fullstackgtm 0.47.0 → 0.49.0

package/dist/credentials.js

@@ -1,10 +1,11 @@
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, unlinkSync, } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshHubspotToken } from "./connectors/hubspotAuth.js";
-import { refreshSalesforceToken } from "./connectors/salesforceAuth.js";
+import { refreshSalesforceToken, validateSalesforceOrigin } from "./connectors/salesforceAuth.js";
 import { detectKeychainBackend } from "./keychain.js";
+import { assertNoSymlinkComponents, readSecureRegularFile, UnsafeManagedPathError, writeSecureFileAtomic, } from "./secureFile.js";
 /**
  * Local CLI credential store: ~/.fullstackgtm/credentials.json (0600), or
  * $FSGTM_HOME/credentials.json when set. Environment tokens always win over
@@ -80,7 +81,9 @@ export function ensureSecureHomeDir() {
     // umask) only to directories it creates, and never to pre-existing ones.
     const levels = dir === baseHomeDir() ? [dir] : [baseHomeDir(), join(baseHomeDir(), "profiles"), dir];
     for (const level of levels) {
+        assertNoSymlinkComponents(level);
         mkdirSync(level, { recursive: true, mode: 0o700 });
+        assertNoSymlinkComponents(level);
         try {
             chmodSync(level, 0o700);
         }
@@ -92,13 +95,7 @@ export function ensureSecureHomeDir() {
 }
 /** Write a 0600 file under the home, enforcing the mode even on rewrite. */
 export function writeSecureFile(path, contents) {
-    writeFileSync(path, contents, { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // Non-POSIX filesystems ignore chmod.
-    }
+    writeSecureFileAtomic(path, contents);
 }
 /**
  * The 0600/0700 guarantee was write-only: a credentials.json inherited at
@@ -107,18 +104,12 @@ export function writeSecureFile(path, contents) {
  * mode on read too — re-tighten to 0600 and warn once — so a world-readable
  * credential store can't sit there silently leaking the token to other users.
  */
-function enforceCredentialFileMode(path) {
-    try {
-        const mode = statSync(path).mode & 0o777;
-        if ((mode & 0o077) !== 0) {
-            chmodSync(path, 0o600);
-            console.error(`fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
-                "(it was readable or writable by other users).");
-        }
-    }
-    catch {
-        // Missing file or non-POSIX filesystem: nothing to enforce.
-    }
+function readCredentialFile(path) {
+    return readSecureRegularFile(path, {
+        tightenMode: 0o600,
+        onModeTightened: (mode) => console.error(`fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
+            "(it was readable or writable by other users)."),
+    });
 }
 /**
  * Persistence backend for the credential blob: the OS keychain when
@@ -144,7 +135,7 @@ function migratePlaintextToKeychain(keychain) {
     if (!existsSync(credentialsPath()))
         return;
     try {
-        const fileParsed = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+        const fileParsed = JSON.parse(readCredentialFile(credentialsPath()));
         if (fileParsed && fileParsed.version === 1 && fileParsed.providers) {
             const current = keychain.backend.get(keychain.account);
             const existing = current ? (JSON.parse(current).providers ?? {}) : {};
@@ -164,7 +155,7 @@ function readFile() {
     if (keychain)
         migratePlaintextToKeychain(keychain);
     try {
-        const raw = keychain ? keychain.backend.get(keychain.account) : (enforceCredentialFileMode(credentialsPath()), readFileSync(credentialsPath(), "utf8"));
+        const raw = keychain ? keychain.backend.get(keychain.account) : readCredentialFile(credentialsPath());
         if (raw) {
             const parsed = JSON.parse(raw);
             if (parsed && typeof parsed === "object" && parsed.version === 1 && parsed.providers) {
@@ -172,7 +163,9 @@ function readFile() {
             }
         }
     }
-    catch {
+    catch (error) {
+        if (error instanceof UnsafeManagedPathError)
+            throw error;
         // Missing or unreadable store falls through to an empty one.
     }
     return { version: 1, providers: {} };
@@ -192,6 +185,18 @@ export function getCredential(provider) {
     return readFile().providers[provider] ?? null;
 }
 export function storeCredential(provider, credential) {
+    if (provider === "salesforce") {
+        if (!credential.instanceUrl) {
+            throw new Error("Salesforce credentials require an instance URL.");
+        }
+        credential = {
+            ...credential,
+            instanceUrl: validateSalesforceOrigin(credential.instanceUrl, "Salesforce credential instance URL"),
+            ...(credential.loginUrl
+                ? { loginUrl: validateSalesforceOrigin(credential.loginUrl, "Salesforce credential login URL") }
+                : {}),
+        };
+    }
     const file = readFile();
     file.providers[provider] = credential;
     persist(file);
@@ -248,11 +253,15 @@ export async function resolveSalesforceConnection(options = {}) {
         if (!credential.instanceUrl) {
             throw new Error("Stored Salesforce credential has no instance URL. Run `fullstackgtm login salesforce` again.");
         }
+        const instanceUrl = validateSalesforceOrigin(credential.instanceUrl, "Stored Salesforce credential instance URL");
+        if (credential.loginUrl) {
+            validateSalesforceOrigin(credential.loginUrl, "Stored Salesforce credential login URL");
+        }
         const needsRefresh = credential.kind === "oauth" &&
             credential.expiresAt !== undefined &&
             Date.now() > credential.expiresAt - REFRESH_SKEW_MS;
         if (!needsRefresh) {
-            return { accessToken: credential.accessToken, instanceUrl: credential.instanceUrl };
+            return { accessToken: credential.accessToken, instanceUrl };
         }
         if (!credential.refreshToken || !credential.clientId) {
             throw new Error("Stored Salesforce token is expired and cannot be refreshed. Run `fullstackgtm login salesforce` again.");
@@ -279,9 +288,10 @@ export async function resolveSalesforceConnection(options = {}) {
     if (!minted.instanceUrl) {
         throw new Error("The hosted deployment returned no Salesforce instance URL.");
     }
+    const instanceUrl = validateSalesforceOrigin(minted.instanceUrl, "Hosted Salesforce credential instance URL");
     return {
         accessToken: minted.accessToken,
-        instanceUrl: minted.instanceUrl,
+        instanceUrl,
         fieldMappings: minted.fieldMappings,
     };
 }

package/dist/format.js

@@ -1,8 +1,7 @@
-// `summary: true` renders only the header + the Findings-by-Rule table + an
-// operation count, for read verbs like `audit` where the full per-operation
-// dump (1,400+ lines on a real portal) buries the signal. Defaults to the full
-// view so write-preview callers (bulk-update, fix, dedupe, plans show, MCP) —
-// where you approve specific operations — keep every operation's detail.
+// `summary: true` renders the compact audit view: header, findings summary,
+// assumptions/open questions, and an operation count. Defaults to the full view
+// so write-preview callers (bulk-update, fix, dedupe, plans show, MCP) — where
+// you approve specific operations — keep every operation's detail.
 export function patchPlanToMarkdown(plan, opts = {}) {
     const lines = [
         `# ${plan.title}`,
@@ -25,6 +24,7 @@ export function patchPlanToMarkdown(plan, opts = {}) {
         });
         lines.push("");
     }
+    appendAssumptionsAndDecisionPoints(lines, plan);
     if (opts.summary) {
         const ops = plan.operations.length;
         lines.push(ops === 0
@@ -96,6 +96,32 @@ export function formatPatchPlanRun(run) {
     }
     return `${lines.join("\n")}\n`;
 }
+function appendAssumptionsAndDecisionPoints(lines, plan) {
+    const assumptions = [...(plan.assumptions ?? [])].sort((left, right) => {
+        if (left.confidence === "guess" && right.confidence !== "guess")
+            return -1;
+        if (left.confidence !== "guess" && right.confidence === "guess")
+            return 1;
+        return 0;
+    });
+    const openQuestions = plan.openQuestions ?? [];
+    if (assumptions.length === 0 && openQuestions.length === 0)
+        return;
+    lines.push("## Assumptions & decision points", "");
+    for (const assumption of assumptions) {
+        const warning = assumption.confidence === "guess" ? "⚠️ " : "";
+        lines.push(`- ${warning}${assumption.text}${assumption.source ? ` _(source: ${assumption.source})_` : ""}`);
+    }
+    if (openQuestions.length > 0) {
+        if (assumptions.length > 0)
+            lines.push("");
+        lines.push("### Open questions", "");
+        for (const question of openQuestions) {
+            lines.push(`- ${question}`);
+        }
+    }
+    lines.push("");
+}
 function formatValue(value) {
     if (value === undefined || value === null || value === "")
         return "unset";

package/dist/freeEmailDomains.d.ts

@@ -0,0 +1 @@
+export declare const FREE_EMAIL_DOMAINS: Set<string>;

package/dist/freeEmailDomains.js

@@ -0,0 +1,14 @@
+// Shared free-mail domains that should never be treated as company domains.
+export const FREE_EMAIL_DOMAINS = new Set([
+    "gmail.com",
+    "googlemail.com",
+    "yahoo.com",
+    "outlook.com",
+    "hotmail.com",
+    "live.com",
+    "icloud.com",
+    "me.com",
+    "aol.com",
+    "proton.me",
+    "protonmail.com",
+]);

package/dist/hierarchy.d.ts

@@ -0,0 +1,29 @@
+import type { CanonicalGtmSnapshot } from "./types.ts";
+export type AccountHierarchyNode = {
+    accountId: string;
+    name: string;
+    domain?: string;
+    parentAccountId?: string;
+    parentReason?: string;
+    children: AccountHierarchyNode[];
+};
+export type AccountHierarchyConflict = {
+    type: "duplicate_domain" | "ambiguous_parent" | "cycle";
+    accountIds: string[];
+    key: string;
+    detail: string;
+};
+export type AccountHierarchyReport = {
+    generatedAt: string;
+    roots: AccountHierarchyNode[];
+    orphanAccounts: string[];
+    conflicts: AccountHierarchyConflict[];
+    counts: {
+        accounts: number;
+        roots: number;
+        linkedChildren: number;
+        conflicts: number;
+    };
+};
+export declare function buildAccountHierarchy(snapshot: CanonicalGtmSnapshot): AccountHierarchyReport;
+export declare function accountHierarchyToMarkdown(report: AccountHierarchyReport): string;

package/dist/hierarchy.js

@@ -0,0 +1,164 @@
+import { normalizeDomain } from "./merge.js";
+function rawString(account, keys) {
+    if (!account.raw || typeof account.raw !== "object")
+        return undefined;
+    const raw = account.raw;
+    for (const key of keys) {
+        const value = raw[key];
+        if (typeof value === "string" && value.trim())
+            return value.trim();
+        if (value && typeof value === "object") {
+            const nested = value;
+            for (const nestedKey of ["id", "value", "name"]) {
+                if (typeof nested[nestedKey] === "string" && String(nested[nestedKey]).trim())
+                    return String(nested[nestedKey]).trim();
+            }
+        }
+    }
+    return undefined;
+}
+function parentHint(account) {
+    return rawString(account, ["parentAccountId", "parent_account_id", "ParentId", "parentCompanyId", "hs_parent_company_id"]);
+}
+function cloneNode(account) {
+    return { accountId: String(account.id), name: account.name, ...(account.domain ? { domain: account.domain } : {}), children: [] };
+}
+function looksLikePublicSuffix(domain) {
+    const parts = domain.split(".");
+    if (parts.length !== 2)
+        return false;
+    const [label, tld] = parts;
+    return tld.length === 2 && ["ac", "co", "com", "edu", "gov", "net", "org"].includes(label);
+}
+function domainParent(childDomain, domains) {
+    const parts = childDomain.split(".");
+    for (let i = 1; i < parts.length - 1; i++) {
+        const candidate = parts.slice(i).join(".");
+        if (candidate.split(".").length < 2 || looksLikePublicSuffix(candidate))
+            continue;
+        const unique = new Map((domains.get(candidate) ?? []).map((account) => [String(account.id), account]));
+        if (unique.size > 1)
+            return "ambiguous";
+        if (unique.size === 1)
+            return [...unique.values()][0];
+    }
+    return null;
+}
+function detectCycles(parentByChild) {
+    const cyclic = new Set();
+    const cycles = [];
+    const emitted = new Set();
+    for (const start of parentByChild.keys()) {
+        const path = [];
+        const indexById = new Map();
+        let cursor = start;
+        while (cursor && parentByChild.has(cursor)) {
+            const seenAt = indexById.get(cursor);
+            if (seenAt !== undefined) {
+                const cycle = path.slice(seenAt);
+                for (const id of cycle)
+                    cyclic.add(id);
+                const key = [...cycle].sort().join("|");
+                if (!emitted.has(key)) {
+                    emitted.add(key);
+                    cycles.push(cycle);
+                }
+                break;
+            }
+            indexById.set(cursor, path.length);
+            path.push(cursor);
+            cursor = parentByChild.get(cursor)?.parentId;
+        }
+    }
+    return { accountIds: cyclic, cycles };
+}
+export function buildAccountHierarchy(snapshot) {
+    const byId = new Map(snapshot.accounts.map((account) => [String(account.id), account]));
+    const accounts = [...byId.values()];
+    const domains = new Map();
+    for (const account of accounts) {
+        const domain = normalizeDomain(account.domain);
+        if (domain)
+            domains.set(domain, [...(domains.get(domain) ?? []), account]);
+    }
+    const conflicts = [];
+    for (const [domain, accounts] of domains) {
+        const ids = [...new Set(accounts.map((account) => String(account.id)))];
+        if (ids.length > 1)
+            conflicts.push({ type: "duplicate_domain", accountIds: ids.sort(), key: domain, detail: `${ids.length} accounts share domain ${domain}; hierarchy inference will not choose between them.` });
+    }
+    const nodes = new Map(accounts.map((account) => [String(account.id), cloneNode(account)]));
+    const parentByChild = new Map();
+    for (const account of accounts) {
+        const id = String(account.id);
+        const hint = parentHint(account);
+        if (hint && byId.has(hint) && hint !== id) {
+            parentByChild.set(id, { parentId: hint, reason: "provider-parent" });
+            continue;
+        }
+        const domain = normalizeDomain(account.domain);
+        if (!domain)
+            continue;
+        const inferred = domainParent(domain, domains);
+        if (inferred === "ambiguous")
+            conflicts.push({ type: "ambiguous_parent", accountIds: [id], key: domain, detail: `Multiple possible parent accounts found for ${domain}; leaving account as a root.` });
+        else if (inferred && String(inferred.id) !== id)
+            parentByChild.set(id, { parentId: String(inferred.id), reason: "domain-subdomain" });
+    }
+    const cyclicAccounts = detectCycles(parentByChild);
+    for (const cycle of cyclicAccounts.cycles) {
+        const ordered = [...cycle].sort();
+        const key = ordered.join(" -> ");
+        conflicts.push({
+            type: "cycle",
+            accountIds: ordered,
+            key,
+            detail: `Cyclic parent hints detected among ${ordered.join(", ")}; leaving those accounts as roots instead of hiding them in a loop.`,
+        });
+    }
+    for (const accountId of cyclicAccounts.accountIds)
+        parentByChild.delete(accountId);
+    const roots = [];
+    const orphanAccounts = [];
+    const linkedChildren = new Set();
+    for (const account of accounts) {
+        const id = String(account.id);
+        const node = nodes.get(id);
+        const parent = parentByChild.get(id);
+        if (parent && nodes.has(parent.parentId)) {
+            node.parentAccountId = parent.parentId;
+            node.parentReason = parent.reason;
+            nodes.get(parent.parentId).children.push(node);
+            linkedChildren.add(id);
+        }
+        else {
+            roots.push(node);
+            if (!account.domain && !parentHint(account))
+                orphanAccounts.push(id);
+        }
+    }
+    const sortTree = (list) => {
+        list.sort((a, b) => a.name.localeCompare(b.name) || a.accountId.localeCompare(b.accountId));
+        for (const node of list)
+            sortTree(node.children);
+    };
+    sortTree(roots);
+    return { generatedAt: snapshot.generatedAt, roots, orphanAccounts: orphanAccounts.sort(), conflicts, counts: { accounts: accounts.length, roots: roots.length, linkedChildren: linkedChildren.size, conflicts: conflicts.length } };
+}
+export function accountHierarchyToMarkdown(report) {
+    const lines = ["# Account hierarchy", "", `${report.counts.accounts} account(s), ${report.counts.roots} root(s), ${report.counts.linkedChildren} inferred child link(s), ${report.counts.conflicts} conflict(s).`, ""];
+    const walk = (nodes, depth) => {
+        for (const node of nodes) {
+            const suffix = [node.domain, node.parentReason ? `via ${node.parentReason}` : undefined].filter(Boolean).join("; ");
+            lines.push(`${"  ".repeat(depth)}- ${node.name} (${node.accountId}${suffix ? ` — ${suffix}` : ""})`);
+            walk(node.children, depth + 1);
+        }
+    };
+    walk(report.roots, 0);
+    if (report.conflicts.length) {
+        lines.push("", "## Conflicts");
+        for (const conflict of report.conflicts)
+            lines.push(`- ${conflict.type} ${conflict.key}: ${conflict.detail}`);
+    }
+    return lines.join("\n");
+}

package/dist/index.d.ts

@@ -3,13 +3,16 @@ export { matchesTerritory, parseAssignmentPolicy, resolveAssignment, type Assign
 export { buildBulkUpdatePlan, isFilterableField, parseWhere, type BulkUpdateOptions } from "./bulkUpdate.ts";
 export { buildDedupePlan, dedupeKey, type DedupeOptions } from "./dedupe.ts";
 export { buildReassignPlans, type ReassignObjectType, type ReassignOptions } from "./reassign.ts";
-export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, type FullstackgtmConfig, type LoadedConfig, } from "./config.ts";
+export { buildLeadRoutePlan, type LeadRouteCounts, type LeadRouteOptions, type LeadRouteResult, } from "./route.ts";
+export { accountHierarchyToMarkdown, buildAccountHierarchy, type AccountHierarchyConflict, type AccountHierarchyNode, type AccountHierarchyReport, } from "./hierarchy.ts";
+export { buildRelationshipMap, relationshipMapToMarkdown, type RelationshipMap, type StakeholderNode, type StakeholderRole, type StakeholderSentiment, } from "./relationships.ts";
+export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli, type FullstackgtmConfig, type LoadedConfig, type RulePackageTrust, } from "./config.ts";
 export { applyPatchPlan, type ApplyPatchPlanOptions } from "./connector.ts";
 export { APPLY_STAGES, BACKFILL_STRIPE_STAGES, composeListeners, createProgressEmitter, CRM_SYNC_STAGES, nullProgressEmitter, SNAPSHOT_PULL_STAGES, STRIPE_SNAPSHOT_STAGES, type ProgressEmitter, type ProgressEvent, type ProgressListener, type ProgressSnapshot, } from "./progress.ts";
 export { createHubspotConnector, type HubspotConnectorOptions } from "./connectors/hubspot.ts";
 export { DEFAULT_LOOPBACK_PORT, DEFAULT_OAUTH_SCOPES, exchangeHubspotCode, refreshHubspotToken, runHubspotLoopbackLogin, validateHubspotToken, type HubspotTokenSet, type LoopbackLoginOptions, } from "./connectors/hubspotAuth.ts";
 export { createSalesforceConnector, type SalesforceConnection, type SalesforceConnectorOptions, } from "./connectors/salesforce.ts";
-export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceToken, type SalesforceDeviceAuthorization, type SalesforceTokenSet, } from "./connectors/salesforceAuth.ts";
+export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken, type SalesforceDeviceAuthorization, type SalesforceTokenSet, } from "./connectors/salesforceAuth.ts";
 export { createStripeConnector, fetchStripePaidInvoices, type StripeConnectorOptions, type StripePaidInvoice, } from "./connectors/stripe.ts";
 export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, type StripeBackfillCounts, type StripeBackfillOptions, type StripeBackfillResult, type StripeBackfillUnmatched, } from "./backfill.ts";
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, type HubspotConnection, type StoredCredential, } from "./credentials.ts";
@@ -23,11 +26,12 @@ export { mergeSnapshots, type MergeConflict, type MergeMatch, type MergeReport,
 export { createFilePlanStore, type PlanStore, type StoredPlan } from "./planStore.ts";
 export { computeApprovalDigests, loadOrCreateSigningKey, loadSigningKey, signApproval, verifyApprovalDigests, type ApprovalVerification, } from "./integrity.ts";
 export { buildAuditLog, verifyAuditLog, type AuditLogEntry, type AuditLogExport, type AuditLogVerification, } from "./auditLog.ts";
+export { FREE_EMAIL_DOMAINS } from "./freeEmailDomains.ts";
 export { formatPatchPlanRun, patchPlanToMarkdown } from "./format.ts";
 export { computeHealth, summarizeHealth, healthToMarkdown, type HealthEntry, type HealthRollup, type HealthRuleDelta, } from "./health.ts";
 export { auditReportToHtml, auditReportToMarkdown, type ReportOptions } from "./report.ts";
 export { HUBSPOT_DEFAULT_FIELD_MAPPINGS, SALESFORCE_DEFAULT_FIELD_MAPPINGS, mappedField, mappedFields, normalizeFieldMappings, readMappedValue, type CrmObjectType, type FieldMappings, } from "./mappings.ts";
-export { accountSingleSourceRule, activeDealAccountWithoutContactsRule, auditFindingId, buildSnapshotIndex, builtinAuditRules, closingSoonInactiveRule, duplicateAccountDomainRule, duplicateContactEmailRule, duplicateOpenDealRule, missingDealAccountRule, missingDealAmountRule, missingDealOwnerRule, orphanAccountRule, pastCloseDateRule, patchOperationId, provenanceSummary, requiresHumanInput, staleDealRule, } from "./rules.ts";
+export { accountSingleSourceRule, activeDealAccountWithoutContactsRule, auditFindingId, buildSnapshotIndex, builtinAuditRules, closingSoonInactiveRule, isFindingsOnlyRule, duplicateAccountDomainRule, duplicateContactEmailRule, duplicateOpenDealRule, missingDealAccountRule, missingDealAmountRule, missingDealOwnerRule, orphanAccountRule, pastCloseDateRule, patchOperationId, provenanceSummary, requiresHumanInput, staleDealRule, } from "./rules.ts";
 export { extractCallInsights, normalizeTranscript, parseCall, parseTranscript, suggestCallDeal, summarizeInsights, type CallDealSuggestion, type CallInsightType, type ExtractedCallInsight, type ParsedCall, type ParsedTranscriptSegment, } from "./calls.ts";
 export { sampleSnapshot } from "./sampleData.ts";
 export { DEFAULT_MODELS, DEFAULT_RUBRIC, classifyCallLlm, detectProviderFromKey, extractInsightsLlm, forcedToolCall, parseRubric, resolveLlmCredential, scoreCallLlm, validateLlmKey, type CallScorecard, type LlmCallClassification, type LlmCredential, type LlmExtractedInsight, type LlmProvider, type Rubric, type RubricDimension, type ScoreBand, type ScoredDimension, } from "./llm.ts";
@@ -48,4 +52,5 @@ export { fetchAtsJobs, snippetFor, type AtsBoardSource, type AtsJob, } from "./c
 export { scoreBand, judgeRunId, normalizeSpan, isGroundedSpan, scoreAccount, accountRecentlyTouched, bestContactForAccount, deterministicDecision, deterministicWhyNow, JUDGE_SCHEMA, DEFAULT_JUDGE_PROMPT, judgeDecisionLlm, judgeSignals, judgeDir, createFileJudgeStore, type JudgeDecisionKind, type JudgeDecision, type JudgeRun, type JudgeBand, type AccountScore, type JudgeStore, } from "./judge.ts";
 export { draft, authorOpeners, draftOpenerLlm, deterministicOpener, creditedTriggerSignal, draftEvidence, sanitizeOpener, firstLine, firstLineGroundedInTrigger, hasBannedGreeting, isStaleTrigger, draftOperationId, draftEvidenceId, DRAFT_CHANNELS, DRAFT_SCHEMA, DEFAULT_DRAFT_PROMPT, DEFAULT_FRESHNESS_DAYS, type Draft, type RejectedDraft, type DraftResult, type DraftChannel, } from "./draft.ts";
 export { DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, HOT_SCORE, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet, type Confusion, type EvalJudgeFn, type GoldenHistory, type GoldenRow, type GradeResult, type OutcomeCalibration, } from "./judgeEval.ts";
-export type { ApprovalStatus, AuditFinding, AuditFindingSeverity, CanonicalAccount, CanonicalActivity, CanonicalContact, CanonicalDeal, CanonicalGtmSnapshot, CanonicalUser, CrmProvider, GtmAuditRule, GtmConnector, GtmEvidence, GtmEvidenceSourceSystem, GtmObjectType, GtmPolicy, GtmRuleContext, GtmRuleResult, GtmSnapshotIndex, PatchOperation, PatchOperationResult, PatchOperationType, PatchPlan, PatchPlanRun, PatchPlanRunStatus, PatchVerification, PipelineFinding, PipelineFindingStatus, PipelineFindingType, ProviderIdentity, RiskLevel, SourceFreshness, } from "./types.ts";
+export type { ApprovalStatus, AuditFinding, AuditFindingSeverity, CanonicalAccount, CanonicalActivity, CanonicalContact, CanonicalDeal, CanonicalGtmSnapshot, CanonicalUser, CrmProvider, GtmAuditRule, GtmConnector, GtmEvidence, GtmEvidenceSourceSystem, GtmObjectType, GtmPolicy, GtmRuleContext, GtmRuleResult, GtmSnapshotIndex, PatchOperation, PatchOperationResult, PatchOperationType, PatchPlan, PatchPlanAssumption, PatchPlanAssumptionConfidence, PatchPlanRun, PatchPlanRunStatus, PatchVerification, PipelineFinding, PipelineFindingStatus, PipelineFindingType, ProviderIdentity, RiskLevel, SourceFreshness, } from "./types.ts";
+export { ProviderHttpError } from "./providerError.ts";

package/dist/index.js

@@ -3,13 +3,16 @@ export { matchesTerritory, parseAssignmentPolicy, resolveAssignment, } from "./a
 export { buildBulkUpdatePlan, isFilterableField, parseWhere } from "./bulkUpdate.js";
 export { buildDedupePlan, dedupeKey } from "./dedupe.js";
 export { buildReassignPlans } from "./reassign.js";
-export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, } from "./config.js";
+export { buildLeadRoutePlan, } from "./route.js";
+export { accountHierarchyToMarkdown, buildAccountHierarchy, } from "./hierarchy.js";
+export { buildRelationshipMap, relationshipMapToMarkdown, } from "./relationships.js";
+export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli, } from "./config.js";
 export { applyPatchPlan } from "./connector.js";
 export { APPLY_STAGES, BACKFILL_STRIPE_STAGES, composeListeners, createProgressEmitter, CRM_SYNC_STAGES, nullProgressEmitter, SNAPSHOT_PULL_STAGES, STRIPE_SNAPSHOT_STAGES, } from "./progress.js";
 export { createHubspotConnector } from "./connectors/hubspot.js";
 export { DEFAULT_LOOPBACK_PORT, DEFAULT_OAUTH_SCOPES, exchangeHubspotCode, refreshHubspotToken, runHubspotLoopbackLogin, validateHubspotToken, } from "./connectors/hubspotAuth.js";
 export { createSalesforceConnector, } from "./connectors/salesforce.js";
-export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceToken, } from "./connectors/salesforceAuth.js";
+export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken, } from "./connectors/salesforceAuth.js";
 export { createStripeConnector, fetchStripePaidInvoices, } from "./connectors/stripe.js";
 export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, } from "./backfill.js";
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, } from "./credentials.js";
@@ -23,11 +26,12 @@ export { mergeSnapshots, } from "./merge.js";
 export { createFilePlanStore } from "./planStore.js";
 export { computeApprovalDigests, loadOrCreateSigningKey, loadSigningKey, signApproval, verifyApprovalDigests, } from "./integrity.js";
 export { buildAuditLog, verifyAuditLog, } from "./auditLog.js";
+export { FREE_EMAIL_DOMAINS } from "./freeEmailDomains.js";
 export { formatPatchPlanRun, patchPlanToMarkdown } from "./format.js";
 export { computeHealth, summarizeHealth, healthToMarkdown, } from "./health.js";
 export { auditReportToHtml, auditReportToMarkdown } from "./report.js";
 export { HUBSPOT_DEFAULT_FIELD_MAPPINGS, SALESFORCE_DEFAULT_FIELD_MAPPINGS, mappedField, mappedFields, normalizeFieldMappings, readMappedValue, } from "./mappings.js";
-export { accountSingleSourceRule, activeDealAccountWithoutContactsRule, auditFindingId, buildSnapshotIndex, builtinAuditRules, closingSoonInactiveRule, duplicateAccountDomainRule, duplicateContactEmailRule, duplicateOpenDealRule, missingDealAccountRule, missingDealAmountRule, missingDealOwnerRule, orphanAccountRule, pastCloseDateRule, patchOperationId, provenanceSummary, requiresHumanInput, staleDealRule, } from "./rules.js";
+export { accountSingleSourceRule, activeDealAccountWithoutContactsRule, auditFindingId, buildSnapshotIndex, builtinAuditRules, closingSoonInactiveRule, isFindingsOnlyRule, duplicateAccountDomainRule, duplicateContactEmailRule, duplicateOpenDealRule, missingDealAccountRule, missingDealAmountRule, missingDealOwnerRule, orphanAccountRule, pastCloseDateRule, patchOperationId, provenanceSummary, requiresHumanInput, staleDealRule, } from "./rules.js";
 export { extractCallInsights, normalizeTranscript, parseCall, parseTranscript, suggestCallDeal, summarizeInsights, } from "./calls.js";
 export { sampleSnapshot } from "./sampleData.js";
 export { DEFAULT_MODELS, DEFAULT_RUBRIC, classifyCallLlm, detectProviderFromKey, extractInsightsLlm, forcedToolCall, parseRubric, resolveLlmCredential, scoreCallLlm, validateLlmKey, } from "./llm.js";
@@ -48,3 +52,4 @@ export { fetchAtsJobs, snippetFor, } from "./connectors/atsBoards.js";
 export { scoreBand, judgeRunId, normalizeSpan, isGroundedSpan, scoreAccount, accountRecentlyTouched, bestContactForAccount, deterministicDecision, deterministicWhyNow, JUDGE_SCHEMA, DEFAULT_JUDGE_PROMPT, judgeDecisionLlm, judgeSignals, judgeDir, createFileJudgeStore, } from "./judge.js";
 export { draft, authorOpeners, draftOpenerLlm, deterministicOpener, creditedTriggerSignal, draftEvidence, sanitizeOpener, firstLine, firstLineGroundedInTrigger, hasBannedGreeting, isStaleTrigger, draftOperationId, draftEvidenceId, DRAFT_CHANNELS, DRAFT_SCHEMA, DEFAULT_DRAFT_PROMPT, DEFAULT_FRESHNESS_DAYS, } from "./draft.js";
 export { DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, HOT_SCORE, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet, } from "./judgeEval.js";
+export { ProviderHttpError } from "./providerError.js";

package/dist/market.d.ts

@@ -1,5 +1,6 @@
 import { type ProgressEmitter } from "./progress.ts";
 import type { GtmEvidence } from "./types.ts";
+export { assertPublicUrl } from "./publicHttp.ts";
 /**
  * The Market Map: a live model of the competitive category a company sells
  * into. Vendors publish claims constantly (pricing pages, feature pages,
@@ -162,7 +163,6 @@ export type FetchPage = (url: string) => Promise<{
     status: number;
     body: string;
 }>;
-export declare function assertPublicUrl(rawUrl: string): Promise<URL>;
 export type CaptureOptions = {
     /** Directory for captures; defaults to <marketHome>/captures. Ignored when `store` is given. */
     dir?: string;