@carrierllc/mcp 0.13.24 → 0.13.26

package/dist/cli.js

@@ -31,6 +31,7 @@ import {
   repairPlanFor,
   rollback,
   run,
+  setWorkerName,
   slug,
   storefrontClerkUrls,
   storefrontScreen,
@@ -39,7 +40,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-YQQUV7AE.js";
+} from "./chunk-HTIPSHMH.js";
 import {
   copyTree,
   exists,
@@ -275,294 +276,6 @@ async function writeStorefrontLogo(target, brand) {
   return { path: svgPath, source: logo.source };
 }
 
-// src/cli/lib/hosted-publish.ts
-import { readFileSync } from "fs";
-
-// ../../packages/sdk/src/storefront-labels.ts
-var regionNames = new Intl.DisplayNames(["en"], { type: "region" });
-var PREFERRED = /* @__PURE__ */ new Set(["CW", "BF", "BJ", "MM", "CD", "RS", "DE", "FR", "GB", "VU", "ZW", "RU", "TL", "VN", "YE"]);
-var NAME_TO_CODE = /* @__PURE__ */ new Map();
-for (let first = 65; first <= 90; first += 1) {
-  for (let second = 65; second <= 90; second += 1) {
-    const code = String.fromCharCode(first, second);
-    const label = regionLabel(code);
-    if (!label) continue;
-    const key = label.toLowerCase();
-    const current = NAME_TO_CODE.get(key);
-    if (!current || PREFERRED.has(code)) NAME_TO_CODE.set(key, code);
-  }
-}
-NAME_TO_CODE.set("uk", "GB");
-var CODE_ALIASES = { UK: "GB" };
-function parseDataGb(raw) {
-  if (raw.trim().toLowerCase() === "unlimited") return { ok: true, value: 0, unlimited: true };
-  const parsed = parseAmount(raw, /gigabytes?|gbs?|gb/gi, "Enter data like 1, 1 GB, or Unlimited.", 1e4, false);
-  if (!parsed.ok) return parsed;
-  return { ok: true, value: parsed.value, unlimited: false };
-}
-function parseValidityDays(raw) {
-  return parseAmount(raw, /days?/gi, "Enter validity like 7 or 7 days.", 3650, true);
-}
-var ZERO_DECIMAL = /* @__PURE__ */ new Set([
-  "BIF",
-  "CLP",
-  "DJF",
-  "GNF",
-  "JPY",
-  "KMF",
-  "KRW",
-  "MGA",
-  "PYG",
-  "RWF",
-  "UGX",
-  "VND",
-  "VUV",
-  "XAF",
-  "XOF",
-  "XPF"
-]);
-function majorToCents(input, currency = "EUR") {
-  const text3 = input.trim();
-  if (ZERO_DECIMAL.has(currency.trim().toUpperCase())) {
-    if (!/^\d+$/.test(text3)) return { ok: false, message: "Enter a whole number, such as 1000." };
-    const cents2 = Number(text3);
-    if (!Number.isSafeInteger(cents2) || cents2 <= 0) return { ok: false, message: "Enter a price above zero." };
-    return { ok: true, cents: cents2 };
-  }
-  const match = /^(\d+)(?:\.(\d{1,2}))?$/.exec(text3);
-  if (!match) return { ok: false, message: "Enter a price like 9.00." };
-  const major = Number(match[1]);
-  const fraction = (match[2] ?? "").padEnd(2, "0");
-  const cents = major * 100 + Number(fraction);
-  if (!Number.isSafeInteger(cents) || cents <= 0) return { ok: false, message: "Enter a price above zero." };
-  return { ok: true, cents };
-}
-function parseCountryInput(raw) {
-  const regions = [];
-  const parts = raw.split(",").map((part) => part.trim()).filter((part) => part !== "");
-  for (const part of parts) {
-    const added = codesFor(part);
-    if (!added) return { ok: false, message: "Countries are names, such as France, or codes such as FR." };
-    for (const code of added) {
-      if (regions.length >= MAX_REGIONS_PER_PLAN) break;
-      if (!regions.includes(code)) regions.push(code);
-    }
-  }
-  return { ok: true, regions };
-}
-var MAX_REGIONS_PER_PLAN = 250;
-function parseAmount(raw, unit, message, max, whole) {
-  const text3 = raw.trim().replace(unit, "").trim();
-  if (text3 === "" || !/^\d+(\.\d+)?$/.test(text3)) return { ok: false, message };
-  const value = Number(text3);
-  if (!Number.isFinite(value) || value < 0 || value > max) return { ok: false, message };
-  if (whole && !Number.isInteger(value)) return { ok: false, message };
-  return { ok: true, value };
-}
-function codesFor(part) {
-  const tokens = part.split(/\s+/).filter((token) => token !== "");
-  if (tokens.length > 1 && tokens.every((token) => /^[A-Za-z]{2}$/.test(token))) {
-    return tokens.map((token) => canonical(token));
-  }
-  if (/^[A-Za-z]{2}$/.test(part)) return [canonical(part)];
-  const code = NAME_TO_CODE.get(part.toLowerCase());
-  return code ? [code] : null;
-}
-function canonical(code) {
-  const upper = code.toUpperCase();
-  return CODE_ALIASES[upper] ?? upper;
-}
-var LOGO_DATA = /^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/]+={0,2}$/;
-var LOGO_MAX_CHARS = 1e5;
-var LOGO_MAX_BYTES = 70 * 1024;
-function logoFileDataUrl(bytes) {
-  const mime = logoMime(bytes);
-  if (!mime || bytes.byteLength < 1 || bytes.byteLength > LOGO_MAX_BYTES) {
-    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
-  }
-  const url = `data:${mime};base64,${toBase64(bytes)}`;
-  if (url.length > LOGO_MAX_CHARS || !LOGO_DATA.test(url)) {
-    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
-  }
-  return { ok: true, url };
-}
-function logoReference(value) {
-  const trimmed = value.trim();
-  if (trimmed.startsWith("data:")) {
-    if (trimmed.length <= LOGO_MAX_CHARS && LOGO_DATA.test(trimmed)) return { ok: true, url: trimmed };
-    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
-  }
-  try {
-    const url = new URL(trimmed);
-    if (url.protocol === "https:") return { ok: true, url: url.toString() };
-  } catch {
-    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
-  }
-  return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
-}
-function toBase64(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary);
-}
-function logoMime(bytes) {
-  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) {
-    return "image/png";
-  }
-  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
-  if (bytes.length >= 6 && bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70) return "image/gif";
-  if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
-    return "image/webp";
-  }
-  return null;
-}
-function regionLabel(code) {
-  if (!/^[A-Z]{2}$/.test(code)) return void 0;
-  try {
-    const label = regionNames.of(code);
-    if (!label || label.toUpperCase() === code) return void 0;
-    return label;
-  } catch {
-    return void 0;
-  }
-}
-
-// ../../packages/sdk/src/storefront-write.ts
-var THEME_FIELDS = [
-  ["accent", "accent"],
-  ["accentDark", "accentDark"],
-  ["bg", "bg"],
-  ["text", "text"],
-  ["logoUrl", "logoUrl"]
-];
-var COPY_FIELDS = [
-  ["hero", "hero"],
-  ["tagline", "tagline"],
-  ["supportEmail", "supportEmail"],
-  ["legalName", "legalName"]
-];
-function storefrontBrandPatch(input, existing) {
-  const theme = overlay(existing?.theme, input, THEME_FIELDS);
-  const copy = overlay(existing?.copy, input, COPY_FIELDS);
-  return {
-    ...theme ? { theme } : {},
-    ...copy ? { copy } : {}
-  };
-}
-function completePlanInput(input, plans) {
-  if ((input.productId?.trim() ?? "") !== "") return input;
-  const touched = [
-    input.slug,
-    input.name,
-    input.priceCents,
-    input.currency,
-    input.templateId,
-    input.dataGb,
-    input.unlimited,
-    input.validityDays,
-    input.regions,
-    input.description,
-    input.active,
-    input.sortOrder
-  ].some((value) => value !== void 0);
-  if (!touched) return input;
-  const slug2 = input.slug?.trim();
-  const match = slug2 ? plans.find((plan) => plan.slug === slug2) : plans.length === 1 ? plans[0] : void 0;
-  if (!match) {
-    const currency = sharedCurrency(plans);
-    if (!input.currency && currency) return { ...input, currency };
-    return input;
-  }
-  return {
-    ...input,
-    slug: input.slug ?? match.slug,
-    name: input.name ?? match.name,
-    currency: input.currency ?? match.currency,
-    templateId: input.templateId ?? match.ocs_package_template_id
-  };
-}
-function sharedCurrency(plans) {
-  const codes = new Set(plans.map((plan) => plan.currency.trim().toUpperCase()).filter((code) => code !== ""));
-  if (codes.size !== 1) return void 0;
-  return [...codes][0];
-}
-function storefrontPlanBody(input) {
-  const productId = input.productId?.trim() ?? "";
-  if (productId !== "") {
-    const body2 = { product_id: productId };
-    if (input.priceCents !== void 0) body2.price_cents = input.priceCents;
-    if (input.active !== void 0) body2.active = input.active;
-    if (input.sortOrder !== void 0) body2.sort_order = input.sortOrder;
-    return body2;
-  }
-  const touched = [
-    input.slug,
-    input.name,
-    input.priceCents,
-    input.currency,
-    input.templateId,
-    input.dataGb,
-    input.unlimited,
-    input.validityDays,
-    input.regions,
-    input.description,
-    input.active,
-    input.sortOrder
-  ].some((value) => value !== void 0);
-  if (!touched) return null;
-  if (!input.slug || !input.name || input.priceCents === void 0 || !input.currency || input.templateId === void 0) {
-    return { error: "A plan needs a slug, name, price in minor units, currency, and OCS template id." };
-  }
-  if (input.dataGb !== void 0 && input.dataGb <= 0 && input.unlimited !== true) {
-    return { error: "data_gb of 0 is refused. Send unlimited: true to sell an unlimited plan." };
-  }
-  const body = {
-    slug: input.slug,
-    name: input.name,
-    price_cents: input.priceCents,
-    currency: input.currency,
-    ocs_package_template_id: input.templateId
-  };
-  if (input.dataGb !== void 0) body.data_gb = input.dataGb;
-  if (input.unlimited !== void 0) body.unlimited = input.unlimited;
-  if (input.validityDays !== void 0) body.validity_days = input.validityDays;
-  if (input.regions !== void 0) body.regions = input.regions;
-  if (input.description !== void 0) body.description = input.description;
-  if (input.active !== void 0) body.active = input.active;
-  if (input.sortOrder !== void 0) body.sort_order = input.sortOrder;
-  return body;
-}
-function isStorefrontPlanError(value) {
-  return value !== null && "error" in value;
-}
-function parseWholeNumber(value, label) {
-  if (value === void 0) return { ok: true, value: void 0 };
-  if (!/^\d+$/.test(value)) return { ok: false, message: `${label} must be a whole number.` };
-  return { ok: true, value: Number(value) };
-}
-function overlay(base, input, fields) {
-  const patch = {};
-  let touched = false;
-  for (const [field, jsonKey] of fields) {
-    const value = input[field];
-    if (typeof value !== "string" || value.trim() === "") continue;
-    patch[jsonKey] = value.trim();
-    touched = true;
-  }
-  if (!touched) return void 0;
-  return { ...base ?? {}, ...patch };
-}
-var RESERVED_SLUGS = /* @__PURE__ */ new Set(["www", "app", "api", "stores", "checkout", "dashboard", "admin", "mail"]);
-function hostedStorefrontUrl(slug2) {
-  return `https://${slug2}.stores.carrier.llc`;
-}
-function storefrontSlugFrom(raw) {
-  const folded = raw.trim().toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  const clipped = folded.slice(0, 40).replace(/-+$/g, "");
-  if (RESERVED_SLUGS.has(clipped)) return "";
-  return /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(clipped) ? clipped : "";
-}
-
 // src/cli/lib/auth.ts
 import { createHash, randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
@@ -1266,247 +979,542 @@ async function callMcpTool(tool, args, opts = {}) {
       return {
         ok: false,
         text: withNextStep(
-          `MCP call to ${tool} timed out after ${secs}s (no response).`,
-          [
-            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
-            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
-            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
-            "Or open Claude and ask there with full tool routing"
-          ]
+          `MCP call to ${tool} timed out after ${secs}s (no response).`,
+          [
+            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
+            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
+            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
+            "Or open Claude and ask there with full tool routing"
+          ]
+        )
+      };
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      ok: false,
+      text: withNextStep(`Could not reach MCP: ${msg}`, [
+        "Verify outbound HTTPS to mcp.carrier.llc",
+        "Use the interactive Claude path while offline from this machine"
+      ])
+    };
+  } finally {
+    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+  }
+}
+var ASK_ERROR_HINTS = [
+  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
+  "Or use a discrete command: carrier --help lists every domain"
+];
+function parseRouting(text3) {
+  const trimmed = text3.trim();
+  if (!trimmed.startsWith("{")) return void 0;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
+    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
+    return routes || asksBack ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function carrierAsk(intent) {
+  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
+  if (!routed.ok) return routed;
+  const routing = parseRouting(routed.text);
+  if (!routing) return routed;
+  if (!routing.resolved_tool) {
+    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
+    return {
+      ok: false,
+      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
+        ...candidates,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  const tool = routing.resolved_tool;
+  const args = routing.resolved_params ?? {};
+  if (routing.match && routing.match !== "confirmed") {
+    return {
+      ok: false,
+      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
+        `Closest tool: ${tool}`,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  if (routing.confirm_required) {
+    return {
+      ok: false,
+      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
+        `Params: ${JSON.stringify(args)}`,
+        "Run the matching discrete command so every flag is explicit and reviewable",
+        "carrier --help lists every domain"
+      ])
+    };
+  }
+  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
+}
+
+// src/cli/lib/rest.ts
+var DEFAULT_ERROR_HINTS2 = [
+  "Re-check the arguments: carrier <domain> <command> --help",
+  "Or open Claude and ask there with full tool routing"
+];
+function resolveApiKey() {
+  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
+}
+function ocsTokenOnly() {
+  return Boolean(
+    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
+  );
+}
+function applyPath(path, args) {
+  const rest = { ...args };
+  const missing = [];
+  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
+    const value = rest[name];
+    if (value === void 0 || value === null || value === "") {
+      missing.push(name);
+      return `{${name}}`;
+    }
+    delete rest[name];
+    return encodeURIComponent(String(value));
+  });
+  return { path: filled, rest, missing };
+}
+function queryString(args) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(args)) {
+    if (value === void 0 || value === null) continue;
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+function bodyText(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return "";
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed.error === "string") return parsed.error;
+    if (typeof parsed.message === "string") return parsed.message;
+    return trimmed;
+  } catch {
+    return trimmed;
+  }
+}
+async function callRestEndpoint(method, path, args, opts = {}) {
+  const token = resolveApiKey() ?? await getAccessToken();
+  if (!token) {
+    return {
+      ok: false,
+      text: withNextStep(
+        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
+        [
+          "Sign in from this terminal: carrier login",
+          "No account yet? carrier open signup",
+          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+        ]
+      )
+    };
+  }
+  const { path: resolvedPath, rest, missing } = applyPath(path, args);
+  if (missing.length) {
+    return {
+      ok: false,
+      text: withNextStep(`Cannot build ${method} ${path}.`, [
+        `Missing path value(s): ${missing.join(", ")}`,
+        "See every flag: carrier <domain> <command> --help"
+      ])
+    };
+  }
+  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
+  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/json",
+    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
+  };
+  if (sendsBody) headers["Content-Type"] = "application/json";
+  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
+  if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
+  const timeoutMs = mcpTimeoutMs();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method,
+      headers,
+      signal: controller.signal,
+      body: sendsBody ? JSON.stringify(rest) : void 0
+    });
+    const raw = await res.text();
+    if (res.status === 202) {
+      let confirmToken;
+      let expires;
+      let message = "";
+      try {
+        const parsed = JSON.parse(raw);
+        confirmToken = parsed.confirm_token;
+        expires = parsed.expires_in_seconds;
+        message = parsed.message ?? "";
+      } catch {
+      }
+      return {
+        ok: false,
+        text: withNextStep(
+          message || `${method} ${path} needs an explicit confirmation.`,
+          confirmToken ? [
+            `Re-run the same command with: --confirm-token ${confirmToken}`,
+            `The token is single-use and expires in ${expires ?? 120}s.`
+          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
+        )
+      };
+    }
+    if (res.status === 401 || res.status === 403) {
+      return {
+        ok: false,
+        text: withNextStep(
+          `Carrier API returned ${res.status} (auth rejected).`,
+          [
+            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
+            "Or sign in from this terminal: carrier login",
+            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
+          ]
+        )
+      };
+    }
+    if (!res.ok) {
+      return {
+        ok: false,
+        text: withNextStep(
+          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
+          opts.errorHints ?? DEFAULT_ERROR_HINTS2
         )
       };
     }
+    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
+  } catch (e) {
+    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
+    if (aborted) {
+      const secs = Math.round(timeoutMs / 1e3);
+      return {
+        ok: false,
+        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
+          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+          "Confirm the service is up: check network access to https://api.carrier.llc"
+        ])
+      };
+    }
     const msg = e instanceof Error ? e.message : String(e);
     return {
       ok: false,
-      text: withNextStep(`Could not reach MCP: ${msg}`, [
-        "Verify outbound HTTPS to mcp.carrier.llc",
+      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
+        "Verify outbound HTTPS to api.carrier.llc",
         "Use the interactive Claude path while offline from this machine"
       ])
     };
   } finally {
-    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+    clearTimeout(timer);
   }
 }
-var ASK_ERROR_HINTS = [
-  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
-  "Or use a discrete command: carrier --help lists every domain"
-];
-function parseRouting(text3) {
-  const trimmed = text3.trim();
-  if (!trimmed.startsWith("{")) return void 0;
+
+// src/cli/lib/hosted-publish.ts
+import { readFileSync } from "fs";
+
+// ../../packages/sdk/src/storefront-labels.ts
+var regionNames = new Intl.DisplayNames(["en"], { type: "region" });
+var PREFERRED = /* @__PURE__ */ new Set(["CW", "BF", "BJ", "MM", "CD", "RS", "DE", "FR", "GB", "VU", "ZW", "RU", "TL", "VN", "YE"]);
+var NAME_TO_CODE = /* @__PURE__ */ new Map();
+for (let first = 65; first <= 90; first += 1) {
+  for (let second = 65; second <= 90; second += 1) {
+    const code = String.fromCharCode(first, second);
+    const label = regionLabel(code);
+    if (!label) continue;
+    const key = label.toLowerCase();
+    const current = NAME_TO_CODE.get(key);
+    if (!current || PREFERRED.has(code)) NAME_TO_CODE.set(key, code);
+  }
+}
+NAME_TO_CODE.set("uk", "GB");
+var CODE_ALIASES = { UK: "GB" };
+function parseDataGb(raw) {
+  if (raw.trim().toLowerCase() === "unlimited") return { ok: true, value: 0, unlimited: true };
+  const parsed = parseAmount(raw, /gigabytes?|gbs?|gb/gi, "Enter data like 1, 1 GB, or Unlimited.", 1e4, false);
+  if (!parsed.ok) return parsed;
+  return { ok: true, value: parsed.value, unlimited: false };
+}
+function parseValidityDays(raw) {
+  return parseAmount(raw, /days?/gi, "Enter validity like 7 or 7 days.", 3650, true);
+}
+var ZERO_DECIMAL = /* @__PURE__ */ new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "UGX",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF"
+]);
+function majorToCents(input, currency = "EUR") {
+  const text3 = input.trim();
+  if (ZERO_DECIMAL.has(currency.trim().toUpperCase())) {
+    if (!/^\d+$/.test(text3)) return { ok: false, message: "Enter a whole number, such as 1000." };
+    const cents2 = Number(text3);
+    if (!Number.isSafeInteger(cents2) || cents2 <= 0) return { ok: false, message: "Enter a price above zero." };
+    return { ok: true, cents: cents2 };
+  }
+  const match = /^(\d+)(?:\.(\d{1,2}))?$/.exec(text3);
+  if (!match) return { ok: false, message: "Enter a price like 9.00." };
+  const major = Number(match[1]);
+  const fraction = (match[2] ?? "").padEnd(2, "0");
+  const cents = major * 100 + Number(fraction);
+  if (!Number.isSafeInteger(cents) || cents <= 0) return { ok: false, message: "Enter a price above zero." };
+  return { ok: true, cents };
+}
+function parseCountryInput(raw) {
+  const regions = [];
+  const parts = raw.split(",").map((part) => part.trim()).filter((part) => part !== "");
+  for (const part of parts) {
+    const added = codesFor(part);
+    if (!added) return { ok: false, message: "Countries are names, such as France, or codes such as FR." };
+    for (const code of added) {
+      if (regions.length >= MAX_REGIONS_PER_PLAN) break;
+      if (!regions.includes(code)) regions.push(code);
+    }
+  }
+  return { ok: true, regions };
+}
+var MAX_REGIONS_PER_PLAN = 250;
+function parseAmount(raw, unit, message, max, whole) {
+  const text3 = raw.trim().replace(unit, "").trim();
+  if (text3 === "" || !/^\d+(\.\d+)?$/.test(text3)) return { ok: false, message };
+  const value = Number(text3);
+  if (!Number.isFinite(value) || value < 0 || value > max) return { ok: false, message };
+  if (whole && !Number.isInteger(value)) return { ok: false, message };
+  return { ok: true, value };
+}
+function codesFor(part) {
+  const tokens = part.split(/\s+/).filter((token) => token !== "");
+  if (tokens.length > 1 && tokens.every((token) => /^[A-Za-z]{2}$/.test(token))) {
+    return tokens.map((token) => canonical(token));
+  }
+  if (/^[A-Za-z]{2}$/.test(part)) return [canonical(part)];
+  const code = NAME_TO_CODE.get(part.toLowerCase());
+  return code ? [code] : null;
+}
+function canonical(code) {
+  const upper = code.toUpperCase();
+  return CODE_ALIASES[upper] ?? upper;
+}
+var LOGO_DATA = /^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/]+={0,2}$/;
+var LOGO_MAX_CHARS = 1e5;
+var LOGO_MAX_BYTES = 70 * 1024;
+function logoFileDataUrl(bytes) {
+  const mime = logoMime(bytes);
+  if (!mime || bytes.byteLength < 1 || bytes.byteLength > LOGO_MAX_BYTES) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  const url = `data:${mime};base64,${toBase64(bytes)}`;
+  if (url.length > LOGO_MAX_CHARS || !LOGO_DATA.test(url)) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  return { ok: true, url };
+}
+function logoReference(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("data:")) {
+    if (trimmed.length <= LOGO_MAX_CHARS && LOGO_DATA.test(trimmed)) return { ok: true, url: trimmed };
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
   try {
-    const parsed = JSON.parse(trimmed);
-    if (!parsed || typeof parsed !== "object") return void 0;
-    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
-    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
-    return routes || asksBack ? parsed : void 0;
+    const url = new URL(trimmed);
+    if (url.protocol === "https:") return { ok: true, url: url.toString() };
   } catch {
-    return void 0;
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
+  return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
 }
-async function carrierAsk(intent) {
-  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
-  if (!routed.ok) return routed;
-  const routing = parseRouting(routed.text);
-  if (!routing) return routed;
-  if (!routing.resolved_tool) {
-    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
-    return {
-      ok: false,
-      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
-        ...candidates,
-        ...ASK_ERROR_HINTS
-      ])
-    };
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function logoMime(bytes) {
+  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) {
+    return "image/png";
   }
-  const tool = routing.resolved_tool;
-  const args = routing.resolved_params ?? {};
-  if (routing.match && routing.match !== "confirmed") {
-    return {
-      ok: false,
-      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
-        `Closest tool: ${tool}`,
-        ...ASK_ERROR_HINTS
-      ])
-    };
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+  if (bytes.length >= 6 && bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70) return "image/gif";
+  if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
+    return "image/webp";
   }
-  if (routing.confirm_required) {
-    return {
-      ok: false,
-      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
-        `Params: ${JSON.stringify(args)}`,
-        "Run the matching discrete command so every flag is explicit and reviewable",
-        "carrier --help lists every domain"
-      ])
-    };
+  return null;
+}
+function regionLabel(code) {
+  if (!/^[A-Z]{2}$/.test(code)) return void 0;
+  try {
+    const label = regionNames.of(code);
+    if (!label || label.toUpperCase() === code) return void 0;
+    return label;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/sdk/src/storefront-write.ts
+var THEME_FIELDS = [
+  ["accent", "accent"],
+  ["accentDark", "accentDark"],
+  ["bg", "bg"],
+  ["text", "text"],
+  ["logoUrl", "logoUrl"]
+];
+var COPY_FIELDS = [
+  ["hero", "hero"],
+  ["tagline", "tagline"],
+  ["supportEmail", "supportEmail"],
+  ["legalName", "legalName"]
+];
+function storefrontBrandPatch(input, existing) {
+  const theme = overlay(existing?.theme, input, THEME_FIELDS);
+  const copy = overlay(existing?.copy, input, COPY_FIELDS);
+  return {
+    ...theme ? { theme } : {},
+    ...copy ? { copy } : {}
+  };
+}
+function completePlanInput(input, plans) {
+  if ((input.productId?.trim() ?? "") !== "") return input;
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.accountId,
+    input.dataGb,
+    input.unlimited,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active,
+    input.sortOrder
+  ].some((value) => value !== void 0);
+  if (!touched) return input;
+  const slug2 = input.slug?.trim();
+  const match = slug2 ? plans.find((plan) => plan.slug === slug2) : plans.length === 1 ? plans[0] : void 0;
+  if (!match) {
+    const currency = sharedCurrency(plans);
+    if (!input.currency && currency) return { ...input, currency };
+    return input;
   }
-  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
-}
-
-// src/cli/lib/rest.ts
-var DEFAULT_ERROR_HINTS2 = [
-  "Re-check the arguments: carrier <domain> <command> --help",
-  "Or open Claude and ask there with full tool routing"
-];
-function resolveApiKey() {
-  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
-}
-function ocsTokenOnly() {
-  return Boolean(
-    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
-  );
+  return {
+    ...input,
+    slug: input.slug ?? match.slug,
+    name: input.name ?? match.name,
+    currency: input.currency ?? match.currency,
+    templateId: input.templateId ?? match.ocs_package_template_id
+  };
 }
-function applyPath(path, args) {
-  const rest = { ...args };
-  const missing = [];
-  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
-    const value = rest[name];
-    if (value === void 0 || value === null || value === "") {
-      missing.push(name);
-      return `{${name}}`;
-    }
-    delete rest[name];
-    return encodeURIComponent(String(value));
-  });
-  return { path: filled, rest, missing };
+function sharedCurrency(plans) {
+  const codes = new Set(plans.map((plan) => plan.currency.trim().toUpperCase()).filter((code) => code !== ""));
+  if (codes.size !== 1) return void 0;
+  return [...codes][0];
 }
-function queryString(args) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(args)) {
-    if (value === void 0 || value === null) continue;
-    params.set(key, String(value));
+function storefrontPlanBody(input) {
+  if (input.accountId !== void 0 && (!Number.isSafeInteger(input.accountId) || input.accountId <= 0)) {
+    return { error: "OCS account id must be a positive integer." };
   }
-  const qs = params.toString();
-  return qs ? `?${qs}` : "";
-}
-function bodyText(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return "";
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (typeof parsed.error === "string") return parsed.error;
-    if (typeof parsed.message === "string") return parsed.message;
-    return trimmed;
-  } catch {
-    return trimmed;
+  const productId = input.productId?.trim() ?? "";
+  if (productId !== "") {
+    const body2 = { product_id: productId };
+    if (input.accountId !== void 0) body2.ocs_account_id = input.accountId;
+    if (input.priceCents !== void 0) body2.price_cents = input.priceCents;
+    if (input.active !== void 0) body2.active = input.active;
+    if (input.sortOrder !== void 0) body2.sort_order = input.sortOrder;
+    return body2;
   }
-}
-async function callRestEndpoint(method, path, args, opts = {}) {
-  const token = resolveApiKey() ?? await getAccessToken();
-  if (!token) {
-    return {
-      ok: false,
-      text: withNextStep(
-        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
-        [
-          "Sign in from this terminal: carrier login",
-          "No account yet? carrier open signup",
-          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
-        ]
-      )
-    };
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.accountId,
+    input.dataGb,
+    input.unlimited,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active,
+    input.sortOrder
+  ].some((value) => value !== void 0);
+  if (!touched) return null;
+  if (!input.slug || !input.name || input.priceCents === void 0 || !input.currency || input.templateId === void 0) {
+    return { error: "A plan needs a slug, name, price in minor units, currency, and OCS template id." };
   }
-  const { path: resolvedPath, rest, missing } = applyPath(path, args);
-  if (missing.length) {
-    return {
-      ok: false,
-      text: withNextStep(`Cannot build ${method} ${path}.`, [
-        `Missing path value(s): ${missing.join(", ")}`,
-        "See every flag: carrier <domain> <command> --help"
-      ])
-    };
+  if (input.dataGb !== void 0 && input.dataGb <= 0 && input.unlimited !== true) {
+    return { error: "data_gb of 0 is refused. Send unlimited: true to sell an unlimited plan." };
   }
-  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
-  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/json",
-    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
+  const body = {
+    slug: input.slug,
+    name: input.name,
+    price_cents: input.priceCents,
+    currency: input.currency,
+    ocs_package_template_id: input.templateId
   };
-  if (sendsBody) headers["Content-Type"] = "application/json";
-  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
-  if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
-  const timeoutMs = mcpTimeoutMs();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, {
-      method,
-      headers,
-      signal: controller.signal,
-      body: sendsBody ? JSON.stringify(rest) : void 0
-    });
-    const raw = await res.text();
-    if (res.status === 202) {
-      let confirmToken;
-      let expires;
-      let message = "";
-      try {
-        const parsed = JSON.parse(raw);
-        confirmToken = parsed.confirm_token;
-        expires = parsed.expires_in_seconds;
-        message = parsed.message ?? "";
-      } catch {
-      }
-      return {
-        ok: false,
-        text: withNextStep(
-          message || `${method} ${path} needs an explicit confirmation.`,
-          confirmToken ? [
-            `Re-run the same command with: --confirm-token ${confirmToken}`,
-            `The token is single-use and expires in ${expires ?? 120}s.`
-          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
-        )
-      };
-    }
-    if (res.status === 401 || res.status === 403) {
-      return {
-        ok: false,
-        text: withNextStep(
-          `Carrier API returned ${res.status} (auth rejected).`,
-          [
-            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
-            "Or sign in from this terminal: carrier login",
-            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
-          ]
-        )
-      };
-    }
-    if (!res.ok) {
-      return {
-        ok: false,
-        text: withNextStep(
-          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
-          opts.errorHints ?? DEFAULT_ERROR_HINTS2
-        )
-      };
-    }
-    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
-  } catch (e) {
-    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
-    if (aborted) {
-      const secs = Math.round(timeoutMs / 1e3);
-      return {
-        ok: false,
-        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
-          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-          "Confirm the service is up: check network access to https://api.carrier.llc"
-        ])
-      };
-    }
-    const msg = e instanceof Error ? e.message : String(e);
-    return {
-      ok: false,
-      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
-        "Verify outbound HTTPS to api.carrier.llc",
-        "Use the interactive Claude path while offline from this machine"
-      ])
-    };
-  } finally {
-    clearTimeout(timer);
+  if (input.accountId !== void 0) body.ocs_account_id = input.accountId;
+  if (input.dataGb !== void 0) body.data_gb = input.dataGb;
+  if (input.unlimited !== void 0) body.unlimited = input.unlimited;
+  if (input.validityDays !== void 0) body.validity_days = input.validityDays;
+  if (input.regions !== void 0) body.regions = input.regions;
+  if (input.description !== void 0) body.description = input.description;
+  if (input.active !== void 0) body.active = input.active;
+  if (input.sortOrder !== void 0) body.sort_order = input.sortOrder;
+  return body;
+}
+function isStorefrontPlanError(value) {
+  return value !== null && "error" in value;
+}
+function parseWholeNumber(value, label) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (!/^\d+$/.test(value)) return { ok: false, message: `${label} must be a whole number.` };
+  return { ok: true, value: Number(value) };
+}
+function overlay(base, input, fields) {
+  const patch = {};
+  let touched = false;
+  for (const [field, jsonKey] of fields) {
+    const value = input[field];
+    if (typeof value !== "string" || value.trim() === "") continue;
+    patch[jsonKey] = value.trim();
+    touched = true;
   }
+  if (!touched) return void 0;
+  return { ...base ?? {}, ...patch };
+}
+var RESERVED_SLUGS = /* @__PURE__ */ new Set(["www", "app", "api", "stores", "checkout", "dashboard", "admin", "mail"]);
+function hostedStorefrontUrl(slug2) {
+  return `https://${slug2}.stores.carrier.llc`;
+}
+function storefrontSlugFrom(raw) {
+  const folded = raw.trim().toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const clipped = folded.slice(0, 40).replace(/-+$/g, "");
+  if (RESERVED_SLUGS.has(clipped)) return "";
+  return /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(clipped) ? clipped : "";
 }
 
 // src/cli/lib/hosted-publish.ts
@@ -1557,6 +1565,10 @@ function hostedPublishInputFromFlags(flags) {
   if (!status) return { ok: false, text: "Status must be draft or published." };
   const price = readPrice(flags);
   if (!price.ok) return { ok: false, text: price.text };
+  const accountId = flags.ocsAccountId === void 0 ? void 0 : Number(flags.ocsAccountId);
+  if (accountId !== void 0 && (!/^\d+$/.test(flags.ocsAccountId) || !Number.isSafeInteger(accountId) || accountId <= 0)) {
+    return { ok: false, text: "OCS account id must be a positive integer." };
+  }
   const template = parseWholeNumber(flags.templateId, "Template id");
   if (!template.ok) return { ok: false, text: template.message };
   const data = readDataGb(flags.dataGb, flags.unlimited);
@@ -1590,6 +1602,7 @@ function hostedPublishInputFromFlags(flags) {
       priceCents: price.value,
       currency: flags.currency,
       templateId: template.value,
+      accountId,
       dataGb: data.value,
       unlimited: data.unlimited,
       validityDays: validity.value,
@@ -1650,6 +1663,7 @@ function planInput(input) {
     priceCents: input.priceCents,
     currency: input.currency,
     templateId: input.templateId,
+    accountId: input.accountId,
     dataGb: input.dataGb,
     unlimited: input.unlimited,
     validityDays: input.validityDays,
@@ -5393,7 +5407,9 @@ async function maybeBuildDeploy(target, brand, opts) {
     const r = await deploySite(target, brand, {
       preferred: opts.preferred,
       pushSecrets: opts.pushSecrets,
-      customDomain: opts.customDomain
+      customDomain: opts.customDomain,
+      explicitName: opts.explicitName,
+      force: opts.force
     });
     s.stop(r.ok ? `Deployed to ${r.target}: ${r.url ?? r.projectName}` : "Deploy skipped");
     if (!r.ok) {
@@ -5472,7 +5488,12 @@ async function verifyAndRepair(storefront, brand, url, targetId, projectName, op
   }
   const redeploy = await deploySite(storefront, brand, {
     preferred: targetId,
-    pushSecrets: opts.pushSecrets !== false
+    pushSecrets: opts.pushSecrets !== false,
+    // Keep the original deployment identity and acknowledgement: without
+    // these, a valid --force deploy to the scaffold default would be refused
+    // during repair, and an explicit --name could resolve differently.
+    explicitName: opts.explicitName,
+    force: opts.force
   });
   rs.stop(redeploy.ok ? "Repaired and redeployed" : "Redeploy failed");
   if (!redeploy.ok) {
@@ -6036,6 +6057,18 @@ program.command("dash [domain]").description(`Render a status screen in the term
   );
 });
 var site = program.command("site").description("Scaffold and deploy a white-labeled storefront.");
+site.command("list").description("List hosted storefronts with stored OCS account ownership.").action(async () => {
+  const result = await callRestEndpoint("GET", "/v1/storefronts", {});
+  process.stdout.write(`${result.text}
+`);
+  if (!result.ok) process.exitCode = 1;
+});
+site.command("show").description("Show a hosted storefront and its plans' OCS accounts.").requiredOption("--id <id>", "Storefront id").action(async (o) => {
+  const result = await callRestEndpoint("GET", "/v1/storefronts/{id}", { id: o.id });
+  process.stdout.write(`${result.text}
+`);
+  if (!result.ok) process.exitCode = 1;
+});
 site.command("create [dir]").description("Scaffold a white-labeled storefront from the bundled template.").option("--name <name>", "Brand name").option("--domain <domain>", "Domain").option("--accent <hex>", "Accent color").option("--yes", "Carrier defaults, no prompts").action(async (dir, o) => {
   header();
   let brand = { ...CARRIER_BRAND };
@@ -6079,9 +6112,15 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
     process.exitCode = 1;
     return;
   }
+  if (o.name) {
+    const workerName = slug(o.name);
+    if (await setWorkerName(target, workerName)) {
+      info(pc4.dim(`Worker name set to "${workerName}" in wrangler.jsonc`));
+    }
+  }
   p3.outro(pc4.green(`Scaffolded. cd ${dir ?? "storefront"} && pnpm install && pnpm dev`));
 });
-site.command("deploy [dir]").description("Build + deploy a storefront to whichever host is available on this box.").option("--name <name>", "Project/worker name (defaults from brand)").option(`--target <target>`, `Force a host: ${TARGET_IDS.join(" | ")}`).option("--no-secrets", "Skip staging runtime secrets on the host").option("--clerk", "Provision and configure Clerk before building").option("--no-verify", "Skip the post-deploy check that the site actually serves").option("--autofix-agent", "On an unrecognised failure, print an agent-ready diagnosis bundle").option("--domain", "Route the brand domain to the deployment (Cloudflare provisions DNS + cert)").action(
+site.command("deploy [dir]").description("Build + deploy a storefront to whichever host is available on this box.").option("--name <name>", "Project/worker name (defaults from brand)").option("--force", "Deploy under the scaffold default name anyway (acknowledges the overwrite risk)").option(`--target <target>`, `Force a host: ${TARGET_IDS.join(" | ")}`).option("--no-secrets", "Skip staging runtime secrets on the host").option("--clerk", "Provision and configure Clerk before building").option("--no-verify", "Skip the post-deploy check that the site actually serves").option("--autofix-agent", "On an unrecognised failure, print an agent-ready diagnosis bundle").option("--domain", "Route the brand domain to the deployment (Cloudflare provisions DNS + cert)").action(
   async (dir, o) => {
     header();
     const target = resolve2(dir ?? "./storefront");
@@ -6101,7 +6140,9 @@ site.command("deploy [dir]").description("Build + deploy a storefront to whichev
         clerk: o.clerk === true,
         verify: o.verify !== false,
         autofixAgent: o.autofixAgent === true,
-        customDomain: o.domain === true
+        customDomain: o.domain === true,
+        explicitName: o.name,
+        force: o.force === true
       });
     } catch (e) {
       fail(String(e instanceof Error ? e.message : e), [
@@ -6114,7 +6155,7 @@ site.command("deploy [dir]").description("Build + deploy a storefront to whichev
     p3.outro("");
   }
 );
-site.command("publish").description("Publish a Carrier-hosted storefront. Does not deploy a self-hosted copy.").requiredOption("--slug <slug>", "Shop address, such as acme or Acme Mobile").requiredOption("--name <name>", "Brand name").option("--status <status>", "draft or published", "published").option("--accent <hex>", "Accent color, such as #112233").option("--accent-dark <hex>", "Darker accent").option("--bg <hex>", "Page background").option("--text <hex>", "Body text color").option("--logo <url-or-file>", "https logo address, or a PNG, JPEG, WebP, or GIF under 70 KB").option("--hero <text>", "Shop headline").option("--tagline <text>", "Line under the headline").option("--support-email <email>", "Support address").option("--legal-name <name>", "Legal name in the footer").option("--product <id>", "Connectivity plan id. Copies its template, price, and allowance.").option("--plan <slug>", "Plan slug, such as eu-1gb").option("--plan-name <name>", "Plan name on the shop").option("--price <amount>", "Retail price, such as 9.00").option("--price-cents <cents>", "Retail price in minor units").option("--currency <code>", "Three-letter currency code").option("--template-id <id>", "OCS package template id").option("--data-gb <gb>", "Data allowance, such as 1 or 1 GB, or the text Unlimited").option("--unlimited", "The only way to sell an unlimited plan. A 0 or missing --data-gb without this is refused.").option("--validity-days <days>", "Validity, such as 7 or 7 days").option("--countries <names>", "Country names or codes, such as France, DE").option("--plan-text <text>", "Buyer-facing sentence. Omit to leave the saved text unchanged.").option("--inactive", "Keep the plan off the shop").option("--plan-sort-order <n>", "Plan display order on the shop (ascending, default 0)").action(async (o) => {
+site.command("publish").description("Publish a Carrier-hosted storefront. Does not deploy a self-hosted copy.").requiredOption("--slug <slug>", "Shop address, such as acme or Acme Mobile").requiredOption("--name <name>", "Brand name").option("--status <status>", "draft or published", "published").option("--accent <hex>", "Accent color, such as #112233").option("--accent-dark <hex>", "Darker accent").option("--bg <hex>", "Page background").option("--text <hex>", "Body text color").option("--logo <url-or-file>", "https logo address, or a PNG, JPEG, WebP, or GIF under 70 KB").option("--hero <text>", "Shop headline").option("--tagline <text>", "Line under the headline").option("--support-email <email>", "Support address").option("--legal-name <name>", "Legal name in the footer").option("--product <id>", "Connectivity plan id. Copies its template, price, and allowance.").option("--plan <slug>", "Plan slug, such as eu-1gb").option("--plan-name <name>", "Plan name on the shop").option("--price <amount>", "Retail price, such as 9.00").option("--price-cents <cents>", "Retail price in minor units").option("--currency <code>", "Three-letter currency code").option("--template-id <id>", "OCS package template id").option("--ocs-account-id <id>", "Owned OCS account override; omit for automatic resolution").option("--data-gb <gb>", "Data allowance, such as 1 or 1 GB, or the text Unlimited").option("--unlimited", "The only way to sell an unlimited plan. A 0 or missing --data-gb without this is refused.").option("--validity-days <days>", "Validity, such as 7 or 7 days").option("--countries <names>", "Country names or codes, such as France, DE").option("--plan-text <text>", "Buyer-facing sentence. Omit to leave the saved text unchanged.").option("--inactive", "Keep the plan off the shop").option("--plan-sort-order <n>", "Plan display order on the shop (ascending, default 0)").action(async (o) => {
   header();
   const built = hostedPublishInputFromFlags(o);
   if (!built.ok) {