fullstackgtm 0.48.0 → 0.49.0

package/dist/connectors/theirstack.d.ts

@@ -1,22 +1,3 @@
-/**
- * TheirStack — technographic company discovery.
- *
- * Explorium can only size a firmographic universe (NAICS/size/geo) and can't even
- * return the list. For a CRM-hygiene/RevOps tool the real buying signal is
- * "company runs a CRM", and the deliverable is an actual list of those companies.
- * TheirStack does both: filter companies by the technology they use (Salesforce,
- * HubSpot, Pipedrive, …) plus firmographics, and return real records (name,
- * domain, employee_count, …). A cheap count sizes the market; a paged search
- * materializes the list. Both cost ~3 credits per company RETURNED — counting
- * still returns 1 row (the API rejects limit:0), so a count is ~3 credits, not
- * free; a list pull is ~3 × the rows.
- *
- * API: POST https://api.theirstack.com/v1/companies/search, Bearer auth.
- * Verified live (2026-06-29): filters company_technology_slug_or /
- * company_country_code_or / min_employee_count / max_employee_count; the total is
- * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
- * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
- */
 type FetchImpl = typeof fetch;
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */

package/dist/connectors/theirstack.js

@@ -17,6 +17,7 @@
  * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
  * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
  */
+import { ProviderHttpError } from "../providerError.js";
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */
 export const THEIRSTACK_CREDITS_PER_COMPANY = 3;
@@ -31,14 +32,6 @@ export function theirStackPullCost(companies, usdPerCredit) {
         ...(usdPerCredit && usdPerCredit > 0 ? { usd: Math.round(credits * usdPerCredit) } : {}),
     };
 }
-async function safeText(res) {
-    try {
-        return (await res.text()).slice(0, 300);
-    }
-    catch {
-        return "";
-    }
-}
 const BASE = "https://api.theirstack.com";
 const SEARCH_PATH = "/v1/companies/search";
 function buildBody(filters, limit, page, includeTotal) {
@@ -99,7 +92,7 @@ export async function theirStackCountCompanies(opts) {
         body: buildBody(opts.filters, 1, 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack count failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "count", res.status);
     }
     return readTheirStackTotal(await res.json());
 }
@@ -117,7 +110,7 @@ export async function theirStackSearchCompanies(opts) {
         body: buildBody(opts.filters, limit, opts.page ?? 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack search failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "search", res.status);
     }
     const body = (await res.json());
     const rows = body.data ?? body.results ?? [];

package/dist/credentials.js

@@ -1,10 +1,11 @@
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, unlinkSync, } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { refreshHubspotToken } from "./connectors/hubspotAuth.js";
-import { refreshSalesforceToken } from "./connectors/salesforceAuth.js";
+import { refreshSalesforceToken, validateSalesforceOrigin } from "./connectors/salesforceAuth.js";
 import { detectKeychainBackend } from "./keychain.js";
+import { assertNoSymlinkComponents, readSecureRegularFile, UnsafeManagedPathError, writeSecureFileAtomic, } from "./secureFile.js";
 /**
  * Local CLI credential store: ~/.fullstackgtm/credentials.json (0600), or
  * $FSGTM_HOME/credentials.json when set. Environment tokens always win over
@@ -80,7 +81,9 @@ export function ensureSecureHomeDir() {
     // umask) only to directories it creates, and never to pre-existing ones.
     const levels = dir === baseHomeDir() ? [dir] : [baseHomeDir(), join(baseHomeDir(), "profiles"), dir];
     for (const level of levels) {
+        assertNoSymlinkComponents(level);
         mkdirSync(level, { recursive: true, mode: 0o700 });
+        assertNoSymlinkComponents(level);
         try {
             chmodSync(level, 0o700);
         }
@@ -92,13 +95,7 @@ export function ensureSecureHomeDir() {
 }
 /** Write a 0600 file under the home, enforcing the mode even on rewrite. */
 export function writeSecureFile(path, contents) {
-    writeFileSync(path, contents, { mode: 0o600 });
-    try {
-        chmodSync(path, 0o600);
-    }
-    catch {
-        // Non-POSIX filesystems ignore chmod.
-    }
+    writeSecureFileAtomic(path, contents);
 }
 /**
  * The 0600/0700 guarantee was write-only: a credentials.json inherited at
@@ -107,18 +104,12 @@ export function writeSecureFile(path, contents) {
  * mode on read too — re-tighten to 0600 and warn once — so a world-readable
  * credential store can't sit there silently leaking the token to other users.
  */
-function enforceCredentialFileMode(path) {
-    try {
-        const mode = statSync(path).mode & 0o777;
-        if ((mode & 0o077) !== 0) {
-            chmodSync(path, 0o600);
-            console.error(`fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
-                "(it was readable or writable by other users).");
-        }
-    }
-    catch {
-        // Missing file or non-POSIX filesystem: nothing to enforce.
-    }
+function readCredentialFile(path) {
+    return readSecureRegularFile(path, {
+        tightenMode: 0o600,
+        onModeTightened: (mode) => console.error(`fullstackgtm: tightened ${path} from ${mode.toString(8).padStart(3, "0")} to 600 ` +
+            "(it was readable or writable by other users)."),
+    });
 }
 /**
  * Persistence backend for the credential blob: the OS keychain when
@@ -144,7 +135,7 @@ function migratePlaintextToKeychain(keychain) {
     if (!existsSync(credentialsPath()))
         return;
     try {
-        const fileParsed = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+        const fileParsed = JSON.parse(readCredentialFile(credentialsPath()));
         if (fileParsed && fileParsed.version === 1 && fileParsed.providers) {
             const current = keychain.backend.get(keychain.account);
             const existing = current ? (JSON.parse(current).providers ?? {}) : {};
@@ -164,7 +155,7 @@ function readFile() {
     if (keychain)
         migratePlaintextToKeychain(keychain);
     try {
-        const raw = keychain ? keychain.backend.get(keychain.account) : (enforceCredentialFileMode(credentialsPath()), readFileSync(credentialsPath(), "utf8"));
+        const raw = keychain ? keychain.backend.get(keychain.account) : readCredentialFile(credentialsPath());
         if (raw) {
             const parsed = JSON.parse(raw);
             if (parsed && typeof parsed === "object" && parsed.version === 1 && parsed.providers) {
@@ -172,7 +163,9 @@ function readFile() {
             }
         }
     }
-    catch {
+    catch (error) {
+        if (error instanceof UnsafeManagedPathError)
+            throw error;
         // Missing or unreadable store falls through to an empty one.
     }
     return { version: 1, providers: {} };
@@ -192,6 +185,18 @@ export function getCredential(provider) {
     return readFile().providers[provider] ?? null;
 }
 export function storeCredential(provider, credential) {
+    if (provider === "salesforce") {
+        if (!credential.instanceUrl) {
+            throw new Error("Salesforce credentials require an instance URL.");
+        }
+        credential = {
+            ...credential,
+            instanceUrl: validateSalesforceOrigin(credential.instanceUrl, "Salesforce credential instance URL"),
+            ...(credential.loginUrl
+                ? { loginUrl: validateSalesforceOrigin(credential.loginUrl, "Salesforce credential login URL") }
+                : {}),
+        };
+    }
     const file = readFile();
     file.providers[provider] = credential;
     persist(file);
@@ -248,11 +253,15 @@ export async function resolveSalesforceConnection(options = {}) {
         if (!credential.instanceUrl) {
             throw new Error("Stored Salesforce credential has no instance URL. Run `fullstackgtm login salesforce` again.");
         }
+        const instanceUrl = validateSalesforceOrigin(credential.instanceUrl, "Stored Salesforce credential instance URL");
+        if (credential.loginUrl) {
+            validateSalesforceOrigin(credential.loginUrl, "Stored Salesforce credential login URL");
+        }
         const needsRefresh = credential.kind === "oauth" &&
             credential.expiresAt !== undefined &&
             Date.now() > credential.expiresAt - REFRESH_SKEW_MS;
         if (!needsRefresh) {
-            return { accessToken: credential.accessToken, instanceUrl: credential.instanceUrl };
+            return { accessToken: credential.accessToken, instanceUrl };
         }
         if (!credential.refreshToken || !credential.clientId) {
             throw new Error("Stored Salesforce token is expired and cannot be refreshed. Run `fullstackgtm login salesforce` again.");
@@ -279,9 +288,10 @@ export async function resolveSalesforceConnection(options = {}) {
     if (!minted.instanceUrl) {
         throw new Error("The hosted deployment returned no Salesforce instance URL.");
     }
+    const instanceUrl = validateSalesforceOrigin(minted.instanceUrl, "Hosted Salesforce credential instance URL");
     return {
         accessToken: minted.accessToken,
-        instanceUrl: minted.instanceUrl,
+        instanceUrl,
         fieldMappings: minted.fieldMappings,
     };
 }

package/dist/index.d.ts

@@ -6,13 +6,13 @@ export { buildReassignPlans, type ReassignObjectType, type ReassignOptions } fro
 export { buildLeadRoutePlan, type LeadRouteCounts, type LeadRouteOptions, type LeadRouteResult, } from "./route.ts";
 export { accountHierarchyToMarkdown, buildAccountHierarchy, type AccountHierarchyConflict, type AccountHierarchyNode, type AccountHierarchyReport, } from "./hierarchy.ts";
 export { buildRelationshipMap, relationshipMapToMarkdown, type RelationshipMap, type StakeholderNode, type StakeholderRole, type StakeholderSentiment, } from "./relationships.ts";
-export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, type FullstackgtmConfig, type LoadedConfig, } from "./config.ts";
+export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli, type FullstackgtmConfig, type LoadedConfig, type RulePackageTrust, } from "./config.ts";
 export { applyPatchPlan, type ApplyPatchPlanOptions } from "./connector.ts";
 export { APPLY_STAGES, BACKFILL_STRIPE_STAGES, composeListeners, createProgressEmitter, CRM_SYNC_STAGES, nullProgressEmitter, SNAPSHOT_PULL_STAGES, STRIPE_SNAPSHOT_STAGES, type ProgressEmitter, type ProgressEvent, type ProgressListener, type ProgressSnapshot, } from "./progress.ts";
 export { createHubspotConnector, type HubspotConnectorOptions } from "./connectors/hubspot.ts";
 export { DEFAULT_LOOPBACK_PORT, DEFAULT_OAUTH_SCOPES, exchangeHubspotCode, refreshHubspotToken, runHubspotLoopbackLogin, validateHubspotToken, type HubspotTokenSet, type LoopbackLoginOptions, } from "./connectors/hubspotAuth.ts";
 export { createSalesforceConnector, type SalesforceConnection, type SalesforceConnectorOptions, } from "./connectors/salesforce.ts";
-export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceToken, type SalesforceDeviceAuthorization, type SalesforceTokenSet, } from "./connectors/salesforceAuth.ts";
+export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken, type SalesforceDeviceAuthorization, type SalesforceTokenSet, } from "./connectors/salesforceAuth.ts";
 export { createStripeConnector, fetchStripePaidInvoices, type StripeConnectorOptions, type StripePaidInvoice, } from "./connectors/stripe.ts";
 export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, type StripeBackfillCounts, type StripeBackfillOptions, type StripeBackfillResult, type StripeBackfillUnmatched, } from "./backfill.ts";
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, type HubspotConnection, type StoredCredential, } from "./credentials.ts";
@@ -53,3 +53,4 @@ export { scoreBand, judgeRunId, normalizeSpan, isGroundedSpan, scoreAccount, acc
 export { draft, authorOpeners, draftOpenerLlm, deterministicOpener, creditedTriggerSignal, draftEvidence, sanitizeOpener, firstLine, firstLineGroundedInTrigger, hasBannedGreeting, isStaleTrigger, draftOperationId, draftEvidenceId, DRAFT_CHANNELS, DRAFT_SCHEMA, DEFAULT_DRAFT_PROMPT, DEFAULT_FRESHNESS_DAYS, type Draft, type RejectedDraft, type DraftResult, type DraftChannel, } from "./draft.ts";
 export { DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, HOT_SCORE, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet, type Confusion, type EvalJudgeFn, type GoldenHistory, type GoldenRow, type GradeResult, type OutcomeCalibration, } from "./judgeEval.ts";
 export type { ApprovalStatus, AuditFinding, AuditFindingSeverity, CanonicalAccount, CanonicalActivity, CanonicalContact, CanonicalDeal, CanonicalGtmSnapshot, CanonicalUser, CrmProvider, GtmAuditRule, GtmConnector, GtmEvidence, GtmEvidenceSourceSystem, GtmObjectType, GtmPolicy, GtmRuleContext, GtmRuleResult, GtmSnapshotIndex, PatchOperation, PatchOperationResult, PatchOperationType, PatchPlan, PatchPlanAssumption, PatchPlanAssumptionConfidence, PatchPlanRun, PatchPlanRunStatus, PatchVerification, PipelineFinding, PipelineFindingStatus, PipelineFindingType, ProviderIdentity, RiskLevel, SourceFreshness, } from "./types.ts";
+export { ProviderHttpError } from "./providerError.ts";

package/dist/index.js

@@ -6,13 +6,13 @@ export { buildReassignPlans } from "./reassign.js";
 export { buildLeadRoutePlan, } from "./route.js";
 export { accountHierarchyToMarkdown, buildAccountHierarchy, } from "./hierarchy.js";
 export { buildRelationshipMap, relationshipMapToMarkdown, } from "./relationships.js";
-export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, } from "./config.js";
+export { CONFIG_FILE_NAME, loadConfig, mergePolicy, resolveConfiguredRules, rulePackageTrustFromCli, } from "./config.js";
 export { applyPatchPlan } from "./connector.js";
 export { APPLY_STAGES, BACKFILL_STRIPE_STAGES, composeListeners, createProgressEmitter, CRM_SYNC_STAGES, nullProgressEmitter, SNAPSHOT_PULL_STAGES, STRIPE_SNAPSHOT_STAGES, } from "./progress.js";
 export { createHubspotConnector } from "./connectors/hubspot.js";
 export { DEFAULT_LOOPBACK_PORT, DEFAULT_OAUTH_SCOPES, exchangeHubspotCode, refreshHubspotToken, runHubspotLoopbackLogin, validateHubspotToken, } from "./connectors/hubspotAuth.js";
 export { createSalesforceConnector, } from "./connectors/salesforce.js";
-export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceToken, } from "./connectors/salesforceAuth.js";
+export { pollSalesforceDeviceLogin, refreshSalesforceToken, startSalesforceDeviceLogin, validateSalesforceOrigin, validateSalesforceToken, } from "./connectors/salesforceAuth.js";
 export { createStripeConnector, fetchStripePaidInvoices, } from "./connectors/stripe.js";
 export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, } from "./backfill.js";
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, } from "./credentials.js";
@@ -52,3 +52,4 @@ export { fetchAtsJobs, snippetFor, } from "./connectors/atsBoards.js";
 export { scoreBand, judgeRunId, normalizeSpan, isGroundedSpan, scoreAccount, accountRecentlyTouched, bestContactForAccount, deterministicDecision, deterministicWhyNow, JUDGE_SCHEMA, DEFAULT_JUDGE_PROMPT, judgeDecisionLlm, judgeSignals, judgeDir, createFileJudgeStore, } from "./judge.js";
 export { draft, authorOpeners, draftOpenerLlm, deterministicOpener, creditedTriggerSignal, draftEvidence, sanitizeOpener, firstLine, firstLineGroundedInTrigger, hasBannedGreeting, isStaleTrigger, draftOperationId, draftEvidenceId, DRAFT_CHANNELS, DRAFT_SCHEMA, DEFAULT_DRAFT_PROMPT, DEFAULT_FRESHNESS_DAYS, } from "./draft.js";
 export { DEFAULT_GOLDEN_SET, DEFAULT_MIN_ACCURACY, HOT_SCORE, defaultJudgeFn, gradeAgainstOutcomes, gradeJudge, parseGoldenSet, } from "./judgeEval.js";
+export { ProviderHttpError } from "./providerError.js";

package/dist/market.d.ts

@@ -1,5 +1,6 @@
 import { type ProgressEmitter } from "./progress.ts";
 import type { GtmEvidence } from "./types.ts";
+export { assertPublicUrl } from "./publicHttp.ts";
 /**
  * The Market Map: a live model of the competitive category a company sells
  * into. Vendors publish claims constantly (pricing pages, feature pages,
@@ -162,7 +163,6 @@ export type FetchPage = (url: string) => Promise<{
     status: number;
     body: string;
 }>;
-export declare function assertPublicUrl(rawUrl: string): Promise<URL>;
 export type CaptureOptions = {
     /** Directory for captures; defaults to <marketHome>/captures. Ignored when `store` is given. */
     dir?: string;

package/dist/market.js

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { lookup } from "node:dns/promises";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { isIP } from "node:net";
 import { join } from "node:path";
 import { credentialsDir } from "./credentials.js";
 import { MARKET_CAPTURE_STAGES, nullProgressEmitter } from "./progress.js";
+import { publicHttpGet } from "./publicHttp.js";
+export { assertPublicUrl } from "./publicHttp.js";
 const INTENSITY_RANK = {
     loud: 3,
     quiet: 2,
@@ -152,136 +152,16 @@ export function extractReadableText(html) {
  * any host that is or resolves to a private/loopback/link-local/metadata
  * address, and (3) follow redirects manually, re-validating each hop.
  *
- * Residual gap (documented, not defended here): TOCTOU DNS rebinding between
- * our lookup and fetch's own resolution. Out of scope for fetching public
- * competitor pages; a hardened deployment should fetch through an egress proxy.
+ * The default transport resolves once, rejects mixed public/private answers,
+ * and pins a validated address into socket creation to prevent DNS rebinding.
  */
 const MAX_REDIRECTS = 5;
 const FETCH_TIMEOUT_MS = 15_000;
 const MAX_BODY_BYTES = 5_000_000;
-function ipv4IsPrivate(ip) {
-    const parts = ip.split(".").map((n) => Number(n));
-    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
-        return true;
-    const [a, b] = parts;
-    if (a === 0 || a === 127)
-        return true; // this-host, loopback
-    if (a === 10)
-        return true; // private
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // private
-    if (a === 192 && b === 168)
-        return true; // private
-    if (a === 169 && b === 254)
-        return true; // link-local incl. 169.254.169.254 metadata
-    if (a === 100 && b >= 64 && b <= 127)
-        return true; // CGNAT
-    if (a >= 224)
-        return true; // multicast / reserved
-    return false;
-}
-function ipIsPrivate(ip) {
-    const family = isIP(ip);
-    if (family === 4)
-        return ipv4IsPrivate(ip);
-    if (family === 6) {
-        const lower = ip.toLowerCase();
-        if (lower === "::1" || lower === "::")
-            return true; // loopback / unspecified
-        // IPv4-mapped (::ffff:…) — Node normalizes ::ffff:127.0.0.1 to ::ffff:7f00:1,
-        // so accept both the dotted and the hex-pair forms, unwrap, check the v4.
-        const mapped = lower.match(/^::ffff:(.+)$/);
-        if (mapped) {
-            const rest = mapped[1];
-            if (rest.includes("."))
-                return ipv4IsPrivate(rest);
-            const groups = rest.split(":");
-            if (groups.length === 2) {
-                const hi = parseInt(groups[0], 16);
-                const lo = parseInt(groups[1], 16);
-                if (Number.isNaN(hi) || Number.isNaN(lo))
-                    return true;
-                return ipv4IsPrivate(`${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`);
-            }
-            return true; // unrecognized mapped form → refuse
-        }
-        if (lower.startsWith("fe8") || lower.startsWith("fe9") || lower.startsWith("fea") || lower.startsWith("feb"))
-            return true; // link-local fe80::/10
-        if (lower.startsWith("fc") || lower.startsWith("fd"))
-            return true; // unique-local fc00::/7
-        return false;
-    }
-    return true; // not a recognizable IP literal → refuse
-}
-export async function assertPublicUrl(rawUrl) {
-    let url;
-    try {
-        url = new URL(rawUrl);
-    }
-    catch {
-        throw new Error(`market capture: "${rawUrl}" is not a valid URL.`);
-    }
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-        throw new Error(`market capture refuses ${url.protocol} URLs (only http/https): ${rawUrl}`);
-    }
-    const host = url.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    if (isIP(host)) {
-        if (ipIsPrivate(host))
-            throw new Error(`market capture refuses private/loopback address ${host} (SSRF guard).`);
-        return url;
-    }
-    // Hostname: resolve and refuse if ANY address is private.
-    const addrs = await lookup(host, { all: true });
-    for (const { address } of addrs) {
-        if (ipIsPrivate(address)) {
-            throw new Error(`market capture refuses ${host} — it resolves to private/internal address ${address} (SSRF guard).`);
-        }
-    }
-    return url;
-}
 const defaultFetchPage = async (url) => {
-    let current = url;
-    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-        await assertPublicUrl(current);
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-        let response;
-        try {
-            response = await fetch(current, {
-                headers: {
-                    "User-Agent": "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)",
-                    "Accept-Language": "en-US",
-                },
-                redirect: "manual",
-                signal: controller.signal,
-            });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (response.status >= 300 && response.status < 400 && response.headers.get("location")) {
-            current = new URL(response.headers.get("location"), current).toString();
-            continue; // re-validate the redirect target on the next iteration
-        }
-        const reader = response.body?.getReader();
-        if (!reader)
-            return { status: response.status, body: await response.text() };
-        const chunks = [];
-        let total = 0;
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            total += value.length;
-            if (total > MAX_BODY_BYTES) {
-                await reader.cancel();
-                break;
-            }
-            chunks.push(value);
-        }
-        return { status: response.status, body: Buffer.concat(chunks).toString("utf8") };
-    }
-    throw new Error(`market capture: too many redirects (>${MAX_REDIRECTS}) for ${url}`);
+    const response = await publicHttpGet(url, { maxBytes: MAX_BODY_BYTES, maxRedirects: MAX_REDIRECTS,
+        timeoutMs: FETCH_TIMEOUT_MS, headers: { "User-Agent": "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)", "Accept-Language": "en-US" } });
+    return { status: response.status, body: Buffer.from(response.body).toString("utf8") };
 };
 export async function captureMarket(config, options = {}) {
     const store = options.store ?? createFileMarketStore(config.category, { capturesDir: options.dir });

package/dist/marketClassify.d.ts

@@ -51,6 +51,16 @@ export type MarketWorksheet = {
         captureHash: string;
         text: string;
     }>;
+    /** Deterministic retrieval hints: page lines that contain claim terms. These are not labels. */
+    claimHints: Array<{
+        claimId: string;
+        matches: Array<{
+            url: string;
+            captureHash: string;
+            term: string;
+            quote: string;
+        }>;
+    }>;
     instructions: string;
 };
 export declare function buildWorksheet(config: MarketConfig, vendorId: string, options?: {

package/dist/marketClassify.js

@@ -188,6 +188,56 @@ export async function classifyMarket(config, options) {
         retriedVendorIds,
     };
 }
+const HINT_STOPWORDS = new Set([
+    "the", "and", "for", "with", "from", "that", "this", "into", "your", "you", "are", "but", "not", "when", "how", "use", "uses", "using",
+    "claim", "claims", "vendor", "vendors", "page", "pages", "loud", "quiet", "absent", "capability", "specific", "differentiating",
+    "unknown", "buyer", "buyers", "pricing", "structure", "category", "support", "supported", "primary", "secondary", "mentioned", "mentions",
+]);
+function normalizeHintText(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().replace(/\s+/g, " ");
+}
+function claimHintTerms(claim) {
+    const exact = [claim.id.replace(/[-_]+/g, " "), claim.capability, ...(claim.terms ?? [])]
+        .map(normalizeHintText)
+        .filter((term) => term.length >= 3);
+    const tokenSource = normalizeHintText(`${claim.capability} ${claim.definition} ${(claim.terms ?? []).join(" ")}`)
+        .split(" ")
+        .filter((term) => term.length >= 4 && !HINT_STOPWORDS.has(term));
+    return Array.from(new Set([...exact, ...tokenSource])).slice(0, 24);
+}
+function lineSnippet(line, term) {
+    const clean = line.trim().replace(/\s+/g, " ");
+    if (clean.length <= 300)
+        return clean;
+    const lower = clean.toLowerCase();
+    const idx = lower.indexOf(term.toLowerCase().split(" ")[0] ?? "");
+    const start = Math.max(0, idx < 0 ? 0 : idx - 120);
+    return clean.slice(start, start + 300).trim();
+}
+function buildClaimHints(claims, pages) {
+    return claims.map((claim) => {
+        const terms = claimHintTerms(claim);
+        const matches = [];
+        for (const page of pages) {
+            const lines = page.text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+            for (const term of terms) {
+                const normalizedTerm = normalizeHintText(term);
+                const line = lines.find((candidate) => normalizeHintText(candidate).includes(normalizedTerm));
+                if (!line)
+                    continue;
+                const quote = lineSnippet(line, term);
+                if (quote && !matches.some((m) => m.quote === quote && m.url === page.url)) {
+                    matches.push({ url: page.url, captureHash: page.captureHash, term, quote });
+                }
+                if (matches.length >= 4)
+                    break;
+            }
+            if (matches.length >= 4)
+                break;
+        }
+        return { claimId: claim.id, matches };
+    });
+}
 export function buildWorksheet(config, vendorId, options = {}) {
     const vendor = config.vendors.find((candidate) => candidate.id === vendorId);
     if (!vendor)
@@ -211,6 +261,7 @@ export function buildWorksheet(config, vendorId, options = {}) {
         vendor: { id: vendor.id, name: vendor.name },
         claims: config.claims,
         pages,
-        instructions: "Produce one observation per claim (intensity loud|quiet|absent from these pages only; unobservable only if a page you need failed to capture). Every loud/quiet reading must quote a verbatim span (≤300 chars) from a page's text, with that page's url and captureHash in evidence metadata. Submit as an ObservationSet via `market observe --from <file>` — quotes are mechanically verified against the captures.",
+        claimHints: buildClaimHints(config.claims, pages),
+        instructions: "Produce one observation per claim from these pages only. Intensity rubric: loud = hero copy, primary positioning, or a named/dedicated product area; quiet = supported by a verbatim page quote but secondary, qualified, or merely available; absent = the pages do not support the claim; unobservable = no usable captured page exists for this vendor, not a synonym for absent. claimHints are deterministic retrieval hints only: use them to find candidate support, but do not mark a claim loud/quiet unless the quote truly supports the claim. Every loud/quiet reading must quote a verbatim span (≤300 chars) from a page's text, with that page's url and captureHash in evidence metadata. Submit as an ObservationSet via `market observe --from <file>` — quotes are mechanically verified against the captures.",
     };
 }

package/dist/marketSourcing.js

@@ -16,7 +16,7 @@
  *    Sitemaps / redirects / logo bytes are plain resources — they never need a
  *    headless browser, so the default fetch is sufficient even in the hosted layer.
  */
-import { assertPublicUrl } from "./market.js";
+import { publicHttpGet } from "./publicHttp.js";
 import { DEFAULT_MODELS, forcedToolCall } from "./llm.js";
 const USER_AGENT = "fullstackgtm-market/0 (+https://github.com/fullstackgtm/core)";
 const FETCH_TIMEOUT_MS = 15_000;
@@ -156,28 +156,9 @@ export function extractLogoUrl(html, baseUrl) {
 // ── Default SSRF-guarded fetchers ────────────────────────────────────────────
 /** Manual-redirect fetch that re-validates every hop against the SSRF guard. */
 async function guardedFetch(url) {
-    let current = url;
-    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-        await assertPublicUrl(current);
-        const res = await fetch(current, {
-            redirect: "manual",
-            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-            headers: { "User-Agent": USER_AGENT },
-        });
-        const location = res.headers.get("location");
-        if (res.status >= 300 && res.status < 400 && location) {
-            try {
-                await res.body?.cancel();
-            }
-            catch {
-                /* ignore */
-            }
-            current = new URL(location, current).toString();
-            continue;
-        }
-        return res;
-    }
-    return null;
+    const res = await publicHttpGet(url, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+        headers: { "User-Agent": USER_AGENT } });
+    return new Response(res.body.length ? Buffer.from(res.body) : null, { status: res.status, headers: res.headers });
 }
 const defaultFetchText = async (url) => {
     try {
@@ -206,28 +187,9 @@ const defaultFetchBytes = async (url) => {
  * + status WITHOUT downloading the body. Used to detect identity drift.
  */
 export const resolveFinalUrl = async (rawUrl) => {
-    let current = rawUrl;
-    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-        await assertPublicUrl(current);
-        const res = await fetch(current, {
-            redirect: "manual",
-            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-            headers: { "User-Agent": USER_AGENT },
-        });
-        try {
-            await res.body?.cancel();
-        }
-        catch {
-            /* ignore */
-        }
-        const location = res.headers.get("location");
-        if (res.status >= 300 && res.status < 400 && location) {
-            current = new URL(location, current).toString();
-            continue;
-        }
-        return { finalUrl: current, status: res.status };
-    }
-    return { finalUrl: current, status: 0 };
+    const res = await publicHttpGet(rawUrl, { maxRedirects: MAX_REDIRECTS, timeoutMs: FETCH_TIMEOUT_MS,
+        maxBytes: 0, headers: { "User-Agent": USER_AGENT } });
+    return { finalUrl: res.finalUrl, status: res.status };
 };
 // ── Fetching helpers ─────────────────────────────────────────────────────────
 /**