@carrierllc/mcp 0.12.0 → 0.13.3

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-J52VP7E7.js";
+} from "./chunk-2TVU2GRC.js";
 import {
   copyTree,
   exists,
@@ -272,6 +272,320 @@ async function writeStorefrontLogo(target, brand) {
   return { path: svgPath, source: logo.source };
 }
 
+// src/cli/lib/resend.ts
+import { createHash, randomBytes } from "crypto";
+import { createServer } from "http";
+var RESEND_API = "https://api.resend.com";
+var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
+var RESEND_DOMAINS_URL = "https://resend.com/domains";
+var USER_AGENT = "carrier-cli";
+var CLIENT_NAME = "Carrier storefront setup";
+var OAUTH_SCOPE = "full_access";
+var REDIRECT_PATH = "/oauth/callback";
+var REDIRECT_HOST = "127.0.0.1";
+function looksResendKey(key) {
+  return /^re_[A-Za-z0-9_-]{8,}$/.test(key.trim());
+}
+function base64url(input) {
+  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+  const verifier = base64url(randomBytes(64));
+  return { verifier, challenge: base64url(createHash("sha256").update(verifier).digest()) };
+}
+function buildAuthorizeUrl(opts) {
+  const url = new URL(`${RESEND_API}/oauth/authorize`);
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", opts.redirectUri);
+  url.searchParams.set("scope", opts.scope ?? OAUTH_SCOPE);
+  url.searchParams.set("state", opts.state);
+  url.searchParams.set("code_challenge", opts.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+async function resendFetch(fetchImpl, path, init = {}) {
+  const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
+  if (init.token) headers.Authorization = `Bearer ${init.token}`;
+  let body;
+  if (init.form) {
+    headers["Content-Type"] = "application/x-www-form-urlencoded";
+    body = new URLSearchParams(init.form).toString();
+  } else if (init.json !== void 0) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.json);
+  }
+  try {
+    const res = await fetchImpl(`${RESEND_API}${path}`, {
+      method: init.method ?? "GET",
+      headers,
+      body
+    });
+    const text3 = await res.text();
+    let json;
+    try {
+      json = text3 ? JSON.parse(text3) : void 0;
+    } catch {
+      json = void 0;
+    }
+    if (!res.ok) {
+      return { ok: false, status: res.status, json, error: resendError(json) ?? text3.slice(0, 300) };
+    }
+    return { ok: true, status: res.status, json };
+  } catch (e) {
+    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+function resendError(json) {
+  if (typeof json !== "object" || json === null) return void 0;
+  const body = json;
+  return body.message ?? body.error_description ?? body.error;
+}
+async function registerOauthClient(fetchImpl) {
+  const registeredRedirect = `http://${REDIRECT_HOST}${REDIRECT_PATH}`;
+  const res = await resendFetch(fetchImpl, "/oauth/register", {
+    method: "POST",
+    json: {
+      client_name: CLIENT_NAME,
+      redirect_uris: [registeredRedirect],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: OAUTH_SCOPE
+    }
+  });
+  if (!res.ok) {
+    return { ok: false, reason: `Resend rejected client registration: ${res.error ?? res.status}` };
+  }
+  const clientId = res.json?.client_id;
+  if (!clientId) return { ok: false, reason: "Resend registered no client_id." };
+  return { ok: true, clientId };
+}
+async function exchangeCode(fetchImpl, opts) {
+  const res = await resendFetch(fetchImpl, "/oauth/token", {
+    method: "POST",
+    form: {
+      grant_type: "authorization_code",
+      client_id: opts.clientId,
+      code: opts.code,
+      redirect_uri: opts.redirectUri,
+      code_verifier: opts.verifier
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Token exchange failed: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.access_token) return { ok: false, reason: "Resend returned no access token." };
+  return { ok: true, accessToken: body.access_token, refreshToken: body.refresh_token };
+}
+async function revokeGrant(fetchImpl, opts) {
+  await resendFetch(fetchImpl, "/oauth/revoke", {
+    method: "POST",
+    form: {
+      client_id: opts.clientId,
+      token: opts.refreshToken,
+      token_type_hint: "refresh_token"
+    }
+  }).catch(() => void 0);
+}
+async function findVerifiedDomainId(fetchImpl, accessToken, domain) {
+  const wanted = domain.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").toLowerCase();
+  if (!wanted) return void 0;
+  const res = await resendFetch(fetchImpl, "/domains", { token: accessToken });
+  if (!res.ok) return void 0;
+  const list = res.json?.data;
+  const match = list?.find((d) => d.name?.toLowerCase() === wanted && d.status === "verified");
+  return match?.id;
+}
+async function createSendingKey(fetchImpl, accessToken, opts) {
+  const res = await resendFetch(fetchImpl, "/api-keys", {
+    method: "POST",
+    token: accessToken,
+    json: {
+      // Resend caps the name at 50 characters.
+      name: opts.name.slice(0, 50),
+      permission: "sending_access",
+      ...opts.domainId ? { domain_id: opts.domainId } : {}
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Could not create an API key: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.token) return { ok: false, reason: "Resend created a key but returned no token." };
+  return { ok: true, token: body.token, id: body.id };
+}
+async function validateResendKey(fetchImpl, key) {
+  if (!looksResendKey(key)) return { ok: false, reason: "That does not look like a Resend key (re_\u2026)." };
+  const res = await resendFetch(fetchImpl, "/emails", { method: "POST", token: key, json: {} });
+  if (res.status === 401) return { ok: false, reason: "Resend says that key is missing or malformed." };
+  if (res.status === 403) return { ok: false, reason: "Resend rejected that key as invalid." };
+  if (res.status === 0) return { ok: false, reason: `Could not reach Resend: ${res.error ?? "network error"}` };
+  return { ok: true };
+}
+async function startLoopbackServer() {
+  let resolveCode = null;
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}`);
+    if (url.pathname !== REDIRECT_PATH) {
+      res.writeHead(404).end();
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(
+      `<!doctype html><meta charset="utf-8"><title>Carrier</title><body style="font-family:system-ui;padding:3rem;text-align:center"><p>${error ? "Authorization was refused." : "Connected. You can close this tab."}</p>`
+    );
+    resolveCode?.(
+      error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
+    );
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(0, REDIRECT_HOST, resolve3);
+  });
+  const port = server.address().port;
+  const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
+  return {
+    redirectUri,
+    close: () => server.close(),
+    waitForCode(state, timeoutMs) {
+      return new Promise((resolve3) => {
+        const done = (r) => {
+          clearTimeout(timer);
+          resolveCode = null;
+          server.close();
+          resolve3(r);
+        };
+        const timer = setTimeout(
+          () => done({ ok: false, reason: "Timed out waiting for the browser." }),
+          timeoutMs
+        );
+        resolveCode = (r) => {
+          if (r.ok && r.reason !== state) {
+            done({ ok: false, reason: "The browser callback did not match this request." });
+            return;
+          }
+          done(r.ok ? { ok: true, code: r.code } : r);
+        };
+      });
+    }
+  };
+}
+function discoverResendKey(env) {
+  const key = env.RESEND_API_KEY?.trim();
+  if (!key || !looksResendKey(key)) return void 0;
+  return { apiKey: key, tier: "discovered" };
+}
+var MANUAL_STEPS = [
+  `Open ${RESEND_API_KEYS_URL} and create an API key.`,
+  `Give it Sending access, and restrict it to your sending domain if that domain is verified at ${RESEND_DOMAINS_URL}.`,
+  "Put the key in the storefront's .env.local as RESEND_API_KEY.",
+  "Re-run `carrier site deploy` \u2014 the key is pushed to the deploy target automatically."
+];
+async function provisionResend(opts) {
+  const { deps } = opts;
+  const notes = [];
+  const discovered = discoverResendKey(opts.env);
+  if (discovered) {
+    const check = await validateResendKey(deps.fetch, discovered.apiKey);
+    if (check.ok) return { ok: true, tier: "discovered", credentials: discovered };
+    notes.push(`A RESEND_API_KEY was already set but did not work: ${check.reason}`);
+  }
+  if (!opts.noBrowser) {
+    const viaBrowser = await oauthTier(opts);
+    if (viaBrowser.ok) {
+      return { ...viaBrowser, reason: notes.length ? notes.join(" ") : void 0 };
+    }
+    notes.push(viaBrowser.reason ?? "The browser authorization did not complete.");
+  }
+  if (deps.promptForKey) {
+    await deps.openBrowser(RESEND_API_KEYS_URL);
+    const pasted = (await deps.promptForKey(RESEND_API_KEYS_URL))?.trim();
+    if (pasted) {
+      const check = await validateResendKey(deps.fetch, pasted);
+      if (check.ok) {
+        return {
+          ok: true,
+          tier: "paste",
+          credentials: { apiKey: pasted, tier: "paste" },
+          reason: notes.length ? notes.join(" ") : void 0
+        };
+      }
+      notes.push(check.reason ?? "The pasted key did not work.");
+    }
+  }
+  return { ok: false, tier: "manual", reason: notes.join(" "), guidance: MANUAL_STEPS };
+}
+async function oauthTier(opts) {
+  const { deps } = opts;
+  let server;
+  try {
+    server = await deps.startLoopback();
+  } catch (e) {
+    return {
+      ok: false,
+      tier: "oauth",
+      reason: `Could not open a local callback listener: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  try {
+    const registered = await registerOauthClient(deps.fetch);
+    if (!registered.ok) return { ok: false, tier: "oauth", reason: registered.reason };
+    const { verifier, challenge } = pkcePair();
+    const state = base64url(randomBytes(24));
+    const authorizeUrl = buildAuthorizeUrl({
+      clientId: registered.clientId,
+      redirectUri: server.redirectUri,
+      state,
+      challenge
+    });
+    const opened = await deps.openBrowser(authorizeUrl);
+    deps.notify(
+      opened.ok ? "Approve the connection in your browser \u2014 this waits for you." : `Open this to approve the connection:
+  ${authorizeUrl}`
+    );
+    const callback = await server.waitForCode(state, opts.timeoutMs ?? 18e4);
+    if (!callback.ok || !callback.code) {
+      return { ok: false, tier: "oauth", reason: callback.reason ?? "No authorization code." };
+    }
+    const token = await exchangeCode(deps.fetch, {
+      clientId: registered.clientId,
+      code: callback.code,
+      redirectUri: server.redirectUri,
+      verifier
+    });
+    if (!token.ok) return { ok: false, tier: "oauth", reason: token.reason };
+    const domainId = opts.domain ? await findVerifiedDomainId(deps.fetch, token.accessToken, opts.domain) : void 0;
+    const created = await createSendingKey(deps.fetch, token.accessToken, {
+      name: `${opts.name} storefront`,
+      domainId
+    });
+    if (token.refreshToken) {
+      await revokeGrant(deps.fetch, {
+        clientId: registered.clientId,
+        refreshToken: token.refreshToken
+      });
+    }
+    if (!created.ok) return { ok: false, tier: "oauth", reason: created.reason };
+    const check = await validateResendKey(deps.fetch, created.token);
+    if (!check.ok) {
+      return { ok: false, tier: "oauth", reason: `Resend minted a key that it then rejected: ${check.reason}` };
+    }
+    return {
+      ok: true,
+      tier: "oauth",
+      credentials: {
+        apiKey: created.token,
+        tier: "oauth",
+        keyId: created.id,
+        domain: domainId ? opts.domain : void 0
+      }
+    };
+  } finally {
+    server.close();
+  }
+}
+
 // src/cli/lib/dash.ts
 var DASH_DOMAINS = [
   "fleet",
@@ -417,6 +731,54 @@ function buildDashScreen(domain, payload) {
 // src/cli/lib/status.ts
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
+
+// src/cli/lib/mcp-url.ts
+var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
+var PRODUCTION_HOST = "mcp.carrier.llc";
+var URL_TOKEN = /https?:\/\/[^\s"'<>)]+/g;
+function pathWithoutTrailingSlash(pathname) {
+  let end = pathname.length;
+  while (end > 1 && pathname.charCodeAt(end - 1) === 47) end -= 1;
+  return pathname.slice(0, end);
+}
+function parseHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isProductionMcpUrl(value) {
+  if (value === PRODUCTION_MCP_URL) return true;
+  const parsed = parseHttpUrl(value);
+  if (!parsed || parsed.protocol !== "https:" || parsed.hostname !== PRODUCTION_HOST) return false;
+  return pathWithoutTrailingSlash(parsed.pathname) === "/mcp";
+}
+function isCarrierMcpHost(value) {
+  const parsed = parseHttpUrl(value);
+  return parsed?.protocol === "https:" && parsed.hostname === PRODUCTION_HOST;
+}
+function trimTrailingPunctuation(token) {
+  let end = token.length;
+  while (end > 0) {
+    const code = token.charCodeAt(end - 1);
+    if (code !== 46 && code !== 44 && code !== 59 && code !== 58) break;
+    end -= 1;
+  }
+  return token.slice(0, end);
+}
+function lineMentionsProductionMcp(line) {
+  const tokens = line.match(URL_TOKEN);
+  if (!tokens) return false;
+  for (const token of tokens) {
+    if (isProductionMcpUrl(trimTrailingPunctuation(token))) return true;
+  }
+  return false;
+}
+
+// src/cli/lib/status.ts
 function detectEnvToken() {
   const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
   if (api.startsWith("ak_") || api.length > 0) {
@@ -432,8 +794,8 @@ function rankHit(name, url) {
   else if (/^carrier[-_]?/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 40;
   else if (/carrier/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 20;
   else if (/carrier/i.test(name)) rank += 5;
-  if (url === MCP_URL || url.includes("https://mcp.carrier.llc/mcp")) rank += 50;
-  else if (/mcp\.carrier\.llc/i.test(url)) rank += 25;
+  if (isProductionMcpUrl(url)) rank += 50;
+  else if (isCarrierMcpHost(url)) rank += 25;
   return rank;
 }
 function scanMcpServers(servers) {
@@ -445,10 +807,10 @@ function scanMcpServers(servers) {
     }
     const url = typeof entry?.url === "string" ? entry.url : "";
     const rank = rankHit(name, url);
-    if (rank < 20 && !url.includes("mcp.carrier.llc")) {
+    if (rank < 20 && !isCarrierMcpHost(url)) {
       continue;
     }
-    const urlMatches = url === MCP_URL || url.includes("https://mcp.carrier.llc/mcp");
+    const urlMatches = isProductionMcpUrl(url);
     const hit = {
       registered: true,
       urlMatches,
@@ -526,7 +888,7 @@ ${r.stderr}`;
   if (!carrierLine) {
     return { registered: false, urlMatches: false, detail: "carrier not in claude mcp list" };
   }
-  const urlMatches = carrierLine.includes(MCP_URL) || /mcp\.carrier\.llc\/mcp/i.test(carrierLine);
+  const urlMatches = lineMentionsProductionMcp(carrierLine);
   return { registered: true, urlMatches, detail: carrierLine.slice(0, 200) };
 }
 function buildNextSteps(s) {
@@ -649,8 +1011,8 @@ import * as p from "@clack/prompts";
 import pc2 from "picocolors";
 
 // src/cli/lib/auth.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
-import { createServer } from "http";
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { createServer as createServer2 } from "http";
 
 // src/cli/lib/credentials.ts
 import { homedir as homedir3 } from "os";
@@ -694,7 +1056,7 @@ function redact(text3) {
 
 // src/cli/lib/auth.ts
 var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-var CLIENT_NAME = "Carrier CLI";
+var CLIENT_NAME2 = "Carrier CLI";
 var DEFAULT_SCOPE = "read write";
 var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
 async function discover(base = MCP_HOME) {
@@ -708,12 +1070,12 @@ async function discover(base = MCP_HOME) {
   }
   return meta;
 }
-function base64url(buf) {
+function base64url2(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-function pkcePair() {
-  const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
+function pkcePair2() {
+  const verifier = base64url2(randomBytes2(32));
+  const challenge = base64url2(createHash2("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 function sameState(a, b) {
@@ -730,7 +1092,7 @@ async function registerClient(meta, redirectUri) {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify({
-      client_name: CLIENT_NAME,
+      client_name: CLIENT_NAME2,
       redirect_uris: [redirectUri],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
@@ -761,7 +1123,7 @@ async function startCallbackServer() {
   let resolveCode;
   let rejectCode;
   let expected = "";
-  const server = createServer((req, res) => {
+  const server = createServer2((req, res) => {
     const url = new URL(req.url ?? "/", "http://127.0.0.1");
     if (url.pathname !== "/callback") {
       res.writeHead(404).end();
@@ -868,8 +1230,8 @@ async function login(opts) {
   try {
     const existing = await readCredentials();
     const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
-    const { verifier, challenge } = pkcePair();
-    const state = base64url(randomBytes(16));
+    const { verifier, challenge } = pkcePair2();
+    const state = base64url2(randomBytes2(16));
     const authUrl = new URL(meta.authorization_endpoint);
     authUrl.searchParams.set("response_type", "code");
     authUrl.searchParams.set("client_id", clientId);
@@ -1671,12 +2033,12 @@ var CLI_DOMAINS = [
       {
         name: "sim-status set",
         tool: "change_sim_status",
-        summary: "Change the SIM/eSIM status at the SIM provider level. DELETED is irreversible.",
+        summary: "Change the SIM/eSIM status at the SIM provider level. ENABLED and DISABLED map to OCS Affected and Free.",
         options: [
           ICCID,
           {
             flags: "--status <status>",
-            description: "New SIM status: ENABLED, DISABLED or DELETED (irreversible)",
+            description: "New SIM status: ENABLED or DISABLED",
             arg: "simStatus",
             type: "string",
             required: true
@@ -1776,12 +2138,12 @@ var CLI_DOMAINS = [
       {
         name: "bitrate set",
         tool: "hlr_set_bitrate",
-        summary: "Set an HLR-level bandwidth cap. Pass a numeric bps value or an OCS level.",
+        summary: "Set an HLR-level bandwidth cap. Bits per second are mapped onto the OCS KB_ enum.",
         options: [
           ICCID,
           {
             flags: "--bitrate <bps>",
-            description: "Max bitrate in bits per second (0 removes the limit)",
+            description: "Max bitrate in bits per second. 256000 is KB_256. 0 is UNLIMITED.",
             arg: "bitrate",
             type: "number"
           },
@@ -2052,7 +2414,7 @@ var CLI_DOMAINS = [
       {
         name: "set-core",
         tool: "modify_template_core",
-        summary: "Change name, limits, price, validity or zone on a template.",
+        summary: "Change name, limits, cost, validity or zone on a template.",
         options: [
           TEMPLATE_ID,
           {
@@ -2073,7 +2435,7 @@ var CLI_DOMAINS = [
           TEMPLATE_ID,
           {
             flags: "--changes <json>",
-            description: `Recurring fields as JSON, e.g. '{"periodicity":"monthly"}'`,
+            description: `Recurring fields as JSON, e.g. '{"recurringPeriodicityType":2,"nbOccurrence":12}'`,
             arg: "changes",
             type: "string",
             required: true
@@ -2138,7 +2500,7 @@ var CLI_DOMAINS = [
         options: [
           {
             flags: "--zone <json>",
-            description: `Zone config as JSON, e.g. '{"name":"Europe","countries":["NL","DE"]}'`,
+            description: `Zone config as JSON, e.g. '{"locationZoneName":"Europe","tadigList":["AZER1","QWER1"],"networkProfileId":79}'`,
             arg: "zone",
             type: "string",
             required: true
@@ -5177,6 +5539,65 @@ site.command("clerk [dir]").description("Create or discover a Clerk instance and
     p3.outro("");
   }
 );
+site.command("email [dir]").description("Connect Resend in the browser so the storefront can email QR codes.").option("--no-browser", "Never open a browser; print the manual steps instead").option("--yes", "Non-interactive: skip rather than wait for a human").option("--timeout <seconds>", "How long to wait for the browser approval", "180").action(
+  async (dir, o) => {
+    header();
+    const storefront = resolve2(dir ?? "./storefront");
+    const interactive = process.stdin.isTTY === true && o.yes !== true;
+    try {
+      const brand = await loadStorefrontBrand(storefront);
+      const result = await provisionResend({
+        name: brand.name,
+        domain: brand.domain,
+        env: process.env,
+        noBrowser: o.browser === false || !interactive,
+        timeoutMs: Math.max(10, Number(o.timeout) || 180) * 1e3,
+        deps: {
+          fetch,
+          openBrowser: (url) => openUrl(url),
+          startLoopback: () => startLoopbackServer(),
+          notify: (message) => info(pc4.dim(message)),
+          promptForKey: interactive ? async (url) => {
+            const value = await p3.text({
+              message: `Paste the Resend API key from ${url}`,
+              placeholder: "re_\u2026"
+            });
+            return p3.isCancel(value) ? null : value;
+          } : void 0
+        }
+      });
+      if (!result.ok || !result.credentials) {
+        if (result.reason) info(pc4.yellow(result.reason));
+        p3.note((result.guidance ?? []).join("\n"), "Set up email delivery");
+        if (interactive) process.exitCode = 1;
+        p3.outro("");
+        return;
+      }
+      const written = await mergeEnvLocal(storefront, {
+        RESEND_API_KEY: result.credentials.apiKey
+      });
+      info(
+        result.tier === "oauth" ? pc4.green(
+          `Created a send-only Resend key on your account${result.credentials.domain ? `, restricted to ${result.credentials.domain}` : ""}`
+        ) : result.tier === "discovered" ? pc4.green("Reused the Resend key already on this machine") : pc4.green("Saved the Resend key you pasted")
+      );
+      if (written.length) info(pc4.dim("Wrote RESEND_API_KEY to .env.local"));
+      else info(pc4.yellow("RESEND_API_KEY already has a value in .env.local \u2014 left it alone."));
+      if (!result.credentials.domain) {
+        info(
+          pc4.dim(
+            `Mail will be sent from ${brand.emailFromMailbox}@${brand.domain}. Verify that domain at ${RESEND_DOMAINS_URL} or it will not be delivered.`
+          )
+        );
+      }
+    } catch (e) {
+      fail(String(e instanceof Error ? e.message : e), ["Scaffold first: carrier site create"]);
+      process.exitCode = 1;
+      return;
+    }
+    p3.outro("");
+  }
+);
 site.command("logo [dir]").description("Generate a storefront logo (SVG always; PNG if an image key is on this box or Carrier).").action(async (dir) => {
   header();
   const target = resolve2(dir ?? "./storefront");