fullstackgtm 0.38.0 → 0.39.0

package/CHANGELOG.md

@@ -7,6 +7,44 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](./docs/roadmap-to-1.0.md)
 
 ## [Unreleased]
 
+## [0.39.0] — 2026-06-23
+
+### Added
+
+- **LinkedIn acquire: configurable + email-resolving.** `linkedin` is now a
+  first-class `SUPPORTED_API_SOURCES` entry, so an explicit `enrich.config.json`
+  can drive it (set discovery `size` to read a whole list, not the preset's 25).
+  Email resolution is no longer gated on the dedupe key being `email`: any source
+  can opt in with `acquire.discovery.<src>.resolveEmailsWith: "pipe0"`, so a
+  LinkedIn source (which keys on the profile URL) can still resolve real work
+  emails (name + company → pipe0 waterfall) and create outreach-ready contacts.
+- **Company-domain resolution for email enrichment** (`pipe0ResolveCompanyDomains`,
+  `hostFromUrl`). The work-email waterfall requires a company domain, but a
+  LinkedIn/HeyReach list supplies only company names — so the email step now
+  first resolves each unique company's domain via pipe0 `company:identity@1`
+  (name → website → bare host) before the waterfall. Unresolved companies are
+  left untouched (never a guessed domain), and the lookup is deduped per company.
+
+### Changed
+
+- **ICP scoring reads the LinkedIn headline, not just the formal title.**
+  `scoreProspectAgainstIcp` now matches title keywords across `jobTitle` *and*
+  `headline`. On LinkedIn-sourced prospects the role signal often lives only in
+  the headline (position "Founder", headline "… | RevOps | …"), which scoring on
+  the title alone would miss. `Prospect` gains a `headline` field.
+
+## [0.38.1] — 2026-06-23
+
+### Fixed
+
+- **`enrich acquire` LinkedIn creates failed with HubSpot 400.** The resolve-first
+  search before a `create_record` filtered on the *canonical* match key
+  (`linkedin`) instead of the HubSpot property name (`hs_linkedin_url`); HubSpot
+  400s on a filter against a property it doesn't have, so every LinkedIn-sourced
+  lead failed at apply. The connector now translates the match key through
+  `HUBSPOT_DEFAULT_FIELD_MAPPINGS.contacts` before searching (email is unaffected
+  — its canonical name already equals the property name). Regression test added.
+
 ## [0.38.0] — 2026-06-23
 
 ### Added

package/dist/acquireLinkedIn.js

@@ -25,6 +25,9 @@ export function linkedInProspectToProspect(lp) {
         fullName: lp.fullName,
         // Title drives ICP scoring; fall back to the headline when no title is set.
         jobTitle: lp.jobTitle ?? lp.headline,
+        // Keep the headline distinct too: the scorer matches keywords across both,
+        // so a role named only in the headline (not the position) still scores.
+        headline: lp.headline,
         companyName: lp.company,
         linkedin: lp.profileUrl || undefined,
         email: lp.email,

package/dist/cli.js

@@ -32,7 +32,7 @@ import { marketMapToHtml, marketMapToMarkdown } from "./marketReport.js";
 import { DEFAULT_RUBRIC, classifyCallLlm, detectProviderFromKey, extractInsightsLlm, parseRubric, resolveLlmCredential, scoreCallLlm, validateLlmKey, } from "./llm.js";
 import { buildAcquirePlan, buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, builtinAcquirePreset, builtinEnrichPreset, enrichRunId, inferIngestObjectType, latestStamps, loadEnrichConfig, parseCsv, resolveCrmField, selectStaleWork, stagedSourceRecords, staleDaysFor, } from "./enrich.js";
 import { loadMeter, recordConsumption, remaining, } from "./acquireMeter.js";
-import { crmContactKeys, fetchExploriumProspects, fetchPipe0CrustdataProspects, partitionFreshProspects, pipe0ResolveWorkEmails, prospectIdentityKeys, } from "./connectors/prospectSources.js";
+import { crmContactKeys, fetchExploriumProspects, fetchPipe0CrustdataProspects, partitionFreshProspects, pipe0ResolveCompanyDomains, pipe0ResolveWorkEmails, prospectIdentityKeys, } from "./connectors/prospectSources.js";
 import { loadSeen, recordSeen } from "./acquireSeen.js";
 import { reportCounts, reportEvent } from "./runReport.js";
 import { createLinkedInProvider, discoverLinkedInProspects } from "./acquireLinkedIn.js";
@@ -2096,9 +2096,18 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen) {
     //     and apply-time resolve-first remain the precise backstop.
     const { fresh, skippedCrm, skippedSeen } = partitionFreshProspects(prospects, crmContactKeys(snapshot), seen);
     prospects = fresh;
-    // 3. Resolve real work emails (both providers need it: Explorium's email is
-    //    hashed, Crustdata search returns none). pipe0 waterfall, chunked.
-    if (matchKey === "email") {
+    // 3. Resolve real work emails. Triggered either when email IS the dedupe key
+    //    (Explorium's email is hashed, Crustdata returns none) or when a source
+    //    that keys on something else opts in via `resolveEmailsWith: "pipe0"`
+    //    (e.g. LinkedIn keys on the profile URL but still wants outreach emails).
+    //    pipe0 waterfall, chunked; resolves from name + company domain/name.
+    if (matchKey === "email" || disc.resolveEmailsWith === "pipe0") {
+        // The waterfall needs a company DOMAIN; LinkedIn/HeyReach lists carry only
+        // names. Resolve domains first (pipe0 company:identity) so resolution can
+        // actually land — without it, name-only resolution fails for every lead.
+        if (prospects.some((p) => !p.companyDomain && p.companyName)) {
+            prospects = await pipe0ResolveCompanyDomains({ apiKey: providerKey("pipe0"), prospects });
+        }
         prospects = await pipe0ResolveWorkEmails({ apiKey: providerKey("pipe0"), prospects });
     }
     const processedKeys = prospects.flatMap(prospectIdentityKeys);

package/dist/connectors/hubspot.js

@@ -493,13 +493,17 @@ export function createHubspotConnector(options) {
             }
             return { operationId: operation.id, status: "applied", detail: `Resolved/created company "${matchValue}" (${id}).`, providerData: { id } };
         }
-        // contact — resolve-first on the dedupe key (email by default)
+        // contact — resolve-first on the dedupe key (email by default). The match
+        // key is canonical (e.g. "linkedin"); translate it to the HubSpot property
+        // name ("hs_linkedin_url") before searching — HubSpot 400s on a filter
+        // against a property it doesn't have (there is no property named "linkedin").
         const matchKey = payload.matchKey || "email";
+        const searchProperty = HUBSPOT_DEFAULT_FIELD_MAPPINGS.contacts[matchKey] ?? matchKey;
         const matchKeyLower = `${matchKey}:${matchValue.toLowerCase()}`;
         if (createdContactsByMatch.has(matchKeyLower)) {
             return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already created earlier in this run; not duplicating.`, providerData: { id: createdContactsByMatch.get(matchKeyLower), existing: true } };
         }
-        const existing = await searchContactsBy(matchKey, matchValue);
+        const existing = await searchContactsBy(searchProperty, matchValue);
         if (existing.length > 0) {
             createdContactsByMatch.set(matchKeyLower, existing[0]);
             return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already exists (${existing.join(", ")}); resolve-first declined to create.`, providerData: { id: existing[0], existing: true } };
@@ -781,7 +785,16 @@ export function createHubspotConnector(options) {
         const defaults = HUBSPOT_DEFAULT_FIELD_MAPPINGS[mappingType] ?? {};
         const property = mappedField(mappings, mappingType, field, defaults[field] ?? field);
         const data = await request(`/crm/v3/objects/${objectPath}/${encodeURIComponent(objectId)}?properties=${encodeURIComponent(property)}`);
-        return data?.properties?.[property] ?? null;
+        const value = data?.properties?.[property] ?? null;
+        // fetchSnapshot normalizes closeDate to a date with `?.split("T")[0]`, so the
+        // value baked into an op's beforeValue is date-only ("2026-03-07"). The
+        // single-object read here returns HubSpot's raw "2026-03-07T00:00:00Z", which
+        // made compare-and-set see a spurious drift and refuse every date-field write.
+        // Mirror the snapshot's normalization so the comparison is apples-to-apples.
+        if (field === "closeDate" && typeof value === "string") {
+            return value.split("T")[0];
+        }
+        return value;
     }
     return {
         provider: "hubspot",

package/dist/connectors/prospectSources.d.ts

@@ -19,6 +19,9 @@ export type Prospect = {
     lastName?: string;
     fullName?: string;
     jobTitle?: string;
+    /** LinkedIn headline — secondary role signal for ICP scoring (the title
+     *  keyword may live here, not in the formal jobTitle). */
+    headline?: string;
     /** normalized seniority, e.g. "cxo","vp","director" (Explorium job_level_main) */
     jobLevel?: string;
     /** normalized department, e.g. "sales" (Explorium job_department_main) */
@@ -68,6 +71,23 @@ export declare function pipe0ResolveWorkEmails(opts: {
      *  for every row, so one big batch is all-or-nothing). Default 3. */
     chunkSize?: number;
 }): Promise<Prospect[]>;
+/** Bare registrable host from a URL or domain string ("https://www.x.com/a" → "x.com"). */
+export declare function hostFromUrl(url: string | undefined): string | undefined;
+/**
+ * Fill `companyDomain` for prospects that have a company NAME but no domain,
+ * using pipe0's `company:identity@1` pipe (name → website URL). The work-email
+ * waterfall requires a domain — a LinkedIn/HeyReach list supplies only names, so
+ * without this step every resolution fails. Resolves each unique company once
+ * (companies repeat across a list); leaves a prospect untouched when the domain
+ * can't be found, so the waterfall simply skips it rather than guessing.
+ */
+export declare function pipe0ResolveCompanyDomains(opts: {
+    apiKey: string;
+    prospects: Prospect[];
+    apiBaseUrl?: string;
+    fetchImpl?: FetchImpl;
+    chunkSize?: number;
+}): Promise<Prospect[]>;
 /**
  * Stable identity keys for a prospect (prefixed by kind). A match on ANY key
  * means "same person". LinkedIn is strongest; name+domain is the only key

package/dist/connectors/prospectSources.js

@@ -144,6 +144,73 @@ export async function pipe0ResolveWorkEmails(opts) {
 function personKey(name, company) {
     return `${(name ?? "").trim().toLowerCase()}|${(company ?? "").trim().toLowerCase()}`;
 }
+/** Bare registrable host from a URL or domain string ("https://www.x.com/a" → "x.com"). */
+export function hostFromUrl(url) {
+    if (!url || !url.trim())
+        return undefined;
+    try {
+        const u = url.includes("://") ? url : `https://${url}`;
+        const host = new URL(u).hostname.replace(/^www\./, "");
+        return host || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Fill `companyDomain` for prospects that have a company NAME but no domain,
+ * using pipe0's `company:identity@1` pipe (name → website URL). The work-email
+ * waterfall requires a domain — a LinkedIn/HeyReach list supplies only names, so
+ * without this step every resolution fails. Resolves each unique company once
+ * (companies repeat across a list); leaves a prospect untouched when the domain
+ * can't be found, so the waterfall simply skips it rather than guessing.
+ */
+export async function pipe0ResolveCompanyDomains(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const base = (opts.apiBaseUrl ?? "https://api.pipe0.com").replace(/\/$/, "");
+    const chunkSize = Math.max(1, opts.chunkSize ?? 5);
+    const uniqueNames = [
+        ...new Set(opts.prospects
+            .filter((p) => !p.companyDomain && p.companyName)
+            .map((p) => p.companyName.trim())
+            .filter(Boolean)),
+    ];
+    if (uniqueNames.length === 0)
+        return opts.prospects;
+    const domainByName = new Map();
+    for (let i = 0; i < uniqueNames.length; i += chunkSize) {
+        const chunk = uniqueNames.slice(i, i + chunkSize);
+        try {
+            const response = await fetchImpl(`${base}/v1/pipes/run/sync`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${opts.apiKey}`, "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    pipes: [{ pipe_id: "company:identity@1" }],
+                    input: chunk.map((company_name) => ({ company_name })),
+                }),
+            });
+            if (!response.ok)
+                continue;
+            const body = (await response.json());
+            for (const recordId of body.order ?? []) {
+                const fields = body.records?.[recordId]?.fields ?? {};
+                const name = fieldValue(fields.company_name) ?? fieldValue(fields.cleaned_company_name);
+                const domain = hostFromUrl(fieldValue(fields.company_website_url));
+                if (name && domain)
+                    domainByName.set(name.trim().toLowerCase(), domain);
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return opts.prospects.map((p) => {
+        if (p.companyDomain || !p.companyName)
+            return p;
+        const domain = domainByName.get(p.companyName.trim().toLowerCase());
+        return domain ? { ...p, companyDomain: domain } : p;
+    });
+}
 function fieldValue(field) {
     const v = field?.value;
     return typeof v === "string" && v.trim() ? v : undefined;

package/dist/connectors/salesforce.js

@@ -31,6 +31,37 @@ export function createSalesforceConnector(options) {
     const mappings = options.fieldMappings;
     // create:<Name> dedup within one connector lifetime (one apply run).
     const createdAccountsByName = new Map();
+    // create_record contact dedup (keyed by matchKey:matchValue), same lifetime.
+    const createdContactsByMatch = new Map();
+    // Resolve an Account by exact name: a unique existing match is reused, a
+    // confirmed miss is created, and an ambiguous name (>1 match) is refused.
+    // Caches within the run so the same name is never created twice — shared by
+    // `link_record`'s create:<Name> path and `create_record`'s company linking.
+    async function resolveOrCreateAccountByName(name) {
+        const nameKey = name.toLowerCase();
+        const cached = createdAccountsByName.get(nameKey);
+        if (cached)
+            return { id: cached, createdNew: false };
+        const soqlName = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const matches = await query(`SELECT Id FROM Account WHERE Name = '${soqlName}' LIMIT 3`);
+        if (matches.length > 1)
+            return { ambiguous: matches.length };
+        let id;
+        let createdNew = false;
+        if (matches.length === 1) {
+            id = String(matches[0].Id);
+        }
+        else {
+            const created = await request(`/services/data/${apiVersion}/sobjects/Account`, {
+                method: "POST",
+                body: JSON.stringify({ Name: name }),
+            });
+            id = String(created.id);
+            createdNew = true;
+        }
+        createdAccountsByName.set(nameKey, id);
+        return { id, createdNew };
+    }
     async function request(path, init = {}) {
         const connection = await options.getConnection();
         const url = path.startsWith("http")
@@ -379,6 +410,85 @@ export function createSalesforceConnector(options) {
             providerData: { survivorId: master, mergedRecordIds: merged },
         };
     }
+    // Resolve-first net-new lead creation (the `enrich acquire` path). Re-resolves
+    // on matchKey/matchValue at apply time — search is the source of truth — and
+    // creates only on a confirmed miss, so concurrent writers never get duplicated.
+    // Mirrors the HubSpot connector's createRecord contract.
+    async function createRecord(operation) {
+        const payload = operation.afterValue;
+        if (!payload || typeof payload !== "object" || !payload.properties) {
+            return { operationId: operation.id, status: "skipped", detail: "create_record needs a CreateRecordPayload afterValue." };
+        }
+        if (operation.objectType !== "contact" && operation.objectType !== "account") {
+            return { operationId: operation.id, status: "skipped", detail: "create_record supports contacts and accounts." };
+        }
+        const matchValue = String(payload.matchValue ?? "").trim();
+        if (!matchValue) {
+            return { operationId: operation.id, status: "skipped", detail: "create_record needs a non-empty matchValue to resolve-first." };
+        }
+        if (operation.objectType === "account") {
+            const resolved = await resolveOrCreateAccountByName(matchValue);
+            if ("ambiguous" in resolved) {
+                return { operationId: operation.id, status: "skipped", detail: `create_record: ambiguous — ${resolved.ambiguous} accounts named "${matchValue}". Not creating.` };
+            }
+            return { operationId: operation.id, status: "applied", detail: `Resolved/created account "${matchValue}" (${resolved.id}).`, providerData: { id: resolved.id, created: resolved.createdNew } };
+        }
+        // contact — resolve-first on the dedupe key (email by default). matchKey is
+        // canonical; translate it to the Salesforce field before the SOQL search.
+        const matchKey = payload.matchKey || "email";
+        const searchField = mappedField(mappings, "contacts", matchKey, SALESFORCE_DEFAULT_FIELD_MAPPINGS.contacts[matchKey] ?? matchKey);
+        const matchKeyLower = `${matchKey}:${matchValue.toLowerCase()}`;
+        if (createdContactsByMatch.has(matchKeyLower)) {
+            return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already created earlier in this run; not duplicating.`, providerData: { id: createdContactsByMatch.get(matchKeyLower), existing: true } };
+        }
+        const soqlValue = matchValue.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        const existing = await query(`SELECT Id FROM Contact WHERE ${searchField} = '${soqlValue}' LIMIT 5`);
+        if (existing.length > 0) {
+            const existingId = String(existing[0].Id);
+            createdContactsByMatch.set(matchKeyLower, existingId);
+            return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already exists (${existing.map((r) => String(r.Id)).join(", ")}); resolve-first declined to create.`, providerData: { id: existingId, existing: true } };
+        }
+        const fields = { ...payload.properties };
+        // Stamp ownership at create time so the lead is never born ownerless. The
+        // canonical ownerId maps to Salesforce's OwnerId.
+        if (payload.ownerId) {
+            const ownerField = mappedField(mappings, "contacts", "ownerId", SALESFORCE_DEFAULT_FIELD_MAPPINGS.contacts.ownerId ?? "OwnerId");
+            if (!fields[ownerField])
+                fields[ownerField] = String(payload.ownerId);
+        }
+        const created = await request(`/services/data/${apiVersion}/sobjects/Contact`, {
+            method: "POST",
+            body: JSON.stringify(fields),
+        });
+        const contactId = String(created.id);
+        createdContactsByMatch.set(matchKeyLower, contactId);
+        let companyNote = "";
+        if (payload.associateCompanyName) {
+            try {
+                const resolved = await resolveOrCreateAccountByName(payload.associateCompanyName);
+                if ("ambiguous" in resolved) {
+                    companyNote = ` Account "${payload.associateCompanyName}" was ambiguous; left unlinked.`;
+                }
+                else {
+                    await request(`/services/data/${apiVersion}/sobjects/Contact/${encodeURIComponent(contactId)}`, {
+                        method: "PATCH",
+                        body: JSON.stringify({ AccountId: resolved.id }),
+                    });
+                    companyNote = ` Linked to account "${payload.associateCompanyName}" (${resolved.id}).`;
+                }
+            }
+            catch (error) {
+                // Association is best-effort — the contact create already succeeded.
+                companyNote = ` (account link failed: ${error instanceof Error ? error.message : String(error)})`;
+            }
+        }
+        return {
+            operationId: operation.id,
+            status: "applied",
+            detail: `Created contact ${matchKey}=${matchValue} (${contactId}).${companyNote}`,
+            providerData: { id: contactId, created: true },
+        };
+    }
     async function applyOperation(operation) {
         try {
             switch (operation.operation) {
@@ -396,32 +506,15 @@ export function createSalesforceConnector(options) {
                         if (!name) {
                             return { operationId: operation.id, status: "skipped", detail: "create: needs an account name (create:<Name>)." };
                         }
-                        const nameKey = name.toLowerCase();
-                        let accountId = createdAccountsByName.get(nameKey);
-                        let createdNew = false;
-                        if (!accountId) {
-                            const soqlName = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-                            const matches = await query(`SELECT Id FROM Account WHERE Name = '${soqlName}' LIMIT 3`);
-                            if (matches.length > 1) {
-                                return {
-                                    operationId: operation.id,
-                                    status: "skipped",
-                                    detail: `create:${name} is ambiguous — ${matches.length} accounts already named "${name}". Link an explicit account id instead.`,
-                                };
-                            }
-                            if (matches.length === 1) {
-                                accountId = String(matches[0].Id);
-                            }
-                            else {
-                                const created = await request(`/services/data/${apiVersion}/sobjects/Account`, {
-                                    method: "POST",
-                                    body: JSON.stringify({ Name: name }),
-                                });
-                                accountId = String(created.id);
-                                createdNew = true;
-                            }
-                            createdAccountsByName.set(nameKey, accountId);
+                        const resolved = await resolveOrCreateAccountByName(name);
+                        if ("ambiguous" in resolved) {
+                            return {
+                                operationId: operation.id,
+                                status: "skipped",
+                                detail: `create:${name} is ambiguous — ${resolved.ambiguous} accounts already named "${name}". Link an explicit account id instead.`,
+                            };
                         }
+                        const { id: accountId, createdNew } = resolved;
                         const result = await setField({ ...operation, operation: "set_field", afterValue: accountId });
                         return result.status === "applied"
                             ? {
@@ -441,6 +534,8 @@ export function createSalesforceConnector(options) {
                     return await mergeRecords(operation);
                 case "archive_record":
                     return await archiveRecord(operation);
+                case "create_record":
+                    return await createRecord(operation);
                 default:
                     return {
                         operationId: operation.id,

package/dist/enrich.js

@@ -12,7 +12,7 @@ const MATCH_KEYS = {
     contact: ["email", "name", "linkedin"],
 };
 /** API source ids the MVP can pull from. */
-export const SUPPORTED_API_SOURCES = ["apollo", "explorium", "pipe0"];
+export const SUPPORTED_API_SOURCES = ["apollo", "explorium", "pipe0", "linkedin"];
 /**
  * Canonical fields enrich may target, plus the HubSpot property spellings the
  * config may use for them (so `"crm": "numberofemployees"` and

package/dist/icp.d.ts

@@ -69,6 +69,7 @@ export declare function scoreProspectAgainstIcp(prospect: {
     jobTitle?: string;
     jobLevel?: string;
     jobDepartment?: string;
+    headline?: string;
 }, icp: Icp): IcpFit;
 export declare function fitThreshold(icp: Icp): number;
 export type IcpInterviewQuestion = {

package/dist/icp.js

@@ -131,7 +131,11 @@ function titleCase(value) {
  */
 export function scoreProspectAgainstIcp(prospect, icp) {
     const reasons = [];
-    const title = (prospect.jobTitle ?? "").toLowerCase();
+    // Match title keywords across BOTH the formal title and the headline: on
+    // LinkedIn-sourced prospects the role signal often lives only in the headline
+    // (e.g. position "Founder" but headline "… | RevOps | …"), so scoring on the
+    // title alone would miss genuine in-persona leads.
+    const title = `${prospect.jobTitle ?? ""} ${prospect.headline ?? ""}`.trim().toLowerCase();
     const keywords = (icp.persona.titleKeywords ?? []).map((k) => k.toLowerCase());
     const levels = (icp.persona.jobLevels ?? []).map((l) => l.toLowerCase());
     const depts = (icp.persona.departments ?? []).map((d) => d.toLowerCase());

package/docs/api.md

@@ -149,6 +149,14 @@ zero-config `EnrichConfig.acquire` (budget, provider, create-mapping) so
   pulls a HeyReach lead list and `linkedInProspectToProspect` maps each lead to the
   canonical `Prospect` (match key = LinkedIn URL), so ICP scoring / dedup / meter /
   apply are reused unchanged. Phase 1 is discovery-only — read-only, never sends.
+  `linkedin` is a `SUPPORTED_API_SOURCES` source, so an explicit config can set
+  discovery `size` (read a whole list, not the preset's 25). A LinkedIn list
+  carries no emails; opt into resolution with
+  `acquire.discovery.linkedin.resolveEmailsWith: "pipe0"` — email resolution is
+  no longer gated on the dedupe key being `email`, so a profile-URL-keyed source
+  still creates outreach-ready, emailed contacts. ICP scoring matches title
+  keywords across `Prospect.jobTitle` **and** `headline` (LinkedIn roles often
+  live in the headline, not the formal title).
 - **Meter** (`acquireMeter.ts`): `AcquireBudget`, `loadMeter` / `remaining` /
   `recordConsumption` — per-profile windowed record+spend budget, charged only
   for landed creates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",

package/src/acquireLinkedIn.ts

@@ -33,6 +33,9 @@ export function linkedInProspectToProspect(lp: LinkedInProspect): Prospect {
     fullName: lp.fullName,
     // Title drives ICP scoring; fall back to the headline when no title is set.
     jobTitle: lp.jobTitle ?? lp.headline,
+    // Keep the headline distinct too: the scorer matches keywords across both,
+    // so a role named only in the headline (not the position) still scores.
+    headline: lp.headline,
     companyName: lp.company,
     linkedin: lp.profileUrl || undefined,
     email: lp.email,

package/src/cli.ts

@@ -130,6 +130,7 @@ import {
   fetchExploriumProspects,
   fetchPipe0CrustdataProspects,
   partitionFreshProspects,
+  pipe0ResolveCompanyDomains,
   pipe0ResolveWorkEmails,
   prospectIdentityKeys,
   type Prospect,
@@ -2450,9 +2451,18 @@ async function acquireFromApi(
   const { fresh, skippedCrm, skippedSeen } = partitionFreshProspects(prospects, crmContactKeys(snapshot), seen);
   prospects = fresh;
 
-  // 3. Resolve real work emails (both providers need it: Explorium's email is
-  //    hashed, Crustdata search returns none). pipe0 waterfall, chunked.
-  if (matchKey === "email") {
+  // 3. Resolve real work emails. Triggered either when email IS the dedupe key
+  //    (Explorium's email is hashed, Crustdata returns none) or when a source
+  //    that keys on something else opts in via `resolveEmailsWith: "pipe0"`
+  //    (e.g. LinkedIn keys on the profile URL but still wants outreach emails).
+  //    pipe0 waterfall, chunked; resolves from name + company domain/name.
+  if (matchKey === "email" || disc.resolveEmailsWith === "pipe0") {
+    // The waterfall needs a company DOMAIN; LinkedIn/HeyReach lists carry only
+    // names. Resolve domains first (pipe0 company:identity) so resolution can
+    // actually land — without it, name-only resolution fails for every lead.
+    if (prospects.some((p) => !p.companyDomain && p.companyName)) {
+      prospects = await pipe0ResolveCompanyDomains({ apiKey: providerKey("pipe0"), prospects });
+    }
     prospects = await pipe0ResolveWorkEmails({ apiKey: providerKey("pipe0"), prospects });
   }
 

package/src/connectors/hubspot.ts

@@ -595,13 +595,17 @@ export function createHubspotConnector(options: HubspotConnectorOptions): Requir
       return { operationId: operation.id, status: "applied", detail: `Resolved/created company "${matchValue}" (${id}).`, providerData: { id } };
     }
 
-    // contact — resolve-first on the dedupe key (email by default)
+    // contact — resolve-first on the dedupe key (email by default). The match
+    // key is canonical (e.g. "linkedin"); translate it to the HubSpot property
+    // name ("hs_linkedin_url") before searching — HubSpot 400s on a filter
+    // against a property it doesn't have (there is no property named "linkedin").
     const matchKey = payload.matchKey || "email";
+    const searchProperty = HUBSPOT_DEFAULT_FIELD_MAPPINGS.contacts[matchKey] ?? matchKey;
     const matchKeyLower = `${matchKey}:${matchValue.toLowerCase()}`;
     if (createdContactsByMatch.has(matchKeyLower)) {
       return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already created earlier in this run; not duplicating.`, providerData: { id: createdContactsByMatch.get(matchKeyLower), existing: true } };
     }
-    const existing = await searchContactsBy(matchKey, matchValue);
+    const existing = await searchContactsBy(searchProperty, matchValue);
     if (existing.length > 0) {
       createdContactsByMatch.set(matchKeyLower, existing[0]);
       return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already exists (${existing.join(", ")}); resolve-first declined to create.`, providerData: { id: existing[0], existing: true } };
@@ -905,7 +909,16 @@ export function createHubspotConnector(options: HubspotConnectorOptions): Requir
     const data = await request(
       `/crm/v3/objects/${objectPath}/${encodeURIComponent(objectId)}?properties=${encodeURIComponent(property)}`,
     );
-    return data?.properties?.[property] ?? null;
+    const value = data?.properties?.[property] ?? null;
+    // fetchSnapshot normalizes closeDate to a date with `?.split("T")[0]`, so the
+    // value baked into an op's beforeValue is date-only ("2026-03-07"). The
+    // single-object read here returns HubSpot's raw "2026-03-07T00:00:00Z", which
+    // made compare-and-set see a spurious drift and refuse every date-field write.
+    // Mirror the snapshot's normalization so the comparison is apples-to-apples.
+    if (field === "closeDate" && typeof value === "string") {
+      return value.split("T")[0];
+    }
+    return value;
   }
 
   return {

package/src/connectors/prospectSources.ts

@@ -20,6 +20,9 @@ export type Prospect = {
   lastName?: string;
   fullName?: string;
   jobTitle?: string;
+  /** LinkedIn headline — secondary role signal for ICP scoring (the title
+   *  keyword may live here, not in the formal jobTitle). */
+  headline?: string;
   /** normalized seniority, e.g. "cxo","vp","director" (Explorium job_level_main) */
   jobLevel?: string;
   /** normalized department, e.g. "sales" (Explorium job_department_main) */
@@ -233,6 +236,78 @@ function personKey(name: string | undefined, company: string | undefined): strin
   return `${(name ?? "").trim().toLowerCase()}|${(company ?? "").trim().toLowerCase()}`;
 }
 
+/** Bare registrable host from a URL or domain string ("https://www.x.com/a" → "x.com"). */
+export function hostFromUrl(url: string | undefined): string | undefined {
+  if (!url || !url.trim()) return undefined;
+  try {
+    const u = url.includes("://") ? url : `https://${url}`;
+    const host = new URL(u).hostname.replace(/^www\./, "");
+    return host || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Fill `companyDomain` for prospects that have a company NAME but no domain,
+ * using pipe0's `company:identity@1` pipe (name → website URL). The work-email
+ * waterfall requires a domain — a LinkedIn/HeyReach list supplies only names, so
+ * without this step every resolution fails. Resolves each unique company once
+ * (companies repeat across a list); leaves a prospect untouched when the domain
+ * can't be found, so the waterfall simply skips it rather than guessing.
+ */
+export async function pipe0ResolveCompanyDomains(opts: {
+  apiKey: string;
+  prospects: Prospect[];
+  apiBaseUrl?: string;
+  fetchImpl?: FetchImpl;
+  chunkSize?: number;
+}): Promise<Prospect[]> {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const base = (opts.apiBaseUrl ?? "https://api.pipe0.com").replace(/\/$/, "");
+  const chunkSize = Math.max(1, opts.chunkSize ?? 5);
+
+  const uniqueNames = [
+    ...new Set(
+      opts.prospects
+        .filter((p) => !p.companyDomain && p.companyName)
+        .map((p) => p.companyName!.trim())
+        .filter(Boolean),
+    ),
+  ];
+  if (uniqueNames.length === 0) return opts.prospects;
+
+  const domainByName = new Map<string, string>();
+  for (let i = 0; i < uniqueNames.length; i += chunkSize) {
+    const chunk = uniqueNames.slice(i, i + chunkSize);
+    try {
+      const response = await fetchImpl(`${base}/v1/pipes/run/sync`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${opts.apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+          pipes: [{ pipe_id: "company:identity@1" }],
+          input: chunk.map((company_name) => ({ company_name })),
+        }),
+      });
+      if (!response.ok) continue;
+      const body = (await response.json()) as Pipe0RunResponse;
+      for (const recordId of body.order ?? []) {
+        const fields = body.records?.[recordId]?.fields ?? {};
+        const name = fieldValue(fields.company_name) ?? fieldValue(fields.cleaned_company_name);
+        const domain = hostFromUrl(fieldValue(fields.company_website_url));
+        if (name && domain) domainByName.set(name.trim().toLowerCase(), domain);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return opts.prospects.map((p) => {
+    if (p.companyDomain || !p.companyName) return p;
+    const domain = domainByName.get(p.companyName.trim().toLowerCase());
+    return domain ? { ...p, companyDomain: domain } : p;
+  });
+}
+
 type Pipe0Field = { value?: unknown; status?: string };
 type Pipe0RunResponse = {
   order?: string[];

package/src/connectors/salesforce.ts

@@ -12,6 +12,7 @@ import type {
   CanonicalDeal,
   CanonicalGtmSnapshot,
   CanonicalUser,
+  CreateRecordPayload,
   GtmConnector,
   GtmObjectType,
   PatchOperation,
@@ -72,6 +73,37 @@ export function createSalesforceConnector(
   const mappings = options.fieldMappings;
   // create:<Name> dedup within one connector lifetime (one apply run).
   const createdAccountsByName = new Map<string, string>();
+  // create_record contact dedup (keyed by matchKey:matchValue), same lifetime.
+  const createdContactsByMatch = new Map<string, string>();
+
+  // Resolve an Account by exact name: a unique existing match is reused, a
+  // confirmed miss is created, and an ambiguous name (>1 match) is refused.
+  // Caches within the run so the same name is never created twice — shared by
+  // `link_record`'s create:<Name> path and `create_record`'s company linking.
+  async function resolveOrCreateAccountByName(
+    name: string,
+  ): Promise<{ id: string; createdNew: boolean } | { ambiguous: number }> {
+    const nameKey = name.toLowerCase();
+    const cached = createdAccountsByName.get(nameKey);
+    if (cached) return { id: cached, createdNew: false };
+    const soqlName = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+    const matches = await query(`SELECT Id FROM Account WHERE Name = '${soqlName}' LIMIT 3`);
+    if (matches.length > 1) return { ambiguous: matches.length };
+    let id: string;
+    let createdNew = false;
+    if (matches.length === 1) {
+      id = String(matches[0].Id);
+    } else {
+      const created = await request(`/services/data/${apiVersion}/sobjects/Account`, {
+        method: "POST",
+        body: JSON.stringify({ Name: name }),
+      });
+      id = String(created.id);
+      createdNew = true;
+    }
+    createdAccountsByName.set(nameKey, id);
+    return { id, createdNew };
+  }
 
   async function request(path: string, init: RequestInit = {}): Promise<any> {
     const connection = await options.getConnection();
@@ -484,6 +516,87 @@ export function createSalesforceConnector(
     };
   }
 
+  // Resolve-first net-new lead creation (the `enrich acquire` path). Re-resolves
+  // on matchKey/matchValue at apply time — search is the source of truth — and
+  // creates only on a confirmed miss, so concurrent writers never get duplicated.
+  // Mirrors the HubSpot connector's createRecord contract.
+  async function createRecord(operation: PatchOperation): Promise<PatchOperationResult> {
+    const payload = operation.afterValue as CreateRecordPayload | undefined;
+    if (!payload || typeof payload !== "object" || !payload.properties) {
+      return { operationId: operation.id, status: "skipped", detail: "create_record needs a CreateRecordPayload afterValue." };
+    }
+    if (operation.objectType !== "contact" && operation.objectType !== "account") {
+      return { operationId: operation.id, status: "skipped", detail: "create_record supports contacts and accounts." };
+    }
+    const matchValue = String(payload.matchValue ?? "").trim();
+    if (!matchValue) {
+      return { operationId: operation.id, status: "skipped", detail: "create_record needs a non-empty matchValue to resolve-first." };
+    }
+
+    if (operation.objectType === "account") {
+      const resolved = await resolveOrCreateAccountByName(matchValue);
+      if ("ambiguous" in resolved) {
+        return { operationId: operation.id, status: "skipped", detail: `create_record: ambiguous — ${resolved.ambiguous} accounts named "${matchValue}". Not creating.` };
+      }
+      return { operationId: operation.id, status: "applied", detail: `Resolved/created account "${matchValue}" (${resolved.id}).`, providerData: { id: resolved.id, created: resolved.createdNew } };
+    }
+
+    // contact — resolve-first on the dedupe key (email by default). matchKey is
+    // canonical; translate it to the Salesforce field before the SOQL search.
+    const matchKey = payload.matchKey || "email";
+    const searchField = mappedField(mappings, "contacts", matchKey, SALESFORCE_DEFAULT_FIELD_MAPPINGS.contacts[matchKey] ?? matchKey);
+    const matchKeyLower = `${matchKey}:${matchValue.toLowerCase()}`;
+    if (createdContactsByMatch.has(matchKeyLower)) {
+      return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already created earlier in this run; not duplicating.`, providerData: { id: createdContactsByMatch.get(matchKeyLower), existing: true } };
+    }
+    const soqlValue = matchValue.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+    const existing = await query(`SELECT Id FROM Contact WHERE ${searchField} = '${soqlValue}' LIMIT 5`);
+    if (existing.length > 0) {
+      const existingId = String(existing[0].Id);
+      createdContactsByMatch.set(matchKeyLower, existingId);
+      return { operationId: operation.id, status: "skipped", detail: `Contact ${matchKey}=${matchValue} already exists (${existing.map((r) => String(r.Id)).join(", ")}); resolve-first declined to create.`, providerData: { id: existingId, existing: true } };
+    }
+
+    const fields: Record<string, string> = { ...payload.properties };
+    // Stamp ownership at create time so the lead is never born ownerless. The
+    // canonical ownerId maps to Salesforce's OwnerId.
+    if (payload.ownerId) {
+      const ownerField = mappedField(mappings, "contacts", "ownerId", SALESFORCE_DEFAULT_FIELD_MAPPINGS.contacts.ownerId ?? "OwnerId");
+      if (!fields[ownerField]) fields[ownerField] = String(payload.ownerId);
+    }
+    const created = await request(`/services/data/${apiVersion}/sobjects/Contact`, {
+      method: "POST",
+      body: JSON.stringify(fields),
+    });
+    const contactId = String(created.id);
+    createdContactsByMatch.set(matchKeyLower, contactId);
+
+    let companyNote = "";
+    if (payload.associateCompanyName) {
+      try {
+        const resolved = await resolveOrCreateAccountByName(payload.associateCompanyName);
+        if ("ambiguous" in resolved) {
+          companyNote = ` Account "${payload.associateCompanyName}" was ambiguous; left unlinked.`;
+        } else {
+          await request(`/services/data/${apiVersion}/sobjects/Contact/${encodeURIComponent(contactId)}`, {
+            method: "PATCH",
+            body: JSON.stringify({ AccountId: resolved.id }),
+          });
+          companyNote = ` Linked to account "${payload.associateCompanyName}" (${resolved.id}).`;
+        }
+      } catch (error) {
+        // Association is best-effort — the contact create already succeeded.
+        companyNote = ` (account link failed: ${error instanceof Error ? error.message : String(error)})`;
+      }
+    }
+    return {
+      operationId: operation.id,
+      status: "applied",
+      detail: `Created contact ${matchKey}=${matchValue} (${contactId}).${companyNote}`,
+      providerData: { id: contactId, created: true },
+    };
+  }
+
   async function applyOperation(operation: PatchOperation): Promise<PatchOperationResult> {
     try {
       switch (operation.operation) {
@@ -501,33 +614,15 @@ export function createSalesforceConnector(
             if (!name) {
               return { operationId: operation.id, status: "skipped", detail: "create: needs an account name (create:<Name>)." };
             }
-            const nameKey = name.toLowerCase();
-            let accountId = createdAccountsByName.get(nameKey);
-            let createdNew = false;
-            if (!accountId) {
-              const soqlName = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-              const matches = await query(
-                `SELECT Id FROM Account WHERE Name = '${soqlName}' LIMIT 3`,
-              );
-              if (matches.length > 1) {
-                return {
-                  operationId: operation.id,
-                  status: "skipped",
-                  detail: `create:${name} is ambiguous — ${matches.length} accounts already named "${name}". Link an explicit account id instead.`,
-                };
-              }
-              if (matches.length === 1) {
-                accountId = String(matches[0].Id);
-              } else {
-                const created = await request(`/services/data/${apiVersion}/sobjects/Account`, {
-                  method: "POST",
-                  body: JSON.stringify({ Name: name }),
-                });
-                accountId = String(created.id);
-                createdNew = true;
-              }
-              createdAccountsByName.set(nameKey, accountId);
+            const resolved = await resolveOrCreateAccountByName(name);
+            if ("ambiguous" in resolved) {
+              return {
+                operationId: operation.id,
+                status: "skipped",
+                detail: `create:${name} is ambiguous — ${resolved.ambiguous} accounts already named "${name}". Link an explicit account id instead.`,
+              };
             }
+            const { id: accountId, createdNew } = resolved;
             const result = await setField({ ...operation, operation: "set_field", afterValue: accountId });
             return result.status === "applied"
               ? {
@@ -547,6 +642,8 @@ export function createSalesforceConnector(
           return await mergeRecords(operation);
         case "archive_record":
           return await archiveRecord(operation);
+        case "create_record":
+          return await createRecord(operation);
         default:
           return {
             operationId: operation.id,

package/src/enrich.ts

@@ -139,7 +139,7 @@ const MATCH_KEYS: Record<EnrichObjectType, string[]> = {
 };
 
 /** API source ids the MVP can pull from. */
-export const SUPPORTED_API_SOURCES = ["apollo", "explorium", "pipe0"];
+export const SUPPORTED_API_SOURCES = ["apollo", "explorium", "pipe0", "linkedin"];
 
 /**
  * Canonical fields enrich may target, plus the HubSpot property spellings the

package/src/icp.ts

@@ -161,11 +161,15 @@ export type IcpFit = { score: number; reasons: string[] };
  * Firmographics aren't re-scored here — discovery already filtered on them.
  */
 export function scoreProspectAgainstIcp(
-  prospect: { jobTitle?: string; jobLevel?: string; jobDepartment?: string },
+  prospect: { jobTitle?: string; jobLevel?: string; jobDepartment?: string; headline?: string },
   icp: Icp,
 ): IcpFit {
   const reasons: string[] = [];
-  const title = (prospect.jobTitle ?? "").toLowerCase();
+  // Match title keywords across BOTH the formal title and the headline: on
+  // LinkedIn-sourced prospects the role signal often lives only in the headline
+  // (e.g. position "Founder" but headline "… | RevOps | …"), so scoring on the
+  // title alone would miss genuine in-persona leads.
+  const title = `${prospect.jobTitle ?? ""} ${prospect.headline ?? ""}`.trim().toLowerCase();
   const keywords = (icp.persona.titleKeywords ?? []).map((k) => k.toLowerCase());
   const levels = (icp.persona.jobLevels ?? []).map((l) => l.toLowerCase());
   const depts = (icp.persona.departments ?? []).map((d) => d.toLowerCase());