fullstackgtm 0.48.0 → 0.50.0

package/dist/cli/ui.d.ts

@@ -88,14 +88,17 @@ export declare function startElapsedStatus(label: (elapsed: string) => string, s
 };
 export type Checklist = {
     update(id: string, state: "pending" | "running" | "ok" | "warn" | "fail", note?: string): void;
-    /** Stop animating and erase the board (callers print their own summary). */
-    done(): void;
+    /** Stop animating; optionally leave the final board in the terminal history. */
+    done(options?: {
+        persist?: boolean;
+    }): void;
     readonly active: boolean;
 };
 /**
  * A multi-line live board — one line per item, each flipping ○ → ⠹ → ✓ as work
  * progresses (the audit rule registry renders through this). Repaints with
- * cursor-up; erases itself on done() so the verb's real output owns stdout.
+ * cursor-up; done() normally erases it, while done({ persist: true }) leaves a
+ * final static history for multi-phase human workflows.
  */
 export declare function createChecklist(items: Array<{
     id: string;
@@ -107,8 +110,10 @@ export type ProgressRenderer = {
      * listener via `composeListeners` when the run should also heartbeat).
      */
     listener: ProgressListener;
-    /** Stop animating and erase the board (callers print their own summary). */
-    done(): void;
+    /** Stop animating; optionally leave the completed board in terminal history. */
+    done(options?: {
+        persist?: boolean;
+    }): void;
     readonly active: boolean;
 };
 /**

package/dist/cli/ui.js

@@ -241,7 +241,8 @@ const NOOP_CHECKLIST = { update() { }, done() { }, active: false };
 /**
  * A multi-line live board — one line per item, each flipping ○ → ⠹ → ✓ as work
  * progresses (the audit rule registry renders through this). Repaints with
- * cursor-up; erases itself on done() so the verb's real output owns stdout.
+ * cursor-up; done() normally erases it, while done({ persist: true }) leaves a
+ * final static history for multi-phase human workflows.
  */
 export function createChecklist(items, stream = process.stderr, env = process.env) {
     if (!animationEnabled(stream, env) || items.length === 0)
@@ -280,14 +281,22 @@ export function createChecklist(items, stream = process.stderr, env = process.en
             if (!entry)
                 return;
             entry.state = state;
-            entry.note = note;
+            if (note !== undefined)
+                entry.note = note;
             start();
             render();
         },
-        done() {
+        done(options = {}) {
             if (timer)
                 clearInterval(timer);
             timer = null;
+            if (options.persist) {
+                // The caller's final state update already painted the completed board.
+                // Freeze that frame in scrollback; repainting here can leave both the
+                // last live frame and the final frame visible in some terminals.
+                painted = 0;
+                return;
+            }
             if (painted > 0) {
                 // Erase the board: cursor up over every painted line, clear each.
                 stream.write(`\u001b[${painted}A${"\u001b[2K\n".repeat(painted)}\u001b[${painted}A`);
@@ -344,8 +353,10 @@ export function createProgressRenderer(stages, stream = process.stderr, env = pr
             if (current)
                 board.update(current, "running", noteFor(event, snapshot));
         },
-        done() {
-            board.done();
+        done(options) {
+            if (current)
+                board.update(current, "ok");
+            board.done(options);
         },
         active: true,
     };
@@ -374,6 +385,8 @@ export function planStatusWord(status, p) {
         return p.yellow(status);
     if (status === "approved" || status === "applied")
         return p.green(status);
+    if (status === "applying")
+        return p.yellow(status);
     if (status === "rejected")
         return p.red(status);
     return status;

package/dist/cli.js

@@ -88,7 +88,7 @@ export async function runCli(argv) {
     }
     // Commands without bespoke help get focused per-command help on --help
     // instead of executing (audit used to silently run the sample audit) or
-    // dumping the whole surface. call/market/enrich/bulk-update/schedule print
+    // dumping the whole surface. call/market/enrich/schedule print
     // their own richer help. `--full` always escapes to the complete reference.
     if (!BESPOKE_HELP.includes(command) && (args.includes("--help") || args.includes("-h"))) {
         console.log(args.includes("--full") ? usage() : commandHelp(command));

package/dist/config.d.ts

@@ -26,6 +26,18 @@ export type LoadedConfig = {
     config: FullstackgtmConfig;
     path: string;
 };
+export type RulePackageTrust = {
+    /** Execute rule-package modules. Only set after an explicit trust decision. */
+    allowRulePackages?: boolean;
+    /** Deliberately ignore rule packages while still applying declarative config. */
+    disableRulePackages?: boolean;
+};
+/**
+ * Translate the CLI's explicit trust flags into the library trust contract.
+ * Plugin execution requires both an explicit config path and --allow-plugins;
+ * discovering a config in the current directory is never a trust decision.
+ */
+export declare function rulePackageTrustFromCli(args: string[], explicitConfigPath?: string): RulePackageTrust;
 export declare function loadConfig(explicitPath?: string, cwd?: string): LoadedConfig | null;
 /** Overlay config policy values onto a base policy; defined values win. */
 export declare function mergePolicy(base: GtmPolicy, config?: FullstackgtmConfig): GtmPolicy;
@@ -33,4 +45,4 @@ export declare function mergePolicy(base: GtmPolicy, config?: FullstackgtmConfig
  * Build the effective rule set: built-ins plus rule-package exports, then
  * `enabled` (allow-list) and `disabled` filters.
  */
-export declare function resolveConfiguredRules(loaded?: LoadedConfig | null, baseRules?: GtmAuditRule[]): Promise<GtmAuditRule[]>;
+export declare function resolveConfiguredRules(loaded?: LoadedConfig | null, baseRules?: GtmAuditRule[], trust?: RulePackageTrust): Promise<GtmAuditRule[]>;

package/dist/config.js

@@ -18,6 +18,22 @@ import { builtinAuditRules } from "./rules.js";
  * in version control.
  */
 export const CONFIG_FILE_NAME = "fullstackgtm.config.json";
+/**
+ * Translate the CLI's explicit trust flags into the library trust contract.
+ * Plugin execution requires both an explicit config path and --allow-plugins;
+ * discovering a config in the current directory is never a trust decision.
+ */
+export function rulePackageTrustFromCli(args, explicitConfigPath) {
+    const allow = args.includes("--allow-plugins");
+    const disable = args.includes("--no-plugins");
+    if (allow && disable) {
+        throw new Error("--allow-plugins and --no-plugins cannot be used together.");
+    }
+    if (allow && !explicitConfigPath) {
+        throw new Error("--allow-plugins requires --config <path>. Plugin code is never trusted from an implicitly discovered config.");
+    }
+    return { allowRulePackages: allow, disableRulePackages: disable };
+}
 export function loadConfig(explicitPath, cwd = process.cwd()) {
     const path = explicitPath ? resolve(cwd, explicitPath) : resolve(cwd, CONFIG_FILE_NAME);
     let raw;
@@ -51,9 +67,14 @@ export function mergePolicy(base, config) {
  * Build the effective rule set: built-ins plus rule-package exports, then
  * `enabled` (allow-list) and `disabled` filters.
  */
-export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules) {
+export async function resolveConfiguredRules(loaded, baseRules = builtinAuditRules, trust = {}) {
     let rules = [...baseRules];
-    for (const specifier of loaded?.config.rulePackages ?? []) {
+    const packages = loaded?.config.rulePackages ?? [];
+    if (packages.length && !trust.allowRulePackages && !trust.disableRulePackages) {
+        throw new Error(`Config ${loaded.path} declares executable rulePackages. Refusing to load plugin code without explicit trust. ` +
+            "For the CLI, pass --config <path> --allow-plugins after reviewing the modules, or pass --no-plugins to use only declarative policy and built-in rules.");
+    }
+    for (const specifier of trust.disableRulePackages ? [] : packages) {
         const resolvedSpecifier = specifier.startsWith(".") || isAbsolute(specifier)
             ? pathToFileURL(resolve(dirname(loaded.path), specifier)).href
             : specifier;

package/dist/connectors/linkedin.d.ts

@@ -38,6 +38,8 @@ export type FetchProspectsOptions = {
     sourceId?: string;
     /** Hard cap on prospects returned; also bounds pagination. */
     max?: number;
+    /** Opaque continuation cursor. HeyReach uses the decimal list offset. */
+    cursor?: string;
 };
 export type ConnectionStatus = {
     ok: boolean;

package/dist/connectors/linkedin.js

@@ -85,6 +85,11 @@ export function createHeyReachProvider(options) {
             const max = opts.max ?? Number.POSITIVE_INFINITY;
             const out = [];
             let offset = 0;
+            if (opts.cursor !== undefined) {
+                if (!/^\d+$/.test(opts.cursor))
+                    throw new Error(`Invalid HeyReach cursor: ${opts.cursor}`);
+                offset = Number(opts.cursor);
+            }
             while (out.length < max) {
                 const data = await call("/list/GetLeadsFromList", "POST", { listId, offset, limit: pageSize });
                 const items = toArray(data);

package/dist/connectors/prospectSources.d.ts

@@ -46,6 +46,8 @@ export declare function fetchExploriumProspects(opts: {
     apiKey: string;
     filters: ExploriumFilters;
     size?: number;
+    /** One-based result page. */
+    page?: number;
     apiBaseUrl?: string;
     fetchImpl?: FetchImpl;
 }): Promise<Prospect[]>;
@@ -53,9 +55,30 @@ export declare function fetchPipe0CrustdataProspects(opts: {
     apiKey: string;
     filters: Record<string, unknown>;
     limit?: number;
+    /** Opaque cursor returned by a previous page. */
+    cursor?: string;
     apiBaseUrl?: string;
     fetchImpl?: FetchImpl;
 }): Promise<Prospect[]>;
+/** A page from pipe0/Crustdata's cursor-based people search. */
+export type Pipe0CrustdataProspectPage = {
+    prospects: Prospect[];
+    /** Opaque cursor for the next page, or null when the search is exhausted. */
+    nextCursor: string | null;
+};
+/**
+ * Fetch one page and expose its continuation cursor. The array-returning
+ * `fetchPipe0CrustdataProspects` remains available for existing consumers.
+ */
+export declare function fetchPipe0CrustdataProspectPage(opts: {
+    apiKey: string;
+    filters: Record<string, unknown>;
+    limit?: number;
+    /** Opaque cursor returned by a previous page. */
+    cursor?: string;
+    apiBaseUrl?: string;
+    fetchImpl?: FetchImpl;
+}): Promise<Pipe0CrustdataProspectPage>;
 export declare const EXPLORIUM_BUSINESS_COUNT_CAP = 60000;
 export type BusinessCountProbe = {
     /** matching companies (the account universe); == cap when saturated. */

package/dist/connectors/prospectSources.js

@@ -1,3 +1,4 @@
+import { ProviderHttpError } from "../providerError.js";
 function splitName(full) {
     if (!full)
         return {};
@@ -23,10 +24,10 @@ export async function fetchExploriumProspects(opts) {
     const response = await fetchImpl(`${base}/v1/prospects`, {
         method: "POST",
         headers: { "api_key": opts.apiKey, "Content-Type": "application/json" },
-        body: JSON.stringify({ mode: "full", size, page_size: size, page: 1, filters: opts.filters }),
+        body: JSON.stringify({ mode: "full", size, page_size: size, page: opts.page ?? 1, filters: opts.filters }),
     });
     if (!response.ok) {
-        throw new Error(`Explorium /v1/prospects failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("Explorium", "prospect search", response.status);
     }
     const data = (await response.json());
     return (data.data ?? []).map((row) => ({
@@ -47,18 +48,28 @@ export async function fetchExploriumProspects(opts) {
 // (no separate connection needed). Returns profiles; pair with
 // pipe0ResolveWorkEmails to get real emails.
 export async function fetchPipe0CrustdataProspects(opts) {
+    return (await fetchPipe0CrustdataProspectPage(opts)).prospects;
+}
+/**
+ * Fetch one page and expose its continuation cursor. The array-returning
+ * `fetchPipe0CrustdataProspects` remains available for existing consumers.
+ */
+export async function fetchPipe0CrustdataProspectPage(opts) {
     const fetchImpl = opts.fetchImpl ?? fetch;
     const base = (opts.apiBaseUrl ?? "https://api.pipe0.com").replace(/\/$/, "");
     const limit = Math.min(opts.limit ?? 25, 100);
+    const config = { limit, filters: opts.filters };
+    if (opts.cursor !== undefined)
+        config.cursor = opts.cursor;
     const response = await fetchImpl(`${base}/v1/searches/run/sync`, {
         method: "POST",
         headers: { Authorization: `Bearer ${opts.apiKey}`, "Content-Type": "application/json" },
         body: JSON.stringify({
-            searches: [{ search_id: "people:profiles:crustdata@1", config: { limit, filters: opts.filters } }],
+            searches: [{ search_id: "people:profiles:crustdata@1", config }],
         }),
     });
     if (!response.ok) {
-        throw new Error(`pipe0 /v1/searches/run/sync failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("pipe0", "prospect search", response.status);
     }
     const body = (await response.json());
     // Surface upstream provider errors (e.g. CreditBalanceInsufficient) instead of
@@ -67,7 +78,7 @@ export async function fetchPipe0CrustdataProspects(opts) {
     if (upstreamErrors.length > 0 && !(body.results ?? []).length) {
         throw new Error(`pipe0/Crustdata search error: ${upstreamErrors.map((e) => `${e.code ?? "error"}: ${e.message ?? ""}`).join("; ")}`);
     }
-    return (body.results ?? []).map((row) => {
+    const prospects = (body.results ?? []).map((row) => {
         const fullName = strField(row.name);
         const { firstName, lastName } = splitName(fullName);
         return {
@@ -80,6 +91,14 @@ export async function fetchPipe0CrustdataProspects(opts) {
             sourceId: strField(row.profile_url) ?? fullName,
         };
     });
+    // Current pipe0 responses expose `next_cursor` at the top level. Accept the
+    // status-envelope variants too so older deployments remain usable.
+    const status = body.search_statuses?.[0];
+    const rawCursor = body.next_cursor ?? status?.next_cursor ?? status?.cursor;
+    return {
+        prospects,
+        nextCursor: typeof rawCursor === "string" && rawCursor.length > 0 ? rawCursor : null,
+    };
 }
 function strField(field) {
     const v = field?.value;
@@ -119,7 +138,7 @@ export async function probeExploriumBusinessCount(opts) {
         body: JSON.stringify({ mode: "full", page_size: 1, page: 1, filters: opts.filters }),
     });
     if (!response.ok) {
-        throw new Error(`Explorium /v1/businesses count failed: HTTP ${response.status} ${await safeText(response)}`);
+        throw new ProviderHttpError("Explorium", "business count", response.status);
     }
     const body = (await response.json());
     const total = body.total_results;
@@ -293,14 +312,6 @@ function fieldValue(field) {
     const v = field?.value;
     return typeof v === "string" && v.trim() ? v : undefined;
 }
-async function safeText(response) {
-    try {
-        return (await response.text()).slice(0, 300);
-    }
-    catch {
-        return "";
-    }
-}
 // ---------------------------------------------------------------------------
 // Pre-email dedup: identity keys shared between prospects and CRM contacts, so
 // we can drop already-in-CRM / already-seen people BEFORE paying for emails.

package/dist/connectors/salesforce.js

@@ -1,4 +1,5 @@
 import { SALESFORCE_DEFAULT_FIELD_MAPPINGS, mappedField, mappedFields, readMappedValue, } from "../mappings.js";
+import { validateSalesforceOrigin } from "./salesforceAuth.js";
 import { SNAPSHOT_PULL_STAGES } from "../progress.js";
 const DEFAULT_API_VERSION = "v59.0";
 const SOBJECT_TYPES = {
@@ -97,13 +98,17 @@ export function createSalesforceConnector(options) {
     }
     async function request(path, init = {}) {
         const connection = await options.getConnection();
-        const url = path.startsWith("http")
-            ? path
-            : `${connection.instanceUrl.replace(/\/$/, "")}${path}`;
+        const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
+        const resolved = new URL(path, `${instanceUrl}/`);
+        if (resolved.origin !== instanceUrl) {
+            throw new Error("Salesforce response attempted to send credentials to a different origin.");
+        }
+        const url = resolved.href;
         let response;
         try {
             response = await fetchImpl(url, {
                 ...init,
+                redirect: "manual",
                 headers: {
                     Authorization: `Bearer ${connection.accessToken}`,
                     "Content-Type": "application/json",
@@ -113,7 +118,7 @@ export function createSalesforceConnector(options) {
         }
         catch (error) {
             const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
-            throw new Error(`Cannot reach Salesforce at ${connection.instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`);
+            throw new Error(`Cannot reach Salesforce at ${instanceUrl}${cause}. Check SALESFORCE_INSTANCE_URL (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`);
         }
         if (!response.ok) {
             // Status line only — the body echoes submitted field values and the
@@ -526,8 +531,9 @@ export function createSalesforceConnector(options) {
      */
     async function soapMerge(sobjectType, masterId, loserIds) {
         const connection = await options.getConnection();
+        const instanceUrl = validateSalesforceOrigin(connection.instanceUrl, "Salesforce connection instance URL");
         const version = apiVersion.replace(/^v/, ""); // SOAP path uses "59.0", not "v59.0"
-        const url = `${connection.instanceUrl.replace(/\/$/, "")}/services/Soap/u/${version}`;
+        const url = `${instanceUrl}/services/Soap/u/${version}`;
         const toMerge = loserIds.map((id) => `<urn:recordToMergeIds>${escapeXml(id)}</urn:recordToMergeIds>`).join("");
         const envelope = `<?xml version="1.0" encoding="UTF-8"?>` +
             `<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:partner.soap.sforce.com" xmlns:urn1="urn:sobject.partner.soap.sforce.com">` +
@@ -540,6 +546,7 @@ export function createSalesforceConnector(options) {
         try {
             response = await fetchImpl(url, {
                 method: "POST",
+                redirect: "manual",
                 headers: { "Content-Type": "text/xml; charset=UTF-8", SOAPAction: '""' },
                 body: envelope,
             });

package/dist/connectors/salesforceAuth.d.ts

@@ -6,6 +6,15 @@
  * user confirms on any device. Requires a Connected App with device flow
  * enabled; only its consumer key (client id) is needed.
  */
+/**
+ * Normalize and validate a Salesforce credential-bearing origin.
+ *
+ * Salesforce API hosts are either the standard login/sandbox hosts or a
+ * Salesforce-owned instance/My Domain below salesforce.com.  Deliberately
+ * return an origin (not the input URL) so callers cannot accidentally retain
+ * paths, queries, credentials, or fragments from configuration.
+ */
+export declare function validateSalesforceOrigin(value: string, label?: string): string;
 export type SalesforceTokenSet = {
     accessToken: string;
     refreshToken?: string;

package/dist/connectors/salesforceAuth.js

@@ -7,9 +7,46 @@
  * enabled; only its consumer key (client id) is needed.
  */
 const DEFAULT_LOGIN_URL = "https://login.salesforce.com";
+/**
+ * Normalize and validate a Salesforce credential-bearing origin.
+ *
+ * Salesforce API hosts are either the standard login/sandbox hosts or a
+ * Salesforce-owned instance/My Domain below salesforce.com.  Deliberately
+ * return an origin (not the input URL) so callers cannot accidentally retain
+ * paths, queries, credentials, or fragments from configuration.
+ */
+export function validateSalesforceOrigin(value, label = "Salesforce URL") {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${label} must be a valid HTTPS Salesforce URL.`);
+    }
+    if (url.protocol !== "https:")
+        throw new Error(`${label} must use HTTPS.`);
+    if (url.username || url.password)
+        throw new Error(`${label} must not contain user information.`);
+    if (url.hash)
+        throw new Error(`${label} must not contain a fragment.`);
+    if (url.search)
+        throw new Error(`${label} must not contain a query string.`);
+    if (url.pathname !== "/" && url.pathname !== "")
+        throw new Error(`${label} must be an origin without a path.`);
+    if (url.port && url.port !== "443")
+        throw new Error(`${label} must use the standard HTTPS port.`);
+    const hostname = url.hostname.toLowerCase();
+    const trusted = hostname === "login.salesforce.com" ||
+        hostname === "test.salesforce.com" ||
+        (hostname.endsWith(".salesforce.com") && hostname.length > ".salesforce.com".length);
+    if (!trusted) {
+        throw new Error(`${label} must use login.salesforce.com, test.salesforce.com, or a Salesforce instance/My Domain host.`);
+    }
+    return url.origin;
+}
 const SESSION_TTL_MS = 2 * 60 * 60 * 1000;
 function tokenUrl(loginUrl) {
-    return `${loginUrl.replace(/\/$/, "")}/services/oauth2/token`;
+    return `${validateSalesforceOrigin(loginUrl, "Salesforce login URL")}/services/oauth2/token`;
 }
 /**
  * OAuth error responses can echo request parameters. Surface only the
@@ -32,6 +69,7 @@ export async function startSalesforceDeviceLogin(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
         method: "POST",
+        redirect: "manual",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
             response_type: "device_code",
@@ -59,6 +97,7 @@ export async function pollSalesforceDeviceLogin(options) {
         await new Promise((resolveSleep) => setTimeout(resolveSleep, intervalMs));
         const response = await fetchImpl(url, {
             method: "POST",
+            redirect: "manual",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams({
                 grant_type: "device",
@@ -68,10 +107,11 @@ export async function pollSalesforceDeviceLogin(options) {
         });
         const data = await response.json().catch(() => ({}));
         if (response.ok && data.access_token && data.instance_url) {
+            const instanceUrl = validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url");
             return {
                 accessToken: data.access_token,
                 refreshToken: data.refresh_token,
-                instanceUrl: data.instance_url,
+                instanceUrl,
                 expiresAt: Date.now() + SESSION_TTL_MS,
             };
         }
@@ -89,6 +129,7 @@ export async function refreshSalesforceToken(options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const response = await fetchImpl(tokenUrl(options.loginUrl ?? DEFAULT_LOGIN_URL), {
         method: "POST",
+        redirect: "manual",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
             grant_type: "refresh_token",
@@ -106,20 +147,21 @@ export async function refreshSalesforceToken(options) {
     return {
         accessToken: data.access_token,
         refreshToken: data.refresh_token ?? options.refreshToken,
-        instanceUrl: data.instance_url,
+        instanceUrl: validateSalesforceOrigin(String(data.instance_url), "Salesforce token instance_url"),
         expiresAt: Date.now() + SESSION_TTL_MS,
     };
 }
 export async function validateSalesforceToken(accessToken, instanceUrl, fetchImpl = fetch) {
+    const trustedInstanceUrl = validateSalesforceOrigin(instanceUrl, "Salesforce instance URL");
     let response;
     try {
-        response = await fetchImpl(`${instanceUrl.replace(/\/$/, "")}/services/oauth2/userinfo`, { headers: { Authorization: `Bearer ${accessToken}` } });
+        response = await fetchImpl(`${trustedInstanceUrl}/services/oauth2/userinfo`, { redirect: "manual", headers: { Authorization: `Bearer ${accessToken}` } });
     }
     catch (error) {
         const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
         return {
             ok: false,
-            detail: `Cannot reach Salesforce at ${instanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
+            detail: `Cannot reach Salesforce at ${trustedInstanceUrl}${cause}. Check the --instance-url (your My Domain URL, e.g. https://yourco.my.salesforce.com) and network access.`,
         };
     }
     if (response.ok) {

package/dist/connectors/theirstack.d.ts

@@ -1,22 +1,3 @@
-/**
- * TheirStack — technographic company discovery.
- *
- * Explorium can only size a firmographic universe (NAICS/size/geo) and can't even
- * return the list. For a CRM-hygiene/RevOps tool the real buying signal is
- * "company runs a CRM", and the deliverable is an actual list of those companies.
- * TheirStack does both: filter companies by the technology they use (Salesforce,
- * HubSpot, Pipedrive, …) plus firmographics, and return real records (name,
- * domain, employee_count, …). A cheap count sizes the market; a paged search
- * materializes the list. Both cost ~3 credits per company RETURNED — counting
- * still returns 1 row (the API rejects limit:0), so a count is ~3 credits, not
- * free; a list pull is ~3 × the rows.
- *
- * API: POST https://api.theirstack.com/v1/companies/search, Bearer auth.
- * Verified live (2026-06-29): filters company_technology_slug_or /
- * company_country_code_or / min_employee_count / max_employee_count; the total is
- * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
- * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
- */
 type FetchImpl = typeof fetch;
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */

package/dist/connectors/theirstack.js

@@ -17,6 +17,7 @@
  * `metadata.total_results` with include_total_results:true; limit must be ≥ 1
  * (limit:0 → 422, the count gotcha — cf. Explorium's `size`-caps-the-total).
  */
+import { ProviderHttpError } from "../providerError.js";
 /** TheirStack charges per company RETURNED — verified live (a list pull of N
  *  companies spends 3N). The count (limit:1) returns 1 row, so it's ~3 credits. */
 export const THEIRSTACK_CREDITS_PER_COMPANY = 3;
@@ -31,14 +32,6 @@ export function theirStackPullCost(companies, usdPerCredit) {
         ...(usdPerCredit && usdPerCredit > 0 ? { usd: Math.round(credits * usdPerCredit) } : {}),
     };
 }
-async function safeText(res) {
-    try {
-        return (await res.text()).slice(0, 300);
-    }
-    catch {
-        return "";
-    }
-}
 const BASE = "https://api.theirstack.com";
 const SEARCH_PATH = "/v1/companies/search";
 function buildBody(filters, limit, page, includeTotal) {
@@ -99,7 +92,7 @@ export async function theirStackCountCompanies(opts) {
         body: buildBody(opts.filters, 1, 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack count failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "count", res.status);
     }
     return readTheirStackTotal(await res.json());
 }
@@ -117,7 +110,7 @@ export async function theirStackSearchCompanies(opts) {
         body: buildBody(opts.filters, limit, opts.page ?? 0, true),
     });
     if (!res.ok) {
-        throw new Error(`TheirStack search failed: HTTP ${res.status} ${await safeText(res)}`);
+        throw new ProviderHttpError("TheirStack", "search", res.status);
     }
     const body = (await res.json());
     const rows = body.data ?? body.results ?? [];