chore(deps): vendor the free-email domain list and drop unused packages

[waleedlatif1]

Summary

Split out of #6013. Low-risk dependency hygiene, independent of the security work in #6030.

• Vendor free-email-domains. Its postinstall downloads a CDN CSV and overwrites its own domains.json, so the lockfile hash covers the tarball but not the data actually installed — the list could change under a pinned version. Now a checked-in JSON (4,779 unique lowercase entries) with a TSDoc note on refreshing it from the MIT upstream.
• Drop tailwind-merge and autoprefixer from apps/sim. Neither is used here: apps/sim has no tailwind-merge import (it reaches it through @sim/emcn's cn(), and both packages/emcn and apps/docs declare their own), and postcss.config.mjs loads only tailwindcss.

Type of Change

• Maintenance

Testing

tsc clean; 97 tests pass across the email modules, covering free-provider classification, work domains, case-insensitivity and malformed input against the vendored list.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 29, 2026 12:27am

[cursor]

PR Summary

Medium Risk
Changes the data source for demo work-email gating on client and server; behavior is intended to match or improve on the package, but mis-vendoring or a bad refresh could block or allow wrong addresses.

Overview
Replaces the free-email-domains npm dependency with a checked-in free-email-domains.json (~4.8k domains) loaded by isFreeEmailDomain, so work-email checks for the demo form and API no longer depend on a package whose postinstall can refresh data from a CDN under a pinned version. The vendored list splits four domains that upstream had fused into invalid combined entries, and tests lock that behavior in.

Also removes tailwind-merge and autoprefixer from apps/sim (unused there; Tailwind merge comes via @sim/emcn).

^{Reviewed by Cursor Bugbot for commit 69feafe. Configure here.}

[greptile-apps]

Greptile Summary

Vendors the free-email domain list in-repo and removes unused packages from apps/sim.

• Replaces the free-email-domains dependency with a checked-in JSON list and documents the upstream refresh + fused-entry split.
• Adds tests for the four previously fused free-provider domains and a guard against concatenated list entries.
• Drops unused tailwind-merge and autoprefixer from apps/sim and updates bun.lock.

Confidence Score: 5/5

This PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/messaging/email/free-email.ts	Switches free-domain lookup to a local JSON import and documents vendoring rationale plus the intentional upstream split.
apps/sim/lib/messaging/email/free-email-domains.json	Adds ~4.8k unique lowercase free-email domains including the four split providers.
apps/sim/lib/messaging/email/free-email.test.ts	Covers fused-entry providers and asserts no unexpected concatenated domain entries remain.
apps/sim/package.json	Removes free-email-domains, tailwind-merge, and autoprefixer from apps/sim dependencies.

_{Reviews (2): Last reviewed commit: "fix(email): split two fused domain entri..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 69feafe. Configure here.}