fullstackgtm 0.47.0 → 0.49.0

package/dist/cli/suggest.js

@@ -11,7 +11,7 @@
 // (exit 1) that prints the exact corrected command for the agent to run
 // itself; this holds uniformly for read and write verbs, so a typo can never
 // silently change what a write-shaped invocation stages.
-import { HELP, usage } from "./help.js";
+import { COMMAND_FLAGS, FLAGS_WITH_VALUES, GLOBAL_FLAGS, GLOBAL_SHORT_FLAGS, HELP, usage, } from "./help.js";
 export function levenshtein(a, b) {
     const dp = Array.from({ length: a.length + 1 }, () => Array(b.length + 1).fill(0));
     for (let i = 0; i <= a.length; i += 1)
@@ -96,6 +96,52 @@ export function detectFlagTypo(args) {
     }
     return null;
 }
+function isFlagShaped(token) {
+    return token !== "-" && token.startsWith("-");
+}
+function suggestCommandFlag(unknown, allowed) {
+    const candidates = [...allowed].filter((flag) => flag.startsWith("--"));
+    const prefix = candidates
+        .filter((flag) => unknown.startsWith(`${flag}-`) || flag.startsWith(unknown))
+        .sort((a, b) => b.length - a.length)[0];
+    if (prefix)
+        return prefix;
+    return nearest(unknown.toLowerCase().replace(/_/g, "-"), candidates, 3);
+}
+export function detectUnknownFlag(command, args) {
+    const commandFlags = COMMAND_FLAGS[command];
+    if (!commandFlags)
+        return null;
+    const allowed = new Set([...GLOBAL_FLAGS, ...commandFlags]);
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        if (token === "--")
+            break;
+        if (GLOBAL_SHORT_FLAGS.includes(token))
+            continue;
+        if (!token.startsWith("-"))
+            continue;
+        if (!token.startsWith("--")) {
+            return { given: token, suggestion: null, replacement: [] };
+        }
+        const equalsIndex = token.indexOf("=");
+        const flag = equalsIndex === -1 ? token : token.slice(0, equalsIndex);
+        if (allowed.has(flag)) {
+            if (equalsIndex !== -1) {
+                const value = token.slice(equalsIndex + 1);
+                const replacement = value === "" ? [flag] : [flag, value];
+                return { given: token, suggestion: replacement.join(" "), replacement };
+            }
+            if (FLAGS_WITH_VALUES.has(flag) && args[index + 1] !== undefined && !isFlagShaped(args[index + 1])) {
+                index += 1;
+            }
+            continue;
+        }
+        const suggestion = suggestCommandFlag(flag, allowed);
+        return { given: flag, suggestion, replacement: suggestion ? [suggestion] : [] };
+    }
+    return null;
+}
 /** Nearest known command, derived from the same HELP table. */
 export function suggestCommand(command) {
     if (!command)
@@ -127,8 +173,8 @@ export function unknownFlagEnvelope(command, args, typo) {
             code: "UNKNOWN_FLAG",
             message: `Unknown flag: ${typo.given}`,
             hints: [
-                `Did you mean: ${typo.suggestion}`,
-                `Try: ${correctedCommand(command, args, typo)}`,
+                ...(typo.suggestion ? [`Did you mean: ${typo.suggestion}`] : []),
+                ...(typo.replacement.length > 0 ? [`Try: ${correctedCommand(command, args, typo)}`] : []),
             ],
         },
     };

package/dist/cli/ui.js

@@ -374,6 +374,8 @@ export function planStatusWord(status, p) {
         return p.yellow(status);
     if (status === "approved" || status === "applied")
         return p.green(status);
+    if (status === "applying")
+        return p.yellow(status);
     if (status === "rejected")
         return p.red(status);
     return status;

package/dist/cli.js

@@ -2,7 +2,7 @@ import { activeProfile, listProfiles, setActiveProfile } from "./credentials.js"
 import { capabilitiesCommand, printCommandHelpJson, robotDocsCommand, unknownCommandEnvelope } from "./cli/capabilities.js";
 import { BESPOKE_HELP, commandHelp, HELP, shortUsage, stylizeShortUsage, usage } from "./cli/help.js";
 import { readPackageInfo } from "./cli/shared.js";
-import { correctedCommand, detectFlagTypo, suggestCommand, unknownFlagEnvelope } from "./cli/suggest.js";
+import { correctedCommand, detectFlagTypo, detectUnknownFlag, suggestCommand, unknownFlagEnvelope } from "./cli/suggest.js";
 import { colorEnabled, paint } from "./cli/ui.js";
 // Verb modules load lazily inside their dispatch branch below. The dispatcher
 // used to import all of them eagerly, so `--version` compiled the full
@@ -56,16 +56,22 @@ export async function runCli(argv) {
     }
     if (command === "help") {
         const [topic] = args;
-        if (topic && topic !== "--full" && !topic.startsWith("-")) {
+        if (topic && !topic.startsWith("-") && args.includes("--json")) {
             // `help <cmd> --json` → machine-readable help derived from the same
-            // HELP entry the plain text renders from. Plain output is unchanged.
-            if (args.includes("--json"))
-                printCommandHelpJson(topic);
-            else
-                console.log(commandHelp(topic));
+            // HELP entry the plain text renders from. JSON takes precedence over
+            // --full so automated callers get a stable shape.
+            printCommandHelpJson(topic);
+        }
+        else if (args.includes("--full")) {
+            // --full is the global escape hatch to the complete reference, even
+            // when a topic is given (help <cmd> --full), unless --json is requested.
+            console.log(usage());
+        }
+        else if (topic && !topic.startsWith("-")) {
+            console.log(commandHelp(topic));
         }
         else {
-            console.log(args.includes("--full") || topic === "--full" ? usage() : styledShortUsage());
+            console.log(styledShortUsage());
         }
         return;
     }
@@ -82,7 +88,7 @@ export async function runCli(argv) {
     }
     // Commands without bespoke help get focused per-command help on --help
     // instead of executing (audit used to silently run the sample audit) or
-    // dumping the whole surface. call/market/enrich/bulk-update/schedule print
+    // dumping the whole surface. call/market/enrich/schedule print
     // their own richer help. `--full` always escapes to the complete reference.
     if (!BESPOKE_HELP.includes(command) && (args.includes("--help") || args.includes("-h"))) {
         console.log(args.includes("--full") ? usage() : commandHelp(command));
@@ -90,20 +96,27 @@ export async function runCli(argv) {
     }
     // Flag typos used to be silently dropped by the per-verb parsers —
     // `audit --demo --jsn` exited 0 and printed markdown where the agent asked
-    // for JSON. Near-miss unknown flags (≤ 1 edit from a flag documented in
-    // help.ts) now stop with the exact corrected command. Suggest-only: never
-    // auto-execute the correction, so a typo can never change what a
-    // write-shaped invocation stages.
+    // for JSON. Every flag-shaped token is now checked against the per-command
+    // registry in help.ts, so unknown flags fail closed instead of being ignored.
+    // Suggest-only: never auto-execute the correction, so a typo can never
+    // silently change what a write-shaped invocation stages.
     if (command in HELP) {
-        const typo = detectFlagTypo(args);
+        const typo = detectUnknownFlag(command, args);
         if (typo) {
             if (args.includes("--json")) {
                 console.log(JSON.stringify(unknownFlagEnvelope(command, args, typo), null, 2));
             }
             else {
+                console.error(`Unknown flag for ${command}: ${typo.given}`);
+                // Keep the old near-miss shape too; existing agents key off it.
                 console.error(`Unknown flag: ${typo.given}`);
-                console.error(`Did you mean: ${typo.suggestion}`);
-                console.error(`Try: ${correctedCommand(command, args, typo)}`);
+                if (typo.suggestion) {
+                    console.error(`Did you mean ${typo.suggestion}?`);
+                    console.error(`Did you mean: ${typo.suggestion}`);
+                    if (typo.replacement.length > 0) {
+                        console.error(`Try: ${correctedCommand(command, args, typo)}`);
+                    }
+                }
             }
             process.exitCode = 1;
             return;
@@ -161,6 +174,18 @@ export async function runCli(argv) {
         await (await import("./cli/fix.js")).resolveCommand(args);
         return;
     }
+    if (command === "route") {
+        await (await import("./cli/fix.js")).routeCommand(args);
+        return;
+    }
+    if (command === "hierarchy") {
+        await (await import("./cli/fix.js")).hierarchyCommand(args);
+        return;
+    }
+    if (command === "relationships") {
+        await (await import("./cli/fix.js")).relationshipsCommand(args);
+        return;
+    }
     if (command === "bulk-update") {
         await (await import("./cli/fix.js")).bulkUpdateCommand(args);
         return;

package/dist/config.d.ts

@@ -26,6 +26,18 @@ export type LoadedConfig = {
     config: FullstackgtmConfig;
     path: string;
 };
+export type RulePackageTrust = {
+    /** Execute rule-package modules. Only set after an explicit trust decision. */
+    allowRulePackages?: boolean;
+    /** Deliberately ignore rule packages while still applying declarative config. */
+    disableRulePackages?: boolean;
+};
+/**
+ * Translate the CLI's explicit trust flags into the library trust contract.
+ * Plugin execution requires both an explicit config path and --allow-plugins;
+ * discovering a config in the current directory is never a trust decision.
+ */
+export declare function rulePackageTrustFromCli(args: string[], explicitConfigPath?: string): RulePackageTrust;
 export declare function loadConfig(explicitPath?: string, cwd?: string): LoadedConfig | null;
 /** Overlay config policy values onto a base policy; defined values win. */
 export declare function mergePolicy(base: GtmPolicy, config?: FullstackgtmConfig): GtmPolicy;
@@ -33,4 +45,4 @@ export declare function mergePolicy(base: GtmPolicy, config?: FullstackgtmConfig
  * Build the effective rule set: built-ins plus rule-package exports, then
  * `enabled` (allow-list) and `disabled` filters.
  */
-export declare function resolveConfiguredRules(loaded?: LoadedConfig | null, baseRules?: GtmAuditRule[]): Promise<GtmAuditRule[]>;
+export declare function resolveConfiguredRules(loaded?: LoadedConfig | null, baseRules?: GtmAuditRule[], trust?: RulePackageTrust): Promise<GtmAuditRule[]>;

package/dist/config.js

@@ -18,6 +18,22 @@ import { builtinAuditRules } from "./rules.js";
  * in version control.
  */
 export const CONFIG_FILE_NAME = "fullstackgtm.config.json";
+/**
+ * Translate the CLI's explicit trust flags into the library trust contract.
+ * Plugin execution requires both an explicit config path and --allow-plugins;
+ * discovering a config in the current directory is never a trust decision.
+ */
+export function rulePackageTrustFromCli(args, explicitConfigPath) {
+    const allow = args.includes("--allow-plugins");
+    const disable = args.includes("--no-plugins");
+    if (allow && disable) {
+        throw new Error("--allow-plugins and --no-plugins cannot be used together.");
+    }
+    if (allow && !explicitConfigPath) {
+        throw new Error("--allow-plugins requires --config <path>. Plugin code is never trusted from an implicitly discovered config.");
+    }
+    return { allowRulePackages: allow, disableRulePackages: disable };
+}
 export function loadConfig(explicitPath, cwd = process.cwd()) {
     const path = explicitPath ? resolve(cwd, explicitPath) : resolve(cwd, CONFIG_FILE_NAME);
     let raw;
@@ -51,9 +67,14 @@ export function mergePolicy(base, config) {
  * Build the effective rule set: built-ins plus rule-package exports, then
  * `enabled` (allow-list) and `disabled` filters.
  */
-export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules) {
+export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules, trust = {}) {
     let rules = [...baseRules];
-    for (const specifier of loaded?.config.rulePackages ?? []) {
+    const packages = loaded?.config.rulePackages ?? [];
+    if (packages.length && !trust.allowRulePackages && !trust.disableRulePackages) {
+        throw new Error(`Config ${loaded.path} declares executable rulePackages. Refusing to load plugin code without explicit trust. ` +
+            "For the CLI, pass --config <path> --allow-plugins after reviewing the modules, or pass --no-plugins to use only declarative policy and built-in rules.");
+    }
+    for (const specifier of trust.disableRulePackages ? [] : packages) {
         const resolvedSpecifier = specifier.startsWith(".") || isAbsolute(specifier)
             ? pathToFileURL(resolve(dirname(loaded.path), specifier)).href
             : specifier;

package/dist/connectors/hubspot.d.ts

@@ -1,6 +1,7 @@
 import { type FieldMappings } from "../mappings.ts";
 import type { GtmConnector, SnapshotProgress } from "../types.ts";
 import { type ProgressEmitter } from "../progress.ts";
+export type HubspotWritableConnector = GtmConnector & Required<Pick<GtmConnector, "applyOperation" | "readField">>;
 export type HubspotConnectorOptions = {
     /** Returns a HubSpot access token (private app token or OAuth access token). */
     getAccessToken: () => string | Promise<string>;
@@ -26,4 +27,4 @@ export type HubspotConnectorOptions = {
  * amountless deals — so audit rules can surface the gaps instead of hiding
  * them.
  */
-export declare function createHubspotConnector(options: HubspotConnectorOptions): GtmConnector;
+export declare function createHubspotConnector(options: HubspotConnectorOptions): HubspotWritableConnector;

package/dist/connectors/prospectSources.js

@@ -1,3 +1,4 @@
+import { ProviderHttpError } from "../providerError.js";
 function splitName(full) {
     if (!full)
         return {};
@@ -26,7 +27,7 @@ export async function fetchExploriumProspects(opts) {
         body: JSON.stringify({ mode: "full", size, page_size: size, page: 1, filters: opts.filters }),
     });
     if (!response.ok) {
-        throw new Error(`Explorium /v1/prospects failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("Explorium", "prospect search", response.status);
     }
     const data = (await response.json());
     return (data.data ?? []).map((row) => ({
@@ -58,7 +59,7 @@ export async function fetchPipe0CrustdataProspects(opts) {
         }),
     });
     if (!response.ok) {
-        throw new Error(`pipe0 /v1/searches/run/sync failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("pipe0", "prospect search", response.status);
     }
     const body = (await response.json());
     // Surface upstream provider errors (e.g. CreditBalanceInsufficient) instead of
@@ -119,7 +120,7 @@ export async function probeExploriumBusinessCount(opts) {
         body: JSON.stringify({ mode: "full", page_size: 1, page: 1, filters: opts.filters }),
     });
     if (!response.ok) {
-        throw new Error(`Explorium /v1/businesses count failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("Explorium", "business count", response.status);
     }
     const body = (await response.json());
     const total = body.total_results;
@@ -293,14 +294,6 @@ function fieldValue(field) {
     const v = field?.value;
     return typeof v === "string" && v.trim() ? v : undefined;
 }
-async function safeText(response) {
-    try {
-        return (await response.text()).slice(0, 300);
-    }
-    catch {
-        return "";
-    }
-}
 // ---------------------------------------------------------------------------
 // Pre-email dedup: identity keys shared between prospects and CRM contacts, so
 // we can drop already-in-CRM / already-seen people BEFORE paying for emails.

package/dist/connectors/salesforce.d.ts

@@ -6,6 +6,7 @@ export type SalesforceConnection = {
     /** e.g. https://yourorg.my.salesforce.com */
     instanceUrl: string;
 };
+export type SalesforceWritableConnector = GtmConnector & Required<Pick<GtmConnector, "applyOperation" | "readField">>;
 export type SalesforceConnectorOptions = {
     /** Returns an access token plus the instance URL it belongs to. */
     getConnection: () => SalesforceConnection | Promise<SalesforceConnection>;
@@ -32,4 +33,4 @@ export type SalesforceConnectorOptions = {
  * surface the gaps). Probabilities are normalized to 0..1 to match the
  * canonical model.
  */
-export declare function createSalesforceConnector(options: SalesforceConnectorOptions): GtmConnector;
+export declare function createSalesforceConnector(options: SalesforceConnectorOptions): SalesforceWritableConnector;

package/dist/connectors/salesforce.js

@@ -1,4 +1,5 @@
 import { SALESFORCE_DEFAULT_FIELD_MAPPINGS, mappedField, mappedFields, readMappedValue, } from "../mappings.js";
+import { validateSalesforceOrigin } from "./salesforceAuth.js";
 import { SNAPSHOT_PULL_STAGES } from "../progress.js";
 const DEFAULT_API_VERSION = "v59.0";
 const SOBJECT_TYPES = {
@@ -97,13 +98,17 @@ export function createSalesforceConnector(options) {
     }
     async function request(path, init = {}) {
         const connection = await options.getConnection();
-        const url = path.startsWith("http")
-            ? path
-            : `${connection.instanceUrl.replace(/\/$/, "")}${path}`;
+        const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
+        const resolved = new URL(path, `${instanceUrl}/`);
+        if (resolved.origin !== instanceUrl) {
+            throw new Error("Salesforce response attempted to send credentials to a different origin.");
+        }
+        const url = resolved.href;
         let response;
         try {
             response = await fetchImpl(url, {
                 ...init,
+                redirect: "manual",
                 headers: {
                     Authorization: `Bearer ${connection.accessToken}`,
                     "Content-Type": "application/json",
@@ -113,7 +118,7 @@ export function createSalesforceConnector(options) {
         }
         catch (error) {
             const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
-            throw new Error(`Cannot reach Salesforce at ${connection.instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`);
+            throw new Error(`Cannot reach Salesforce at ${instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`);
         }
         if (!response.ok) {
             // Status line only — the body echoes submitted field values and the
@@ -526,8 +531,9 @@ export function createSalesforceConnector(options) {
      */
     async function soapMerge(sobjectType, masterId, loserIds) {
         const connection = await options.getConnection();
+        const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
         const version = apiVersion.replace(/^v/, ""); // SOAP path uses "59.0", not "v59.0"
-        const url = `${connection.instanceUrl.replace(/\/$/, "")}/services/Soap/u/${version}`;
+        const url = `${instanceUrl}/services/Soap/u/${version}`;
         const toMerge = loserIds.map((id) => `<urn:recordToMergeIds>${escapeXml(id)}</urn:recordToMergeIds>`).join("");
         const envelope = `<?xml version="1.0" encoding="UTF-8"?>` +
             `<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:partner.soap.sforce.com" xmlns:urn1="urn:sobject.partner.soap.sforce.com">` +
@@ -540,6 +546,7 @@ export function createSalesforceConnector(options) {
         try {
             response = await fetchImpl(url, {
                 method: "POST",
+                redirect: "manual",
                 headers: { "Content-Type": "text/xml; charset=UTF-8", SOAPAction: '""' },
                 body: envelope,
             });

package/dist/connectors/salesforceAuth.d.ts

@@ -6,6 +6,15 @@
  * user confirms on any device. Requires a Connected App with device flow
  * enabled; only its consumer key (client id) is needed.
  */
+/**
+ * Normalize and validate a Salesforce credential-bearing origin.
+ *
+ * Salesforce API hosts are either the standard login/sandbox hosts or a
+ * Salesforce-owned instance/My Domain below salesforce.com.  Deliberately
+ * return an origin (not the input URL) so callers cannot accidentally retain
+ * paths, queries, credentials, or fragments from configuration.
+ */
+export declare function validateSalesforceOrigin(value: string, label?: string): string;
 export type SalesforceTokenSet = {
     accessToken: string;
     refreshToken?: string;

package/dist/connectors/salesforceAuth.js

@@ -7,9 +7,46 @@
  * enabled; only its consumer key (client id) is needed.
  */
 const DEFAULT_LOGIN_URL = "https://login.salesforce.com";
+/**
+ * Normalize and validate a Salesforce credential-bearing origin.
+ *
+ * Salesforce API hosts are either the standard login/sandbox hosts or a
+ * Salesforce-owned instance/My Domain below salesforce.com.  Deliberately
+ * return an origin (not the input URL) so callers cannot accidentally retain
+ * paths, queries, credentials, or fragments from configuration.
+ */
+export function validateSalesforceOrigin(value, label = "Salesforce URL") {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${label} must be a valid HTTPS Salesforce URL.`);
+    }
+    if (url.protocol !== "https:")
+        throw new Error(`${label} must use HTTPS.`);
+    if (url.username || url.password)
+        throw new Error(`${label} must not contain user information.`);
+    if (url.hash)
+        throw new Error(`${label} must not contain a fragment.`);
+    if (url.search)
+        throw new Error(`${label} must not contain a query string.`);
+    if (url.pathname !== "/" && url.pathname !== "")
+        throw new Error(`${label} must be an origin without a path.`);
+    if (url.port && url.port !== "443")
+        throw new Error(`${label} must use the standard HTTPS port.`);
+    const hostname = url.hostname.toLowerCase();
+    const trusted = hostname === "login.salesforce.com" ||
+        hostname === "test.salesforce.com" ||
+        (hostname.endsWith(".salesforce.com") && hostname.length > ".salesforce.com".length);
+    if (!trusted) {
+        throw new Error(`${label} must use login.salesforce.com, test.salesforce.com, or a Salesforce instance/My Domain host.`);
+    }
+    return url.origin;
+}
 const SESSION_TTL_MS = 2 * 60 * 60 * 1000;
 function tokenUrl(loginUrl) {
-    return `${loginUrl.replace(/\/$/, "")}/services/oauth2/token`;
+    return `${validateSalesforceOrigin(loginUrl, "Salesforce login URL")}/services/oauth2/token`;
 }
 /**
  * OAuth error responses can echo request parameters. Surface only the
@@ -32,6 +69,7 @@ export async function startSalesforceDeviceLogin(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
         method: "POST",
+        redirect: "manual",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
             response_type: "device_code",
@@ -59,6 +97,7 @@ export async function pollSalesforceDeviceLogin(options) {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
         const response = await fetchImpl(url, {
             method: "POST",
+            redirect: "manual",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
                 grant_type: "device",
@@ -68,10 +107,11 @@ export async function pollSalesforceDeviceLogin(options) {
         });
         const data = await response.json().catch(() => ({}));
         if (response.ok && data.access_token && data.instance_url) {
+            const instanceUrl = validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url");
             return {
                 accessToken: data.access_token,
                 refreshToken: data.refresh_token,
-                instanceUrl: data.instance_url,
+                instanceUrl,
                 expiresAt: Date.now() + SESSION_TTL_MS,
             };
         }
@@ -89,6 +129,7 @@ export async function refreshSalesforceToken(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
         method: "POST",
+        redirect: "manual",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
             grant_type: "refresh_token",
@@ -106,20 +147,21 @@ export async function refreshSalesforceToken(options) {
     return {
         accessToken: data.access_token,
         refreshToken: data.refresh_token ?? options.refreshToken,
-        instanceUrl: data.instance_url,
+        instanceUrl: validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url"),
         expiresAt: Date.now() + SESSION_TTL_MS,
     };
 }
 export async function validateSalesforceToken(accessToken, instanceUrl, fetchImpl = fetch) {
+    const trustedInstanceUrl = validateSalesforceOrigin(instanceUrl, "Salesforce instance URL");
     let response;
     try {
-        response = await fetchImpl(`${instanceUrl.replace(/\/$/, "")}/services/oauth2/userinfo`, { headers: { Authorization: `Bearer ${accessToken}` } });
+        response = await fetchImpl(`${trustedInstanceUrl}/services/oauth2/userinfo`, { redirect: "manual", headers: { Authorization: `Bearer ${accessToken}` } });
     }
     catch (error) {
         const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
         return {
             ok: false,
-            detail: `Cannot reach Salesforce at ${instanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
+            detail: `Cannot reach Salesforce at ${trustedInstanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
         };
     }
     if (response.ok) {

package/dist/connectors/signalSources.js

@@ -20,6 +20,7 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { resolve } from "node:path";
+import { FREE_EMAIL_DOMAINS } from "../freeEmailDomains.js";
 import { SIGNAL_BUCKETS } from "../signals.js";
 import { parseSpoolText, spoolFilesIn } from "../spoolFiles.js";
 // ---------------------------------------------------------------------------
@@ -243,22 +244,12 @@ function fieldValue(values, name) {
     }
     return "";
 }
-const FREE_MAIL = new Set([
-    "gmail.com",
-    "yahoo.com",
-    "hotmail.com",
-    "outlook.com",
-    "icloud.com",
-    "aol.com",
-    "proton.me",
-    "protonmail.com",
-]);
 /** Company domain from an email, or "" for free-mail / no email. */
 function corporateDomain(email) {
     if (!email.includes("@"))
         return "";
     const domain = email.split("@").at(-1).trim().toLowerCase();
-    if (!domain || FREE_MAIL.has(domain))
+    if (!domain || FREE_EMAIL_DOMAINS.has(domain))
         return "";
     return domain;
 }

package/dist/connectors/theirstack.d.ts

@@ -1,22 +1,3 @@
-/**
- * TheirStack — technographic company discovery.
- *
- * Explorium can only size a firmographic universe (NAICS/size/geo) and can't even
- * return the list. For a CRM-hygiene/RevOps tool the real buying signal is
- * "company runs a CRM", and the deliverable is an actual list of those companies.
- * TheirStack does both: filter companies by the technology they use (Salesforce,
- * HubSpot, Pipedrive, …) plus firmographics, and return real records (name,
- * domain, employee_count, …). A cheap count sizes the market; a paged search
- * materializes the list. Both cost ~3 credits per company RETURNED — counting
- * still returns 1 row (the API rejects limit:0), so a count is ~3 credits, not
- * free; a list pull is ~3 × the rows.
- *
- * API: POST https://api.theirstack.com/v1/companies/search, Bearer auth.
- * Verified live (2026-06-29): filters company_technology_slug_or /
- * company_country_code_or / min_employee_count / max_employee_count; the total is
- * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
- * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
- */
 type FetchImpl = typeof fetch;
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */

package/dist/connectors/theirstack.js

@@ -17,6 +17,7 @@
  * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
  * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
  */
+import { ProviderHttpError } from "../providerError.js";
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */
 export const THEIRSTACK_CREDITS_PER_COMPANY = 3;
@@ -31,14 +32,6 @@ export function theirStackPullCost(companies, usdPerCredit) {
         ...(usdPerCredit && usdPerCredit > 0 ? { usd: Math.round(credits * usdPerCredit) } : {}),
     };
 }
-async function safeText(res) {
-    try {
-        return (await res.text()).slice(0, 300);
-    }
-    catch {
-        return "";
-    }
-}
 const BASE = "https://api.theirstack.com";
 const SEARCH_PATH = "/v1/companies/search";
 function buildBody(filters, limit, page, includeTotal) {
@@ -99,7 +92,7 @@ export async function theirStackCountCompanies(opts) {
         body: buildBody(opts.filters, 1, 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack count failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "count", res.status);
     }
     return readTheirStackTotal(await res.json());
 }
@@ -117,7 +110,7 @@ export async function theirStackSearchCompanies(opts) {
         body: buildBody(opts.filters, limit, opts.page ?? 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack search failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "search", res.status);
     }
     const body = (await res.json());
     const rows = body.data ?? body.results ?? [];