address, and (3) follow redirects manually, re-validating each hop.
  *
- * Residual gap (documented, not defended here): TOCTOU DNS rebinding between
- * our lookup and fetch's own resolution. Out of scope for fetching public
- * competitor pages; a hardened deployment should fetch through an egress proxy.
+ * The default transport resolves once, rejects mixed public/private answers,
+ * and pins a validated address into socket creation to prevent DNS rebinding.
  */
 const MAX_REDIRECTS = 5;
 const FETCH_TIMEOUT_MS = 15_000;
 const MAX_BODY_BYTES = 5_000_000;
 
-function ipv4IsPrivate(ip: string): boolean {
-  const parts = ip.split(".").map((n) => Number(n));
-  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true;
-  const [a, b] = parts;
-  if (a === 0 || a === 127) return true; // this-host, loopback
-  if (a === 10) return true; // private
-  if (a === 172 && b >= 16 && b <= 31) return true; // private
-  if (a === 192 && b === 168) return true; // private
-  if (a === 169 && b === 254) return true; // link-local incl. 169.254.169.254 metadata
-  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
-  if (a >= 224) return true; // multicast / reserved
-  return false;
-}
-
-function ipIsPrivate(ip: string): boolean {
-  const family = isIP(ip);
-  if (family === 4) return ipv4IsPrivate(ip);
-  if (family === 6) {
-    const lower = ip.toLowerCase();
-    if (lower === "::1" || lower === "::") return true; // loopback / unspecified
-    // IPv4-mapped (::ffff:…) — Node normalizes ::ffff:127.0.0.1 to ::ffff:7f00:1,
-    // so accept both the dotted and the hex-pair forms, unwrap, check the v4.
-    const mapped = lower.match(/^::ffff:(.+)$/);
-    if (mapped) {
-      const rest = mapped[1];
-      if (rest.includes(".")) return ipv4IsPrivate(rest);
-      const groups = rest.split(":");
-      if (groups.length === 2) {
-        const hi = parseInt(groups[0], 16);
-        const lo = parseInt(groups[1], 16);
-        if (Number.isNaN(hi) || Number.isNaN(lo)) return true;
-        return ipv4IsPrivate(`${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`);
-      }
-      return true; // unrecognized mapped form → refuse
-    }
-    if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb")) return true; // link-local fe80::/10
-    if (lower.startsWith("fc") || lower.startsWith("fd")) return true; // unique-local fc00::/7
-    return false;
-  }
-  return true; // not a recognizable IP literal → refuse
-}
-
-export async function assertPublicUrl(rawUrl: string): Promise<URL> {
-  let url: URL;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new Error(`market capture: "${rawUrl}" is not a valid URL.`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(`market capture refuses ${url.protocol} URLs (only http/https): ${rawUrl}`);
-  }
-  const host = url.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-  if (isIP(host)) {
-    if (ipIsPrivate(host)) throw new Error(`market capture refuses private/loopback address ${host} (SSRF guard).`);
-    return url;
-  }
-  // Hostname: resolve and refuse if ANY address is private.
-  const addrs = await lookup(host, { all: true });
-  for (const { address } of addrs) {
-    if (ipIsPrivate(address)) {
-      throw new Error(`market capture refuses ${host} — it resolves to private/internal address ${address} (SSRF guard).`);
-    }
-  }
-  return url;
-}
-
 const defaultFetchPage: FetchPage = async (url) => {
-  let current = url;
-  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-    await assertPublicUrl(current);
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-    let response: Response;
-    try {
-      response = await fetch(current, {
-        headers: {
-          "User-Agent": "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)",
-          "Accept-Language": "en-US",
-        },
-        redirect: "manual",
-        signal: controller.signal,
-      });
-    } finally {
-      clearTimeout(timer);
-    }
-    if (response.status >= 300 && response.status < 400 && response.headers.get("location")) {
-      current = new URL(response.headers.get("location") as string, current).toString();
-      continue; // re-validate the redirect target on the next iteration
-    }
-    const reader = response.body?.getReader();
-    if (!reader) return { status: response.status, body: await response.text() };
-    const chunks: Uint8Array[] = [];
-    let total = 0;
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      total += value.length;
-      if (total > MAX_BODY_BYTES) {
-        await reader.cancel();
-        break;
-      }
-      chunks.push(value);
-    }
-    return { status: response.status, body: Buffer.concat(chunks).toString("utf8") };
-  }
-  throw new Error(`market capture: too many redirects (>${MAX_REDIRECTS}) for ${url}`);
+  const response = await publicHttpGet(url, { maxBytes: MAX_BODY_BYTES, maxRedirects: MAX_REDIRECTS,
+    timeoutMs: FETCH_TIMEOUT_MS, headers: { "User-Agent": "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)", "Accept-Language": "en-US" } });
+  return { status: response.status, body: Buffer.from(response.body).toString("utf8") };
 };
 
 export type CaptureOptions = {