fullstackgtm 0.53.1 → 0.55.0

package/CHANGELOG.md

@@ -7,6 +7,48 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.55.0] — 2026-07-13
+
+### Added
+
+- `signals discover` turns editable ICP behavioral-trigger hypotheses into
+  evidence-gated public ATS searches through Exa, resolves employers to
+  official domains, and emits verbatim-quoted signals for `icp judge`.
+- ICP derivation now proposes structured trigger hypotheses with positive
+  evidence, active projects, buyer functions, negative evidence, and preferred
+  public source classes; existing `intentTopics` ICPs remain compatible.
+- Exa joins the credential ladder through `EXA_API_KEY`,
+  `FSGTM_EXA_API_KEY`, or `fullstackgtm login exa`.
+
+### Changed
+
+- Signal discovery exposes explicit account, result, search, and reported-cost
+  limits, structured JSON output, and remains read-only unless `--save` is used
+  to persist the local signal ledger.
+- `signals discover` is schedulable alongside `signals fetch`; unattended runs
+  still cannot emit or apply CRM patch plans.
+
+## [0.54.0] — 2026-07-12
+
+### Added
+
+- Website-derived ICPs classify investment firms as an explicit `investment`
+  motion with editable target stages, target-company funding bands, thesis
+  keywords, and founder personas.
+- Clay investment acquisition searches thesis-shaped companies first, then
+  resolves founders across the matched accounts in one batched people search.
+- The public Clay connector exports normalized company-search pages and the
+  shared account-first investment discovery primitive.
+
+### Changed
+
+- Investment discovery validates that resolved people currently work at the
+  thesis-qualified account, preventing past-employer matches from becoming
+  proposed leads.
+- ICP derivation distinguishes fund size, AUM, and check size from a target
+  company's prior funding, and maps earliest-stage language conservatively.
+- Clay company-size filters use the provider's lower-bound bucket vocabulary.
+
 ## [0.53.1] — 2026-07-11
 
 ### Changed

package/DATA-FLOWS.md

@@ -24,6 +24,7 @@ is no fullstackgtm-operated server in the data path for the open package.**
 | `snapshot`, `audit`, `apply`, `resolve`, `bulk-update`, `dedupe`, `reassign`, `fix`, `enrich` (writeback) | **Your CRM** (HubSpot / Salesforce / Stripe API) | Reads: your CRM records. Writes: only approved patch operations. | Your CRM token (env / stored / broker) |
 | `call parse`, `call score`, `market classify`, `market refresh` | **Your LLM provider** (api.anthropic.com or api.openai.com) | The call transcript / captured competitor page text you point at, plus the extraction prompt | Your `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` (BYO) |
 | `enrich append --source apollo`, `enrich refresh` | **Apollo** (api.apollo.io) | The company domain / contact email being enriched | Your `APOLLO_API_KEY` (BYO) |
+| `signals discover --source exa` | **Exa** (api.exa.ai) | Behavioral trigger labels/evidence terms from the selected ICP; employer names from matching public ATS results are sent in follow-up searches to resolve official domains. No CRM snapshot or credentials other than the Exa key. | Your `EXA_API_KEY` / stored `login exa` key (BYO) |
 | `market capture`, `market refresh` | **Public vendor websites** you list in `market.config.json` | A bounded HTTP GET; DNS answers are validated and pinned, mixed/private/reserved answers are refused, and every redirect is revalidated | none |
 | `login --via <url>` (optional) | **Your hosted deployment's broker** | A pairing handshake; the broker mints short-lived CRM tokens | broker pairing token |
 | paired `enrich acquire` checkpoint sync (optional) | **Your hosted deployment** | Opaque query fingerprint plus provider cursor/list offset, exhaustion flag, and CAS revision. No prospect records, emails, names, or provider credentials. Scoped to the broker token's organization. | broker pairing token |

package/README.md

@@ -275,6 +275,8 @@ Cleaning and filling the CRM tells you *who* to reach; it never tells you *when*
 fullstackgtm signals fetch --bucket job --source greenhouse,lever,ashby --keywords "revops,growth" --save
 fullstackgtm signals fetch --connector serpapi-news,hubspot-forms --save   # news + first-party form demand
 fullstackgtm signals fetch --connector file --save                         # webhook landing zone (see docs/signal-spool-format.md)
+echo "$EXA_API_KEY" | fullstackgtm login exa                              # once; or keep the key in env
+fullstackgtm signals discover --icp ./icp.json --source exa --since 30d --max-searches 12 --max-usd 0.25 --save
 fullstackgtm signals list --since 7d                         # ranked triggers, each with a verbatim source quote
 
 # 2. Decide who's worth a touch — and who isn't. Scores timing × fit × memory into send/nurture/skip.
@@ -313,7 +315,7 @@ fullstackgtm schedule status --runs 5            # last runs, exit codes, artifa
 fullstackgtm schedule uninstall                  # remove the managed block, touch nothing else
 ```
 
-**Scheduling never auto-approves.** Schedulable commands are read/plan-side only — `audit`, `snapshot`, `enrich append|refresh`, `enrich acquire --save`, `market capture|refresh`, `signals fetch`, `icp judge`, `icp eval`, `draft`, `suggest`, `report`, `doctor` — so unattended runs accumulate *proposals* (plans in the queue, run records, reports), never CRM writes. `apply` is schedulable only as `apply --plan-id <id>`, and every firing re-checks the plan's status is approved: an unapproved plan records a `plan_not_approved` no-op run instead of executing, and no flag relaxes this. Arbitrary shell is not schedulable — an entry's argv must resolve to a known fullstackgtm command (validated at `add` time and re-checked at run time), and the timer line you audit — crontab entry or LaunchAgent `ProgramArguments` — is always `fullstackgtm schedule run <id>` and nothing else.
+**Scheduling never auto-approves.** Schedulable commands are read/plan-side only — `audit`, `snapshot`, `enrich append|refresh`, `enrich acquire --save`, `market capture|refresh`, `signals fetch|discover`, `icp judge`, `icp eval`, `draft`, `suggest`, `report`, `doctor` — so unattended runs accumulate *proposals* (plans in the queue, run records, reports), never CRM writes. `apply` is schedulable only as `apply --plan-id <id>`, and every firing re-checks the plan's status is approved: an unapproved plan records a `plan_not_approved` no-op run instead of executing, and no flag relaxes this. Arbitrary shell is not schedulable — an entry's argv must resolve to a known fullstackgtm command (validated at `add` time and re-checked at run time), and the timer line you audit — crontab entry or LaunchAgent `ProgramArguments` — is always `fullstackgtm schedule run <id>` and nothing else.
 
 `install` materializes enabled entries into the system timer; `--timer` defaults by platform. On macOS it writes one LaunchAgent plist per entry (`com.fullstackgtm.<profile>.<id>` in `~/Library/LaunchAgents`, loaded via `launchctl bootstrap`) — macOS gates `crontab` writes behind Full Disk Access, a permission no program can request, while LaunchAgents need none; launchd also coalesces firings missed during sleep into one run on wake. Re-install replaces the profile's plist fleet wholesale and never touches foreign plists. Elsewhere (or with `--timer crontab`) it renders a sentinel-delimited block (`# >>> fullstackgtm <profile> >>>` … `# <<< fullstackgtm <profile> <<<`) in your user crontab; re-install replaces the block wholesale and never touches lines outside it. Honest limitation: cron has no catch-up — a laptop asleep at firing time means a missed run. `schedule status` surfaces missed firings by comparing expected-vs-actual run history, so the gap is at least visible. Entries are provider-agnostic; cloud providers (Modal, AWS) arrive as scaffold generators that call the same `schedule run <id>` contract, and are refused as "not yet implemented" until then.
 

package/dist/cli/auth.js

@@ -376,7 +376,7 @@ export async function login(args) {
         console.log(`Stored Clay Public API key in ${credentialsPath()}. Clay connector commands resolve it automatically.`);
         return;
     }
-    if (provider === "pipe0" || provider === "explorium" || provider === "heyreach" || provider === "theirstack") {
+    if (provider === "pipe0" || provider === "explorium" || provider === "heyreach" || provider === "theirstack" || provider === "exa") {
         rejectArgvSecret(args, "--token", "--key", "--api-key");
         const key = await readSecret(`${provider} API key`);
         if (!key)
@@ -385,12 +385,13 @@ export async function login(args) {
         // is stored as-is and validated on the first pull.
         const stamp = new Date().toISOString();
         storeCredential(provider, { kind: "api_key", accessToken: key, createdAt: stamp, updatedAt: stamp });
-        const usedBy = provider === "theirstack" ? "`fullstackgtm tam estimate --source theirstack`" : "`fullstackgtm enrich acquire`";
+        const usedBy = provider === "theirstack" ? "`fullstackgtm tam estimate --source theirstack`" :
+            provider === "exa" ? "`fullstackgtm signals discover`" : "`fullstackgtm enrich acquire`";
         console.log(`Stored ${provider} API key in ${credentialsPath()}. ${usedBy} uses it automatically (validated on first pull).`);
         return;
     }
     if (provider !== "hubspot") {
-        throw new Error("login supports: hubspot, salesforce, stripe, anthropic, openai, openrouter, apollo, clay, pipe0, explorium, heyreach, theirstack, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com");
+        throw new Error("login supports: hubspot, salesforce, stripe, anthropic, openai, openrouter, apollo, clay, pipe0, explorium, heyreach, theirstack, exa, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com");
     }
     const now = new Date().toISOString();
     rejectArgvSecret(args, "--token");

package/dist/cli/enrich.js

@@ -8,7 +8,7 @@ import { createFilePlanStore } from "../planStore.js";
 import { buildAcquirePlan, buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, builtinAcquirePreset, builtinEnrichPreset, enrichRunId, inferIngestObjectType, latestStamps, loadEnrichConfig, parseCsv, resolveCrmField, selectStaleWork, stagedSourceRecords, staleDaysFor } from "../enrich.js";
 import { loadMeter, remaining } from "../acquireMeter.js";
 import { crmContactKeys, fetchExploriumProspects, fetchPipe0CrustdataProspectPage, partitionFreshProspects, pipe0ResolveCompanyDomains, pipe0ResolveWorkEmails, prospectIdentityKeys } from "../connectors/prospectSources.js";
-import { createClaySearch, runClayPeopleSearchPage } from "../connectors/clay.js";
+import { createClaySearch, discoverClayInvestmentProspects, runClayPeopleSearchPage } from "../connectors/clay.js";
 import { runContactWaterfall } from "../contactProviders.js";
 import { loadSeen, recordSeen } from "../acquireSeen.js";
 import { acquireCheckpointId, createFileAcquireCheckpointStore } from "../acquireCheckpoint.js";
@@ -17,13 +17,13 @@ import { uploadHostedPatchPlan } from "../hostedPatchPlan.js";
 import { progressReporter, reportCounts, reportEvent } from "../runReport.js";
 import { ACQUIRE_STAGES, composeListeners, createProgressEmitter } from "../progress.js";
 import { createLinkedInProvider, discoverLinkedInProspects } from "../acquireLinkedIn.js";
-import { clayPeopleFilterRoutes, fitThreshold, icpToClayPeopleFilters, icpToCrustdataFilters, icpToExploriumFilters, scoreProspectAgainstIcp } from "../icp.js";
+import { clayPeopleFilterRoutes, fitThreshold, icpToClayInvestmentCompanyFilters, icpToClayPeopleFilters, icpToCrustdataFilters, icpToExploriumFilters, scoreProspectAgainstIcp } from "../icp.js";
 import { apolloPullKeysForAppend, apolloPullKeysForRefresh, createApolloClient, pullApolloRecords } from "../enrichApollo.js";
 import { isSpoolPath, readSpoolPath } from "../spoolFiles.js";
 import { isOptionValue, loadIcp, numericOption, option, readSnapshot, saveRequested } from "./shared.js";
 import { providerKey } from "./tam.js";
 import { unknownSubcommandError } from "./suggest.js";
-import { box, colorEnabled, createProgressRenderer, createStatusLine, formatBar, formatDuration, paint, truncateToWidth } from "./ui.js";
+import { box, colorEnabled, createProgressRenderer, createStatusLine, formatBar, formatDuration, paint, scoreColor, truncateToWidth } from "./ui.js";
 import { compactPlan, verbosePlanRequested } from "./planOutput.js";
 /**
  * The enrich layer: governed append/refresh of third-party data (Apollo pull,
@@ -581,27 +581,42 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
             exhausted = result.nextCursor === null;
         }
         else if (disc.provider === "clay") {
-            while (true) {
-                if (!cursor) {
-                    const route = clayRoutes[clayRouteIndex];
-                    if (route)
-                        filters = route.filters;
-                    progress.note(`creating Clay people-search iterator · ${route?.id ?? "configured"}`);
-                    cursor = await createClaySearch({ apiKey: providerKey("clay"), sourceType: "people", filters });
-                }
-                const result = await runClayPeopleSearchPage({ apiKey: providerKey("clay"), searchId: cursor, limit: requestSize });
+            if (icp?.motion === "investment") {
+                const companyFilters = icpToClayInvestmentCompanyFilters(icp);
+                progress.note("searching Clay companies against the investment thesis");
+                const result = await discoverClayInvestmentProspects({
+                    apiKey: providerKey("clay"), companyFilters,
+                    titleKeywords: icp.persona.titleKeywords ?? ["Founder", "Co-founder", "CEO", "CTO"],
+                    companyLimit: Math.min(scanLimit - discovered, 25), prospectLimit: requestSize,
+                });
                 page = result.prospects;
-                offset += page.length;
-                exhausted = !result.hasMore;
-                if (page.length > 0 || !allowClayFallback || clayRouteIndex >= clayRoutes.length - 1)
-                    break;
-                const failed = clayRoutes[clayRouteIndex]?.id ?? "configured";
-                clayRouteIndex += 1;
-                const next = clayRoutes[clayRouteIndex];
-                progress.note(`Clay ${failed} route returned 0 · trying ${next.id}`);
-                cursor = null;
-                offset = 0;
-                exhausted = false;
+                progress.note(`${result.companiesScanned} target account(s) scanned · resolving founders`);
+                exhausted = true;
+                cursor = "investment-account-first";
+            }
+            else {
+                while (true) {
+                    if (!cursor) {
+                        const route = clayRoutes[clayRouteIndex];
+                        if (route)
+                            filters = route.filters;
+                        progress.note(`creating Clay people-search iterator · ${route?.id ?? "configured"}`);
+                        cursor = await createClaySearch({ apiKey: providerKey("clay"), sourceType: "people", filters });
+                    }
+                    const result = await runClayPeopleSearchPage({ apiKey: providerKey("clay"), searchId: cursor, limit: requestSize });
+                    page = result.prospects;
+                    offset += page.length;
+                    exhausted = !result.hasMore;
+                    if (page.length > 0 || !allowClayFallback || clayRouteIndex >= clayRoutes.length - 1)
+                        break;
+                    const failed = clayRoutes[clayRouteIndex]?.id ?? "configured";
+                    clayRouteIndex += 1;
+                    const next = clayRoutes[clayRouteIndex];
+                    progress.note(`Clay ${failed} route returned 0 · trying ${next.id}`);
+                    cursor = null;
+                    offset = 0;
+                    exhausted = false;
+                }
             }
         }
         else if (disc.provider === "explorium") {
@@ -815,12 +830,14 @@ function renderAcquireLeadCards(result) {
             fit = Number(JSON.parse(item?.text ?? "{}").fitScore);
         }
         catch { /* malformed evidence remains display-only */ }
+        const fitPercent = Number.isFinite(fit) ? Math.round((fit ?? 0) * 100) : undefined;
         const lines = [
-            truncateToWidth(name, 84),
-            truncateToWidth(`${title} · ${company}`, 84),
-            truncateToWidth([payload.associateCompanyDomain, props.hs_linkedin_url].filter(Boolean).join(" · "), 84),
+            p.bold(truncateToWidth(name, 84)),
+            p.cyan(truncateToWidth(`${title} · ${company}`, 84)),
+            p.blue(truncateToWidth([payload.associateCompanyDomain, props.hs_linkedin_url].filter(Boolean).join(" · "), 84)),
         ];
-        return box(lines, p, `Lead ${index + 1}/${result.plan.operations.length}${Number.isFinite(fit) ? ` · ${Math.round((fit ?? 0) * 100)}% fit` : ""}`).join("\n");
+        const fitLabel = fitPercent === undefined ? "" : ` · ${scoreColor(fitPercent, p)}% fit`;
+        return box(lines, p, `Lead ${index + 1}/${result.plan.operations.length}${fitLabel}`).join("\n");
     }).join("\n");
 }
 function printAcquireOutput(options) {

package/dist/cli/help.js

@@ -17,9 +17,9 @@ Usage:
   fullstackgtm login stripe [--no-validate]
   fullstackgtm login anthropic | openai        store an LLM API key for call parse/score
   fullstackgtm login apollo | clay             store a data-provider Public API key
-  fullstackgtm login pipe0 | explorium | theirstack  store a discovery-provider key (theirstack = technographic TAM)
+  fullstackgtm login pipe0 | explorium | theirstack | exa  store a discovery-provider key
   fullstackgtm login heyreach                  store a HeyReach key for enrich acquire --source linkedin
-  fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|heyreach|broker>
+  fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|theirstack|exa|heyreach|broker>
 
   Secrets (tokens, client secrets) are NEVER passed as flags — they leak via
   the process list and shell history. Pipe them on stdin or enter them at the
@@ -101,10 +101,12 @@ Usage:
                                                in the same plan (freemail domains never used;
                                                --skip-unmatched = report-only). HubSpot-only for now.
   fullstackgtm signals fetch [--bucket job,…] [--source greenhouse,lever,ashby] [--watchlist <path|crm:seg>] [--keywords …] [--from <file.json|spool.jsonl|spool-dir>] [--save]
+  fullstackgtm signals discover [--icp <path>] [--source exa] [--since 30d] [--max-accounts 10] [--max-results 50] [--max-searches 12] [--max-usd 0.25] [--save]
   fullstackgtm signals list [--since 7d] [--bucket b] [--account d] [--unjudged]
   fullstackgtm signals outcome --account <d> [--touch <id>] --result replied|meeting|bounced|no_reply
   fullstackgtm signals weights [--explain]
-                                               detect fresh buying triggers (ATS hiring scrapes + staged
+                                               detect fresh buying triggers (ICP-driven evidence discovery,
+                                               ATS hiring scans, and staged
                                                funding/company/social ingest), rank them, persist a local
                                                signal ledger. READ-ONLY re: CRM — fetch NEVER emits a plan;
                                                --save persists only the signal ledger. outcome feeds the
@@ -300,7 +302,7 @@ export const HELP = {
     logout: {
         summary: "remove stored credentials for a provider",
         phase: "Setup",
-        synopsis: ["fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|broker>"],
+        synopsis: ["fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|apollo|clay|pipe0|explorium|theirstack|exa|broker>"],
         seeAlso: ["login", "doctor"],
     },
     doctor: {
@@ -566,11 +568,12 @@ export const HELP = {
         phase: "Detect",
         synopsis: [
             "fullstackgtm signals fetch [--bucket job,…] [--source greenhouse,lever,ashby] [--connector file,serpapi-news,hubspot-forms] [--connector-opt k=v] [--watchlist <path|crm:seg>] [--keywords …] [--from <file.json|spool.jsonl|spool-dir>] [--save]",
+            "fullstackgtm signals discover [--icp <path>] [--source exa] [--since 30d] [--max-accounts 10] [--max-results 50] [--max-searches 12] [--max-usd 0.25] [--save]",
             "fullstackgtm signals list [--since 7d] [--bucket b] [--account d] [--unjudged]",
             "fullstackgtm signals outcome --account <d> [--touch <id>] --result replied|meeting|bounced|no_reply",
             "fullstackgtm signals weights [--explain]",
         ],
-        detail: "Read-only re: CRM — `fetch` NEVER emits a patch plan; `--save` persists only the local signal ledger. ATS adapters are no-auth; source connectors (`--connector`) pull from connected platforms with secrets via the credential ladder, never argv. `outcome` feeds the learned per-bucket `weights`.",
+        detail: "Read-only re: CRM — `fetch` and `discover` NEVER emit a patch plan; `--save` persists only the local signal ledger. `discover` matches ICP behavioral hypotheses against canonical public ATS evidence through Exa, with explicit request and reported-cost budgets. Secrets resolve through env/login, never argv. `outcome` feeds the learned per-bucket `weights`.",
         seeAlso: ["icp", "draft"],
     },
     icp: {
@@ -637,12 +640,12 @@ export const COMMAND_FLAGS = {
     market: ["--category", "--config", "--vendor", "--snapshot", "--task-account", "--task-deal", "--capture-run", "--run", "--prior-run", "--diff", "--from", "--calls", "--anchor", "--min-mentions", "--max-claims", "--promote-lift", "--model", "--format", "--auto", "--unverified", "--save", "--dry-run", "--verbose", "--json", "--out"],
     tam: [...SOURCE_FLAGS, "--source", "--name", "--icp", "--accounts", "--acv", "--acv-basis", "--acv-from-crm", "--deal-period", "--buyers-per-account", "--cross-checks", "--max", "--max-credits", "--usd-per-credit", "--dry-run", "--confirm", "--cron", "--label", "--save", "--verbose", "--json", "--out"],
     icp: [...SOURCE_FLAGS, "--name", "--icp", "--domain", "--no-interactive", "--signals-from", "--with-history", "--prompt", "--min-score", "--from-judge", "--golden", "--against-outcomes", "--min-accuracy", "--model", "--label", "--save", "--verbose", "--json", "--out"],
-    signals: ["--bucket", "--source", "--connector", "--connector-opt", "--watchlist", "--keywords", "--from", "--label", "--since", "--account", "--contact", "--unjudged", "--touch", "--result", "--save", "--verbose", "--json", "--explain"],
+    signals: ["--bucket", "--source", "--connector", "--connector-opt", "--watchlist", "--keywords", "--from", "--label", "--since", "--icp", "--max-accounts", "--max-results", "--max-searches", "--max-usd", "--account", "--contact", "--unjudged", "--touch", "--result", "--save", "--verbose", "--json", "--explain"],
     draft: ["--from-judge", "--min-score", "--prompt", "--model", "--channel", "--save", "--dry-run", "--verbose", "--json", "--out"],
     schedule: ["--cron", "--label", "--provider", "--trigger", "--timer", "--runs", "--verbose", "--json"],
 };
 export const FLAGS_WITH_VALUES = new Set([
-    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
+    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-accounts", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--max-results", "--max-searches", "--max-usd", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
 ]);
 // Lifecycle-grouped front door. One line per verb, organized by the
 // Prevent→Detect→Remediate→Verify loop so a new user sees ~6 jobs, not 22 verbs.

package/dist/cli/icp.js

@@ -38,6 +38,10 @@ function updateReviewSegment(icp, id, raw) {
     if (["titleKeywords", "jobLevels", "departments"].includes(id)) {
         return { ...icp, persona: { ...icp.persona, [id]: values } };
     }
+    if (["investmentStages", "fundingAmounts", "thesisKeywords"].includes(id)) {
+        const field = id === "investmentStages" ? "stages" : id;
+        return { ...icp, investment: { ...icp.investment, [field]: values } };
+    }
     return { ...icp, signals: { ...icp.signals, intentTopics: values } };
 }
 function renderDerivedIcp(result, selected = -1) {

package/dist/cli/signals.js

@@ -2,11 +2,12 @@
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { getCredential, resolveHubspotConnection } from "../credentials.js";
+import { discoverSignalsWithExa } from "../signalDiscovery.js";
 import { buildSignalsFromAts, computeWeights, createFileSignalStore, DEFAULT_SIGNALS_CONFIG, dedupeSignals, loadSignalsConfig, makeOutcome, normalizeAccountDomain, SIGNAL_BUCKETS, signalRunId, signalsSpoolDir, stagedRowToSignal } from "../signals.js";
 import { fetchAtsJobs } from "../connectors/atsBoards.js";
 import { getSignalSource, listSignalSources } from "../connectors/signalSources.js";
 import { isSpoolPath, readSpoolPath } from "../spoolFiles.js";
-import { option, readSnapshot, repeatedOption, saveRequested } from "./shared.js";
+import { loadIcp, option, readSnapshot, repeatedOption, saveRequested } from "./shared.js";
 import { createStatusLine } from "./ui.js";
 import { unknownSubcommandError } from "./suggest.js";
 /**
@@ -103,12 +104,15 @@ export async function signalsCommand(args) {
     if (!sub || args.includes("--help") || args.includes("-h")) {
         console.log(`Usage:
   fullstackgtm signals fetch [--bucket job,funding,...] [--source greenhouse,lever,ashby] [--connector file,serpapi-news,hubspot-forms] [--connector-opt k=v ...] [--watchlist <path|crm:segment>] [--keywords "growth,revops"] [--from <file.json|spool.jsonl|spool-dir>] [--config <path>] [--save]
+  fullstackgtm signals discover [--icp <path>] [--source exa] [--since 30d] [--max-accounts 10] [--max-results 50] [--max-searches 12] [--max-usd 0.25] [--save]
   fullstackgtm signals list [--since 7d] [--bucket b] [--account d] [--unjudged]
   fullstackgtm signals outcome --account <domain> [--touch <id>] --result replied|meeting|bounced|no_reply
   fullstackgtm signals weights [--explain]
 
-Detect fresh buying triggers and rank them. \`fetch\` is read-only re: CRM — it
-NEVER emits a patch plan; --save persists only the local signal ledger (used by
+Detect fresh buying triggers and rank them. \`discover\` searches canonical
+public ATS pages for evidence matching the ICP's behavioral trigger hypotheses,
+then resolves employer domains through Exa. \`fetch\` and \`discover\` are read-only re: CRM — they
+NEVER emit a patch plan; --save persists only the local signal ledger (used by
 \`icp judge\`). ATS adapters are no-auth. Source connectors (--connector) pull
 from connected platforms: file (local JSON/JSONL spool, no auth), serpapi-news
 (API key via env/login), hubspot-forms (reuses the HubSpot login). Secrets come
@@ -120,6 +124,57 @@ from the credential ladder, never argv; --connector-opt carries non-secret knobs
 (one row per event); see docs/signal-spool-format.md.`);
         return;
     }
+    if (sub === "discover") {
+        const source = option(rest, "--source") ?? "exa";
+        if (source !== "exa")
+            throw new Error(`signals discover: unsupported --source "${source}" (currently: exa).`);
+        const icp = loadIcp(rest);
+        if (!icp)
+            throw new Error("signals discover: no ICP found. Pass --icp <path> or create ./icp.json.");
+        const apiKey = await resolveSignalSourceKey("exa");
+        if (!apiKey)
+            throw new Error("signals discover: missing Exa API key. Set EXA_API_KEY or run `fullstackgtm login exa`.");
+        const now = new Date();
+        const sinceArg = option(rest, "--since") ?? "30d";
+        const since = new Date(now.getTime() - parseSinceWindowMs(sinceArg));
+        const maxAccounts = positiveIntegerOption(rest, "--max-accounts", 10);
+        const maxResults = positiveIntegerOption(rest, "--max-results", 50);
+        const maxSearches = positiveIntegerOption(rest, "--max-searches", 12);
+        const maxUsd = positiveNumberOption(rest, "--max-usd", 0.25);
+        const config = resolveSignalsConfig(rest);
+        const status = createStatusLine();
+        status.set(`Searching public evidence with Exa… up to ${maxSearches} searches / $${maxUsd.toFixed(2)}`);
+        let discovered;
+        try {
+            discovered = await discoverSignalsWithExa({ icp, apiKey, since, maxAccounts, maxResults, maxSearches, maxUsd, now,
+                config });
+        }
+        finally {
+            status.done();
+        }
+        const store = createFileSignalStore();
+        const priorSignals = await store.allSignals();
+        const { fresh, deduped } = dedupeSignals(discovered.signals, priorSignals, config.dedupWindowDays, now);
+        const ranked = [...fresh].sort((a, b) => b.weight - a.weight || a.accountDomain.localeCompare(b.accountDomain));
+        const output = { ...discovered.summary, freshSignals: ranked.length, dedupedSignals: deduped.length,
+            warnings: discovered.summary.warnings, signals: ranked };
+        console.log(rest.includes("--json") || rest.includes("--verbose") ? JSON.stringify(output, null, 2) : renderSignals(ranked));
+        console.error(`Exa: ${discovered.summary.searchesUsed}/${maxSearches} searches, $${discovered.summary.costUsd.toFixed(4)} reported cost; ` +
+            `${discovered.summary.matchedEvidence} evidence match(es), ${discovered.summary.resolvedAccounts} account(s), ` +
+            `${ranked.length} fresh. NO plan emitted — discovery is read-only re: CRM.`);
+        for (const warning of discovered.summary.warnings)
+            console.error(`Warning: ${warning}`);
+        if (saveRequested(rest)) {
+            const runLabel = option(rest, "--label") ?? `discover-${now.toISOString().slice(0, 10)}`;
+            await store.appendRun({ id: signalRunId(runLabel), runLabel, startedAt: now.toISOString(), completedAt: new Date().toISOString(),
+                buckets: ["job"], counts: { fetched: discovered.summary.rawResults, new: ranked.length, deduped: deduped.length }, signals: ranked });
+            console.error(`Saved signal run "${runLabel}". Next: \`fullstackgtm icp judge --signals-from ${runLabel} --save\`.`);
+        }
+        else {
+            console.error("(not saved — re-run with --save to persist this evidence to the signal ledger)");
+        }
+        return;
+    }
     if (sub === "fetch") {
         const config = resolveSignalsConfig(rest);
         // Merge --keywords into the job bucket; filter buckets + job sources.
@@ -328,7 +383,25 @@ from the credential ladder, never argv; --connector-opt carries non-secret knobs
         }
         return;
     }
-    throw unknownSubcommandError("signals", sub, ["fetch", "list", "outcome", "weights"]);
+    throw unknownSubcommandError("signals", sub, ["fetch", "discover", "list", "outcome", "weights"]);
+}
+function positiveIntegerOption(args, flag, fallback) {
+    const raw = option(args, flag);
+    if (raw == null)
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 1)
+        throw new Error(`${flag}: expected a positive integer (got "${raw}").`);
+    return value;
+}
+function positiveNumberOption(args, flag, fallback) {
+    const raw = option(args, flag);
+    if (raw == null)
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value <= 0)
+        throw new Error(`${flag}: expected a number greater than zero (got "${raw}").`);
+    return value;
 }
 /** Parse a "7d"/"30d"/"12h" recency window into milliseconds. */
 function parseSinceWindowMs(value) {

package/dist/cli/ui.js

@@ -135,14 +135,14 @@ export function formatCount(value) {
  * ANSI codes inside `lines` would inflate the measured width.
  */
 export function box(lines, p, title) {
-    const inner = Math.max(...lines.map((line) => line.length), title ? title.length + 2 : 0);
+    const inner = Math.max(...lines.map((line) => stripAnsi(line).length), title ? stripAnsi(title).length + 2 : 0);
     const top = title
-        ? `╭─ ${title} ${"─".repeat(Math.max(0, inner - title.length - 1))}╮`
+        ? `╭─ ${title} ${"─".repeat(Math.max(0, inner - stripAnsi(title).length - 1))}╮`
         : `╭${"─".repeat(inner + 2)}╮`;
     const bottom = `╰${"─".repeat(inner + 2)}╯`;
     return [
         p.dim(top),
-        ...lines.map((line) => `${p.dim("│")} ${line.padEnd(inner)} ${p.dim("│")}`),
+        ...lines.map((line) => `${p.dim("│")} ${line}${" ".repeat(Math.max(0, inner - stripAnsi(line).length))} ${p.dim("│")}`),
         p.dim(bottom),
     ];
 }

package/dist/connectors/clay.d.ts

@@ -10,6 +10,20 @@ export type ClayPeopleSearchPage = {
     prospects: Prospect[];
     hasMore: boolean;
 };
+export type ClayCompany = {
+    name?: string;
+    domain?: string;
+    linkedin?: string;
+    description?: string;
+    industry?: string;
+    size?: string;
+    location?: string;
+    fundingAmountRange?: string;
+};
+export type ClayCompanySearchPage = {
+    companies: ClayCompany[];
+    hasMore: boolean;
+};
 /** Create a forward-only Clay search iterator. This call does not fetch a page. */
 export declare function createClaySearch(opts: {
     apiKey: string;
@@ -26,6 +40,30 @@ export declare function runClayPeopleSearchPage(opts: {
     fetchImpl?: typeof fetch;
     apiBaseUrl?: string;
 }): Promise<ClayPeopleSearchPage>;
+/** Consume the next company page from a Clay search iterator. */
+export declare function runClayCompanySearchPage(opts: {
+    apiKey: string;
+    searchId: string;
+    limit?: number;
+    fetchImpl?: typeof fetch;
+    apiBaseUrl?: string;
+}): Promise<ClayCompanySearchPage>;
+export declare function normalizeClayCompany(value: unknown): ClayCompany;
+/** Account-first investment discovery: find thesis-shaped companies, then
+ * resolve founders/operators only inside those accounts. */
+export declare function discoverClayInvestmentProspects(opts: {
+    apiKey: string;
+    companyFilters: Record<string, unknown>;
+    titleKeywords: string[];
+    companyLimit: number;
+    prospectLimit: number;
+    fetchImpl?: typeof fetch;
+    apiBaseUrl?: string;
+}): Promise<{
+    prospects: Prospect[];
+    companiesScanned: number;
+    companiesMatched: ClayCompany[];
+}>;
 export declare function normalizeClayPerson(value: unknown): Prospect;
 /** Validate a Clay Public API key without creating a search or spending enrichment credits. */
 export declare function validateClayApiKey(apiKey: string, fetchImpl?: typeof fetch, apiBaseUrl?: string): Promise<ClayKeyValidation>;

package/dist/connectors/clay.js

@@ -41,6 +41,64 @@ export async function runClayPeopleSearchPage(opts) {
         throw new Error("Clay people search returned no has_more flag.");
     return { prospects: body.data.map(normalizeClayPerson), hasMore };
 }
+/** Consume the next company page from a Clay search iterator. */
+export async function runClayCompanySearchPage(opts) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const base = (opts.apiBaseUrl ?? CLAY_PUBLIC_API_BASE).replace(/\/$/, "");
+    const limit = Math.max(1, Math.min(opts.limit ?? 25, 100));
+    const response = await fetchImpl(`${base}/search/filters-mode/${encodeURIComponent(opts.searchId)}/run`, {
+        method: "POST", headers: clayHeaders(opts.apiKey), body: JSON.stringify({ limit }),
+    });
+    if (!response.ok)
+        throw new ProviderHttpError("Clay", "run company search", response.status);
+    const body = await response.json();
+    if (!Array.isArray(body.data))
+        throw new Error("Clay company search returned an invalid data array.");
+    const hasMore = body.has_more ?? body.hasMore;
+    if (typeof hasMore !== "boolean")
+        throw new Error("Clay company search returned no has_more flag.");
+    return { companies: body.data.map(normalizeClayCompany), hasMore };
+}
+export function normalizeClayCompany(value) {
+    const row = value && typeof value === "object" ? value : {};
+    return {
+        name: stringValue(row.name), domain: bareDomain(stringValue(row.domain)),
+        linkedin: normalizeLinkedin(stringValue(row.linkedin_url)), description: stringValue(row.description),
+        industry: stringValue(row.industry), size: stringValue(row.size), location: stringValue(row.location),
+        fundingAmountRange: stringValue(row.total_funding_amount_range_usd),
+    };
+}
+/** Account-first investment discovery: find thesis-shaped companies, then
+ * resolve founders/operators only inside those accounts. */
+export async function discoverClayInvestmentProspects(opts) {
+    const companySearchId = await createClaySearch({
+        apiKey: opts.apiKey, sourceType: "companies", filters: opts.companyFilters,
+        fetchImpl: opts.fetchImpl, apiBaseUrl: opts.apiBaseUrl,
+    });
+    const companyPage = await runClayCompanySearchPage({
+        apiKey: opts.apiKey, searchId: companySearchId, limit: opts.companyLimit,
+        fetchImpl: opts.fetchImpl, apiBaseUrl: opts.apiBaseUrl,
+    });
+    const prospects = [];
+    const identifiers = companyPage.companies.map((company) => company.domain ?? company.linkedin).filter((value) => Boolean(value));
+    if (identifiers.length > 0) {
+        const peopleSearchId = await createClaySearch({
+            apiKey: opts.apiKey, sourceType: "people",
+            filters: { company_identifier: identifiers, job_title_keywords: opts.titleKeywords },
+            fetchImpl: opts.fetchImpl, apiBaseUrl: opts.apiBaseUrl,
+        });
+        const peoplePage = await runClayPeopleSearchPage({
+            apiKey: opts.apiKey, searchId: peopleSearchId,
+            limit: opts.prospectLimit,
+            fetchImpl: opts.fetchImpl, apiBaseUrl: opts.apiBaseUrl,
+        });
+        // company_identifier may match a past experience. Investment discovery is
+        // explicitly account-first, so retain only people currently at an account.
+        const currentDomains = new Set(companyPage.companies.map((company) => company.domain).filter(Boolean));
+        prospects.push(...peoplePage.prospects.filter((person) => person.companyDomain && currentDomains.has(person.companyDomain)));
+    }
+    return { prospects, companiesScanned: companyPage.companies.length, companiesMatched: companyPage.companies };
+}
 export function normalizeClayPerson(value) {
     const row = value && typeof value === "object" ? value : {};
     const location = row.structured_location && typeof row.structured_location === "object"

package/dist/icp.d.ts

@@ -12,8 +12,35 @@
  *
  * Zero runtime deps; pure functions (translation + scoring take plain data).
  */
+export type TriggerHypothesis = {
+    /** Stable, human-editable key used to trace discovered evidence back to the ICP. */
+    id: string;
+    /** Observable business condition, e.g. "sales compensation process is breaking". */
+    label: string;
+    /** Phrases or concepts that count as supporting public evidence. */
+    positiveEvidence: string[];
+    /** Concrete projects/roles that often expose the condition. */
+    activeProjects?: string[];
+    /** Functions likely to own or feel the problem. */
+    buyerFunctions?: string[];
+    /** Terms that make a result a likely false positive. */
+    negativeEvidence?: string[];
+    /** Preferred public source classes. Discovery currently implements `job`. */
+    preferredSources?: Array<"job" | "news" | "company" | "social" | "review" | "legal">;
+};
 export type Icp = {
     name: string;
+    /** `investment` means the organization is sourcing companies to invest in,
+     * not conventional customers. Discovery becomes company-first, then resolves
+     * founders at the matched accounts. */
+    motion?: "sales" | "investment";
+    investment?: {
+        stages?: Array<"pre-seed" | "seed" | "series-a" | "series-b" | "growth" | "bootstrapped">;
+        /** Clay's native funding bands. */
+        fundingAmounts?: Array<"under_1m" | "1m_5m" | "5m_10m" | "10m_25m" | "25m_50m" | "50m_100m" | "100m_250m" | "over_250m" | "unknown">;
+        /** Terms expected in an investment target's company description. */
+        thesisKeywords?: string[];
+    };
     firmographics: {
         /** human industry labels, e.g. ["software","saas"] — used for keyword/industry filters */
         industries?: string[];
@@ -38,6 +65,8 @@ export type Icp = {
     };
     signals?: {
         intentTopics?: string[];
+        /** Testable behavioral hypotheses for evidence-first account discovery. */
+        triggerHypotheses?: TriggerHypothesis[];
     };
     scoring?: {
         /** minimum fit (0..1) for a prospect to become a create_record op. Default 0.5. */
@@ -46,6 +75,10 @@ export type Icp = {
 };
 export declare const DEFAULT_FIT_THRESHOLD = 0.5;
 export declare function parseIcp(raw: string): Icp;
+/** Native Clay company filters for an investment thesis. */
+export declare function icpToClayInvestmentCompanyFilters(icp: Icp): Record<string, unknown>;
+/** People filters used only after an investment target account has matched. */
+export declare function clayInvestmentPeopleFilters(icp: Icp, companyIdentifier: string): Record<string, unknown>;
 /** Explorium /v1/prospects filters from the ICP. */
 export declare function icpToExploriumFilters(icp: Icp): Record<string, {
     values?: string[];