fullstackgtm 0.50.1 → 0.52.0

package/CHANGELOG.md

@@ -7,6 +7,46 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.52.0] — 2026-07-11
+
+### Added
+
+- `fullstackgtm icp derive --domain <site>` derives an evidence-backed ICP
+  from a public website with OpenRouter, OpenAI, or Anthropic, then offers an
+  interactive arrow-key review before writing `icp.json`.
+- `fullstackgtm login openrouter` stores and validates a profile-scoped API key
+  for website-to-ICP derivation.
+- OpenRouter derivation streams reasoning activity and provider-authored
+  reasoning summaries into the CLI status line during the model's longest wait.
+
+### Changed
+
+- Public website fetching retains DNS pinning while disabling Node's automatic
+  address-family selection, avoiding custom-lookup failures on current Node.
+- ICP-to-Clay filters map only supported catalog industries rather than
+  inventing unsupported provider labels.
+
+## [0.51.0] — 2026-07-11
+
+### Added
+
+- Native Clay Public API authentication and people search for governed lead
+  acquisition, including ICP-to-Clay filter translation and resumable search
+  checkpoints.
+- A provider-neutral, fill-only contact waterfall contract for work email,
+  mobile, and direct-dial enrichment, with Pipe0 as the first registered
+  provider and compatibility for existing Pipe0 email resolution.
+- Clay acquisition presets, initialization, doctor diagnostics, public API
+  exports, strategy documentation, and live-safe credential validation.
+
+### Changed
+
+- `enrich acquire` now uses the shared decision-first presentation contract:
+  compact cards by default, full evidence with `--verbose`, and a stable JSON
+  envelope with counts, cost, meter, and persistence state under `--json`.
+- Pre-enrichment deduplication and avoided-spend reporting are provider-neutral
+  so the same acquisition pipeline can support additional contact sources.
+
 ## [0.50.1] — 2026-07-10
 
 ### Added

package/dist/cli/auth.js

@@ -7,6 +7,7 @@ import { activeProfile, credentialsPath, DEFAULT_PROFILE, deleteCredential, getC
 import { activeWorkspaceProfile, readHealthTimeline, summarizeHealth } from "../health.js";
 import { resolveLlmCredential, validateLlmKey } from "../llm.js";
 import { createFilePlanStore } from "../planStore.js";
+import { validateClayApiKey } from "../connectors/clay.js";
 import { isOptionValue, numericOption, option, readPackageInfo, readSecret } from "./shared.js";
 import { box, colorEnabled, paint, scoreColor, sparkline } from "./ui.js";
 /**
@@ -316,20 +317,28 @@ export async function login(args) {
         console.log(`Logged in to Stripe. Credentials stored in ${credentialsPath()}.`);
         return;
     }
-    if (provider === "anthropic" || provider === "openai") {
+    if (provider === "anthropic" || provider === "openai" || provider === "openrouter") {
         rejectArgvSecret(args, "--token", "--key", "--api-key");
-        const key = await readSecret(`${provider} API key (${provider === "anthropic" ? "sk-ant-..." : "sk-..."})`);
+        const key = await readSecret(`${provider} API key (${provider === "anthropic" ? "sk-ant-..." : provider === "openrouter" ? "sk-or-..." : "sk-..."})`);
         if (!key)
             throw new Error(`No ${provider} key provided.`);
         if (!args.includes("--no-validate")) {
-            const validation = await validateLlmKey(provider, key);
-            if (!validation.ok)
-                throw new Error(`${provider} rejected the key: ${validation.detail}`);
-            console.log(validation.detail);
+            if (provider === "openrouter") {
+                const response = await fetch("https://openrouter.ai/api/v1/key", { headers: { Authorization: `Bearer ${key}` } });
+                if (!response.ok)
+                    throw new Error(`openrouter rejected the key: ${safeStatus(response)}`);
+                console.log("Key accepted by OpenRouter.");
+            }
+            else {
+                const validation = await validateLlmKey(provider, key);
+                if (!validation.ok)
+                    throw new Error(`${provider} rejected the key: ${validation.detail}`);
+                console.log(validation.detail);
+            }
         }
         const stamp = new Date().toISOString();
         storeCredential(provider, { kind: "api_key", accessToken: key, createdAt: stamp, updatedAt: stamp });
-        console.log(`Stored ${provider} API key in ${credentialsPath()}. \`fullstackgtm call parse\` and \`call score\` use it automatically.`);
+        console.log(`Stored ${provider} API key in ${credentialsPath()}. \`fullstackgtm icp derive\` uses it automatically${provider === "openrouter" ? "." : "; call parse/score use it too."}`);
         return;
     }
     if (provider === "apollo") {
@@ -351,6 +360,22 @@ export async function login(args) {
         console.log(`Stored Apollo API key in ${credentialsPath()}. \`fullstackgtm enrich append|refresh\` use it automatically.`);
         return;
     }
+    if (provider === "clay") {
+        rejectArgvSecret(args, "--token", "--key", "--api-key");
+        const key = await readSecret("Clay Public API key");
+        if (!key)
+            throw new Error("No Clay Public API key provided.");
+        if (!args.includes("--no-validate")) {
+            const validation = await validateClayApiKey(key);
+            if (!validation.ok)
+                throw new Error(validation.detail);
+            console.log(validation.detail);
+        }
+        const stamp = new Date().toISOString();
+        storeCredential("clay", { kind: "api_key", accessToken: key, createdAt: stamp, updatedAt: stamp });
+        console.log(`Stored Clay Public API key in ${credentialsPath()}. Clay connector commands resolve it automatically.`);
+        return;
+    }
     if (provider === "pipe0" || provider === "explorium" || provider === "heyreach" || provider === "theirstack") {
         rejectArgvSecret(args, "--token", "--key", "--api-key");
         const key = await readSecret(`${provider} API key`);
@@ -365,7 +390,7 @@ export async function login(args) {
         return;
     }
     if (provider !== "hubspot") {
-        throw new Error("login supports: hubspot, salesforce, stripe, anthropic, openai, apollo, pipe0, explorium, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com");
+        throw new Error("login supports: hubspot, salesforce, stripe, anthropic, openai, openrouter, apollo, clay, pipe0, explorium, heyreach, theirstack, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com");
     }
     const now = new Date().toISOString();
     rejectArgvSecret(args, "--token");
@@ -450,6 +475,12 @@ export function doctorReport(env = process.env) {
         stripe: env.STRIPE_SECRET_KEY
             ? { source: "env", detail: "STRIPE_SECRET_KEY" }
             : providerStatus("stripe", broker),
+        clay: env.CLAY_API_KEY
+            ? { source: "env", detail: "CLAY_API_KEY" }
+            : providerStatus("clay", null),
+        openrouter: env.OPENROUTER_API_KEY
+            ? { source: "env", detail: "OPENROUTER_API_KEY" }
+            : providerStatus("openrouter", null),
     };
     const llm = resolveLlmCredential(env);
     const missingPeers = ["@modelcontextprotocol/sdk", "zod"].filter((name) => {
@@ -461,13 +492,13 @@ export function doctorReport(env = process.env) {
             return true;
         }
     });
-    const connected = Object.entries(providers).filter(([, status]) => status.source !== "none");
-    const nextSteps = connected.length === 0
+    const connectedCrm = ["hubspot", "salesforce"].filter((provider) => providers[provider].source !== "none");
+    const nextSteps = connectedCrm.length === 0
         ? [
             "fullstackgtm audit --demo            # no credentials needed",
             "fullstackgtm login hubspot           # hosted browser OAuth (default; or: login salesforce)",
         ]
-        : [`fullstackgtm audit --provider ${connected[0][0]}`];
+        : [`fullstackgtm audit --provider ${connectedCrm[0]}`];
     return {
         package: packageInfo,
         node: { version: process.versions.node, ok: nodeMajor >= 20, required: ">=20" },

package/dist/cli/enrich.js

@@ -8,6 +8,8 @@ import { createFilePlanStore } from "../planStore.js";
 import { buildAcquirePlan, buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, builtinAcquirePreset, builtinEnrichPreset, enrichRunId, inferIngestObjectType, latestStamps, loadEnrichConfig, parseCsv, resolveCrmField, selectStaleWork, stagedSourceRecords, staleDaysFor } from "../enrich.js";
 import { loadMeter, remaining } from "../acquireMeter.js";
 import { crmContactKeys, fetchExploriumProspects, fetchPipe0CrustdataProspectPage, partitionFreshProspects, pipe0ResolveCompanyDomains, pipe0ResolveWorkEmails, prospectIdentityKeys } from "../connectors/prospectSources.js";
+import { createClaySearch, runClayPeopleSearchPage } from "../connectors/clay.js";
+import { runContactWaterfall } from "../contactProviders.js";
 import { loadSeen, recordSeen } from "../acquireSeen.js";
 import { acquireCheckpointId, createFileAcquireCheckpointStore } from "../acquireCheckpoint.js";
 import { readHostedAcquireCheckpoint, writeHostedAcquireCheckpoint } from "../hostedAcquireCheckpoint.js";
@@ -15,7 +17,7 @@ import { uploadHostedPatchPlan } from "../hostedPatchPlan.js";
 import { progressReporter, reportCounts, reportEvent } from "../runReport.js";
 import { ACQUIRE_STAGES, composeListeners, createProgressEmitter } from "../progress.js";
 import { createLinkedInProvider, discoverLinkedInProspects } from "../acquireLinkedIn.js";
-import { fitThreshold, icpToCrustdataFilters, icpToExploriumFilters, scoreProspectAgainstIcp } from "../icp.js";
+import { fitThreshold, icpToClayPeopleFilters, icpToCrustdataFilters, icpToExploriumFilters, scoreProspectAgainstIcp } from "../icp.js";
 import { apolloPullKeysForAppend, apolloPullKeysForRefresh, createApolloClient, pullApolloRecords } from "../enrichApollo.js";
 import { isSpoolPath, readSpoolPath } from "../spoolFiles.js";
 import { isOptionValue, loadIcp, numericOption, option, readSnapshot, saveRequested } from "./shared.js";
@@ -193,8 +195,8 @@ are phase 2. Recurring execution is the scheduler's job; enrich has no cron.`);
         // Meter: how many MORE leads may we create right now? --max is an
         // additional per-run ceiling, never a way to exceed the budget.
         if (apiSkippedCrm || apiSkippedSeen) {
-            console.error(`Pre-email dedup: skipped ${apiSkippedCrm} already-in-CRM + ${apiSkippedSeen} seen before paying for emails ` +
-                `(≈$${((apiSkippedCrm + apiSkippedSeen) * costPerRecord).toFixed(2)} enrichment saved).`);
+            console.error(`Pre-enrichment dedup: skipped ${apiSkippedCrm} already-in-CRM + ${apiSkippedSeen} previously seen ` +
+                `(≈$${((apiSkippedCrm + apiSkippedSeen) * costPerRecord).toFixed(2)} downstream spend avoided).`);
         }
         // `cap` is the desired create count bounded by the persistent meter. Raw
         // discovery scanning has its own --scan-limit and may cross many duplicate-
@@ -264,16 +266,16 @@ are phase 2. Recurring execution is the scheduler's job; enrich has no cron.`);
         const meterLine = formatAcquireMeter(headroom, costPerRecord);
         const gaugeLine = acquireGaugeLine(headroom, config.acquire.budget ?? {}, paint(colorEnabled(process.stdout)));
         if (!save) {
-            if (rest.includes("--json")) {
-                console.log(JSON.stringify({ plan: result.plan, counts: result.counts, estCostUsd: result.estCostUsd, meter: headroom }, null, 2));
-            }
-            else {
-                console.log(verbosePlanRequested(rest) ? patchPlanToMarkdown(result.plan) : compactPlan(result.plan));
-                console.log(meterLine);
-                if (gaugeLine)
-                    console.log(gaugeLine);
-                console.log("\nDry run — nothing written. Re-run with --save to persist the plan, then approve + apply.");
-            }
+            printAcquireOutput({
+                args: rest,
+                result,
+                meter: headroom,
+                meterLine,
+                gaugeLine,
+                saved: false,
+                planSaved: false,
+                hostedPlanUrl: null,
+            });
             return;
         }
         const run = await openEnrichRun(store, source, "acquire", option(rest, "--run-label"), today);
@@ -319,28 +321,16 @@ are phase 2. Recurring execution is the scheduler's job; enrich has no cron.`);
         if (acquireTelemetry && acquireCheckpointSync) {
             await persistAcquireCheckpoint(acquireCheckpointSync.key, acquireTelemetry.discovery, acquireCheckpointSync.hostedVersion);
         }
-        if (planIds.length > 0) {
-            const hostedRuns = hostedRunsUrl();
-            console.log(`\nSaved plan ${result.plan.id}`);
-            console.log(`  Leads      ${result.counts.created} net-new`);
-            console.log(`  Est. cost  $${result.estCostUsd.toFixed(2)}`);
-            console.log(`  Budget     ${gaugeLine ?? meterLine}`);
-            if (hostedPlanUrl)
-                console.log(`  Plan       ${hostedPlanUrl}`);
-            if (hostedRuns)
-                console.log(`  Observe    ${hostedRuns}`);
-            console.log("\nNext steps");
-            console.log(`  Review     fullstackgtm plans show ${result.plan.id}`);
-            console.log(`  Approve    fullstackgtm plans approve ${result.plan.id} --operations all`);
-            console.log(`  Apply      fullstackgtm apply --plan-id ${result.plan.id} --provider hubspot`);
-            console.log("\nThe meter is charged only when a create lands at apply.");
-        }
-        else {
-            console.log(meterLine);
-            if (gaugeLine)
-                console.log(gaugeLine);
-            console.log("No net-new leads to create (everything sourced already matched, or was withheld by the meter).");
-        }
+        printAcquireOutput({
+            args: rest,
+            result,
+            meter: headroom,
+            meterLine,
+            gaugeLine,
+            saved: true,
+            planSaved: planIds.length > 0,
+            hostedPlanUrl,
+        });
         return;
     }
     const mode = subcommand === "refresh" ? "refresh" : "append";
@@ -501,8 +491,9 @@ function formatEnrichCounts(counts, ambiguities) {
 /**
  * Pull net-new prospects from an API acquire source into source records the
  * acquire builder dedupes + turns into create_record ops. Explorium discovers;
- * pipe0 (when resolveEmailsWith=pipe0) fills real work emails. Only rows that
- * carry the dedupe key (email) survive — you cannot resolve-first without it.
+ * A field-level provider waterfall fills missing contact data. Existing
+ * email-keyed and resolveEmailsWith=pipe0 configs translate to an implicit
+ * Pipe0 work-email step. Only rows that carry the configured dedupe key survive.
  */
 async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRun, targetFresh, persistCheckpoint, progress) {
     const acquire = config.acquire;
@@ -521,7 +512,9 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
         ? (icp ? icpToExploriumFilters(icp) : (disc.filters ?? {}))
         : disc.provider === "pipe0"
             ? (icp ? icpToCrustdataFilters(icp) : (disc.filters ?? {}))
-            : {};
+            : disc.provider === "clay"
+                ? (icp ? icpToClayPeopleFilters(icp) : (disc.filters ?? {}))
+                : {};
     const queryFingerprint = createHash("sha256")
         .update(JSON.stringify({ source, provider: disc.provider, listId, filters, icp: icp ?? null }))
         .digest("hex");
@@ -584,6 +577,20 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
             cursor = result.nextCursor;
             exhausted = result.nextCursor === null;
         }
+        else if (disc.provider === "clay") {
+            if (!cursor) {
+                progress.note("creating Clay people-search iterator");
+                cursor = await createClaySearch({
+                    apiKey: providerKey("clay"), sourceType: "people", filters,
+                });
+            }
+            const result = await runClayPeopleSearchPage({
+                apiKey: providerKey("clay"), searchId: cursor, limit: requestSize,
+            });
+            page = result.prospects;
+            offset += page.length;
+            exhausted = !result.hasMore;
+        }
         else if (disc.provider === "explorium") {
             const pageNumber = offset + 1;
             exploriumPage = pageNumber;
@@ -604,7 +611,7 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
             exhausted = page.length < requestSize;
         }
         else {
-            throw new Error(`enrich acquire: unknown discovery provider "${disc.provider}" (explorium | pipe0 | linkedin).`);
+            throw new Error(`enrich acquire: unknown discovery provider "${disc.provider}" (clay | explorium | pipe0 | linkedin).`);
         }
         discovered += page.length;
         progress.items(discovered, scanLimit);
@@ -650,23 +657,35 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
     }
     progress.stage(ACQUIRE_STAGES[1], 1, ACQUIRE_STAGES.length);
     progress.note("checking work-email requirements");
-    // 3. Resolve real work emails. Triggered either when email IS the dedupe key
-    //    (Explorium's email is hashed, Crustdata returns none) or when a source
-    //    that keys on something else opts in via `resolveEmailsWith: "pipe0"`
-    //    (e.g. LinkedIn keys on the profile URL but still wants outreach emails).
-    //    pipe0 waterfall, chunked; resolves from name + company domain/name.
-    if (matchKey === "email" || disc.resolveEmailsWith === "pipe0") {
-        // The waterfall needs a company DOMAIN; LinkedIn/HeyReach lists carry only
-        // names. Resolve domains first (pipe0 company:identity) so resolution can
-        // actually land — without it, name-only resolution fails for every lead.
-        if (prospects.some((p) => !p.companyDomain && p.companyName)) {
-            progress.note(`resolving company domains for ${prospects.length} candidate(s)`);
-            const resolved = await pipe0ResolveCompanyDomains({ apiKey: providerKey("pipe0"), prospects });
-            prospects.splice(0, prospects.length, ...resolved);
-        }
-        progress.note(`resolving work emails for ${prospects.length} candidate(s)`);
-        const resolved = await pipe0ResolveWorkEmails({ apiKey: providerKey("pipe0"), prospects });
-        prospects.splice(0, prospects.length, ...resolved);
+    // 3. Resolve contact fields through the ordered, fill-only waterfall. Keep
+    // legacy behavior: email-keyed acquisition and resolveEmailsWith=pipe0 imply
+    // a Pipe0 work-email step when no explicit waterfall is configured.
+    const implicitPipe0 = matchKey === "email" || disc.resolveEmailsWith === "pipe0";
+    const contactWaterfall = disc.contactWaterfall ?? (implicitPipe0 ? [{ provider: "pipe0", fields: ["work_email"] }] : []);
+    if (contactWaterfall.length > 0) {
+        const adapters = {
+            pipe0: {
+                provider: "pipe0",
+                resolve: async (candidates, fields) => {
+                    let resolved = candidates;
+                    if (fields.includes("work_email") && resolved.some((p) => !p.companyDomain && p.companyName)) {
+                        progress.note(`resolving company domains for ${resolved.length} candidate(s)`);
+                        resolved = await pipe0ResolveCompanyDomains({ apiKey: providerKey("pipe0"), prospects: resolved });
+                    }
+                    if (fields.includes("work_email")) {
+                        progress.note(`resolving work emails with pipe0 for ${resolved.length} candidate(s)`);
+                        resolved = await pipe0ResolveWorkEmails({ apiKey: providerKey("pipe0"), prospects: resolved });
+                    }
+                    return resolved;
+                },
+            },
+        };
+        const result = await runContactWaterfall({ prospects, steps: contactWaterfall, adapters });
+        prospects.splice(0, prospects.length, ...result.prospects);
+        for (const attempt of result.attempts) {
+            const added = Object.entries(attempt.added).map(([field, count]) => `${count} ${field}`).join(", ") || "0 fields";
+            progress.note(`${attempt.provider}: ${attempt.attempted} attempted · ${added} added`);
+        }
     }
     progress.items(prospects.length, prospects.length);
     progress.note(`${prospects.length} candidate(s) ready for planning`);
@@ -756,6 +775,53 @@ function formatAcquireMeter(headroom, costPerRecord) {
         `Spend left: ${money(headroom.spendUsd.day)}/day, ${money(headroom.spendUsd.month)}/month ` +
         `(≈$${costPerRecord.toFixed(2)}/lead).`);
 }
+function printAcquireOutput(options) {
+    const { args, result, meter, meterLine, gaugeLine, saved, planSaved, hostedPlanUrl } = options;
+    if (args.includes("--json")) {
+        console.log(JSON.stringify({
+            plan: result.plan,
+            counts: result.counts,
+            estCostUsd: result.estCostUsd,
+            meter,
+            persistence: {
+                runSaved: saved,
+                planSaved,
+                planId: planSaved ? result.plan.id : null,
+                hostedPlanUrl,
+            },
+        }, null, 2));
+        return;
+    }
+    if (verbosePlanRequested(args)) {
+        console.log(patchPlanToMarkdown(result.plan));
+        console.log(`\nAcquisition`);
+        console.log(`  Leads      ${result.counts.created} net-new · ${result.counts.unassigned} unassigned`);
+        console.log(`  Est. cost  $${result.estCostUsd.toFixed(2)}`);
+        console.log(`  Budget     ${gaugeLine ?? meterLine}`);
+        if (hostedPlanUrl)
+            console.log(`  Plan       ${hostedPlanUrl}`);
+    }
+    else if (planSaved || !saved) {
+        console.log(compactPlan(result.plan, { saved: planSaved }));
+        console.log(meterLine);
+        if (gaugeLine)
+            console.log(gaugeLine);
+    }
+    else {
+        console.log(meterLine);
+        if (gaugeLine)
+            console.log(gaugeLine);
+        console.log("No net-new leads to create (everything sourced already matched, or was withheld by the meter).");
+    }
+    if (planSaved) {
+        console.log(`\nApprove  fullstackgtm plans approve ${result.plan.id} --operations all`);
+        console.log(`Apply    fullstackgtm apply --plan-id ${result.plan.id} --provider <hubspot|salesforce>`);
+        const hostedRuns = hostedRunsUrl();
+        if (hostedRuns)
+            console.log(`Observe  ${hostedRuns}`);
+        console.log("The meter is charged only when a create lands at apply.");
+    }
+}
 function hostedRunsUrl() {
     const baseUrl = getCredential("broker")?.baseUrl?.replace(/\/+$/, "");
     return baseUrl ? `${baseUrl}/dashboard/runs` : null;

package/dist/cli/help.js

@@ -16,13 +16,16 @@ Usage:
   fullstackgtm login salesforce --instance-url <url> [--no-validate]  advanced: paste access token
   fullstackgtm login stripe [--no-validate]
   fullstackgtm login anthropic | openai        store an LLM API key for call parse/score
-  fullstackgtm login apollo                    store an Apollo API key for enrich pulls\n  fullstackgtm login pipe0 | explorium | theirstack  store a discovery-provider key (theirstack = technographic TAM)\n  fullstackgtm login heyreach                  store a HeyReach key for enrich acquire --source linkedin\n  fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|pipe0|explorium|heyreach|broker>
+  fullstackgtm login apollo | clay             store a data-provider Public API key
+  fullstackgtm login pipe0 | explorium | theirstack  store a discovery-provider key (theirstack = technographic TAM)
+  fullstackgtm login heyreach                  store a HeyReach key for enrich acquire --source linkedin
+  fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|heyreach|broker>
 
   Secrets (tokens, client secrets) are NEVER passed as flags — they leak via
   the process list and shell history. Pipe them on stdin or enter them at the
   interactive prompt:
     echo "$HUBSPOT_TOKEN" | fullstackgtm login hubspot --private-token
-  fullstackgtm init [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]
+  fullstackgtm init [--source pipe0|explorium|clay|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]
                                                cold start: scaffold icp.json + enrich.config.json + a
                                                PLAYBOOK wired for this workspace (the CLI ships primitives,
                                                your agent is the orchestrator — see docs/recipes.md)
@@ -72,7 +75,7 @@ Usage:
   fullstackgtm tam estimate [--name <n>] [--icp <path>] (--accounts <n> | --source theirstack|explorium) (--acv <annual-usd> | --acv-from-crm --deal-period monthly|quarterly|annual) [--acv-basis account|buyer] [--buyers-per-account <n>] [--cross-checks <file.json>] [source options] [--json]
   fullstackgtm tam status [--name <n>] <source options> [--save] [--json]
   fullstackgtm tam report [--name <n>] [--out <path>]
-  fullstackgtm tam populate [--name <n>] --cron "<expr>" [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--label <l>]
+  fullstackgtm tam populate [--name <n>] --cron "<expr>" [--source pipe0|explorium|clay|linkedin] [--provider hubspot|salesforce] [--label <l>]
                                                size the reachable market FROM the ICP (a real account count ×
                                                ACV; buyers/account = the contact population target), then fill
                                                it: populate schedules plan-only enrich acquire --save (apply
@@ -276,7 +279,7 @@ export const HELP = {
         summary: "scaffold a workspace (icp.json + enrich.config.json + PLAYBOOK)",
         phase: "Setup",
         synopsis: [
-            "fullstackgtm init [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]",
+            "fullstackgtm init [--source pipe0|explorium|clay|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]",
         ],
         detail: "Cold start: writes a starter ICP, an acquire-ready enrich.config.json (with a visible assign seam so leads are never ownerless), and a PLAYBOOK wired with the cold-start + outbound-loop recipes for this workspace. Pure file-writer — no network, keeps existing files unless --force. The CLI ships governed primitives; your coding agent is the orchestrator (see docs/recipes.md).",
         seeAlso: ["icp", "enrich", "signals"],
@@ -289,7 +292,7 @@ export const HELP = {
             "fullstackgtm login hubspot | salesforce          hosted browser OAuth (default)",
             "fullstackgtm login --via <hosted url>            pair with a team deployment",
             "fullstackgtm login stripe",
-            "fullstackgtm login anthropic | openai | apollo",
+            "fullstackgtm login anthropic | openai | apollo | clay",
         ],
         detail: "HubSpot/Salesforce use hosted browser OAuth by default; BYO app/token paths are advanced. Secrets are NEVER passed as flags — pipe on stdin or enter at the prompt: `echo \"$TOKEN\" | fullstackgtm login hubspot --private-token`.",
         seeAlso: ["doctor", "logout", "profiles"],
@@ -297,7 +300,7 @@ export const HELP = {
     logout: {
         summary: "remove stored credentials for a provider",
         phase: "Setup",
-        synopsis: ["fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|pipe0|explorium|broker>"],
+        synopsis: ["fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|broker>"],
         seeAlso: ["login", "doctor"],
     },
     doctor: {
@@ -633,7 +636,7 @@ export const COMMAND_FLAGS = {
     merge: ["--input", "--out", "--json"],
     market: ["--category", "--config", "--vendor", "--snapshot", "--task-account", "--task-deal", "--capture-run", "--run", "--prior-run", "--diff", "--from", "--calls", "--anchor", "--min-mentions", "--max-claims", "--promote-lift", "--model", "--format", "--auto", "--unverified", "--save", "--dry-run", "--verbose", "--json", "--out"],
     tam: [...SOURCE_FLAGS, "--source", "--name", "--icp", "--accounts", "--acv", "--acv-basis", "--acv-from-crm", "--deal-period", "--buyers-per-account", "--cross-checks", "--max", "--max-credits", "--usd-per-credit", "--dry-run", "--confirm", "--cron", "--label", "--save", "--verbose", "--json", "--out"],
-    icp: [...SOURCE_FLAGS, "--name", "--signals-from", "--with-history", "--prompt", "--min-score", "--from-judge", "--golden", "--against-outcomes", "--min-accuracy", "--model", "--label", "--save", "--verbose", "--json", "--out"],
+    icp: [...SOURCE_FLAGS, "--name", "--icp", "--domain", "--no-interactive", "--signals-from", "--with-history", "--prompt", "--min-score", "--from-judge", "--golden", "--against-outcomes", "--min-accuracy", "--model", "--label", "--save", "--verbose", "--json", "--out"],
     signals: ["--bucket", "--source", "--connector", "--connector-opt", "--watchlist", "--keywords", "--from", "--label", "--since", "--account", "--contact", "--unjudged", "--touch", "--result", "--save", "--verbose", "--json", "--explain"],
     draft: ["--from-judge", "--min-score", "--prompt", "--model", "--channel", "--save", "--dry-run", "--verbose", "--json", "--out"],
     schedule: ["--cron", "--label", "--provider", "--trigger", "--timer", "--runs", "--verbose", "--json"],