@carrierllc/mcp 0.13.17 → 0.13.18

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-SAZFMURF.js";
+} from "./chunk-VXROP2SU.js";
 import {
   copyTree,
   exists,

package/dist/index.js

@@ -80,7 +80,7 @@ import {
   verifyStorefront,
   withOcsListSummary,
   withTemplateResellerId
-} from "./chunk-SAZFMURF.js";
+} from "./chunk-VXROP2SU.js";
 import "./chunk-SHKKVIIA.js";
 
 // src/index.ts
@@ -6827,6 +6827,33 @@ function requireBinding(binding, tool, name, subject) {
   );
 }
 
+// src/stripe-headers.ts
+var STRIPE_API_VERSION = "2025-08-27.basil";
+function isStripeOrgKey(stripeKey) {
+  return stripeKey.startsWith("sk_org_");
+}
+function stripeAccountHeaders(stripeKey, connectedAccountId, platformAccountId) {
+  if (isStripeOrgKey(stripeKey)) {
+    if (connectedAccountId) {
+      return {
+        "Stripe-Context": platformAccountId ? `${platformAccountId}/${connectedAccountId}` : connectedAccountId
+      };
+    }
+    return platformAccountId ? { "Stripe-Context": platformAccountId } : {};
+  }
+  if (connectedAccountId) return { "Stripe-Account": connectedAccountId };
+  return {};
+}
+function buildStripeHeaders(stripeKey, opts = {}) {
+  const headers = {
+    Authorization: `Bearer ${stripeKey}`,
+    "Stripe-Version": STRIPE_API_VERSION,
+    ...stripeAccountHeaders(stripeKey, opts.connectedAccountId, opts.platformAccountId)
+  };
+  if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
+  return headers;
+}
+
 // src/stripe-connect-tools.ts
 async function verifyConfirmToken(env, sub, toolName, token2) {
   requireBinding(
@@ -6861,23 +6888,21 @@ function err2(text) {
   return { isError: true, content: [{ type: "text", text }] };
 }
 async function stripeGet(stripeKey, path, connectedAccountId) {
-  const headers = {
-    Authorization: `Bearer ${stripeKey}`,
-    "Stripe-Version": "2025-08-27.basil"
-  };
-  if (connectedAccountId) headers["Stripe-Account"] = connectedAccountId;
+  const headers = buildStripeHeaders(stripeKey, {
+    connectedAccountId,
+    platformAccountId: process.env.STRIPE_PLATFORM_ACCOUNT_ID
+  });
   const res = await fetch(`https://api.stripe.com${path}`, { headers });
   const data = await res.json();
   return { ok: res.ok, status: res.status, data };
 }
 async function stripePost(stripeKey, path, params, connectedAccountId, idempotencyKey) {
-  const headers = {
-    Authorization: `Bearer ${stripeKey}`,
-    "Stripe-Version": "2025-08-27.basil",
-    "Content-Type": "application/x-www-form-urlencoded"
-  };
-  if (connectedAccountId) headers["Stripe-Account"] = connectedAccountId;
-  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;
+  const headers = buildStripeHeaders(stripeKey, {
+    connectedAccountId,
+    platformAccountId: process.env.STRIPE_PLATFORM_ACCOUNT_ID,
+    idempotencyKey
+  });
+  headers["Content-Type"] = "application/x-www-form-urlencoded";
   const res = await fetch(`https://api.stripe.com${path}`, {
     method: "POST",
     headers,
@@ -6932,7 +6957,7 @@ function registerStripeConnectTools(server2, ctx) {
       const opKvKey = operator_id ? `stripe_account:${operator_id}` : kvKey;
       const start = Date.now();
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const accountId = await env.CARRIER_USERS.get(opKvKey);
         if (!accountId) {
@@ -6985,7 +7010,7 @@ function registerStripeConnectTools(server2, ctx) {
       if (denied) return denied;
       const start = Date.now();
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
         if (!accountId) return err2("No connected Stripe account found.");
@@ -7022,7 +7047,7 @@ function registerStripeConnectTools(server2, ctx) {
       if (denied) return denied;
       const start = Date.now();
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
         if (!accountId) return err2("No connected Stripe account found.");
@@ -7079,7 +7104,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
         return err2("Invalid or expired confirm_token. Call without token to get a new one.");
       }
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
         if (!accountId) return err2("No connected Stripe account found.");
@@ -7126,7 +7151,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
       if (denied) return denied;
       const start = Date.now();
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
         if (!accountId) return err2("No connected Stripe account found.");
@@ -7171,7 +7196,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
       }
       const start = Date.now();
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const params = new URLSearchParams({ limit: String(limit) });
         if (open_only) params.set("open", "true");
@@ -7225,7 +7250,7 @@ Call again with confirm_token="${token2}" to execute. Expires in 5 minutes.`
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
       if (!valid) return err2("Invalid or expired confirm_token.");
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
@@ -7281,7 +7306,7 @@ Expires in 5 minutes.`
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
       if (!valid) return err2("Invalid or expired confirm_token.");
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
@@ -7338,7 +7363,7 @@ Expires in 5 minutes.`
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
       if (!valid) return err2("Invalid or expired confirm_token.");
       try {
-        const stripeKey = env.STRIPE_SECRET_KEY;
+        const stripeKey = env.STRIPE_ORG_SECRET_KEY ?? env.STRIPE_SECRET_KEY;
         if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
@@ -12573,6 +12598,10 @@ var stdioEnv = {
   CARRIER_USERS: null,
   DOWNLOADS: null,
   STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY ?? "",
+  // Undefined (not "") when absent so `ORG ?? SECRET` falls back in the
+  // stripe-connect tools; an empty string would shadow the legacy key.
+  STRIPE_ORG_SECRET_KEY: process.env.STRIPE_ORG_SECRET_KEY,
+  STRIPE_PLATFORM_ACCOUNT_ID: process.env.STRIPE_PLATFORM_ACCOUNT_ID,
   // Browser Use Cloud. Read from the environment with a real fallback, the way
   // STRIPE_SECRET_KEY above and the wallet values below are — unlike the
   // MANUS_API_KEY this replaces, which was hardcoded to "" with no fallback at