@carrierllc/mcp 0.13.12 → 0.13.14

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   CARRIER_VERSION,
+  NETWORK_DEFAULT_MODES,
   OCS_MAX_USAGE_WINDOW_DAYS,
   OcsApiError,
   OcsClient,
@@ -28,6 +29,7 @@ import {
   formatProbes,
   generateStorefrontLogo,
   getLimitForEndpoint,
+  getNetworkDefault,
   getRateLimitWindowCounts,
   gyCountryHistoryFromResponse,
   imsiFromSubscriberRecord,
@@ -40,6 +42,8 @@ import {
   mccToIso,
   mergeEnvLocal,
   modifySubscriberStatusParams,
+  networkDefaultKey,
+  networkDefaultPartition,
   networkEventRows,
   networkEventsOverPeriodParams,
   ocsHlrBitrate,
@@ -53,6 +57,7 @@ import {
   packageName,
   packageTemplateCreateFromToolJson,
   packageTemplateModifyFromToolJson,
+  planNetworkDefault,
   prepaidPackageLimits,
   prepaidPackageRows,
   probeAll,
@@ -63,6 +68,8 @@ import {
   recurringPackageParams,
   renderHtml,
   repairPlanFor,
+  scopeListSubscriberParams,
+  setNetworkDefault,
   staleActivePackages,
   storefrontClerkUrls,
   subscriberIdParams,
@@ -73,7 +80,7 @@ import {
   verifyStorefront,
   withOcsListSummary,
   withTemplateResellerId
-} from "./chunk-IQDAU7WA.js";
+} from "./chunk-DIHA6TVT.js";
 import "./chunk-SHKKVIIA.js";
 
 // src/index.ts
@@ -1066,22 +1073,22 @@ function boundZonesResult(raw, opts = {}) {
   const { verbose = false, resellerId } = opts;
   const maxZones = opts.maxZones ?? ZONES_MAX_ZONES;
   const maxOperators = opts.maxOperators ?? (verbose ? ZONES_VERBOSE_MAX_OPERATORS : ZONES_MAX_OPERATORS);
-  const totalOperators = all.reduce((n, z24) => n + (z24.operators?.length ?? 0), 0);
+  const totalOperators = all.reduce((n, z25) => n + (z25.operators?.length ?? 0), 0);
   const keptZones = all.slice(0, maxZones);
   let budget = maxOperators;
   let returnedOperators = 0;
-  const zones = keptZones.map((z24) => {
-    const ops = z24.operators ?? [];
+  const zones = keptZones.map((z25) => {
+    const ops = z25.operators ?? [];
     const take = Math.max(0, Math.min(ops.length, budget));
     budget -= take;
     returnedOperators += take;
     const sliced = ops.slice(0, take);
     if (verbose) {
-      return { ...z24, operators: sliced, operatorCount: ops.length };
+      return { ...z25, operators: sliced, operatorCount: ops.length };
     }
     return {
-      zoneId: z24.zoneId,
-      zoneName: z24.zoneName,
+      zoneId: z25.zoneId,
+      zoneName: z25.zoneName,
       operatorCount: ops.length,
       operators: sliced.map((o) => ({
         net: o.networkId,
@@ -1512,7 +1519,7 @@ function registerAllTools(server2, ctx) {
     "list_subscribers",
     {
       title: "List Subscribers",
-      description: "Use this to list subscribers with optional filters and pagination. Good for fleet enumeration, bulk status checks, and finding subscribers by account or status. OCS REQUIRES at least one search key \u2014 provide exactly one of: `imsi`, `iccid`, `activationCode`, `accountId`, or `msisdn`. Calling with no key will be rejected before reaching OCS. Params: `imsi` (string), `iccid` (string), `activationCode` (string), `accountId` (integer), `msisdn` (string), `status` (string, e.g. 'ACTIVE'/'SUSPENDED'), `offset` (integer, pagination \u2014 default 0), `limit` (integer, max results \u2014 always set to avoid unbounded fetches; recommended max 100 per call). Returns: `{ summary, subscriberList: [...] }` \u2014 subscriber summary records with ICCID, status and account, behind a server-counted `summary.total` (rows returned) and `summary.breakdown.status`. Answer 'how many' from `summary`, not by counting rows \u2014 but when `summary.moreAvailable` is set this is one page, so report `summary.upstreamTotal` for the fleet-wide figure, never `total`. Do NOT use this to fetch full details for a specific subscriber \u2014 use `get_subscriber` for that.",
+      description: "Use this to list subscribers with optional filters and pagination. Good for fleet enumeration, bulk status checks, and finding subscribers by account or status. OCS needs a search key: `imsi`, `iccid`, `activationCode`, `accountId` or `msisdn`. With none, Carrier scopes the call to this organization's default account (its preferred_account_id, else the lowest-id account under its reseller) and says so in `default_account`. If no account can be found the call fails with an error \u2014 it never returns an empty list. Params: `imsi` (string), `iccid` (string), `activationCode` (string), `accountId` (integer), `msisdn` (string), `status` (string, e.g. 'ACTIVE'/'SUSPENDED'), `offset` (integer, pagination \u2014 default 0), `limit` (integer, max results \u2014 always set to avoid unbounded fetches; recommended max 100 per call). Returns: `{ summary, subscriberList: [...] }` \u2014 subscriber summary records with ICCID, status and account, behind a server-counted `summary.total` (rows returned) and `summary.breakdown.status`. Answer 'how many' from `summary`, not by counting rows \u2014 but when `summary.moreAvailable` is set this is one page, so report `summary.upstreamTotal` for the fleet-wide figure, never `total`. Do NOT use this to fetch full details for a specific subscriber \u2014 use `get_subscriber` for that.",
       inputSchema: z.object({
         imsi: z.string().optional().describe("Filter by IMSI"),
         iccid: z.string().optional().describe("Filter by ICCID"),
@@ -1522,12 +1529,7 @@ function registerAllTools(server2, ctx) {
         status: z.string().optional().describe("Filter by status"),
         offset: z.number().optional().describe("Pagination offset"),
         limit: z.number().optional().describe("Max results to return")
-      }).refine(
-        (d) => d.imsi !== void 0 || d.iccid !== void 0 || d.activationCode !== void 0 || d.accountId !== void 0 || d.msisdn !== void 0,
-        {
-          message: "Provide at least one of: imsi, iccid, activationCode, accountId, msisdn"
-        }
-      ),
+      }),
       annotations: { readOnlyHint: true }
     },
     wrapHandler(
@@ -1538,13 +1540,25 @@ function registerAllTools(server2, ctx) {
       async (args, token2) => {
         const params = buildListSubscriberParams(args);
         const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const raw = await client2.call("listSubscriber", params);
+        const scope = await scopeListSubscriberParams({
+          params,
+          ...ctx.managedAuth.managed ? { managed: true } : {},
+          ...ctx.managedAuth.preferredAccountId ? { preferredAccountId: ctx.managedAuth.preferredAccountId } : {},
+          call: (method, callParams) => client2.call(method, callParams)
+        });
+        if (!scope.ok) throw new Error(scope.message);
+        const raw = await client2.call("listSubscriber", scope.params);
         const payload = applySubscriberFilters(raw, args);
+        const summarised = withOcsListSummary(payload, "subscribers");
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify(withOcsListSummary(payload, "subscribers"), null, 2)
+              text: JSON.stringify(
+                scope.defaultAccount ? { ...summarised, default_account: scope.defaultAccount } : summarised,
+                null,
+                2
+              )
             }
           ]
         };
@@ -5069,7 +5083,7 @@ function registerAllBacklogTools(server2, ctx) {
 }
 
 // src/tools-carrier-ask.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/tools-ui-agent.ts
 import { z as z4 } from "zod";
@@ -7706,6 +7720,118 @@ function registerAtlasTools(server2, ctx) {
   );
 }
 
+// src/tools-network-default.ts
+import { z as z12 } from "zod";
+var NETWORK_DEFAULT_TOOL_SCOPES = {
+  get_network_default: "read",
+  set_network_default: "write",
+  plan_network_default: "read"
+};
+var choiceShape = z12.object({
+  mode: z12.enum(NETWORK_DEFAULT_MODES),
+  steeringListId: z12.number().int().positive().optional()
+}).describe("`cheapest_available`, `all`, or `custom` with a steeringListId from list_steering_lists");
+function ioFor(ctx, token2) {
+  const kv = ctx.env.CARRIER_USERS;
+  const key = networkDefaultKey(
+    networkDefaultPartition({
+      ...ctx.props.org_id ? { orgId: ctx.props.org_id } : {},
+      sub: ctx.props.sub
+    })
+  );
+  const io = {
+    resolveResellerId: () => getDefaultResellerId(ctx.env, token2),
+    // Single operator, own OCS token: the token is the tenant boundary (see
+    // docs/single-tenant-model.md), so no managed scoping is needed here.
+    callOcs: (method, resellerId) => new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2).call(method, resellerId),
+    // No binding means no store: say so (undefined), never pretend "nothing stored".
+    readStored: () => kv ? kv.get(key, "json").catch(() => null) : void 0
+  };
+  if (kv) {
+    io.writeStored = async (record) => {
+      await kv.put(key, JSON.stringify(record));
+    };
+  }
+  return io;
+}
+function asResult(r) {
+  if (r.ok) return { content: [{ type: "text", text: JSON.stringify(r.data, null, 2) }] };
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify({ error: r.error, code: r.code, status: r.status }) }]
+  };
+}
+function registerNetworkDefaultTools(server2, ctx) {
+  server2.registerTool(
+    "get_network_default",
+    {
+      title: "Get Network Default",
+      description: "Use this to read the network default for this organisation: which networks a SIM is given in a country. The system default is `cheapest_available` (the lowest data rate among networks really available in the country). The org can choose `all` or a `custom` steering list instead. Returns: `systemDefault`, `orgDefault` (null when none stored), `effectiveMode`, `warnings`, and `appliesTo` (always `new_assignments_only`: existing SIMs are never changed by this setting). Do NOT use this to see which list a specific SIM has \u2014 use `get_subscriber`.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true }
+    },
+    wrapHandler(
+      "get_network_default",
+      "getCustomerTariff",
+      NETWORK_DEFAULT_TOOL_SCOPES["get_network_default"],
+      ctx,
+      async (_args, token2) => asResult(await getNetworkDefault(ioFor(ctx, token2)))
+    )
+  );
+  server2.registerTool(
+    "set_network_default",
+    {
+      title: "Set Network Default",
+      description: "Use this to set the organisation's network default to `cheapest_available`, `all`, or `custom` (a steering list id from `list_steering_lists`, which must exist). This only stores the setting. It changes no SIM, writes nothing to OCS and does not migrate existing customers: it applies to NEW assignments. A single assignment can still override it with `plan_network_default`'s `simOverride`. Params: `mode` (required), `steeringListId` (required when mode is `custom`), `dry_run` (preview only). Do NOT use this to assign a list to one SIM \u2014 use `modify_subscriber_steering_list`.",
+      inputSchema: {
+        mode: z12.enum(NETWORK_DEFAULT_MODES).describe("cheapest_available | all | custom"),
+        steeringListId: z12.number().int().positive().optional().describe("Required when mode is custom"),
+        dry_run: z12.boolean().optional().describe("If true, validate and return what would be stored; store nothing")
+      },
+      annotations: { readOnlyHint: false, idempotentHint: true, destructiveHint: false }
+    },
+    wrapHandler(
+      "set_network_default",
+      "listSteeringList",
+      NETWORK_DEFAULT_TOOL_SCOPES["set_network_default"],
+      ctx,
+      async (args, token2) => {
+        const body2 = args.mode === "custom" ? { mode: args.mode, steeringListId: args.steeringListId } : { mode: args.mode };
+        const io = ioFor(ctx, token2);
+        if (args.dry_run === true) {
+          if (!io.writeStored) return asResult(await setNetworkDefault(io, body2, ctx.props.sub, /* @__PURE__ */ new Date()));
+          const probe = await setNetworkDefault({ ...io, writeStored: async () => {
+          } }, body2, ctx.props.sub, /* @__PURE__ */ new Date());
+          if (!probe.ok) return asResult(probe);
+          return asResult({ ok: true, data: { dry_run: true, wouldStore: probe.data.orgDefault, appliesTo: probe.data.appliesTo } });
+        }
+        return asResult(await setNetworkDefault(io, body2, ctx.props.sub, /* @__PURE__ */ new Date()));
+      }
+    )
+  );
+  server2.registerTool(
+    "plan_network_default",
+    {
+      title: "Plan Network Default",
+      description: "Use this to see which networks a SIM would be given in one or more countries, before anything is assigned. By default that is the cheapest available network per country (lowest data rate above zero, among rules really in force). Precedence: `simOverride`, then `packageOverride`, then the org default, then `cheapest_available`. Read only: `applied` is always false. If the tariff is missing or cannot be compared it falls back to ALL networks and says so in `warnings` and `summary` (`fellBackToAll: true`); never present that as a cheapest choice. The price basis is the wholesale data rate per MB, not the end price. Creating a steering list has no OCS REST method, so when no existing list matches the result is `needs_list`, not a created list. Params: `countries` (ISO-3166 alpha-2 codes, required), `simOverride`, `packageOverride`, `resellerId` (optional).",
+      inputSchema: {
+        countries: z12.array(z12.string().length(2)).min(1).describe('ISO-3166 alpha-2 codes, e.g. ["CA"]'),
+        simOverride: choiceShape.optional(),
+        packageOverride: choiceShape.optional(),
+        resellerId: z12.number().int().positive().optional().describe("Omit to use the token owner's reseller")
+      },
+      annotations: { readOnlyHint: true }
+    },
+    wrapHandler(
+      "plan_network_default",
+      "getCustomerTariff",
+      NETWORK_DEFAULT_TOOL_SCOPES["plan_network_default"],
+      ctx,
+      async (args, token2) => asResult(await planNetworkDefault(ioFor(ctx, token2), args, /* @__PURE__ */ new Date()))
+    )
+  );
+}
+
 // src/credits.ts
 var TIER_CREDIT_ALLOTMENTS = {
   free: 5e3,
@@ -9080,7 +9206,8 @@ var ALL_TOOL_SCOPES = Object.freeze({
   ...STOREFRONT_LOGO_TOOL_SCOPES,
   // Storefront deploy tools exist only in this package, not in the Worker.
   ...STOREFRONT_DEPLOY_TOOL_SCOPES,
-  ...ATLAS_TOOL_SCOPES
+  ...ATLAS_TOOL_SCOPES,
+  ...NETWORK_DEFAULT_TOOL_SCOPES
 });
 var TOOL_REGISTRY = new Set(Object.keys(ALL_TOOL_SCOPES));
 var UNREGISTERED_TOOLS = /* @__PURE__ */ new Set(["stripe_proxy_call"]);
@@ -9755,15 +9882,15 @@ function registerAllCarrierAskTools(server2, ctx) {
       title: "Natural Language Carrier Tool Router",
       description: "Use this when you want to perform a carrier operation but don't know which specific tool to call. Describe your intent in plain language and carrier_ask will identify the correct tool(s) and suggest the required parameters. For simple read intents, it executes directly and returns results. For destructive operations it returns a confirm_token that you must pass in a second call. Params: `intent` (string \u2014 natural language description of what you want to do), `context` (optional: iccid, account_id, reseller_id if already known). Returns: RouteResult \u2014 confirmed | pending_confirm | ambiguous | none. Do NOT use this when you know the right tool \u2014 direct calls are faster and cheaper.",
       inputSchema: {
-        intent: z12.string().min(3).describe(
+        intent: z13.string().min(3).describe(
           "Natural-language description of the operation to perform (e.g. 'suspend ICCID 89316 until next month', 'show fleet health', 'assign Europe 5GB package to subscriber 89316...')"
         ),
-        context: z12.object({
-          iccid: z12.string().optional().describe("Subscriber ICCID if already known"),
-          account_id: z12.number().optional().describe("Account ID if already known"),
-          reseller_id: z12.number().optional().describe("Reseller ID if already known")
+        context: z13.object({
+          iccid: z13.string().optional().describe("Subscriber ICCID if already known"),
+          account_id: z13.number().optional().describe("Account ID if already known"),
+          reseller_id: z13.number().optional().describe("Reseller ID if already known")
         }).optional().describe("Optional pre-resolved context to improve routing accuracy"),
-        confirm_token: z12.string().optional().describe(
+        confirm_token: z13.string().optional().describe(
           "One-time token from a previous carrier_ask call with confirm_required=true. Providing this executes the previously staged destructive operation."
         )
       }
@@ -9967,7 +10094,7 @@ function registerAllCarrierAskTools(server2, ctx) {
       title: "Describe a Carrier Tool",
       description: "Get full documentation for any registered Carrier MCP tool: description, parameters, 2-3 example invocations, required scope, destructive flag, and guidance. Params: `tool_name` (exact MCP tool name, e.g. 'assign_package'). Returns: structured tool metadata. Does NOT execute the tool.",
       inputSchema: {
-        tool_name: z12.string().describe("The exact MCP tool name to describe (e.g. 'assign_package', 'hlr_set_bitrate')")
+        tool_name: z13.string().describe("The exact MCP tool name to describe (e.g. 'assign_package', 'hlr_set_bitrate')")
       }
     },
     wrapHandler(
@@ -10060,7 +10187,7 @@ function buildExamples(toolName) {
 }
 
 // src/list-recent-ocs-events.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/ocs-scoping.ts
 function managedOwnAccountId(auth) {
@@ -10228,10 +10355,10 @@ var ALLOWED_EVENT_TYPES = [
   "usage.anomaly"
 ];
 var listRecentOcsEventsSchema = {
-  iccid: z13.string().regex(/^\d{19,20}$/).describe("ICCID, 19 or 20 digits, ITU-T E.118 format"),
-  limit: z13.number().int().min(1).max(50).default(20).describe("Max events to return, newest first"),
-  event_types: z13.array(z13.enum(ALLOWED_EVENT_TYPES)).optional().describe("Filter to specific event types"),
-  since: z13.string().datetime().optional().describe("ISO-8601 timestamp; only events after this point")
+  iccid: z14.string().regex(/^\d{19,20}$/).describe("ICCID, 19 or 20 digits, ITU-T E.118 format"),
+  limit: z14.number().int().min(1).max(50).default(20).describe("Max events to return, newest first"),
+  event_types: z14.array(z14.enum(ALLOWED_EVENT_TYPES)).optional().describe("Filter to specific event types"),
+  since: z14.string().datetime().optional().describe("ISO-8601 timestamp; only events after this point")
 };
 async function listRecentOcsEvents2(iccid, limit, eventTypes, since, kv) {
   return listRecentOcsEvents(iccid, limit, eventTypes, since, kv);
@@ -10294,7 +10421,7 @@ function registerListRecentOcsEventsTool(server2, ctx) {
 }
 
 // src/tools-rate-governor.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var MONITORED_ENDPOINTS = [
   "subscriberNetworkEventsOverPeriod",
   // 30/min
@@ -10326,7 +10453,7 @@ function registerRateLimitStatusTool(server2, ctx) {
       title: "API Rate-Limit Governor Status",
       description: "Inspect Bridge4IP OCS rate-limit governor state \u2014 bucket fill levels, per-endpoint limits, and 80% alert thresholds. Use this to answer: 'are we rate limited', 'check ocs quota', 'how full is the rate limit bucket', 'rate limit status'. Params: `endpoint` (optional \u2014 OCS camelCase method name to inspect a single bucket, e.g. 'subscriberUsageOverPeriod'; omit for all monitored endpoints). Returns: per-endpoint { limit_per_min, batch_cap_per_min, calls_in_window, batch_calls_in_window, utilisation_pct, alert (true when \u226580% of limit) }. Note: counts come from the in-process sliding-window log (same key as OCS calls: API token + endpoint) \u2014 they reset when the Worker isolate recycles. Use as a relative signal, not an exact counter. Do NOT use this to adjust limits \u2014 limits are set by Bridge4IP contract and cannot be changed via MCP.",
       inputSchema: {
-        endpoint: z14.string().optional().describe(
+        endpoint: z15.string().optional().describe(
           "OCS method name in camelCase (e.g. 'subscriberUsageOverPeriod'). Omit to return status for all monitored endpoints."
         )
       },
@@ -10382,7 +10509,7 @@ function registerRateLimitStatusTool(server2, ctx) {
 }
 
 // src/tools-depletion-events.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 function ok4(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
 }
@@ -10410,10 +10537,10 @@ function registerDepletionEventsTool(server2, ctx) {
       title: "Subscriber Bundle Depletion Events",
       description: "Look up bundle depletion events for a subscriber (or list recent fleet-wide depletions). Returns the most recent bundle.depleted event stored when the prepaid usage webhook received a last_slice notification. Events are retained for 7 days. Use subscriberId to check a specific subscriber, or omit to list the 20 most recent fleet-wide depletions. Requires 'read' scope.",
       inputSchema: {
-        subscriberId: z15.string().optional().describe(
+        subscriberId: z16.string().optional().describe(
           "OCS subscriber ID to look up. Omit to list the 20 most recent fleet-wide depletions."
         ),
-        since: z15.string().optional().describe(
+        since: z16.string().optional().describe(
           "ISO-8601 timestamp \u2014 only return events at or after this time (for single-subscriber lookup)."
         )
       },
@@ -10528,7 +10655,7 @@ function registerDepletionEventsTool(server2, ctx) {
 }
 
 // src/tools-country-history.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 function isoDate(now, daysAgo = 0) {
   const d = new Date(now.getTime() - daysAgo * 864e5);
   return d.toISOString().slice(0, 10);
@@ -10551,10 +10678,10 @@ function registerCountryHistoryTool(server2, ctx) {
       title: "Subscriber Country History",
       description: "Return cross-border movement history for a subscriber, reconstructed from OCS Gy charging events. Reads `gyAnswer.events` from `subscriberNetworkEventsOverPeriod` \u2014 every Gy record carries its own country, operator and MCC \u2014 and collapses consecutive same-country records into stays with first-seen and last-seen timestamps. This needs no webhook: it works with Relay LU and Relay Gy off. Relay `country.entered` events from the 24h ring-buffer are merged in as a supplement when present. Use this to answer: 'where has subscriber X traveled', 'show country history for ICCID', 'border crossings for this SIM'. Params: `subscriberId` (ICCID, 19\u201320 digits), `startDate`/`endDate` (YYYY-MM-DD, max 7 days apart, default the last 7 days), `limit` (1\u201350, default 20, newest first). Returns: `stays` ({ country, country_name, first_seen, last_seen, operators, mccs, event_count, used_bytes }), `transitions` ({ from, to, at }), and `country_events` in the legacy flat shape. `used_bytes` already handles the string-typed `usedUnits` and its 'N/A' values. Do NOT use this for raw per-session records \u2014 use `subscriber_network_events` for those.",
       inputSchema: {
-        subscriberId: z16.string().regex(/^\d{19,20}$/, "subscriberId must be a 19\u201320 digit ICCID").describe("Subscriber ICCID (19\u201320 digits, ITU-T E.118)"),
-        startDate: z16.string().regex(/^\d{4}-\d{2}-\d{2}$/, "startDate must be YYYY-MM-DD").optional().describe("Start of the period, YYYY-MM-DD inclusive (default: 7 days ago)"),
-        endDate: z16.string().regex(/^\d{4}-\d{2}-\d{2}$/, "endDate must be YYYY-MM-DD").optional().describe("End of the period, YYYY-MM-DD inclusive, max 7 days from start (default: today)"),
-        limit: z16.number().int().min(1).max(50).default(20).optional().describe("Maximum number of country_events to return, newest first (default 20, max 50)")
+        subscriberId: z17.string().regex(/^\d{19,20}$/, "subscriberId must be a 19\u201320 digit ICCID").describe("Subscriber ICCID (19\u201320 digits, ITU-T E.118)"),
+        startDate: z17.string().regex(/^\d{4}-\d{2}-\d{2}$/, "startDate must be YYYY-MM-DD").optional().describe("Start of the period, YYYY-MM-DD inclusive (default: 7 days ago)"),
+        endDate: z17.string().regex(/^\d{4}-\d{2}-\d{2}$/, "endDate must be YYYY-MM-DD").optional().describe("End of the period, YYYY-MM-DD inclusive, max 7 days from start (default: today)"),
+        limit: z17.number().int().min(1).max(50).default(20).optional().describe("Maximum number of country_events to return, newest first (default 20, max 50)")
       },
       annotations: { readOnlyHint: true, idempotentHint: true }
     },
@@ -10662,7 +10789,7 @@ function registerCountryHistoryTool(server2, ctx) {
 }
 
 // src/apps/fleet-health-app.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 import {
   registerAppTool,
   registerAppResource,
@@ -10778,7 +10905,7 @@ function registerFleetHealthApp(server2, ctx) {
       title: "Fleet Health Dashboard",
       description: "Draw the fleet overview as an interactive panel: eSIM status, per-account breakdown and low-balance alerts. Returns structuredContent for the panel, so it only helps a client that can render MCP UI resources. Do NOT use this when the answer has to be readable text, or in any headless or scripted context \u2014 `fleet_health` returns the same data as prose.",
       inputSchema: {
-        accountId: z17.number().optional().describe("Filter to a specific account (omit for all)")
+        accountId: z18.number().optional().describe("Filter to a specific account (omit for all)")
       },
       annotations: { readOnlyHint: true },
       _meta: {
@@ -10821,7 +10948,7 @@ function registerFleetHealthApp(server2, ctx) {
 }
 
 // src/apps/provisioning-wizard.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import {
   registerAppTool as registerAppTool2,
   registerAppResource as registerAppResource2,
@@ -10926,10 +11053,10 @@ function registerProvisioningWizard(server2, ctx) {
       title: "eSIM Provisioning Wizard",
       description: "Interactive 3-step wizard to provision an eSIM: select subscriber, choose package template, preview (dry_run) and confirm execution.",
       inputSchema: {
-        step: z18.enum(["init", "select-package", "preview", "confirm"]).describe("Current wizard step"),
-        wizardId: z18.string().optional().describe("Wizard session ID (absent on init)"),
-        subscriber_iccid: z18.string().optional().describe("Subscriber ICCID (required for select-package)"),
-        package_template_id: z18.number().optional().describe("Package template ID (required for preview)")
+        step: z19.enum(["init", "select-package", "preview", "confirm"]).describe("Current wizard step"),
+        wizardId: z19.string().optional().describe("Wizard session ID (absent on init)"),
+        subscriber_iccid: z19.string().optional().describe("Subscriber ICCID (required for select-package)"),
+        package_template_id: z19.number().optional().describe("Package template ID (required for preview)")
       },
       _meta: {
         ui: {
@@ -11199,7 +11326,7 @@ function registerProvisioningWizard(server2, ctx) {
 }
 
 // src/apps/balance-topup.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 import {
   registerAppTool as registerAppTool3,
   registerAppResource as registerAppResource3,
@@ -11252,9 +11379,9 @@ function registerBalanceTopupApp(server2, ctx) {
       title: "Balance Top-up Form",
       description: "Adjust the OCS reseller-account balance behind one subscriber, through a form panel the user can review before it commits. Defaults to preview: a call that omits `preview` returns a projection and writes nothing. Only `preview: false` performs the OCS write. Params: `iccid` (subscriber identifier used to find the account), `delta` (amount to add when positive, deduct when negative), `preview` (boolean, default true). Requires `admin` scope plus recent MFA, and a client that can render UI panels. Do NOT use this in a headless or scripted context \u2014 call `modify_account_balance` directly, which takes an `accountId` and needs no panel. Do NOT use this for a subscriber's own balance \u2014 the `iccid` here only locates the account; per-subscriber money is `modify_subscriber_balance`. Do NOT use this for the Carrier prepaid wallet or MCP credits \u2014 see `wallet_topup_checkout` and `credit_balance`.",
       inputSchema: {
-        iccid: z19.string().describe("The subscriber ICCID for the account lookup"),
-        delta: z19.number().describe("Amount to add (positive) or deduct (negative) from the account balance"),
-        preview: z19.boolean().default(true).describe("If true, return preview without writing. If false, execute the balance change.")
+        iccid: z20.string().describe("The subscriber ICCID for the account lookup"),
+        delta: z20.number().describe("Amount to add (positive) or deduct (negative) from the account balance"),
+        preview: z20.boolean().default(true).describe("If true, return preview without writing. If false, execute the balance change.")
       },
       annotations: { destructiveHint: true },
       _meta: {
@@ -11337,7 +11464,7 @@ function registerAllApps(server2, ctx) {
 }
 
 // src/prompts.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 function registerAllPrompts(server2) {
   server2.registerPrompt(
     "fleet_health_report",
@@ -11373,7 +11500,7 @@ Format as a structured report with sections, tables, and actionable recommendati
     {
       title: "Subscriber Deep Dive",
       description: "Comprehensive analysis of a single subscriber: profile, packages, usage patterns, location history, recommendations.",
-      argsSchema: { iccid: z20.string().describe("The subscriber ICCID to analyse") }
+      argsSchema: { iccid: z21.string().describe("The subscriber ICCID to analyse") }
     },
     async ({ iccid }) => ({
       messages: [
@@ -11472,7 +11599,7 @@ Analyze and present:
     {
       title: "Bulk Operations Planner",
       description: "Plan bulk operations safely: mass package assignments, account migrations, balance adjustments, or status changes.",
-      argsSchema: { operation: z20.string().describe("Describe the bulk operation you want to perform") }
+      argsSchema: { operation: z21.string().describe("Describe the bulk operation you want to perform") }
     },
     async ({ operation }) => ({
       messages: [
@@ -11505,7 +11632,7 @@ NEVER execute destructive operations without confirmation.`
 }
 
 // src/tools-pricing.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 function registerAllPricingTools(server2, ctx) {
   const allTools = [...PRICING_TOOLS, ...PROJECTS_TOOLS];
   for (const tool of allTools) {
@@ -11612,19 +11739,19 @@ function buildZodSchema(schema) {
   for (const [key, prop] of Object.entries(properties)) {
     let field;
     if (prop.enum) {
-      field = z21.enum(prop.enum);
+      field = z22.enum(prop.enum);
     } else if (prop.type === "number") {
-      field = z21.number();
+      field = z22.number();
     } else if (prop.type === "boolean") {
-      field = z21.boolean();
+      field = z22.boolean();
     } else if (prop.type === "array") {
       if (prop.items?.type === "number") {
-        field = z21.array(z21.number());
+        field = z22.array(z22.number());
       } else {
-        field = z21.array(z21.string());
+        field = z22.array(z22.string());
       }
     } else {
-      field = z21.string();
+      field = z22.string();
     }
     const required = schema.required ?? [];
     if (!required.includes(key)) {
@@ -11639,7 +11766,7 @@ function buildZodSchema(schema) {
 }
 
 // src/tools-greenzone.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // src/greenzone-whitelist.ts
 var STATE_KEY = "greenzone:state";
@@ -11930,9 +12057,9 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 Add",
       description: "Add a hostname and/or IP address to the Bridge4IP Greenzone whitelist. The Greenzone whitelist controls which hosts/IPs are exempt from data charging after a subscriber's bundle is depleted. This operates via browser automation (Kapture) against the OCS portal \u2014 no REST API exists for this surface. Provide `host` (e.g. 'example.com') and/or `ip` (e.g. '203.0.113.0/24'). At least one of host or ip must be provided. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
       inputSchema: {
-        host: z22.string().optional().describe("Hostname to whitelist (e.g. 'example.com')"),
-        ip: z22.string().optional().describe("IP address or CIDR to whitelist (e.g. '203.0.113.0/24')"),
-        dry_run: z22.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+        host: z23.string().optional().describe("Hostname to whitelist (e.g. 'example.com')"),
+        ip: z23.string().optional().describe("IP address or CIDR to whitelist (e.g. '203.0.113.0/24')"),
+        dry_run: z23.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
       },
       annotations: { destructiveHint: true }
     },
@@ -11991,9 +12118,9 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 Remove",
       description: "Remove a hostname and/or IP address from the Bridge4IP Greenzone whitelist. This operates via browser automation (Kapture) against the OCS portal. Provide `host` and/or `ip` to remove \u2014 at least one required. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
       inputSchema: {
-        host: z22.string().optional().describe("Hostname to remove from whitelist"),
-        ip: z22.string().optional().describe("IP address or CIDR to remove from whitelist"),
-        dry_run: z22.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+        host: z23.string().optional().describe("Hostname to remove from whitelist"),
+        ip: z23.string().optional().describe("IP address or CIDR to remove from whitelist"),
+        dry_run: z23.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
       },
       annotations: { destructiveHint: true }
     },
@@ -12052,7 +12179,7 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 List",
       description: "List current Greenzone whitelist entries from the KV cache. Returns all whitelisted hosts and IPs, when the state was last synced, and whether the last hourly reconciliation detected drift from the portal. This is a fast read from KV \u2014 no browser automation required. Use `from_portal: true` to trigger a live portal read via Kapture instead of KV. Requires 'read' scope.",
       inputSchema: {
-        from_portal: z22.boolean().optional().describe(
+        from_portal: z23.boolean().optional().describe(
           "When true, return Kapture steps to read live portal state instead of KV cache"
         )
       },
@@ -12104,7 +12231,7 @@ function registerGreenzoneTools(server2, ctx) {
 }
 
 // src/tools-ui-agent-generic.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var COST_PER_STEP_USD = 0.014;
 var SESSION_OVERHEAD_USD = 5e-3;
 function estimateCostUsd2(steps) {
@@ -12146,13 +12273,13 @@ function registerUiAgentGenericTools(server2, ctx, runtime) {
       title: "Dispatch Generic Browsing Agent",
       description: "Send a plain-language task to a hosted browsing agent, which drives a real browser on the open web \u2014 navigating pages, searching, extracting content, filling forms outside the OCS portal. Each run costs roughly $0.20-1.00 in model spend against your own BROWSER_USE_API_KEY, so treat it as the expensive last resort, not a lookup. Limited to CARRIER_BROWSER_USE_MAX_RUNS runs per CLI session (default 10). Params: `prompt` (1-4000 chars \u2014 name the target URL and the exact data or action), `max_steps` (1-30, default 15; prices the dry-run estimate only), `dry_run` (true returns only `estimated_cost_usd` and creates no session). Returns the finished result: unlike the hosted Worker, a local CLI has no background runtime, so this call blocks for the length of the run. Requires `write` scope. Do NOT use this to work out which Carrier tool answers a request \u2014 that is `carrier_ask`, which costs nothing. Do NOT use this for anything the OCS API already covers; every other tool here is faster, free, and audited.",
       inputSchema: {
-        prompt: z23.string().min(1).max(4e3).describe(
+        prompt: z24.string().min(1).max(4e3).describe(
           "Natural-language task description for the browsing agent. Be specific: include target URLs, data to extract, or actions to perform."
         ),
-        max_steps: z23.number().int().min(1).max(30).optional().describe(
+        max_steps: z24.number().int().min(1).max(30).optional().describe(
           "Advisory step budget (1\u201330, default 15). Prices the dry-run estimate; the hosted agent sets its own depth."
         ),
-        dry_run: z23.boolean().optional().describe(
+        dry_run: z24.boolean().optional().describe(
           "Preview cost estimate without dispatching. Returns estimated_cost_usd only \u2014 no browser session is created."
         )
       }
@@ -12289,7 +12416,7 @@ function registerUiAgentGenericTools(server2, ctx, runtime) {
       title: "Poll Browsing Agent Task Status",
       description: "Returns the current state of a browsing-agent task by `task_id`, including its result once finished. In the local CLI, ui_agent_ask already returns the finished result, so this is mainly for re-reading a task within the same session. Task records do not survive the CLI process exiting. Requires `read` scope.",
       inputSchema: {
-        task_id: z23.string().describe("Task ID returned by ui_agent_ask")
+        task_id: z24.string().describe("Task ID returned by ui_agent_ask")
       }
     },
     async (args) => {
@@ -12417,6 +12544,7 @@ registerAllCarrierAskTools(server, toolCtx);
 registerListRecentOcsEventsTool(server, toolCtx);
 registerRateLimitStatusTool(server, toolCtx);
 registerCountryHistoryTool(server, toolCtx);
+registerNetworkDefaultTools(server, toolCtx);
 registerDepletionEventsTool(server, toolCtx);
 registerAllApps(server, toolCtx);
 registerAllPricingTools(server, toolCtx);