@carrierllc/mcp 0.10.7 → 0.11.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carrierllc/mcp",
-  "version": "0.10.7",
+  "version": "0.11.4",
   "description": "Carrier MCP \u2014 natural-language control of MVNO/eSIM fleets via eSIMVault OCS. Stdio mode for direct integration with Claude Desktop, Cursor, Windsurf, and MCP-compatible clients. Ships the `carrier` CLI (plugin install + white-label eSIM storefront scaffold).",
   "license": "MIT",
   "author": "Carrier (Lifecycle Innovations Limited)",
@@ -48,7 +48,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^5.20260819.1",
+    "@cloudflare/workers-types": "^5.20260903.1",
     "@types/node": "^26.1.2",
     "@typescript-eslint/eslint-plugin": "^8.59.4",
     "@typescript-eslint/parser": "^8.67.0",

package/plugin/carrier/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "carrier",
   "version": "0.1.4",
-  "description": "Natural-language control of your MVNO/eSIM fleet — the Stripe of telecom. Provision eSIMs, manage subscribers, packages, billing, usage, SMS, churn, and fleet health, and roll out a white-labeled storefront. Wraps the Carrier MCP (122 tools over OAuth 2.1).",
+  "description": "Natural-language control of your MVNO/eSIM fleet — the Stripe of telecom. Provision eSIMs, manage subscribers, packages, billing, usage, SMS, churn, and fleet health, and roll out a white-labeled storefront. Wraps the Carrier MCP (125 tools over OAuth 2.1).",
   "author": {
     "name": "Lifecycle Innovations Limited",
     "url": "https://carrier.llc"

package/templates/storefront/package-lock.json

@@ -12,7 +12,7 @@
         "clsx": "^2.1.1",
         "framer-motion": "^11.15.0",
         "geist": "^1.3.1",
-        "next": "^16.3.0",
+        "next": "^16.3.1",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "tailwind-merge": "^2.6.0"
@@ -3039,9 +3039,9 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.0.tgz",
-      "integrity": "sha512-o9r1S0BNiNreHP9Vs+Qnqd9kviDkJh8xIACY7UFZSmiGbbQRzPBBosvHzAU4TULHOIuOj/18RSsyz2qrREmIFw==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.1.tgz",
+      "integrity": "sha512-35G3xwkQUb2oETSDjFXGrVugknoayLFBh7vSE+yAcl9IP2zT9wyGwq7297AYHR11kJld807t5f8AJBs6WBzXsQ==",
       "license": "MIT"
     },
     "node_modules/@next/eslint-plugin-next": {
@@ -3088,9 +3088,9 @@
       }
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.0.tgz",
-      "integrity": "sha512-55hpqq18bEVAlxedlTt3tFqZmKg2nUXT1kn1G/BGEy0R13h3LwtwHPVzzjG6P4LLeOHE32PFDQUVaJEWvBEZBw==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.1.tgz",
+      "integrity": "sha512-ABMIu2zQ7cnNIHm5ivKGwZwUrm0pAai3yiJ/gK/rF1c1VP9UOnj7XECbMKFdVKp9I9eMYq9NoDs1WXOoowxzJw==",
       "cpu": [
         "arm64"
       ],
@@ -3104,9 +3104,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.0.tgz",
-      "integrity": "sha512-SOi96kSaF5T+0wW4koiM1bWzSPwjzTesC1p3df+FjdOi5LIQkBK/blxh7HdoKnNuI4PURF1OO7TZqtfnbWDSgw==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.1.tgz",
+      "integrity": "sha512-gNG21e/UnrroeScbY/QndUEdl0mF1FRibW7BBeYUz/5ABCepjqDdEdgr592vpzMtCn/m7FTjYq3TN4TpyDnutw==",
       "cpu": [
         "x64"
       ],
@@ -3120,9 +3120,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.0.tgz",
-      "integrity": "sha512-P0gZAoPMF4dyTRzhmkV4PrqVzSOB6t4mC1oI3c4dqijJ+OVEVx5clIXAKR4/uQpsqw2KKM/0D5tVumcR2r5blg==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.1.tgz",
+      "integrity": "sha512-6B6Lw016iwNUQuaJoraMMTLh6TwHzFUtxipSScD1F3YyymcrRWkobodRS2ftIOkF5vrs4zNlyUrTC5YZQ9Lz5w==",
       "cpu": [
         "arm64"
       ],
@@ -3136,9 +3136,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.0.tgz",
-      "integrity": "sha512-tXXGKJw0m37O0eKJARVTX/TheKPhz0QFVtVVZXmOig+9YKLQOSP6hvf2pxv5DO7CLEJyTHx3Pg043CDQkv1G4Q==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.1.tgz",
+      "integrity": "sha512-JUiPXZKK9wOhjf4MgDiH29GZLxfqOesbLtHq2pDxwH/WwscTRV2ToymnOTh1egzaZf0ueUf8T2+CeYTGHjW0Iw==",
       "cpu": [
         "arm64"
       ],
@@ -3152,9 +3152,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.0.tgz",
-      "integrity": "sha512-pjGxK5EY7yWml78ALejFkWmgHsU7wbFQrISiugpH6FbUJhgEvw3xFZ/EBAtLl7QtL0WdQKiG9eWJ3mOKGTukHw==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.1.tgz",
+      "integrity": "sha512-Uog9jsrmIRIL/lfvIp9htmskSNC7JcQsMVucXL2V2YY1y/D9IUN3LPEafqy0zRJ2cIU1SQ0V6F6TlffQ+pLAGg==",
       "cpu": [
         "x64"
       ],
@@ -3168,9 +3168,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.0.tgz",
-      "integrity": "sha512-sjo++Xx+lomlPs3HRsHWhVDyGG6ms1kGW5EtHLERdII8AyG1i+f6aq68xHREO6AEMlhjTNEWBSmfJfqm9orf7g==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.1.tgz",
+      "integrity": "sha512-6yy3FT13KgUFOj5H8bl8w/6nKiJwHIvbtwh1V+1acsu+7y4tJjnemSa6mhsh53BeoVrlozE+fMgZhXH46WmjMA==",
       "cpu": [
         "x64"
       ],
@@ -3184,9 +3184,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.0.tgz",
-      "integrity": "sha512-C5JSgiO54wURdaxdEUIXqkz04uMqC9UmPX1gtDrV/5Tf1UowdWYI8uA5hfFbPolTlp0q4KZ60xlHePNibf0VIw==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.1.tgz",
+      "integrity": "sha512-iOoN1QecUoGNZik536U/vtK43YwgyrCsGIkth52yIkl612n+0C9MjSnJbQAikISpb+WYRooBVhaDlUW7iZoKog==",
       "cpu": [
         "arm64"
       ],
@@ -3200,9 +3200,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.0.tgz",
-      "integrity": "sha512-fDOggsweNb5SSw0ZKVk6U+gxSyGFFlIBY/LBc1r8GUj4u/6t6oArL+Pmkg0MBnsgR+KkdsURilVH4F3GXUGepA==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.1.tgz",
+      "integrity": "sha512-d/k+PpAriUPaeMJJOG7HUSdqfEX46FEPWU1p3/nm2ACmXhj9hFEWdFODUBIpkuijXYkfL90qZzTqVPRp4BW/hw==",
       "cpu": [
         "x64"
       ],
@@ -4085,9 +4085,9 @@
       "license": "MIT"
     },
     "node_modules/@swc/helpers": {
-      "version": "0.5.15",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.15.tgz",
-      "integrity": "sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==",
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.8.0"
@@ -9621,13 +9621,13 @@
       }
     },
     "node_modules/next": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.3.0.tgz",
-      "integrity": "sha512-NEdGOzH+08eTXMUp9UYkA99Nhi5N6Thrhc1jgFOQgfgnGK/dA2hRwBpXep+exdFQrnwlRf/3Wixyp8lLBUpE2A==",
+      "version": "16.3.1",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.3.1.tgz",
+      "integrity": "sha512-hsAp0i7Rh+/dhe7DGIeN2YlpLM1DP4MNxti9EtDMtqcO612X81MvvEj388/oTce9U1EcEIOWDlGq0zRwrBKvuA==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.3.0",
-        "@swc/helpers": "0.5.15",
+        "@next/env": "16.3.1",
+        "@swc/helpers": "0.5.23",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
         "postcss": "8.5.23",
@@ -9640,14 +9640,14 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.3.0",
-        "@next/swc-darwin-x64": "16.3.0",
-        "@next/swc-linux-arm64-gnu": "16.3.0",
-        "@next/swc-linux-arm64-musl": "16.3.0",
-        "@next/swc-linux-x64-gnu": "16.3.0",
-        "@next/swc-linux-x64-musl": "16.3.0",
-        "@next/swc-win32-arm64-msvc": "16.3.0",
-        "@next/swc-win32-x64-msvc": "16.3.0",
+        "@next/swc-darwin-arm64": "16.3.1",
+        "@next/swc-darwin-x64": "16.3.1",
+        "@next/swc-linux-arm64-gnu": "16.3.1",
+        "@next/swc-linux-arm64-musl": "16.3.1",
+        "@next/swc-linux-x64-gnu": "16.3.1",
+        "@next/swc-linux-x64-musl": "16.3.1",
+        "@next/swc-win32-arm64-msvc": "16.3.1",
+        "@next/swc-win32-x64-msvc": "16.3.1",
         "sharp": "^0.35.3"
       },
       "peerDependencies": {
@@ -10223,9 +10223,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {

package/templates/storefront/package.json

@@ -17,7 +17,7 @@
     "clsx": "^2.1.1",
     "framer-motion": "^11.15.0",
     "geist": "^1.3.1",
-    "next": "^16.3.0",
+    "next": "^16.3.1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "tailwind-merge": "^2.6.0"

package/templates/storefront/src/app/activate/[orderId]/ActivateClient.tsx

@@ -4,21 +4,87 @@
  *
  * MANGO-8/9: Shown after sign-up/sign-in on /activate/[orderId].
  *
- * - Displays the eSIM QR code (once available from the API).
+ * - Fetches the order and shows the real eSIM QR code once provisioning is done.
+ * - Falls back to the SM-DP+ address and matching ID for manual entry whenever
+ *   the QR image is missing — every phone accepts those typed by hand.
+ * - Says plainly when it cannot read the order at all. The page used to print
+ *   a fixed reassurance that a QR code was on its way, and then never
+ *   ask anyone anything, which reads as progress and is not.
  * - Optionally collects phone number / WhatsApp for eSIM delivery notifications.
  *   Phone is NEVER required — user can skip.
  */
-import { useState, FormEvent } from "react";
+import { useCallback, useEffect, useRef, useState, FormEvent } from "react";
+import type { EsimOrder } from "@/vendor/carrier/types";
 
 interface Props {
   orderId: string;
 }
 
+type LoadState =
+  | { phase: "loading" }
+  | { phase: "ready"; order: EsimOrder }
+  | { phase: "error"; message: string };
+
+/** Provisioning is usually seconds. Poll a bounded number of times, then stop. */
+const POLL_INTERVAL_MS = 4000;
+const MAX_POLLS = 15;
+
 export function ActivateClient({ orderId }: Props) {
   const [phone, setPhone] = useState("");
   const [submitted, setSubmitted] = useState(false);
   const [saving, setSaving] = useState(false);
   const [saveError, setSaveError] = useState<string | null>(null);
+  const [state, setState] = useState<LoadState>({ phase: "loading" });
+  const [copied, setCopied] = useState(false);
+  const pollsRef = useRef(0);
+
+  const loadOrder = useCallback(async (): Promise<EsimOrder | null> => {
+    try {
+      const res = await fetch(`/api/orders/${encodeURIComponent(orderId)}`, {
+        cache: "no-store",
+      });
+      const payload = (await res.json().catch(() => ({}))) as {
+        order?: EsimOrder;
+        error?: string;
+      };
+      if (!res.ok || !payload.order) {
+        setState({
+          phase: "error",
+          message: payload.error ?? "We could not load your eSIM details right now.",
+        });
+        return null;
+      }
+      setState({ phase: "ready", order: payload.order });
+      return payload.order;
+    } catch {
+      setState({
+        phase: "error",
+        message: "We could not reach your eSIM details. Check your connection and try again.",
+      });
+      return null;
+    }
+  }, [orderId]);
+
+  useEffect(() => {
+    let cancelled = false;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+
+    async function tick() {
+      const order = await loadOrder();
+      if (cancelled) return;
+      const stillWorking = order?.status === "pending" || order?.status === "provisioning";
+      if (stillWorking && pollsRef.current < MAX_POLLS) {
+        pollsRef.current += 1;
+        timer = setTimeout(tick, POLL_INTERVAL_MS);
+      }
+    }
+
+    void tick();
+    return () => {
+      cancelled = true;
+      if (timer) clearTimeout(timer);
+    };
+  }, [loadOrder]);
 
   async function handlePhoneSubmit(e: FormEvent<HTMLFormElement>) {
     e.preventDefault();
@@ -44,27 +110,175 @@ export function ActivateClient({ orderId }: Props) {
     }
   }
 
+  async function copyActivationCode(code: string) {
+    try {
+      await navigator.clipboard.writeText(code);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2000);
+    } catch {
+      setCopied(false);
+    }
+  }
+
+  const order = state.phase === "ready" ? state.order : null;
+  const ready = order?.status === "ready";
+  const manualCode =
+    order?.activationCode ??
+    (order?.smdpAddress && order?.matchingId ? `LPA:1$${order.smdpAddress}$${order.matchingId}` : null);
+
   return (
     <div className="mx-auto max-w-lg px-4 py-16">
       {/* Header */}
       <div className="text-center mb-10">
         <div className="inline-flex items-center justify-center size-14 rounded-full bg-emerald-500/10 border border-emerald-500/30 mb-4">
-          <span className="text-2xl">✓</span>
+          <span className="text-2xl">{ready ? "✓" : "•"}</span>
         </div>
-        <h1 className="text-2xl font-bold text-sand-900 dark:text-sand-50">Your eSIM is ready</h1>
+        <h1 className="text-2xl font-bold text-sand-900 dark:text-sand-50">
+          {ready ? "Your eSIM is ready" : "Setting up your eSIM"}
+        </h1>
         <p className="mt-2 text-sm text-sand-500">Order: {orderId}</p>
       </div>
 
-      {/* QR Code placeholder */}
       <div className="rounded-2xl border border-sand-200 dark:border-sand-800 bg-white dark:bg-sand-900 p-8 text-center mb-8">
-        <p className="text-sand-600 dark:text-sand-400 text-sm mb-2">
-          Your QR code will appear here once your order is confirmed.
-        </p>
-        <p className="text-sand-400 text-xs">
-          This usually takes less than a minute. Refresh if needed.
-        </p>
+        {state.phase === "loading" && (
+          <>
+            <div className="h-8 w-8 rounded-full border-2 border-[var(--brand-accent)] border-t-transparent animate-spin mx-auto mb-4" />
+            <p className="text-sand-600 dark:text-sand-400 text-sm">Loading your eSIM…</p>
+          </>
+        )}
+
+        {state.phase === "error" && (
+          <>
+            <p className="text-sand-900 dark:text-sand-50 text-sm font-medium mb-2">
+              We couldn&apos;t load your eSIM
+            </p>
+            <p className="text-sand-600 dark:text-sand-400 text-sm mb-4">{state.message}</p>
+            <p className="text-sand-400 text-xs mb-4">
+              Your payment is safe and your order number is above. Quote it if you contact us.
+            </p>
+            <div className="flex items-center justify-center gap-3">
+              <button
+                type="button"
+                onClick={() => {
+                  pollsRef.current = 0;
+                  setState({ phase: "loading" });
+                  void loadOrder();
+                }}
+                className="rounded-full bg-[var(--brand-accent)] px-5 py-2 text-sm font-semibold text-white transition-opacity hover:opacity-90"
+              >
+                Try again
+              </button>
+              <a
+                href="/contact"
+                className="rounded-full border border-sand-300 dark:border-sand-700 px-5 py-2 text-sm text-sand-900 dark:text-sand-50 hover:bg-white/10 transition-colors"
+              >
+                Contact support
+              </a>
+            </div>
+          </>
+        )}
+
+        {order && !ready && order.status !== "failed" && (
+          <>
+            <div className="h-8 w-8 rounded-full border-2 border-[var(--brand-accent)] border-t-transparent animate-spin mx-auto mb-4" />
+            <p className="text-sand-600 dark:text-sand-400 text-sm mb-2">
+              We&apos;re preparing your eSIM. This usually takes less than a minute.
+            </p>
+            <p className="text-sand-400 text-xs">
+              You can leave this page — we&apos;ll email you the QR code when it&apos;s ready.
+            </p>
+          </>
+        )}
+
+        {order?.status === "failed" && (
+          <>
+            <p className="text-sand-900 dark:text-sand-50 text-sm font-medium mb-2">
+              Your eSIM couldn&apos;t be set up
+            </p>
+            <p className="text-sand-600 dark:text-sand-400 text-sm mb-4">
+              {order.failureMessage ??
+                "Something went wrong while activating your plan. Our team can sort this out for you."}
+            </p>
+            <a
+              href="/contact"
+              className="inline-block rounded-full bg-[var(--brand-accent)] px-5 py-2 text-sm font-semibold text-white transition-opacity hover:opacity-90"
+            >
+              Contact support
+            </a>
+          </>
+        )}
+
+        {ready && (
+          <>
+            {order?.qrCode ? (
+              /* The QR image is served by the fulfilment API; next/image would
+                 need every possible operator origin allow-listed in
+                 next.config, so this stays a plain img on purpose. */
+              // eslint-disable-next-line @next/next/no-img-element
+              <img
+                src={order.qrCode}
+                alt="eSIM activation QR code"
+                className="mx-auto mb-4 size-56 rounded-xl bg-white p-2"
+              />
+            ) : (
+              <p className="text-sand-600 dark:text-sand-400 text-sm mb-4">
+                Your eSIM is active. Enter the details below on your phone to install it.
+              </p>
+            )}
+            <p className="text-sand-600 dark:text-sand-400 text-sm">
+              Scan this with your phone&apos;s camera, or add the eSIM manually with the details
+              below.
+            </p>
+            {order?.planName && <p className="mt-2 text-xs text-sand-400">{order.planName}</p>}
+          </>
+        )}
       </div>
 
+      {/* Manual install — always available once we know the credentials, because
+          a QR is useless on the one phone the customer is reading this on. */}
+      {ready && (order?.smdpAddress || manualCode) && (
+        <div className="rounded-2xl border border-sand-200 dark:border-sand-800 bg-white dark:bg-sand-900 p-6 mb-8">
+          <p className="text-sm font-medium text-sand-900 dark:text-sand-50 mb-3">
+            Install manually
+          </p>
+          <dl className="space-y-3 text-sm">
+            {order?.smdpAddress && (
+              <div>
+                <dt className="text-xs text-sand-500">SM-DP+ address</dt>
+                <dd className="font-mono break-all text-sand-900 dark:text-sand-50">
+                  {order.smdpAddress}
+                </dd>
+              </div>
+            )}
+            {order?.matchingId && (
+              <div>
+                <dt className="text-xs text-sand-500">Activation code</dt>
+                <dd className="font-mono break-all text-sand-900 dark:text-sand-50">
+                  {order.matchingId}
+                </dd>
+              </div>
+            )}
+            {order?.iccid && (
+              <div>
+                <dt className="text-xs text-sand-500">ICCID</dt>
+                <dd className="font-mono break-all text-sand-900 dark:text-sand-50">
+                  {order.iccid}
+                </dd>
+              </div>
+            )}
+          </dl>
+          {manualCode && (
+            <button
+              type="button"
+              onClick={() => void copyActivationCode(manualCode)}
+              className="mt-4 w-full rounded-lg border border-sand-300 dark:border-sand-700 px-4 py-2 text-sm text-sand-900 dark:text-sand-50 hover:bg-white/10 transition-colors"
+            >
+              {copied ? "Copied" : "Copy activation string"}
+            </button>
+          )}
+        </div>
+      )}
+
       {/* Optional phone / WhatsApp collection */}
       <div className="rounded-2xl border border-sand-200 dark:border-sand-800 bg-white dark:bg-sand-900 p-6">
         <div className="flex items-start gap-3 mb-4">
@@ -107,9 +321,7 @@ export function ActivateClient({ orderId }: Props) {
                 {saving ? "Saving…" : "Save"}
               </button>
             </div>
-            {saveError && (
-              <p className="text-xs text-red-300">{saveError}</p>
-            )}
+            {saveError && <p className="text-xs text-red-300">{saveError}</p>}
             <button
               type="button"
               onClick={() => setSubmitted(true)}

package/templates/storefront/src/app/api/checkout/guest/route.ts

@@ -4,20 +4,28 @@
  * MANGO-8/9: Purchase-first flow — creates a Stripe Checkout session for
  * unauthenticated users. No Clerk auth required.
  *
- * Body: { templateId: string }
+ * Body: { templateId: string, channel?: string }
  *
  * Returns: { url: string } — Stripe-hosted checkout URL
  *
  * The Stripe success_url encodes the templateId so the /checkout/success
  * page can display the correct plan and prompt sign-up / sign-in.
+ *
+ * The line item is built inline from the plan's own price (`price_data`, no
+ * Stripe price id), which means Stripe accepts whatever number we send. So the
+ * plan has to be real before we get here: with a live Stripe key, a catalog
+ * that fell back to sample plans is refused outright. Charging for
+ * "Visit — Calm" at EUR 4.99 when no such product exists is a real payment
+ * against nothing, and no webhook downstream can fulfil it.
  */
 import { NextRequest, NextResponse } from "next/server";
-import { fetchTemplates } from "@/vendor/carrier/client";
+import { fetchTemplateCatalog } from "@/vendor/carrier/client";
+import { decideGuestCheckout, normalizeChannel } from "@/vendor/carrier/catalog-guard";
 
 export async function POST(req: NextRequest): Promise<NextResponse> {
-  let body: { templateId?: string };
+  let body: { templateId?: string; channel?: string };
   try {
-    body = (await req.json()) as { templateId?: string };
+    body = (await req.json()) as { templateId?: string; channel?: string };
   } catch {
     return NextResponse.json({ error: "Invalid request body" }, { status: 400 });
   }
@@ -27,17 +35,32 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
     return NextResponse.json({ error: "templateId is required" }, { status: 400 });
   }
 
-  // Validate the template exists
-  const plans = await fetchTemplates();
-  const plan = plans.find((p) => p.id === templateId);
-  if (!plan) {
-    return NextResponse.json({ error: "Plan not found" }, { status: 404 });
+  const channel = normalizeChannel(body.channel);
+  const stripeKey = process.env.STRIPE_SECRET_KEY;
+  const catalog = await fetchTemplateCatalog();
+
+  const decision = decideGuestCheckout({
+    catalog,
+    templateId,
+    stripeConfigured: Boolean(stripeKey),
+  });
+  if (!decision.ok) {
+    if (decision.code === "catalog_degraded") {
+      // Loud on the server, calm to the customer. This is the state where a
+      // storefront is live, taking traffic, and cannot tell what it sells.
+      console.error(
+        `[checkout] refusing to sell from a sample catalog (reason=${catalog.reason ?? "unknown"}) — ` +
+          "NEXT_PUBLIC_CARRIER_API_URL is unset or the catalog request failed",
+      );
+    }
+    return NextResponse.json({ error: decision.error, code: decision.code }, { status: decision.status });
   }
 
-  const stripeKey = process.env.STRIPE_SECRET_KEY;
+  const plan = decision.plan;
+
   if (!stripeKey) {
     // No Stripe configured — return a mock URL so the storefront still builds
-    // and renders without credentials (same pattern as fetchTemplates mock).
+    // and renders without credentials. No money moves on this path.
     const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? "";
     const successUrl = `${appUrl}/checkout/success?templateId=${encodeURIComponent(templateId)}&session_id=mock`;
     return NextResponse.json({ url: successUrl });
@@ -65,6 +88,11 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
     // without it the plan is lost and the order is stuck "activating".
     "metadata[templateId]": templateId,
     "payment_intent_data[metadata][templateId]": templateId,
+    // Where the sale came from. Written alongside templateId and by the same
+    // reasoning: attribution recovered later from Stripe reports is guesswork,
+    // and the session is the only record that survives the redirect.
+    "metadata[channel]": channel,
+    "payment_intent_data[metadata][channel]": channel,
     // Allow guest checkout (no Stripe account required)
     "payment_method_collection": "always",
   });
@@ -79,9 +107,12 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
   });
 
   if (!resp.ok) {
-    const err = (await resp.json()) as { error?: { message?: string } };
+    // Stripe's message names our parameters and our account. It goes to the
+    // log, not to the customer.
+    const err = (await resp.json().catch(() => ({}))) as { error?: { message?: string } };
+    console.error(`[checkout] Stripe session creation failed: ${err.error?.message ?? resp.status}`);
     return NextResponse.json(
-      { error: err.error?.message ?? "Failed to create checkout session" },
+      { error: "We could not start checkout. Please try again in a moment.", code: "stripe_error" },
       { status: 502 },
     );
   }