@carrierllc/mcp 0.13.24 → 0.13.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carrierllc/mcp",
-  "version": "0.13.24",
+  "version": "0.13.26",
   "description": "Carrier MCP \u2014 natural-language control of MVNO/eSIM fleets via eSIMVault OCS. Stdio mode for direct integration with Claude Desktop, Cursor, Windsurf, and MCP-compatible clients. Ships the `carrier` CLI (plugin install + white-label eSIM storefront scaffold).",
   "license": "MIT",
   "author": "Carrier (Lifecycle Innovations Limited)",

package/plugin/carrier/skills/storefront/SKILL.md

@@ -51,7 +51,7 @@ MCP over stdio (these drive host CLIs on your machine, so they are local-only):
 
 ```
 list_deploy_targets        dir: ./storefront
-deploy_storefront          dir: ./storefront   [target, name, skip_build, push_secrets, verify, domain]
+deploy_storefront          dir: ./storefront   [target, name, force, skip_build, push_secrets, verify, domain]
 provision_storefront_clerk dir: ./storefront   [name, production, no_create, url]
 ```
 

package/templates/storefront/src/app/api/checkout/guest/route.ts

@@ -102,7 +102,32 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
     }
     const channel = normalizeChannel(body.channel);
     const stripeKey = process.env.STRIPE_SECRET_KEY;
-    const catalog = await fetchTemplateCatalog();
+    // The deployment selects the public shop, never request-body scope. Read
+    // its canonical id and plans together so fulfilment cannot fall back to
+    // the legacy catalog or charge a stale/foreign tenant's price.
+    const slug = process.env.NEXT_PUBLIC_STOREFRONT_SLUG;
+    let storefrontId: string | null = null;
+    let catalog;
+    if (slug) {
+      const base = (process.env.NEXT_PUBLIC_CARRIER_API_URL ?? "").replace(/\/+$/, "");
+      if (!base || !/^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(slug)) {
+        return NextResponse.json({ error: "Storefront unavailable" }, { status: 503 });
+      }
+      const response = await fetch(`${base}/api/hosted/${encodeURIComponent(slug)}`, { cache: "no-store" });
+      if (!response.ok) return NextResponse.json({ error: "Storefront unavailable" }, { status: 503 });
+      const shop = await response.json();
+      if (!shop || typeof shop !== "object" || Array.isArray(shop) ||
+          typeof shop.id !== "string" || !/^sf_[A-Za-z0-9_-]{20}$/.test(shop.id) ||
+          typeof shop.name !== "string" || !shop.name.trim() || typeof shop.url !== "string" ||
+          (shop.status !== undefined && shop.status !== "published") ||
+          shop.slug !== slug || !Array.isArray(shop.plans)) {
+        return NextResponse.json({ error: "Storefront unavailable" }, { status: 503 });
+      }
+      storefrontId = shop.id;
+      catalog = { source: "live" as const, templates: shop.plans };
+    } else {
+      catalog = await fetchTemplateCatalog();
+    }
 
     const decision = decideGuestCheckout({
       catalog,
@@ -179,6 +204,10 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
       // session-level copy is what fulfilment keys off to provision the eSIM —
       // without it the plan is lost and the order is stuck "activating".
       "metadata[templateId]": templateId,
+      ...(storefrontId ? {
+        "metadata[storefront_id]": storefrontId,
+        "payment_intent_data[metadata][storefront_id]": storefrontId,
+      } : {}),
       "payment_intent_data[metadata][templateId]": templateId,
       // Where the sale came from. Written alongside templateId and by the same
       // reasoning: attribution recovered later from Stripe reports is guesswork,

package/templates/storefront/src/vendor/carrier/client.ts

@@ -102,6 +102,14 @@ function apiKey(): string {
   return process.env.CARRIER_API_KEY ?? "";
 }
 
+/** Order tenant scope comes only from deployment config, never buyer input. */
+function orderPath(orderId: string, action = ""): string | null {
+  const path = `/api/orders/${encodeURIComponent(orderId)}${action}`;
+  const slug = process.env.NEXT_PUBLIC_STOREFRONT_SLUG;
+  if (slug && !/^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(slug)) return null;
+  return slug ? `${path}?storefront=${encodeURIComponent(slug)}` : path;
+}
+
 function sampleCatalog(reason: CatalogDegradedReason): TemplateCatalog {
   return { templates: MOCK_TEMPLATES, source: "sample", reason };
 }
@@ -190,12 +198,15 @@ export async function fetchOrder(orderId: string): Promise<OrderLookup> {
   if (!base) return { ok: false, reason: "unconfigured" };
   if (!/^[A-Za-z0-9_-]{1,256}$/.test(orderId)) return { ok: false, reason: "not-found" };
 
+  const path = orderPath(orderId);
+  if (path === null) return { ok: false, reason: "unconfigured" };
+
   const headers: Record<string, string> = { Accept: "application/json" };
   const key = apiKey();
   if (key) headers.Authorization = `Bearer ${key}`;
 
   try {
-    const res = await fetch(`${base}/api/orders/${encodeURIComponent(orderId)}`, {
+    const res = await fetch(`${base}${path}`, {
       headers,
       cache: "no-store",
     });
@@ -228,12 +239,15 @@ async function orderScopedCall<T>(
   if (!base) return { ok: false, reason: "unconfigured" };
   if (!/^[A-Za-z0-9_-]{1,256}$/.test(orderId)) return { ok: false, reason: "not-found" };
 
+  const scopedPath = orderPath(orderId, path);
+  if (scopedPath === null) return { ok: false, reason: "unconfigured" };
+
   const headers: Record<string, string> = { Accept: "application/json", ...(init?.headers as Record<string, string>) };
   const key = apiKey();
   if (key) headers.Authorization = `Bearer ${key}`;
 
   try {
-    const res = await fetch(`${base}/api/orders/${encodeURIComponent(orderId)}${path}`, {
+    const res = await fetch(`${base}${scopedPath}`, {
       ...init,
       headers,
       cache: "no-store",