fullstackgtm 0.13.1 → 0.14.1

package/dist/llm.js

@@ -0,0 +1,241 @@
+import { getCredential } from "./credentials.js";
+export const DEFAULT_MODELS = {
+    anthropic: "claude-haiku-4-5",
+    openai: "gpt-4o-mini",
+};
+const ANTHROPIC_URL = "https://api.anthropic.com/v1/messages";
+const OPENAI_URL = "https://api.openai.com/v1/chat/completions";
+// Bound cost and context: long calls keep the head and tail.
+const MAX_TRANSCRIPT_CHARS = 28_000;
+export function detectProviderFromKey(apiKey) {
+    return apiKey.startsWith("sk-ant-") ? "anthropic" : "openai";
+}
+/** Env first (ANTHROPIC_API_KEY, then OPENAI_API_KEY), then the credential store. */
+export function resolveLlmCredential(env = process.env) {
+    if (env.ANTHROPIC_API_KEY)
+        return { provider: "anthropic", apiKey: env.ANTHROPIC_API_KEY, source: "env" };
+    if (env.OPENAI_API_KEY)
+        return { provider: "openai", apiKey: env.OPENAI_API_KEY, source: "env" };
+    for (const provider of ["anthropic", "openai"]) {
+        const stored = getCredential(provider);
+        if (stored?.accessToken)
+            return { provider, apiKey: stored.accessToken, source: "stored" };
+    }
+    return null;
+}
+const INSIGHT_TYPES = [
+    "pain_point",
+    "objection",
+    "competitor_mention",
+    "next_step",
+    "feature_request",
+    "pricing",
+    "decision_criteria",
+    "risk",
+    "coaching_moment",
+];
+const EXTRACT_SCHEMA = {
+    type: "object",
+    required: ["insights"],
+    properties: {
+        insights: {
+            type: "array",
+            items: {
+                type: "object",
+                required: ["type", "text", "evidence", "importance", "confidence"],
+                properties: {
+                    type: { type: "string", enum: INSIGHT_TYPES },
+                    text: { type: "string", description: "The insight, concise and specific (one sentence)." },
+                    evidence: { type: "string", description: "VERBATIM quote from the transcript that grounds this insight. Never paraphrase." },
+                    speaker: { type: "string", description: "Who said the evidence, exactly as named in the transcript." },
+                    importance: { type: "integer", minimum: 1, maximum: 5 },
+                    confidence: { type: "number", minimum: 0, maximum: 1 },
+                    owner: { type: "string", description: "next_step only: who committed to the action." },
+                    deadline: { type: "string", description: "next_step only: when, as stated (e.g. 'Thursday 2 PM')." },
+                    commitment: { type: "string", enum: ["firm", "tentative", "exploratory"], description: "next_step only." },
+                },
+            },
+        },
+    },
+};
+const EXTRACT_INSTRUCTIONS = `Extract GTM insights from this sales call transcript.
+Rules:
+- evidence MUST be a verbatim quote from the transcript. If you cannot quote it, do not emit the insight.
+- text is your concise restatement; one sentence, specific (names, numbers, dates).
+- next_step insights are concrete commitments: include owner, deadline (as stated), and commitment level.
+- importance: 5 = affects the deal outcome directly, 1 = color.
+- Emit nothing for small talk. Quality over quantity.`;
+export async function extractInsightsLlm(transcript, options) {
+    const model = options.model ?? DEFAULT_MODELS[options.provider];
+    const text = truncateTranscript(transcript);
+    const prompt = `${EXTRACT_INSTRUCTIONS}\n\n${options.title ? `Call: ${options.title}\n` : ""}Transcript:\n${text}`;
+    const result = (await forcedToolCall(prompt, "extract_call_insights", EXTRACT_SCHEMA, model, options));
+    const insights = (result.insights ?? [])
+        .filter((insight) => INSIGHT_TYPES.includes(insight.type))
+        .map((insight) => ({
+        ...insight,
+        title: insight.type.replace(/_/g, " "),
+        importance: clamp(Math.round(insight.importance ?? 3), 1, 5),
+        confidence: clamp(insight.confidence ?? 0.7, 0, 1),
+    }))
+        .sort((a, b) => b.importance - a.importance || b.confidence - a.confidence);
+    return { insights, model };
+}
+export const DEFAULT_RUBRIC = {
+    scale: 5,
+    dimensions: [
+        { name: "Depth of Discovery", weight: 1.2, rubric: "Did the rep uncover concrete pain, current process, and cost of inaction with specifics — 5 — or stay at surface level — 1?" },
+        { name: "Next Steps & Commitment", weight: 1.2, rubric: "Did the call end with a specific, time-bound, mutually agreed next step (5) or vague intentions (1)?" },
+        { name: "Stakeholder Engagement", weight: 1.0, rubric: "Were decision makers and influencers identified and engaged (5) or is the rep single-threaded with an unknown buying group (1)?" },
+        { name: "Value Articulation", weight: 1.0, rubric: "Was value tied to the prospect's own stated problems and numbers (5) or generic feature talk (1)?" },
+        { name: "Objection Handling", weight: 1.0, rubric: "Were concerns surfaced, acknowledged, and resolved with evidence (5), or dismissed/avoided (1)?" },
+    ],
+};
+const SCORE_SCHEMA = (scale, dimensions) => ({
+    type: "object",
+    required: ["dimensions", "highlights", "missed_items"],
+    properties: {
+        dimensions: {
+            type: "array",
+            items: {
+                type: "object",
+                required: ["name", "score", "evidence", "coaching_note"],
+                properties: {
+                    name: { type: "string", enum: dimensions.map((d) => d.name) },
+                    score: { type: "integer", minimum: 1, maximum: scale },
+                    evidence: { type: "array", items: { type: "string" }, description: "Verbatim quotes supporting the score." },
+                    coaching_note: { type: "string", description: "One actionable sentence, max 25 words." },
+                },
+            },
+        },
+        highlights: { type: "array", items: { type: "string" } },
+        missed_items: { type: "array", items: { type: "string" } },
+    },
+});
+export async function scoreCallLlm(transcript, rubric, options) {
+    const model = options.model ?? DEFAULT_MODELS[options.provider];
+    const text = truncateTranscript(transcript);
+    const rubricText = rubric.dimensions
+        .map((d) => `- ${d.name} (weight ${d.weight}): ${d.rubric}`)
+        .join("\n");
+    const prompt = `Score this sales call against the rubric. Score every dimension 1-${rubric.scale}. Ground every score in verbatim quotes; if the transcript gives no signal for a dimension, score it low and say why in the coaching note.\n\nRubric:\n${rubricText}\n\n${options.title ? `Call: ${options.title}\n` : ""}Transcript:\n${text}`;
+    const result = (await forcedToolCall(prompt, "score_call", SCORE_SCHEMA(rubric.scale, rubric.dimensions), model, options));
+    const byName = new Map((result.dimensions ?? []).map((d) => [d.name, d]));
+    const dimensions = rubric.dimensions.map((dim) => {
+        const scored = byName.get(dim.name);
+        return {
+            name: dim.name,
+            score: clamp(Math.round(scored?.score ?? 1), 1, rubric.scale),
+            maxScore: rubric.scale,
+            weight: dim.weight,
+            evidence: scored?.evidence ?? [],
+            coachingNote: scored?.coaching_note ?? "No signal for this dimension in the transcript.",
+        };
+    });
+    const totalWeight = dimensions.reduce((sum, d) => sum + d.weight, 0);
+    const overallScore = Math.round((dimensions.reduce((sum, d) => sum + d.score * d.weight, 0) / totalWeight) * 100) / 100;
+    return {
+        dimensions,
+        overallScore,
+        scale: rubric.scale,
+        highlights: result.highlights ?? [],
+        missedItems: result.missed_items ?? [],
+        model,
+    };
+}
+export function parseRubric(json) {
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed.dimensions) || parsed.dimensions.length === 0) {
+        throw new Error("Rubric needs a dimensions array: { scale, dimensions: [{ name, weight, rubric }] }");
+    }
+    return {
+        scale: parsed.scale ?? 5,
+        dimensions: parsed.dimensions.map((d) => ({
+            name: String(d.name),
+            weight: typeof d.weight === "number" ? d.weight : 1,
+            rubric: String(d.rubric ?? ""),
+        })),
+    };
+}
+// ── Provider plumbing (raw fetch, forced tool calls) ───────────────────────
+async function forcedToolCall(prompt, toolName, schema, model, options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    if (options.provider === "anthropic") {
+        const response = await llmFetch(fetchImpl, ANTHROPIC_URL, {
+            method: "POST",
+            headers: {
+                "x-api-key": options.apiKey,
+                "anthropic-version": "2023-06-01",
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                model,
+                max_tokens: 4096,
+                tools: [{ name: toolName, description: `Return the ${toolName} result.`, input_schema: schema }],
+                tool_choice: { type: "tool", name: toolName },
+                messages: [{ role: "user", content: prompt }],
+            }),
+        });
+        const block = response.content?.find((item) => item.type === "tool_use");
+        if (!block?.input)
+            throw new Error("Anthropic returned no tool call — try again or a different --model.");
+        return block.input;
+    }
+    const response = await llmFetch(fetchImpl, OPENAI_URL, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${options.apiKey}`, "Content-Type": "application/json" },
+        body: JSON.stringify({
+            model,
+            messages: [{ role: "user", content: prompt }],
+            tools: [{ type: "function", function: { name: toolName, parameters: schema } }],
+            tool_choice: { type: "function", function: { name: toolName } },
+        }),
+    });
+    const call = response
+        .choices?.[0]?.message?.tool_calls?.[0];
+    if (!call?.function?.arguments)
+        throw new Error("OpenAI returned no tool call — try again or a different --model.");
+    return JSON.parse(call.function.arguments);
+}
+async function llmFetch(fetchImpl, url, init) {
+    let response;
+    try {
+        response = await fetchImpl(url, init);
+    }
+    catch (error) {
+        const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
+        throw new Error(`Cannot reach ${new URL(url).hostname}${cause}. Check network access.`);
+    }
+    if (!response.ok) {
+        // Status line only — provider error bodies can reflect request content.
+        throw new Error(`LLM API error ${response.status} ${response.statusText} from ${new URL(url).hostname}. Check the API key (\`fullstackgtm login anthropic|openai\`) and model name.`);
+    }
+    return response.json();
+}
+function truncateTranscript(transcript) {
+    if (transcript.length <= MAX_TRANSCRIPT_CHARS)
+        return transcript;
+    const half = MAX_TRANSCRIPT_CHARS / 2;
+    return `${transcript.slice(0, half)}\n[... middle of transcript truncated ...]\n${transcript.slice(-half)}`;
+}
+function clamp(value, min, max) {
+    return Math.min(max, Math.max(min, value));
+}
+/** Cheap key validation against the provider's model-list endpoint. Status line only. */
+export async function validateLlmKey(provider, apiKey, fetchImpl = fetch) {
+    const url = provider === "anthropic" ? "https://api.anthropic.com/v1/models" : "https://api.openai.com/v1/models";
+    const headers = provider === "anthropic"
+        ? { "x-api-key": apiKey, "anthropic-version": "2023-06-01" }
+        : { Authorization: `Bearer ${apiKey}` };
+    let response;
+    try {
+        response = await fetchImpl(url, { headers });
+    }
+    catch (error) {
+        const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : "";
+        return { ok: false, detail: `Cannot reach ${new URL(url).hostname}${cause}.` };
+    }
+    return response.ok
+        ? { ok: true, detail: `Key accepted by the ${provider} API.` }
+        : { ok: false, detail: `HTTP ${response.status} ${response.statusText}`.trim() };
+}

package/dist/mcp.js

@@ -45,7 +45,8 @@ import { generateDemoSnapshot } from "./demo.js";
 import { formatPatchPlanRun, patchPlanToMarkdown } from "./format.js";
 import { builtinAuditRules } from "./rules.js";
 import { sampleSnapshot } from "./sampleData.js";
-import { parseCall } from "./calls.js";
+import { normalizeTranscript, parseCall } from "./calls.js";
+import { extractInsightsLlm, resolveLlmCredential } from "./llm.js";
 import { suggestValues } from "./suggest.js";
 function content(value) {
     return {
@@ -162,21 +163,38 @@ export async function startMcpServer() {
     });
     server.registerTool("fullstackgtm_call_parse", {
         title: "Parse Call Transcript",
-        description: "Deterministically parse a call transcript (Speaker:/[Speaker]: lines or Granola " +
-            "utterance JSON) into canonical segments, keyword-derived insights (next steps, " +
-            "objections, pricing, risks, competitor mentions...), and GtmEvidence records. " +
-            "Read-only and LLM-free; pair with fullstackgtm_audit/apply for governed writes.",
+        description: "Parse a call transcript (Speaker:/[Speaker]: lines or Granola utterance JSON) into " +
+            "canonical segments, insights, and GtmEvidence records. extractor: 'auto' (default) " +
+            "uses LLM extraction when an Anthropic/OpenAI key is configured in the server " +
+            "environment or credential store, else the free deterministic keyword baseline; " +
+            "'llm' and 'deterministic' force either. Read-only; every insight is provenance-marked.",
         inputSchema: {
             transcript: z.string().optional(),
             transcriptPath: z.string().optional(),
             title: z.string().optional(),
             source: z.enum(["gong", "chorus", "fathom", "manual", "csv", "unknown"]).optional(),
+            extractor: z.enum(["auto", "llm", "deterministic"]).optional(),
+            model: z.string().optional(),
         },
-    }, async ({ transcript, transcriptPath, title, source }) => {
+    }, async ({ transcript, transcriptPath, title, source, extractor, model }) => {
         const raw = transcript ??
             (transcriptPath ? readFileSync(resolve(process.cwd(), transcriptPath), "utf8") : null);
         if (!raw)
             throw new Error("Provide transcript (text) or transcriptPath (file).");
+        const mode = extractor ?? "auto";
+        const credential = mode === "deterministic" ? null : resolveLlmCredential();
+        if (mode === "llm" && !credential) {
+            throw new Error("extractor 'llm' needs an API key: set ANTHROPIC_API_KEY or OPENAI_API_KEY in the MCP server environment, or store one with `fullstackgtm login anthropic|openai`.");
+        }
+        if (credential) {
+            const normalized = normalizeTranscript(raw);
+            const { insights, model: used } = await extractInsightsLlm(normalized, {
+                ...credential,
+                model,
+                title,
+            });
+            return content(parseCall(raw, { title, sourceSystem: source, insights, extractor: `llm:${credential.provider}:${used}` }));
+        }
         return content(parseCall(raw, { title, sourceSystem: source }));
     });
     server.registerTool("fullstackgtm_rules", {

package/llms.txt

@@ -20,8 +20,10 @@ at/above `--fail-on`.
 
 ## Key invariants (calls)
 
-`fullstackgtm call parse` (and MCP fullstackgtm_call_parse) is deterministic
-and LLM-free; `call link` suggests the deal with confidence + reason;
+`fullstackgtm call parse` defaults to LLM extraction (BYO Anthropic/OpenAI
+key; env or stored via `login anthropic|openai`); `--deterministic` is the
+free keyword baseline; `call score --rubric` produces evidence-quoted
+coaching scorecards; `call link` suggests the deal with confidence + reason;
 `call plan` proposes governed next-step writes through the standard
 approve/apply lifecycle.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.13.1",
+  "version": "0.14.1",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM",

package/src/calls.ts

@@ -270,6 +270,8 @@ export type ParsedCall = {
   id: string;
   title?: string;
   sourceSystem: GtmEvidenceSourceSystem;
+  /** What produced the insights: "deterministic" or "llm:<provider>:<model>". */
+  extractor: string;
   segments: ParsedTranscriptSegment[];
   insights: ExtractedCallInsight[];
   evidence: GtmEvidence[];
@@ -319,11 +321,18 @@ export function normalizeTranscript(raw: string): string {
  */
 export function parseCall(
   raw: string,
-  options: { title?: string; sourceSystem?: GtmEvidenceSourceSystem; capturedAt?: string } = {},
+  options: {
+    title?: string;
+    sourceSystem?: GtmEvidenceSourceSystem;
+    capturedAt?: string;
+    /** Pre-extracted insights (e.g. LLM); skips the deterministic extractor. */
+    insights?: ExtractedCallInsight[];
+    extractor?: string;
+  } = {},
 ): ParsedCall {
   const normalized = normalizeTranscript(raw);
   const segments = parseTranscript(normalized);
-  const insights = extractCallInsights(normalized, segments);
+  const insights = options.insights ?? extractCallInsights(normalized, segments);
   const sourceSystem = options.sourceSystem ?? "manual";
   const id = `call_${callHash(normalized)}`;
   const evidence: GtmEvidence[] = insights.map((insight, index) => ({
@@ -335,6 +344,7 @@ export function parseCall(
     text: insight.evidence,
     capturedAt: options.capturedAt,
     metadata: {
+      extractor: options.extractor ?? "deterministic",
       insightType: insight.type,
       speaker: insight.speaker,
       confidence: insight.confidence,
@@ -346,6 +356,7 @@ export function parseCall(
     id,
     title: options.title,
     sourceSystem,
+    extractor: options.extractor ?? "deterministic",
     segments,
     insights,
     evidence,

package/src/cli.ts

@@ -38,7 +38,18 @@ import { createFilePlanStore } from "./planStore.ts";
 import { auditReportToHtml, auditReportToMarkdown, type ReportOptions } from "./report.ts";
 import { builtinAuditRules } from "./rules.ts";
 import { sampleSnapshot } from "./sampleData.ts";
-import { parseCall, suggestCallDeal, type ExtractedCallInsight, type ParsedCall } from "./calls.ts";
+import { normalizeTranscript, parseCall, suggestCallDeal, type ExtractedCallInsight, type ParsedCall } from "./calls.ts";
+import {
+  DEFAULT_RUBRIC,
+  detectProviderFromKey,
+  extractInsightsLlm,
+  parseRubric,
+  resolveLlmCredential,
+  scoreCallLlm,
+  validateLlmKey,
+  type CallScorecard,
+  type LlmProvider,
+} from "./llm.ts";
 import { suggestValues, type ValueSuggestion } from "./suggest.ts";
 import type { FieldMappings } from "./mappings.ts";
 import type {
@@ -59,7 +70,7 @@ Usage:
   fullstackgtm login salesforce --device --client-id <consumer key> [--login-url <url>]
   fullstackgtm login salesforce --instance-url <url> [--no-validate]
   fullstackgtm login stripe [--no-validate]
-  fullstackgtm logout <hubspot|salesforce|stripe|broker>
+  fullstackgtm login anthropic | openai        store an LLM API key for call parse/score\n  fullstackgtm logout <hubspot|salesforce|stripe|anthropic|openai|broker>
 
   Secrets (tokens, client secrets) are NEVER passed as flags — they leak via
   the process list and shell history. Pipe them on stdin or enter them at the
@@ -70,11 +81,15 @@ Usage:
   fullstackgtm report [source options] [audit options] [report options]
   fullstackgtm diff --before <a.json> --after <b.json> [--json] [--fail-on-new-findings]
   fullstackgtm merge --input <a.json> --input <b.json> [...] --out <merged.json> [--json]
-  fullstackgtm call parse --transcript <file> [--title t] [--source fathom|granola|...] [--json|--ndjson] [--out <path>]
+  fullstackgtm call parse --transcript <file> [--title t] [--source fathom|granola|...] [--model m] [--deterministic] [--json|--ndjson] [--out <path>]
+  fullstackgtm call score --transcript <file>|--call <parsed.json> [--rubric <rubric.json>] [--model m] [--json|--out <path>]
   fullstackgtm call link --attendees <a@x.com,...> | --domain <x.com>  [source options] [--json]
   fullstackgtm call plan --transcript <file>|--call <parsed.json> --deal <id> [source options] [--save|--json]
-                                               calls become evidence: parse dialects (Speaker:/[Me]/Granola JSON),
-                                               link to the right deal, and propose governed next-step writes
+                                               calls become evidence: LLM extraction by default (bring your own
+                                               Anthropic or OpenAI key — captured once on first use, or
+                                               ANTHROPIC_API_KEY/OPENAI_API_KEY, or \`login anthropic|openai\`);
+                                               --deterministic uses the free keyword baseline. Then link the call
+                                               to its deal and propose governed next-step writes.
   fullstackgtm suggest --plan-id <id> | --plan <path>  [source options] [--json] [--out <path>]
                                                derive values for requires_human_* placeholders
                                                from snapshot evidence, with confidence + reasons
@@ -475,8 +490,19 @@ function parseValueOverrides(args: string[]) {
 
 async function callCommand(args: string[]) {
   const [subcommand, ...rest] = args;
+  if (args.includes("--help") || args.includes("-h")) {
+    console.log(`call parse --transcript <file> [--title t] [--source s] [--model m] [--deterministic] [--json|--ndjson] [--out <path>]
+call score --transcript <file>|--call <parsed.json> [--rubric <rubric.json>] [--model m] [--json|--out <path>]
+call link --attendees <a@x.com,...> | --domain <x.com>  [source options] [--json]
+call plan --transcript <file>|--call <parsed.json> --deal <id> [source options] [--save|--json]
+
+parse/score default to LLM extraction (Anthropic or OpenAI key via env,
+\`login anthropic|openai\`, or a one-time prompt). parse --deterministic is
+the free keyword baseline; score always needs a key (scoring is LLM work).`);
+    return;
+  }
 
-  const loadParsedCall = (): ParsedCall => {
+  const loadParsedCall = async (): Promise<ParsedCall> => {
     const callPath = option(rest, "--call");
     if (callPath) {
       return JSON.parse(readFileSync(resolve(process.cwd(), callPath), "utf8")) as ParsedCall;
@@ -485,15 +511,31 @@ async function callCommand(args: string[]) {
     if (!transcriptPath) throw new Error(`call ${subcommand} requires --transcript <file> or --call <parsed.json>`);
     const raw = readFileSync(resolve(process.cwd(), transcriptPath), "utf8");
     const source = option(rest, "--source") as ParsedCall["sourceSystem"] | undefined;
-    return parseCall(raw, {
+    const base = {
       title: option(rest, "--title") ?? undefined,
       sourceSystem: source,
       capturedAt: new Date().toISOString(),
+    };
+    if (rest.includes("--deterministic")) {
+      return parseCall(raw, base);
+    }
+    // LLM extraction is the default: bring-your-own-key (Anthropic or OpenAI).
+    const credential = await requireLlmCredential();
+    const normalized = normalizeTranscript(raw);
+    const { insights, model } = await extractInsightsLlm(normalized, {
+      ...credential,
+      model: option(rest, "--model") ?? undefined,
+      title: base.title,
+    });
+    return parseCall(raw, {
+      ...base,
+      insights,
+      extractor: `llm:${credential.provider}:${model}`,
     });
   };
 
   if (subcommand === "parse") {
-    const parsed = loadParsedCall();
+    const parsed = await loadParsedCall();
     const outPath = option(rest, "--out");
     if (outPath) writeFileSync(resolve(process.cwd(), outPath), `${JSON.stringify(parsed, null, 2)}\n`);
     if (rest.includes("--ndjson")) {
@@ -504,6 +546,7 @@ async function callCommand(args: string[]) {
             call_id: parsed.id,
             call_title: parsed.title ?? null,
             source_system: parsed.sourceSystem,
+            extractor: parsed.extractor,
             type: insight.type,
             title: insight.title,
             text: insight.text,
@@ -551,7 +594,7 @@ async function callCommand(args: string[]) {
   if (subcommand === "plan") {
     const dealId = option(rest, "--deal");
     if (!dealId) throw new Error("call plan requires --deal <dealId> (use `call link` to find it)");
-    const parsed = loadParsedCall();
+    const parsed = await loadParsedCall();
     const snapshot = await readSnapshot(rest);
     const deal = snapshot.deals.find((row) => row.id === dealId);
     if (!deal) throw new Error(`Deal ${dealId} is not in the snapshot — check the id or the snapshot source.`);
@@ -577,7 +620,105 @@ async function callCommand(args: string[]) {
     return;
   }
 
-  throw new Error(`call supports: parse, link, plan (got ${subcommand ?? "nothing"})`);
+  if (subcommand === "score") {
+    // Rubric problems surface before any credential or API work.
+    const rubricPath = option(rest, "--rubric");
+    let rubric = DEFAULT_RUBRIC;
+    if (rubricPath) {
+      const rubricRaw = readFileSync(resolve(process.cwd(), rubricPath), "utf8");
+      try {
+        rubric = parseRubric(rubricRaw);
+      } catch (error) {
+        throw new Error(
+          `${rubricPath} is not a valid rubric: ${error instanceof Error ? error.message : String(error)} Expected JSON like { "scale": 5, "dimensions": [{ "name": "...", "weight": 1, "rubric": "..." }] }.`,
+        );
+      }
+    }
+    const credential = await requireLlmCredential("score");
+    const transcriptPath = option(rest, "--transcript");
+    let transcriptText: string;
+    let title = option(rest, "--title") ?? undefined;
+    if (transcriptPath) {
+      transcriptText = normalizeTranscript(readFileSync(resolve(process.cwd(), transcriptPath), "utf8"));
+    } else {
+      const callPath = option(rest, "--call");
+      if (!callPath) throw new Error("call score requires --transcript <file> or --call <parsed.json>");
+      const parsed = JSON.parse(readFileSync(resolve(process.cwd(), callPath), "utf8")) as ParsedCall;
+      transcriptText = parsed.segments
+        .map((segment) => (segment.speaker ? `${segment.speaker}: ${segment.text}` : segment.text))
+        .join("\n");
+      title = title ?? parsed.title;
+    }
+    const scorecard = await scoreCallLlm(transcriptText, rubric, {
+      ...credential,
+      model: option(rest, "--model") ?? undefined,
+      title,
+    });
+    const outPath = option(rest, "--out");
+    if (outPath) writeFileSync(resolve(process.cwd(), outPath), `${JSON.stringify(scorecard, null, 2)}\n`);
+    if (rest.includes("--json")) {
+      console.log(JSON.stringify(scorecard, null, 2));
+      return;
+    }
+    console.log(renderScorecard(scorecard, title));
+    return;
+  }
+
+  throw new Error(`call supports: parse, link, plan, score (got ${subcommand ?? "nothing"})`);
+}
+
+/**
+ * First-touch key onboarding: env vars win, then the credential store; on a
+ * TTY a missing key is captured once (validated, stored 0600 like provider
+ * logins). Non-interactive contexts get an actionable error instead.
+ */
+async function requireLlmCredential(command: "parse" | "score" = "parse"): Promise<{ provider: LlmProvider; apiKey: string }> {
+  const resolved = resolveLlmCredential();
+  if (resolved) return resolved;
+  // Scoring is inherently LLM work — there is no keyword fallback to suggest.
+  const fallbackHint =
+    command === "parse" ? ", or pass --deterministic for the free keyword baseline" : " (call score has no non-LLM mode)";
+  if (!process.stdin.isTTY) {
+    throw new Error(
+      `LLM ${command === "score" ? "scoring" : "extraction"} needs an API key. Set ANTHROPIC_API_KEY or OPENAI_API_KEY, or run \`echo "$KEY" | fullstackgtm login anthropic\` (or \`login openai\`) once${fallbackHint}.`,
+    );
+  }
+  console.error("LLM parsing needs an API key (Anthropic or OpenAI) — yours, used directly with the provider.");
+  console.error(`Paste it once; it is validated and stored at ${credentialsPath()} (file mode 0600), like CRM logins.`);
+  console.error("(Alternatives: set ANTHROPIC_API_KEY / OPENAI_API_KEY, or pass --deterministic for the free keyword baseline.)\n");
+  const apiKey = await readSecret("API key (sk-ant-... or sk-...): ");
+  const provider = detectProviderFromKey(apiKey);
+  const validation = await validateLlmKey(provider, apiKey);
+  if (!validation.ok) throw new Error(`${provider} rejected the key: ${validation.detail}`);
+  const now = new Date().toISOString();
+  storeCredential(provider, { kind: "api_key", accessToken: apiKey, createdAt: now, updatedAt: now });
+  console.error(`Stored ${provider} key (${validation.detail}). Future runs use it automatically; remove with \`fullstackgtm logout ${provider}\`.\n`);
+  return { provider, apiKey };
+}
+
+function renderScorecard(scorecard: CallScorecard, title?: string): string {
+  const lines = [
+    `# Coaching Scorecard${title ? ` — ${title}` : ""}`,
+    "",
+    `**Overall: ${scorecard.overallScore}/${scorecard.scale}** (model: ${scorecard.model})`,
+    "",
+    "| Dimension | Score | | Coaching note |",
+    "| --- | --- | --- | --- |",
+  ];
+  for (const dim of scorecard.dimensions) {
+    const filled = Math.round((dim.score / dim.maxScore) * 5);
+    const bar = "█".repeat(filled) + "░".repeat(5 - filled);
+    lines.push(`| ${dim.name} | ${dim.score}/${dim.maxScore} | ${bar} | ${dim.coachingNote} |`);
+  }
+  if (scorecard.highlights.length) {
+    lines.push("", "**Highlights**");
+    for (const h of scorecard.highlights) lines.push(`- ${h}`);
+  }
+  if (scorecard.missedItems.length) {
+    lines.push("", "**Missed**");
+    for (const m of scorecard.missedItems) lines.push(`- ${m}`);
+  }
+  return lines.join("\n");
 }
 
 function buildCallPlan(
@@ -1207,9 +1348,23 @@ async function login(args: string[]) {
     console.log(`Logged in to Stripe. Credentials stored in ${credentialsPath()}.`);
     return;
   }
+  if (provider === "anthropic" || provider === "openai") {
+    rejectArgvSecret(args, "--token", "--key", "--api-key");
+    const key = await readSecret(`${provider} API key (${provider === "anthropic" ? "sk-ant-..." : "sk-..."})`);
+    if (!key) throw new Error(`No ${provider} key provided.`);
+    if (!args.includes("--no-validate")) {
+      const validation = await validateLlmKey(provider, key);
+      if (!validation.ok) throw new Error(`${provider} rejected the key: ${validation.detail}`);
+      console.log(validation.detail);
+    }
+    const stamp = new Date().toISOString();
+    storeCredential(provider, { kind: "api_key", accessToken: key, createdAt: stamp, updatedAt: stamp });
+    console.log(`Stored ${provider} API key in ${credentialsPath()}. \`fullstackgtm call parse\` and \`call score\` use it automatically.`);
+    return;
+  }
   if (provider !== "hubspot") {
     throw new Error(
-      "login supports: hubspot, salesforce, stripe, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com",
+      "login supports: hubspot, salesforce, stripe, anthropic, openai, or --via <hosted url>. Usage: fullstackgtm login <provider> | fullstackgtm login --via https://gtm.example.com",
     );
   }
   const now = new Date().toISOString();
@@ -1302,6 +1457,7 @@ export function doctorReport(env: Record<string, string | undefined> = process.e
       : providerStatus("stripe", broker),
   };
 
+  const llm = resolveLlmCredential(env);
   const missingPeers = ["@modelcontextprotocol/sdk", "zod"].filter((name) => {
     try {
       import.meta.resolve(name);
@@ -1328,6 +1484,9 @@ export function doctorReport(env: Record<string, string | undefined> = process.e
     config: { path: configPath, exists: existsSync(configPath) },
     providers,
     broker: broker ? { paired: true, baseUrl: broker.baseUrl ?? "unknown" } : { paired: false },
+    llm: llm
+      ? { configured: true, provider: llm.provider, source: llm.source }
+      : { configured: false, detail: "call parse/score will prompt once, or set ANTHROPIC_API_KEY / OPENAI_API_KEY" },
     mcp: { peersInstalled: missingPeers.length === 0, missing: missingPeers },
     nextSteps,
   };
@@ -1374,6 +1533,7 @@ function doctorCommand(args: string[]) {
       `  ${provider.padEnd(11)} ${status.source === "none" ? `not connected (${status.detail})` : `${status.source}: ${status.detail}`}`,
     ),
     `  ${"broker".padEnd(11)} ${report.broker.paired ? `paired with ${report.broker.baseUrl}` : "not paired (fullstackgtm login --via <hosted url>)"}`,
+    `  ${"llm".padEnd(11)} ${report.llm.configured ? `${report.llm.provider} key (${report.llm.source}) — call parse/score ready` : `not configured (${report.llm.detail})`}`,
     "",
     report.mcp.peersInstalled
       ? "MCP:        peers installed — `fullstackgtm-mcp` is ready"

package/src/credentials.ts

@@ -74,7 +74,7 @@ export function listProfiles(): string[] {
 }
 
 export type StoredCredential = {
-  kind: "private_app" | "oauth" | "broker";
+  kind: "private_app" | "oauth" | "broker" | "api_key";
   accessToken: string;
   refreshToken?: string;
   /** Epoch ms when the access token expires (oauth only). */