@carrierllc/mcp 0.13.29 → 0.13.31

package/dist/cli.js

@@ -2,6 +2,7 @@
 import {
   CARRIER_BRAND,
   CARRIER_VERSION,
+  OCS_LIST_KEYS,
   OCS_MAX_USAGE_WINDOW_DAYS,
   TARGET_IDS,
   billingScreen,
@@ -13,6 +14,7 @@ import {
   deriveAccentDark,
   deriveAccentLight,
   deriveAccentPaletteSubs,
+  extractSubscriberStatus,
   fleetScreen,
   formatProbes,
   generateStorefrontLogo,
@@ -22,6 +24,7 @@ import {
   lastNDaysPeriod,
   loadStorefrontBrand,
   mergeEnvLocal,
+  package_default,
   packagesScreen,
   probeAll,
   provisionClerk,
@@ -35,12 +38,13 @@ import {
   slug,
   storefrontClerkUrls,
   storefrontScreen,
+  subscriberIccid,
   subscribersScreen,
   usageScreen,
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-LJPYVILK.js";
+} from "./chunk-EHJEAI4V.js";
 import {
   copyTree,
   exists,
@@ -54,7 +58,7 @@ import {
 import { Command } from "commander";
 import * as p3 from "@clack/prompts";
 import pc4 from "picocolors";
-import { resolve as resolve2 } from "path";
+import { resolve as resolve4 } from "path";
 
 // src/cli/lib/plugin.ts
 import { join as join2 } from "path";
@@ -66,7 +70,7 @@ import { existsSync } from "fs";
 import { homedir } from "os";
 function packageRoot() {
   const here = dirname(fileURLToPath(import.meta.url));
-  for (const candidate of [resolve(here, ".."), resolve(here, "..", "..")]) {
+  for (const candidate of [resolve(here, ".."), resolve(here, "..", ".."), resolve(here, "..", "..", "..")]) {
     if (existsSync(join(candidate, "plugin")) && existsSync(join(candidate, "templates"))) {
       return candidate;
     }
@@ -219,7 +223,7 @@ async function scaffoldStorefront(target, brand) {
   await patchBrandConfig(join3(target, "src", "brand.config.ts"), brand);
   const envBody = existingEnv ? preserveClerkFromEnv(existingEnv, renderEnv(brand)) : renderEnv(brand);
   await writeFile(envPath, envBody);
-  await writeFile(join3(target, ".npmrc"), "ignore-workspace-root-check=true\n");
+  await writeFile(join3(target, ".npmrc"), "# Standalone template installs use pnpm --ignore-workspace explicitly.\n");
 }
 async function patchBrandConfig(path, brand) {
   if (!await exists(path)) return;
@@ -277,13 +281,24 @@ async function writeStorefrontLogo(target, brand) {
 }
 
 // src/cli/lib/auth.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
 import { createServer } from "http";
 
+// src/cli/lib/mcp-oauth.ts
+import { createHash } from "crypto";
+import { open as open2, lstat, realpath } from "fs/promises";
+import { constants as constants2 } from "fs";
+import { join as join6, resolve as resolve2, dirname as dirname2 } from "path";
+import { homedir as homedir3, userInfo } from "os";
+import { spawn as spawn2, execFile } from "child_process";
+import { promisify } from "util";
+
 // src/cli/lib/credentials.ts
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
+import { chmod, mkdir as mkdir2, rm, rename, open } from "fs/promises";
+import { constants, rmSync } from "fs";
+import { randomUUID } from "crypto";
 function carrierHome() {
   return process.env.CARRIER_HOME?.trim() || join5(homedir2(), ".carrier");
 }
@@ -292,7 +307,15 @@ function credentialsPath() {
 }
 async function readCredentials() {
   try {
-    const raw = await readFile2(credentialsPath(), "utf8");
+    const handle = await open(credentialsPath(), constants.O_RDONLY | constants.O_NOFOLLOW);
+    let raw;
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile() || stat.size > 1024 * 1024 || process.platform !== "win32" && stat.mode & 63 || process.getuid && stat.uid !== process.getuid()) return null;
+      raw = await handle.readFile("utf8");
+    } finally {
+      await handle.close();
+    }
     const parsed = JSON.parse(raw);
     if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
     return parsed;
@@ -305,9 +328,56 @@ async function writeCredentials(creds) {
   await mkdir2(dir, { recursive: true, mode: 448 });
   await chmod(dir, 448).catch(() => void 0);
   const file = credentialsPath();
-  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-  await chmod(file, 384).catch(() => void 0);
+  const temporary = join5(dir, `.credentials-${randomUUID()}.json`);
+  try {
+    const handle = await open(temporary, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({ ...creds, generation: randomUUID() }, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function withCredentialLock(action) {
+  const dir = carrierHome();
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+  const lock = join5(dir, "credentials.lock");
+  const deadline = Date.now() + 31e4;
+  while (true) {
+    try {
+      await mkdir2(lock, { mode: 448 });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() >= deadline) throw new Error("Carrier credential owner is busy; retry or recover its abandoned lock.");
+      await new Promise((resolve5) => setTimeout(resolve5, 25));
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    rmSync(lock, { recursive: true, force: true });
+  };
+  const onSignal = () => {
+    release();
+    process.exit(1);
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  try {
+    return await action();
+  } finally {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+    if (!released) await rm(lock, { recursive: true });
+  }
 }
 async function clearCredentials() {
   await rm(credentialsPath(), { force: true });
@@ -316,11 +386,403 @@ function isExpired(creds, skewMs = 6e4) {
   if (!creds.expiresAt) return false;
   return Date.now() >= creds.expiresAt - skewMs;
 }
+function redactCredential(value, token) {
+  if (typeof value === "string") return value.split(token).join("***");
+  if (Array.isArray(value)) return value.map((item) => redactCredential(item, token));
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key.split(token).join("***"), redactCredential(item, token)]));
+  return value;
+}
 function redact(text3) {
-  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+  return text3.replace(/\bclerk_[^\s:"<>]+:[^\s:"<>]+:[^\s"<>]+/g, "clerk_***").replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+}
+
+// src/cli/lib/mcp-oauth.ts
+var CLAUDE_OWNER_VERSIONS = package_default.carrierCompatibility.claudeOAuthOwnerVersions;
+function usableOAuth(creds) {
+  if (creds.issuer !== MCP_HOME || !Number.isFinite(creds.expiresAt) || creds.expiresAt <= 0) return false;
+  if (Object.hasOwn(creds, "resource") && creds.resource !== MCP_URL) return false;
+  if (typeof creds.scope !== "string" || !creds.scope.split(/\s+/).includes("read")) return false;
+  if (typeof creds.accessToken !== "string" || !creds.accessToken || /[\s\0]/.test(creds.accessToken)) return false;
+  const account = process.env.CARRIER_OAUTH_ACCOUNT?.trim();
+  if (account && creds.accessToken.split(":")[0] !== `clerk_${account}`) return false;
+  return true;
+}
+async function privateText(file, privateMode = true) {
+  try {
+    const handle = await open2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
+    try {
+      const stat = await handle.stat();
+      if (!stat.isFile() || stat.size > 1024 * 1024 || privateMode && process.platform !== "win32" && stat.mode & 63 || process.getuid && stat.uid !== process.getuid()) return null;
+      return await handle.readFile("utf8");
+    } finally {
+      await handle.close();
+    }
+  } catch {
+    return null;
+  }
+}
+async function privateJson(file) {
+  try {
+    const text3 = await privateText(file);
+    return text3 ? JSON.parse(text3) : null;
+  } catch {
+    return null;
+  }
+}
+function oauthBinding(creds, selection) {
+  const parts = creds.accessToken.split(":");
+  const subject = /^clerk_[^:\s]+:[^:\s]+:[^:\s]+$/.test(creds.accessToken) ? parts.slice(0, 2) : [createHash("sha256").update(creds.accessToken).digest("hex")];
+  return createHash("sha256").update(JSON.stringify([selection, creds.issuer, creds.resource, subject])).digest("hex");
+}
+function validImport(creds) {
+  if (!/^clerk_[^:\s]+:[^:\s]+:[^:\s]+$/.test(creds.accessToken ?? "")) return null;
+  return usableOAuth(creds) && !isExpired(creds) ? creds : null;
+}
+function hermesServerConfig(text3, server) {
+  try {
+    return JSON.parse(text3)?.mcp_servers?.[server] ?? null;
+  } catch {
+  }
+  let inside = false, selected = false;
+  let sectionIndent = -1, serverIndent = -1;
+  const entry = {};
+  for (const line of text3.split(/\r?\n/)) {
+    if (!line.trim() || line.trimStart().startsWith("#")) continue;
+    if (/\t/.test(line)) return null;
+    const match = /^( *)([^:]+):\s*(.*?)\s*$/.exec(line);
+    if (!match) {
+      if (inside) return null;
+      continue;
+    }
+    const indent = match[1].length, key = match[2], value = match[3];
+    if (!inside) {
+      if (key === "mcp_servers" && value === "") {
+        inside = true;
+        sectionIndent = indent;
+      }
+      continue;
+    }
+    if (indent <= sectionIndent) break;
+    if (serverIndent < 0) serverIndent = indent;
+    if (indent === serverIndent) {
+      selected = key === server || key === JSON.stringify(server) || key === `'${server}'`;
+      if (selected && value) return null;
+      continue;
+    }
+    if (!selected) continue;
+    if (!value || /^[&*!>|\[{]/.test(value)) return null;
+    if (Object.hasOwn(entry, key)) return null;
+    let scalar = value;
+    if (value.startsWith('"')) {
+      try {
+        scalar = JSON.parse(value);
+      } catch {
+        return null;
+      }
+    } else if (value.startsWith("'")) {
+      if (!value.endsWith("'")) return null;
+      scalar = value.slice(1, -1).replace(/''/g, "'");
+    } else scalar = value.replace(/\s+#.*$/, "");
+    entry[key] = scalar;
+  }
+  return Object.keys(entry).length ? entry : null;
+}
+async function readHermesOAuth(server) {
+  if (!/^[\w-]{1,128}$/.test(server)) return null;
+  const home = process.env.HERMES_HOME?.trim() || join6(homedir3(), ".hermes");
+  const text3 = await privateText(join6(home, "config.yaml"), false);
+  const config = text3 && hermesServerConfig(text3, server);
+  if (!config || config.url !== MCP_URL || config.command || config.headers || config.type && config.type !== "http" && config.type !== "streamable-http") return null;
+  const dir = join6(home, "mcp-tokens");
+  const [token, client, meta] = await Promise.all([privateJson(join6(dir, `${server}.json`)), privateJson(join6(dir, `${server}.client.json`)), privateJson(join6(dir, `${server}.meta.json`))]);
+  if (!token || !client || !meta || token.hermes_issuer !== MCP_HOME || meta.issuer !== MCP_HOME) return null;
+  if (typeof client.client_id !== "string" || !client.client_id || token.client_id && token.client_id !== client.client_id) return null;
+  if (typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer") return null;
+  for (const field of ["authorization_endpoint", "token_endpoint"]) {
+    try {
+      if (new URL(String(meta[field])).origin !== MCP_HOME) return null;
+    } catch {
+      return null;
+    }
+  }
+  const hasResource = Object.hasOwn(token, "resource");
+  if (hasResource && token.resource !== MCP_URL) return null;
+  if (typeof token.expires_at !== "number") return null;
+  const creds = validImport({ issuer: MCP_HOME, ...hasResource ? { resource: token.resource } : {}, origin: "hermes-mcp", accessToken: token.access_token, expiresAt: token.expires_at * 1e3, scope: token.scope });
+  if (creds) creds.binding = oauthBinding(creds, [
+    "hermes",
+    resolve2(home),
+    server,
+    config,
+    client,
+    meta,
+    token.organization_id,
+    token.org_id,
+    token.account_id,
+    token.user_id
+  ]);
+  return creds;
+}
+function configuredClaudeDir() {
+  const value = process.env.CLAUDE_CONFIG_DIR;
+  return value && value.trim() ? value : void 0;
+}
+function claudeKeychainSelection() {
+  const custom = process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL;
+  if (custom && !["https://beacon.claude-ai.staging.ant.dev", "https://claude.fedstart.com", "https://claude-staging.fedstart.com"].includes(custom.replace(/\/$/, ""))) return null;
+  const configured = (configuredClaudeDir() ?? join6(homedir3(), ".claude")).normalize("NFC");
+  const secure = process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR;
+  const home = (secure !== void 0 ? secure || join6(homedir3(), ".claude") : configured).normalize("NFC");
+  const isDefault = secure !== void 0 ? !secure : !configuredClaudeDir();
+  const suffix = isDefault ? "" : `-${createHash("sha256").update(secure !== void 0 ? secure.normalize("NFC") : configured).digest("hex").slice(0, 8)}`;
+  let account;
+  try {
+    account = process.env.USER || userInfo().username;
+  } catch {
+    account = "claude-code-user";
+  }
+  if (!/^[a-zA-Z0-9._-]+$/.test(account)) account = "claude-code-user";
+  return { service: `Claude Code${custom ? "-custom-oauth" : ""}-credentials${suffix}`, account, home };
+}
+async function claudeResolvedConfig(server) {
+  const configDir = (configuredClaudeDir() ?? join6(homedir3(), ".claude")).normalize("NFC");
+  let file = join6(configuredClaudeDir() || homedir3(), `.claude${process.env.CLAUDE_CODE_CUSTOM_OAUTH_URL ? "-custom-oauth" : ""}.json`);
+  try {
+    await lstat(join6(configDir, ".config.json"));
+    file = join6(configDir, ".config.json");
+  } catch (e) {
+    if (e.code !== "ENOENT") return null;
+  }
+  const json = await privateJson(file);
+  if (!json) return null;
+  const object2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+  const readOptional = async (path) => {
+    try {
+      await lstat(path);
+      const text3 = await privateText(path, false);
+      if (text3 === null) return null;
+      const value = JSON.parse(text3);
+      return object2(value) ? value : null;
+    } catch (e) {
+      return e.code === "ENOENT" ? void 0 : null;
+    }
+  };
+  let cwd;
+  try {
+    cwd = await realpath(process.cwd());
+  } catch {
+    return null;
+  }
+  let workspace = cwd;
+  for (let dir = cwd; ; ) {
+    try {
+      await lstat(join6(dir, ".git"));
+      const { stdout } = await promisify(execFile)("git", ["-C", cwd, "rev-parse", "--show-toplevel"], { timeout: 3e3, maxBuffer: 8192 });
+      workspace = await realpath(stdout.trim());
+      break;
+    } catch (e) {
+      if (e.code !== "ENOENT") return null;
+    }
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const managedDir = process.platform === "darwin" ? "/Library/Application Support/ClaudeCode" : "/etc/claude-code";
+  for (const path of [join6(managedDir, "managed-mcp.json"), join6(managedDir, "managed-settings.json"), join6(configDir, "managed-mcp.json"), join6(configDir, "managed-settings.json")]) {
+    try {
+      await lstat(path);
+      return null;
+    } catch (e) {
+      if (e.code !== "ENOENT") return null;
+    }
+  }
+  const policyFields = ["managedMcpServers", "allowedMcpServers", "deniedMcpServers", "mcpServers", "env", "enabledSettingsSources", "allowManagedMcpServersOnly"];
+  if (["managedMcpServers", "allowedMcpServers", "deniedMcpServers"].some((k) => Object.hasOwn(json, k))) return null;
+  for (const path of [join6(configDir, "settings.json"), join6(workspace, ".claude/settings.json"), join6(workspace, ".claude/settings.local.json")]) {
+    const settings = await readOptional(path);
+    if (settings === null || settings && policyFields.some((k) => Object.hasOwn(settings, k))) return null;
+  }
+  const projects = json.projects;
+  if (projects !== void 0 && !object2(projects)) return null;
+  const local = object2(projects) ? projects[workspace] : void 0;
+  if (local !== void 0 && !object2(local)) return null;
+  const userServers = json.mcpServers;
+  const localServers = object2(local) ? local.mcpServers : void 0;
+  if (userServers !== void 0 && !object2(userServers) || localServers !== void 0 && !object2(localServers)) return null;
+  let config = object2(userServers) ? userServers[server] : void 0;
+  let scope = "user", selectedFile = file;
+  const hasLocal = object2(localServers) && Object.hasOwn(localServers, server);
+  let project, projectFile;
+  const dirs = [];
+  for (let dir = cwd; ; ) {
+    const parent = dirname2(dir);
+    if (parent === dir) break;
+    dirs.push(dir);
+    dir = parent;
+  }
+  for (const dir of dirs.reverse()) {
+    const path = join6(dir, ".mcp.json"), value = await readOptional(path);
+    if (value === null) return null;
+    if (!value) continue;
+    if (!object2(value.mcpServers)) return null;
+    if (Object.hasOwn(value.mcpServers, server)) {
+      project = value.mcpServers[server];
+      projectFile = path;
+    }
+  }
+  if (projectFile && !hasLocal) {
+    const settings = await readOptional(join6(configDir, "settings.json"));
+    if (settings === null || !object2(local) || local.hasTrustDialogAccepted !== true) return null;
+    const disabled = settings?.disabledMcpjsonServers;
+    const enabled = settings?.enabledMcpjsonServers;
+    if (disabled !== void 0 && (!Array.isArray(disabled) || disabled.some((v) => typeof v !== "string"))) return null;
+    if (enabled !== void 0 && (!Array.isArray(enabled) || enabled.some((v) => typeof v !== "string"))) return null;
+    if (Array.isArray(disabled) && disabled.includes(server)) return null;
+    if (settings?.enableAllProjectMcpServers !== true && !(Array.isArray(enabled) && enabled.includes(server))) return null;
+    for (const path of [join6(workspace, ".claude/settings.json"), join6(workspace, ".claude/settings.local.json")]) {
+      const extra = await readOptional(path);
+      if (extra === null || extra && ["env", "enabledMcpjsonServers", "disabledMcpjsonServers", "enableAllProjectMcpServers"].some((k) => Object.hasOwn(extra, k))) return null;
+    }
+    config = project;
+    scope = "project";
+    selectedFile = projectFile;
+  }
+  if (hasLocal) {
+    config = localServers[server];
+    scope = "local";
+  }
+  if (!object2(config) || config.url !== MCP_URL || config.command || config.type !== void 0 && config.type !== "http" && config.type !== "sse") return null;
+  if (config.headers !== void 0 && !object2(config.headers)) return null;
+  for (const [key, value] of Object.entries(config.headers ?? {})) {
+    if (typeof value !== "string" || /authorization|api[-_]?key|token|cookie/i.test(key) || /\$\{|[\r\n\0]/.test(value)) return null;
+  }
+  return { config, file: selectedFile, scope, cwd: workspace };
+}
+async function readClaudeKeychain(request) {
+  return new Promise((resolveResult) => {
+    const child = spawn2(
+      "/usr/bin/osascript",
+      ["-l", "JavaScript", join6(packageRoot(), "native/claude-keychain.js")],
+      { stdio: ["pipe", "ignore", "ignore", "pipe"], env: { PATH: "/usr/bin:/bin" } }
+    );
+    let text3 = "", failed = false;
+    const pipe = child.stdio[3];
+    if (!pipe || !("on" in pipe)) {
+      child.kill();
+      resolveResult({ status: "unavailable" });
+      return;
+    }
+    const timer = setTimeout(() => {
+      failed = true;
+      child.kill();
+    }, 5e3);
+    pipe.on("data", (data) => {
+      if (text3.length + data.length > 65536) {
+        failed = true;
+        child.kill();
+      } else text3 += data.toString("utf8");
+    });
+    child.once("error", () => {
+      failed = true;
+    });
+    child.stdin?.on("error", () => {
+      failed = true;
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      if (failed || code !== 0) {
+        resolveResult({ status: "unavailable" });
+        return;
+      }
+      try {
+        const result = JSON.parse(text3);
+        if (!["ok", "absent", "absent-entry", "locked", "denied", "malformed", "unavailable"].includes(result.status)) throw new Error();
+        resolveResult(result);
+      } catch {
+        resolveResult({ status: "malformed" });
+      }
+    });
+    child.stdin?.end(JSON.stringify(request));
+  });
+}
+async function claudeVersion() {
+  try {
+    const { stdout } = await promisify(execFile)("claude", ["--version"], { timeout: 3e3, maxBuffer: 1024 });
+    const version = stdout.trim().replace(/ \(Claude Code\)$/, "");
+    return CLAUDE_OWNER_VERSIONS.includes(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+async function readClaudeOwner(server, options = {}) {
+  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(server)) return { status: "unsupported-config" };
+  const selection = claudeKeychainSelection(), resolved = await claudeResolvedConfig(server);
+  if (!selection || !resolved) return { status: "unsupported-config" };
+  const hash = createHash("sha256").update(JSON.stringify({ type: resolved.config.type, url: resolved.config.url, headers: resolved.config.headers || {} })).digest("hex").slice(0, 16);
+  const key = `${server}|${hash}`, explicitFile = process.env.CARRIER_MCP_OAUTH_FILE;
+  let entry;
+  let source;
+  if ((options.platform ?? process.platform) === "darwin" && !explicitFile) {
+    if (!CLAUDE_OWNER_VERSIONS.includes(await (options.version ?? claudeVersion)() ?? "")) return { status: "unsupported-version" };
+    const result = await (options.native ?? readClaudeKeychain)({ ...selection, key });
+    if (result.status === "ok") {
+      if (!result.entry) return { status: "malformed" };
+      entry = result.entry;
+      source = ["keychain", selection.service, selection.account, selection.home];
+    } else if (result.status !== "absent") return { status: result.status };
+  }
+  if (!entry) {
+    const file = explicitFile || join6(selection.home, ".credentials.json");
+    const json = await privateJson(file);
+    entry = json?.mcpOAuth?.[key];
+    source = ["file", resolve2(file)];
+  }
+  if (!entry || entry.serverName !== server || entry.serverUrl !== MCP_URL) return { status: "absent-entry" };
+  const discovery = entry.discoveryState;
+  const issuer = entry.issuer ?? discovery?.authorizationServerUrl;
+  if (entry.issuer !== void 0 && discovery?.authorizationServerUrl !== void 0 && entry.issuer !== discovery.authorizationServerUrl || entry.resource !== void 0 && entry.resource !== MCP_URL || discovery?.resourceMetadataUrl !== void 0 && discovery.resourceMetadataUrl !== `${MCP_HOME}/.well-known/oauth-protected-resource/mcp`) return { status: "malformed" };
+  const creds = validImport({ issuer, resource: MCP_URL, origin: "claude-mcp", accessToken: entry.accessToken, expiresAt: entry.expiresAt, scope: entry.scope });
+  if (!creds) return { status: "malformed" };
+  creds.binding = oauthBinding(creds, [
+    "claude",
+    source,
+    resolve2(resolved.file),
+    resolved.scope,
+    resolved.cwd,
+    server,
+    hash,
+    entry.clientId,
+    entry.organizationId,
+    entry.organization_id,
+    entry.orgId,
+    entry.accountId,
+    discovery?.authorizationServerUrl,
+    discovery?.resourceMetadataUrl
+  ]);
+  return { status: "ok", credentials: creds };
+}
+async function readClaudeOAuth(server) {
+  return (await readClaudeOwner(server)).credentials ?? null;
+}
+async function readMcpOAuth(selectedOwner) {
+  const server = process.env.CARRIER_MCP_OAUTH_SERVER?.trim() || "carrier";
+  const owner = process.env.CARRIER_MCP_OAUTH_OWNER?.trim();
+  if (owner && owner !== "hermes" && owner !== "claude") return null;
+  if (selectedOwner) {
+    if (owner && owner !== selectedOwner || selectedOwner === "hermes" && process.env.CARRIER_MCP_OAUTH_FILE) return null;
+    return selectedOwner === "hermes" ? readHermesOAuth(server) : readClaudeOAuth(server);
+  }
+  if (owner === "hermes") return readHermesOAuth(server);
+  if (owner === "claude" || process.env.CARRIER_MCP_OAUTH_FILE) return readClaudeOAuth(server);
+  const claude = await readClaudeOwner(server);
+  if (["locked", "denied", "malformed", "unavailable", "unsupported-version"].includes(claude.status)) return null;
+  const owners = [await readHermesOAuth(server), claude.credentials ?? null].filter((c) => c !== null);
+  return owners.length === 1 ? owners[0] : null;
 }
 
 // src/cli/lib/auth.ts
+import { access, writeFile as writeFile3, rm as rm2 } from "fs/promises";
+import { join as join7, resolve as resolve3 } from "path";
 var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
 var CLIENT_NAME = "Carrier CLI";
 var DEFAULT_SCOPE = "read write";
@@ -334,6 +796,11 @@ async function discover(base = MCP_HOME) {
   if (!meta.authorization_endpoint || !meta.token_endpoint) {
     throw new Error("OAuth discovery returned no authorization or token endpoint");
   }
+  if (meta.issuer !== MCP_HOME) throw new Error("OAuth issuer does not match Carrier");
+  for (const endpoint of [meta.authorization_endpoint, meta.token_endpoint, meta.registration_endpoint].filter(Boolean)) {
+    const url = new URL(endpoint);
+    if (url.origin !== MCP_HOME || url.username || url.password) throw new Error("OAuth endpoint does not match Carrier");
+  }
   return meta;
 }
 function base64url(buf) {
@@ -341,7 +808,7 @@ function base64url(buf) {
 }
 function pkcePair() {
   const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  const challenge = base64url(createHash2("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
 function sameState(a, b) {
@@ -368,8 +835,7 @@ async function registerClient(meta, redirectUri) {
     })
   });
   if (!res.ok) {
-    const body = (await res.text().catch(() => "")).slice(0, 200);
-    throw new Error(`Client registration failed (${res.status}). ${body}`);
+    throw new Error(`Client registration failed (${res.status}).`);
   }
   const json = await res.json();
   if (!json.client_id) throw new Error("Client registration returned no client_id");
@@ -400,8 +866,8 @@ async function startCallbackServer() {
     const state = url.searchParams.get("state") ?? "";
     if (err) {
       res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", err));
-      rejectCode?.(new Error(`Authorization server returned "${err}"`));
+      res.end(page("Sign-in failed", "Authorization was rejected."));
+      rejectCode?.(new Error("Authorization server rejected sign-in."));
       return;
     }
     if (!code || !expected || !sameState(state, expected)) {
@@ -414,24 +880,24 @@ async function startCallbackServer() {
     res.end(page("You're signed in", "Close this tab and return to your terminal."));
     resolveCode?.(code);
   });
-  let bound = false;
+  let bound2 = false;
   let lastErr;
   for (const port2 of CALLBACK_PORTS) {
     try {
-      await new Promise((resolve3, reject) => {
+      await new Promise((resolve5, reject) => {
         server.once("error", reject);
         server.listen(port2, "127.0.0.1", () => {
           server.removeListener("error", reject);
-          resolve3();
+          resolve5();
         });
       });
-      bound = true;
+      bound2 = true;
       break;
     } catch (e) {
       lastErr = e;
     }
   }
-  if (!bound) {
+  if (!bound2) {
     throw new Error(
       `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
     );
@@ -443,14 +909,14 @@ async function startCallbackServer() {
     // browser would hold the event loop open and the CLI would never exit.
     waitForCode: (expectedState, timeoutMs) => {
       expected = expectedState;
-      return new Promise((resolve3, reject) => {
+      return new Promise((resolve5, reject) => {
         const timer = setTimeout(
           () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
           timeoutMs
         );
         resolveCode = (code) => {
           clearTimeout(timer);
-          resolve3(code);
+          resolve5(code);
         };
         rejectCode = (err) => {
           clearTimeout(timer);
@@ -475,14 +941,20 @@ async function postToken(meta, body) {
   });
   const json = await res.json().catch(() => ({}));
   if (!res.ok || json.error) {
-    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
+    throw new Error(`OAuth token exchange rejected (${res.status}).`);
   }
   if (!json.access_token) throw new Error("Token endpoint returned no access_token");
+  if (Object.hasOwn(json, "resource")) {
+    const resources = Array.isArray(json.resource) ? json.resource : [json.resource];
+    if (resources.length !== 1 || resources[0] !== MCP_URL) throw new Error("OAuth token resource does not match Carrier.");
+    json.resource = MCP_URL;
+  }
   return json;
 }
 function store(meta, token, clientId) {
   return {
     issuer: meta.issuer,
+    ...Object.hasOwn(token, "resource") ? { resource: token.resource } : {},
     accessToken: token.access_token,
     refreshToken: token.refresh_token,
     expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
@@ -492,65 +964,140 @@ function store(meta, token, clientId) {
 }
 async function login(opts) {
   const meta = await discover();
-  const server = await startCallbackServer();
-  try {
-    const existing = await readCredentials();
-    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
-    const { verifier, challenge } = pkcePair();
-    const state = base64url(randomBytes(16));
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", server.redirectUri);
-    authUrl.searchParams.set("scope", pickScope(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", challenge);
-    authUrl.searchParams.set("code_challenge_method", "S256");
-    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
-    pendingCode.catch(() => void 0);
-    opts.onUrl?.(authUrl.toString());
-    await opts.openBrowser(authUrl.toString());
-    const code = await pendingCode;
-    const token = await postToken(meta, {
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: server.redirectUri,
-      client_id: clientId,
-      code_verifier: verifier
-    });
-    await writeCredentials(store(meta, token, clientId));
-    return { ok: true, message: "Signed in.", scope: token.scope };
-  } finally {
-    server.close();
-  }
+  return withCredentialLock(async () => {
+    const server = await startCallbackServer();
+    try {
+      const existing = await readCredentials();
+      const clientId = existing?.clientId && existing.issuer === meta.issuer && existing.redirectUri === server.redirectUri ? existing.clientId : await registerClient(meta, server.redirectUri);
+      const { verifier, challenge } = pkcePair();
+      const state = base64url(randomBytes(16));
+      const authUrl = new URL(meta.authorization_endpoint);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("resource", MCP_URL);
+      authUrl.searchParams.set("client_id", clientId);
+      authUrl.searchParams.set("redirect_uri", server.redirectUri);
+      authUrl.searchParams.set("scope", pickScope(meta));
+      authUrl.searchParams.set("state", state);
+      authUrl.searchParams.set("code_challenge", challenge);
+      authUrl.searchParams.set("code_challenge_method", "S256");
+      const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
+      pendingCode.catch(() => void 0);
+      opts.onUrl?.(authUrl.toString());
+      await opts.openBrowser(authUrl.toString());
+      const code = await pendingCode;
+      const token = await postToken(meta, {
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: server.redirectUri,
+        client_id: clientId,
+        code_verifier: verifier,
+        resource: MCP_URL
+      });
+      const next = { ...store(meta, token, clientId), redirectUri: server.redirectUri };
+      if (!usableOAuth(next)) throw new Error("OAuth endpoint returned an unusable Carrier session.");
+      await writeCredentials(next);
+      await rm2(join7(carrierHome(), "mcp-oauth-disabled"), { force: true });
+      return { ok: true, message: "Signed in.", scope: token.scope };
+    } finally {
+      server.close();
+    }
+  });
 }
 function pickScope(meta) {
   const supported = meta.scopes_supported ?? [];
   if (!supported.length) return DEFAULT_SCOPE;
   return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
 }
-async function getAccessToken() {
+function inheritedOAuth() {
+  const api = process.env.CARRIER_API_KEY?.trim();
+  if (!api || process.env.CARRIER_OAUTH_HANDOFF !== createHash2("sha256").update(api).digest("hex")) return null;
+  const origin = process.env.CARRIER_OAUTH_ORIGIN, binding = process.env.CARRIER_OAUTH_BINDING;
+  if (!origin || !["native-cli", "hermes-mcp", "claude-mcp"].includes(origin) || !/^[a-f0-9]{64}$/.test(binding ?? "")) return false;
+  return { origin, binding };
+}
+function nativeBinding(creds) {
+  return oauthBinding(creds, ["native-cli", resolve3(carrierHome()), creds.clientId]);
+}
+async function selectedMcpOAuth(handoff) {
+  if (handoff === false || handoff && handoff.origin === "native-cli") return null;
+  const owner = await readMcpOAuth(handoff ? handoff.origin === "hermes-mcp" ? "hermes" : "claude" : void 0);
+  return owner && (!handoff || owner.binding === handoff.binding) ? owner : null;
+}
+async function getAccessTokenLocked() {
+  const handoff = inheritedOAuth();
+  if (handoff === false) return null;
   const creds = await readCredentials();
-  if (!creds) return null;
+  if (creds && handoff && (handoff.origin !== "native-cli" || nativeBinding(creds) !== handoff.binding)) return null;
+  if (!creds) {
+    try {
+      await access(join7(carrierHome(), "credentials.json"));
+      return null;
+    } catch (error) {
+      if (error.code !== "ENOENT") return null;
+    }
+    try {
+      await access(join7(carrierHome(), "mcp-oauth-disabled"));
+      return null;
+    } catch (error) {
+      if (error.code !== "ENOENT") return null;
+    }
+    return (await selectedMcpOAuth(handoff))?.accessToken ?? null;
+  }
+  if (!usableOAuth(creds)) return null;
   if (!isExpired(creds)) return creds.accessToken;
   if (!creds.refreshToken || !creds.clientId) return null;
   try {
     const meta = await discover();
+    if (meta.issuer !== creds.issuer) return null;
     const token = await postToken(meta, {
       grant_type: "refresh_token",
+      resource: MCP_URL,
       refresh_token: creds.refreshToken,
       client_id: creds.clientId
     });
     const next = store(meta, token, creds.clientId);
     if (!next.refreshToken) next.refreshToken = creds.refreshToken;
+    if (!next.scope) next.scope = creds.scope;
+    if (!Object.hasOwn(next, "resource") && Object.hasOwn(creds, "resource")) next.resource = creds.resource;
+    if (!usableOAuth(next) || handoff && nativeBinding(next) !== handoff.binding) return null;
+    next.redirectUri = creds.redirectUri;
+    const latest = await readCredentials();
+    if (latest?.generation !== creds.generation || latest?.accessToken !== creds.accessToken) return null;
     await writeCredentials(next);
     return next.accessToken;
   } catch {
     return null;
   }
 }
+function resolveExplicitCredential(opts = {}) {
+  const api = process.env.CARRIER_API_KEY?.trim();
+  const handedOff = api && process.env.CARRIER_OAUTH_HANDOFF === createHash2("sha256").update(api).digest("hex");
+  if (api && !handedOff) return { token: api, kind: "api-key" };
+  const org = process.env.CARRIER_ORG_API_KEY?.trim();
+  if (org) return { token: org, kind: "api-key" };
+  if (opts.allowOcs) {
+    const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim();
+    if (ocs) return { token: ocs, kind: "ocs-token" };
+  }
+  return null;
+}
+async function resolveCredential(opts = {}) {
+  const explicit = resolveExplicitCredential(opts);
+  if (explicit) return explicit;
+  return withCredentialLock(async () => {
+    const token = await getAccessTokenLocked();
+    if (!token) return null;
+    const native = await readCredentials();
+    const owner = native ?? await selectedMcpOAuth(inheritedOAuth());
+    if (!owner || owner.accessToken !== token) return null;
+    return { token, kind: "oauth", origin: native ? "native-cli" : owner.origin, expiresAt: owner.expiresAt, binding: native ? nativeBinding(native) : owner.binding };
+  });
+}
 async function logout() {
-  await clearCredentials();
+  await withCredentialLock(async () => {
+    await writeFile3(join7(carrierHome(), "mcp-oauth-disabled"), "disabled\n", { mode: 384 });
+    await clearCredentials();
+  });
 }
 
 // src/cli/lib/guidance.ts
@@ -572,13 +1119,15 @@ function oauthFirstUseNote() {
     "  Token:    none required in Claude / Cursor / Windsurf",
     "",
     "When you first talk to Carrier in your MCP client, the browser opens",
-    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
-    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
+    "sign-in/sign-up. After authorize, tools work. Headless: carrier login,",
+    "or reuse compatible Claude Code Carrier OAuth. No manual key export needed.",
+    "To export CARRIER_API_KEY into a child terminal: carrier exec -- bash.",
+    `For unattended CI use an org key from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
   ].join("\n");
 }
 function formatStatusBlock(st) {
   const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
-  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
+  const authLabel = st.authMode === "oauth" ? pc.green("OAuth session ready for CLI / Ask the fleet") : st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
   return [
     `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
     `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
@@ -607,228 +1156,286 @@ function withNextStep(errorMsg, next) {
   return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
 }
 
-// src/cli/lib/status.ts
-import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
-
-// src/cli/lib/mcp-url.ts
-var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
-var PRODUCTION_HOST = "mcp.carrier.llc";
-var URL_TOKEN = /https?:\/\/[^\s"'<>)]+/g;
-function pathWithoutTrailingSlash(pathname) {
-  let end = pathname.length;
-  while (end > 1 && pathname.charCodeAt(end - 1) === 47) end -= 1;
-  return pathname.slice(0, end);
-}
-function parseHttpUrl(value) {
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function isProductionMcpUrl(value) {
-  if (value === PRODUCTION_MCP_URL) return true;
-  const parsed = parseHttpUrl(value);
-  if (!parsed || parsed.protocol !== "https:" || parsed.hostname !== PRODUCTION_HOST) return false;
-  return pathWithoutTrailingSlash(parsed.pathname) === "/mcp";
-}
-function isCarrierMcpHost(value) {
-  const parsed = parseHttpUrl(value);
-  return parsed?.protocol === "https:" && parsed.hostname === PRODUCTION_HOST;
-}
-function trimTrailingPunctuation(token) {
-  let end = token.length;
-  while (end > 0) {
-    const code = token.charCodeAt(end - 1);
-    if (code !== 46 && code !== 44 && code !== 59 && code !== 58) break;
-    end -= 1;
-  }
-  return token.slice(0, end);
-}
-function lineMentionsProductionMcp(line) {
-  const tokens = line.match(URL_TOKEN);
-  if (!tokens) return false;
-  for (const token of tokens) {
-    if (isProductionMcpUrl(trimTrailingPunctuation(token))) return true;
-  }
+// src/cli/lib/ask-answer.ts
+var MAX_CHARS = 3800;
+var MAX_ROWS = 10;
+var RAW_HINT = 'Use carrier ask "your question" --json for the complete raw result (may contain sensitive data).';
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function measured(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function bound(text3, prose = false) {
+  text3 = sanitizeAskText(text3);
+  if (text3.length <= MAX_CHARS) return text3;
+  const notice = `Answer shortened; complete rows or sentences omitted. ${RAW_HINT}`;
+  const budget = MAX_CHARS - notice.length - 1;
+  const units = prose ? text3.match(/[^\n]+?(?:[.!?](?=\s|$)|(?=\n|$))/g) ?? [] : text3.split("\n");
+  const kept = [];
+  let size = 0;
+  for (const unit of units) {
+    const clean = unit.trim();
+    if (size + clean.length + 1 > budget) break;
+    kept.push(clean);
+    size += clean.length + 1;
+  }
+  return [...kept, notice].join("\n");
+}
+function safeFacet(key, value) {
+  if (key === "recurring") return value === "true" || value === "false";
+  if (key === "status") return ["active", "inactive", "inventory", "manually suspended", "end of life", "free", "expired", "terminated"].includes(value.toLowerCase());
   return false;
 }
-
-// src/cli/lib/status.ts
-function detectEnvToken() {
-  const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
-  if (api.startsWith("ak_") || api.length > 0) {
-    return { present: true, kind: "api-key" };
-  }
-  const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim() || "";
-  if (ocs) return { present: true, kind: "ocs-token" };
-  return { present: false, kind: "none" };
-}
-function rankHit(name, url) {
-  let rank = 0;
-  if (name.toLowerCase() === MCP_NAME) rank += 100;
-  else if (/^carrier[-_]?/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 40;
-  else if (/carrier/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 20;
-  else if (/carrier/i.test(name)) rank += 5;
-  if (isProductionMcpUrl(url)) rank += 50;
-  else if (isCarrierMcpHost(url)) rank += 25;
-  return rank;
-}
-function scanMcpServers(servers) {
-  if (!servers || typeof servers !== "object") return null;
-  let best = null;
-  for (const [name, entry] of Object.entries(servers)) {
-    if (!/carrier/i.test(name) && !(typeof entry?.url === "string" && /carrier\.llc/i.test(entry.url))) {
-      continue;
-    }
-    const url = typeof entry?.url === "string" ? entry.url : "";
-    const rank = rankHit(name, url);
-    if (rank < 20 && !isCarrierMcpHost(url)) {
-      continue;
-    }
-    const urlMatches = isProductionMcpUrl(url);
-    const hit = {
-      registered: true,
-      urlMatches,
-      detail: url ? `${name}: ${url}` : `${name}: ${entry?.command ?? "configured"}`,
-      rank
-    };
-    if (!best || hit.rank > best.rank) best = hit;
-  }
-  return best;
-}
-async function probeMcpFromConfig() {
-  const candidates = [
-    join6(homedir3(), ".claude.json"),
-    join6(claudeHome(), "settings.json"),
-    join6(claudeHome(), ".mcp.json"),
-    join6(process.cwd(), ".mcp.json")
-  ];
-  let best = null;
-  let configSeen = false;
-  for (const file of candidates) {
-    if (!await exists(file)) continue;
-    try {
-      const json = JSON.parse(await readFile(file, "utf8"));
-      configSeen = true;
-      const direct = scanMcpServers(json.mcpServers);
-      if (direct && (!best || direct.rank > best.rank)) best = direct;
-      if (json.projects) {
-        for (const proj of Object.values(json.projects)) {
-          const hit = scanMcpServers(proj?.mcpServers);
-          if (hit && (!best || hit.rank > best.rank)) best = hit;
-        }
-      }
-    } catch {
-    }
-  }
-  if (!best) return { hit: null, configSeen };
-  return {
-    hit: { registered: best.registered, urlMatches: best.urlMatches, detail: best.detail },
-    configSeen
-  };
-}
-async function probeMcpRegistration() {
-  const { hit, configSeen } = await probeMcpFromConfig();
-  if (hit) return hit;
-  if (configSeen) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "carrier not registered (no production MCP URL in Claude config)"
-    };
-  }
-  const claudeFound = await which("claude");
-  if (!claudeFound) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "claude CLI not on PATH"
-    };
-  }
-  const r = await run("claude", ["mcp", "list"], { timeoutMs: 5e3 });
-  const out = `${r.stdout}
-${r.stderr}`;
-  if (!r.ok && !out.trim()) {
-    return { registered: false, urlMatches: false, detail: "claude mcp list failed or timed out" };
-  }
-  if (/timeout after/i.test(r.stderr) && !/carrier/i.test(out)) {
-    return {
-      registered: false,
-      urlMatches: false,
-      detail: "claude mcp list timed out \u2014 run `claude mcp list` manually"
-    };
-  }
-  const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
-  const carrierLine = lines.find((l) => new RegExp(`^${MCP_NAME}\\s*:`, "i").test(l)) ?? lines.find((l) => /carrier/i.test(l) && /mcp\.carrier\.llc/i.test(l));
-  if (!carrierLine) {
-    return { registered: false, urlMatches: false, detail: "carrier not in claude mcp list" };
-  }
-  const urlMatches = lineMentionsProductionMcp(carrierLine);
-  return { registered: true, urlMatches, detail: carrierLine.slice(0, 200) };
-}
-function buildNextSteps(s) {
-  const steps = [];
-  if (!s.claudeFound) {
-    steps.push("Install Claude Code (https://claude.ai/code), then re-run: carrier plugin install");
-  } else if (!s.pluginInstalled) {
-    steps.push("Install the Carrier plugin: carrier plugin install");
-  } else if (!s.mcpRegistered) {
-    steps.push(`Register the zero-cred MCP URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
-  } else if (!s.mcpUrlMatches) {
-    steps.push(`Update MCP to production URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
-  }
-  if (s.mcpRegistered || s.pluginInstalled) {
-    steps.push(
-      "Talk to your fleet in Claude \u2014 first tool call opens Clerk OAuth (Google / GitHub / email). No API token needed."
-    );
-  } else {
-    steps.push("Create a free account (browser): carrier open signup");
-    steps.push("Or sign in: carrier open signin");
-  }
-  if (!s.tokenPresent) {
-    steps.push(
-      "Optional headless key: Console \u2192 Settings \u2192 API Keys (ak_\u2026) then export CARRIER_API_KEY=ak_\u2026 for `carrier ask`."
-    );
-  } else {
-    steps.push('Try a natural-language fleet query: carrier ask "show fleet health"');
-  }
-  steps.push("Scaffold a white-label storefront anytime: carrier site create");
-  return steps;
-}
-async function gatherStatus() {
-  const [plugin2, mcp, claudeFound] = await Promise.all([
-    pluginStatus(),
-    probeMcpRegistration(),
-    which("claude")
-  ]);
-  const token = detectEnvToken();
-  let authMode = "none";
-  if (token.kind === "api-key") authMode = "api-key";
-  else if (token.kind === "ocs-token") authMode = "ocs-token";
-  else if (mcp.registered || plugin2.installed) authMode = "oauth-first-use";
-  const base = {
-    pluginInstalled: plugin2.installed,
-    pluginVersion: plugin2.version,
-    pluginDir: plugin2.dir,
-    claudeFound,
-    mcpRegistered: mcp.registered,
-    mcpUrlMatches: mcp.urlMatches,
-    mcpDetail: mcp.detail,
-    tokenPresent: token.present,
-    tokenKind: token.kind,
-    authMode
-  };
-  return { ...base, nextSteps: buildNextSteps(base) };
-}
-function resolveCliToken() {
-  const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
-  if (api) return api;
-  const ocs = process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim() || "";
-  return ocs || null;
+function unsupportedJudgement(intent) {
+  return /\b(predict\w*|most likely|least likely|likelihood|probability|forecast\w*|voorspel\w*|waarschijnlijk)\b/i.test(intent) || /\b(who|which|what|wie|welke)\b.*\b(best|worst|beste|slechtste)\b(?=\s*(?:[?!.]|$))/i.test(intent) || /\b(who|which|what|wie|welke)\s+(?:(?:is|are|has|the|subscriber|package|action)\s+)*(best|worst|beste|slechtste)\b/i.test(intent) || /\b(?:recommend\w*|advise)\b/i.test(intent) || /^\s*should\b/i.test(intent) || /\b(will|going to)\b.*\b(cancel|churn|leave|fail)\b/i.test(intent);
+}
+function subscriberLine(value) {
+  const row = object(value);
+  if (!row) return void 0;
+  const status = extractSubscriberStatus(row);
+  const sim = object(row.sim);
+  const id = typeof row.subscriberId === "string" || typeof row.subscriberId === "number" ? row.subscriberId : "(identifier not reported)";
+  return `Subscriber ${inline(id)}. Subscriber status: ${inline(status || "not reported")}. SIM inventory status: ${typeof sim?.status === "string" ? inline(sim.status) : "not reported"}.`;
+}
+function subscriberStatusAnswer(rows2, summary, intent) {
+  const identities = [...intent.matchAll(/\b(subscriberId|subscriber\s+id|subscriber|ICCID)(?:\s*[:=]\s*|\s+)(?:"([^"\r\n]+)"|'([^'\r\n]+)'|([^\s"'?!,;]+))/gi)].map((m) => {
+    if (m[4]) m[4] = m[4].replace(/[.:)]+$/, "");
+    return m;
+  }).filter((m) => !/^(?:status|statuses|current|is|are|the|list|count|in|for|of|from|their|my|our|all|each|every|now|today|currently|and|or)$/i.test(m[4] ?? ""));
+  if (identities.length) {
+    const tail = intent.slice((identities[0].index ?? 0) + identities[0][0].length);
+    const extraIdentity = /\b(?:and|or)\b/i.test(tail) && !/^\s*[.:)]*\s+and\s+(?:(?:its|their|the)\s+)?(?:ICCID|subscriberId|subscriber\s+id|(?:current\s+)?status)\s*[.?!]*$/i.test(tail);
+    if (identities.length !== 1 || /\b(named|with|whose|and|or)\b/i.test(identities[0][4] ?? "") || extraIdentity) {
+      return "Carrier cannot identify a single subscriber from this unclear request. Specify one exact subscriberId or ICCID; no subscriber was selected.";
+    }
+    const match = identities[0];
+    const id = match[2] ?? match[3] ?? match[4];
+    if (!rows2) return "Subscriber row details were not returned; Carrier cannot determine the requested current status.";
+    const selected = rows2.filter((value) => {
+      const row = object(value);
+      if (!row) return false;
+      return match[1].toLowerCase() === "iccid" ? subscriberIccid(row) === id : (typeof row.subscriberId === "string" || typeof row.subscriberId === "number" && Number.isFinite(row.subscriberId)) && String(row.subscriberId) === id;
+    });
+    if (!selected.length) return "The requested identifier is not present in the returned rows. This does not establish fleet-wide absence.";
+    if (selected.length !== 1) return "Carrier cannot select a single subscriber: that identifier is ambiguous in the returned rows.";
+    return bound(`Current status from the returned row:
+${subscriberLine(selected[0])}`);
+  }
+  const fieldList = /^\s*(?:list|show)\b/i.test(intent) && /\b(?:all|each|every)\s+subscribers\b/i.test(intent);
+  if (!fieldList && /\b(subscriberId|subscriber\s+id|ICCID)\b|\b(?:of|for)\s+(?:the\s+)?subscriber\b/i.test(intent)) return "Carrier cannot identify a single subscriber from this unclear request. Specify one exact subscriberId or ICCID; no subscriber was selected.";
+  if (!rows2) return "Subscriber row details were not returned; current statuses are unavailable.";
+  const lines = ["Current subscriber statuses from the returned rows only:"];
+  if (/\b(how many|count|number|total|hoeveel)\b/i.test(intent)) {
+    lines.push(`Carrier reports ${summary.total} subscribers in this result.`);
+    if (rows2.length < summary.total) lines.push(`Only ${rows2.length} of the reported ${summary.total} rows are present in the response; the remaining details are unavailable.`);
+  }
+  if (rows2.length === 0) lines.push("No subscriber rows were returned; no current statuses can be determined.");
+  for (const row of rows2.slice(0, MAX_ROWS)) {
+    const line = subscriberLine(row);
+    if (line) lines.push(line);
+    else lines.push("A returned row has an unsupported shape; its current status is unavailable.");
+  }
+  if (rows2.length < summary.total || summary.moreAvailable === true) lines.push("Current statuses for remaining rows are unavailable; these returned statuses are not a fleet-wide status breakdown.");
+  if (rows2.length > MAX_ROWS) lines.push(`Showing ${MAX_ROWS} of ${rows2.length} returned rows. ${RAW_HINT}`);
+  return bound(lines.join("\n"));
+}
+function formatAskAnswer(text3, tool, structured, intent = "") {
+  const countOnly = /\b(how many|count|number of|hoeveel|aantal)\b/i.test(intent) && !/\b(status|list|details?|which|their|lijst)\b/i.test(intent);
+  if (unsupportedJudgement(intent) && !INTELLIGENCE_TOOLS.has(tool)) return `Carrier cannot determine or predict that judgement from this tool result. No such conclusion is supported by the returned records. ${RAW_HINT}`;
+  let value = structured;
+  try {
+    const parsed = JSON.parse(text3);
+    if (structured === void 0) value = parsed;
+  } catch {
+    if (text3.trim() && !/^[\[{]/.test(text3.trim())) return bound(text3, true);
+    if (structured === void 0) return `The tool result could not be read as complete JSON. ${RAW_HINT}`;
+  }
+  const fallback = object(value);
+  if (structured === void 0 && Array.isArray(fallback?.content) && fallback.content.length === 0) {
+    return "No result data was returned.";
+  }
+  const body = object(value);
+  if (tool === "get_subscriber" && /\b(status|statuses)\b/i.test(intent)) {
+    const row = object(body?.subscriber) ?? object(object(body?.data)?.subscriber) ?? object(body?.data) ?? body;
+    if (row && (Object.hasOwn(row, "subscriberId") || Object.hasOwn(row, "status") || Object.hasOwn(row, "sim"))) {
+      return subscriberStatusAnswer([row], { total: 1 }, intent);
+    }
+  }
+  const summary = object(body?.summary);
+  if (measured(summary?.total)) {
+    const data = object(body?.data) ?? body;
+    const collections = [["subscriberList", "subscribers"], ["template", "package templates"], ["prepaidPackageTemplate", "package templates"], ["reseller", "resellers"], ...OCS_LIST_KEYS.packages.map((key) => [key, "packages"]), ["zone", "zones"]];
+    const found = collections.find(([key]) => Array.isArray(data?.[key]));
+    const noun = found?.[1] ?? (tool === "list_subscribers" ? "subscribers" : tool === "list_package_templates" ? "package templates" : tool === "list_subscriber_packages" ? "packages" : "items");
+    const rows2 = found ? data?.[found[0]] : void 0;
+    if (noun === "subscribers" && !countOnly && /\b(status|statuses)\b/i.test(intent)) return subscriberStatusAnswer(rows2, summary, intent);
+    const lines = [`Carrier reports ${summary.total} ${noun} in this result.`];
+    for (const [key, count] of Object.entries(object(summary.nested) ?? {})) {
+      if (key === "accounts" && measured(count)) lines.push(`${count} accounts reported inside the result.`);
+    }
+    if (summary.moreAvailable === true) lines.push("More results are available; this is not a complete fleet total.");
+    if (measured(summary.upstreamTotal)) lines.push(`Upstream reports ${summary.upstreamTotal} matches before paging.`);
+    for (const [key, value2] of Object.entries(object(summary.breakdown) ?? {})) {
+      const counts = object(object(value2)?.counts);
+      const entries = Object.entries(counts ?? {}).filter(([name, n]) => measured(n) && safeFacet(key, name));
+      if (entries.length) lines.push(`${label(key)} (server-reported): ${entries.map(([k, n]) => `${k}: ${n}`).join(", ")}.`);
+    }
+    if (rows2) {
+      if (rows2.length < summary.total) lines.push(`Only ${rows2.length} of the reported ${summary.total} rows are present in the response; the remaining details are unavailable.`);
+      if (countOnly) return bound(lines.join("\n"));
+      if (noun === "subscribers") {
+        for (const value2 of rows2.slice(0, MAX_ROWS)) {
+          const line = subscriberLine(value2);
+          if (line) lines.push(line);
+        }
+      } else if (found?.[0] === "reseller") {
+        const accounts = projectResellerAccounts(rows2);
+        lines.push(...facts(accounts.length ? accounts : rows2));
+      } else if (found?.[0] === "template" || found?.[0] === "prepaidPackageTemplate") {
+        lines.push(...facts(projectPackageTemplates(rows2) ?? rows2));
+      } else lines.push(...facts(rows2));
+      if (rows2.length > MAX_ROWS && noun === "subscribers") lines.push(`Showing ${MAX_ROWS} of ${rows2.length} returned rows. ${RAW_HINT}`);
+    } else lines.push("Row details were not returned.");
+    return bound(lines.join("\n"));
+  }
+  if (value === null) return "No result data was returned.";
+  if (typeof value !== "object") return bound(`Carrier returned: ${String(value)}`);
+  if (tool === "fleet_health_app" && body) {
+    return bound(["Carrier returned these fleet facts:", ...recordFacts(body, FLEET_FIELDS, false)].join("\n"));
+  }
+  return bound(["Carrier returned these facts (not an inferred answer):", ...facts(value)].join("\n"));
+}
+var UNSUPPORTED = `Carrier cannot safely interpret unsupported result fields or shapes. ${RAW_HINT}`;
+var INTELLIGENCE_TOOLS = /* @__PURE__ */ new Set(["optimize_package", "churn_risk", "fleet_health", "fleet_health_app"]);
+var FLEET_FIELDS = {
+  utilization: "number",
+  totalActive: "number",
+  totalSuspended: "number",
+  totalInventory: "number",
+  totalOther: "number",
+  totalAccounts: "number",
+  lowBalanceCount: "number"
+};
+var FIELD_TYPES = {
+  name: "string",
+  description: "string",
+  detail: "string",
+  currency: "string",
+  status: "string",
+  balance: "money",
+  amount: "money",
+  price: "money",
+  dataLimit: "number",
+  dataUsed: "number",
+  expirationDate: "string",
+  startDate: "string",
+  endDate: "string",
+  useddatabyte: "number",
+  pckdatabyte: "number",
+  tsexpirationutc: "string",
+  recurring: "boolean",
+  active: "boolean",
+  enabled: "boolean",
+  id: "scalar",
+  accountId: "scalar",
+  resellerId: "scalar",
+  templateId: "scalar",
+  packageId: "scalar",
+  zoneId: "scalar",
+  subscriberId: "scalar",
+  // Live listPrepaidPackageTemplate rows use these wire names, not templateId.
+  prepaidpackagetemplateid: "scalar",
+  prepaidpackagetemplatename: "string",
+  resellerid: "scalar",
+  locationzoneid: "scalar",
+  // listResellerAccount account rows. packageOnly is a boolean on the live shape.
+  packageOnly: "boolean"
+};
+function inline(value) {
+  return sanitizeAskText(String(value)).replace(/[\r\n\t]+/g, " ");
+}
+function sanitizeAskText(text3) {
+  return text3.replace(/(?:\x1b\]|\x9d)[\s\S]*?(?:\x07|\x1b\\|\x9c|$)/g, "").replace(/(?:\x1b[P^_X]|[\x90\x98\x9e\x9f])[\s\S]*?(?:\x1b\\|\x9c|$)/g, "").replace(/(?:\x1b\[|\x9b)[0-?]*[ -/]*[@-~]/g, "").replace(/\x1b[ -/]*[@-~]/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "");
+}
+function label(key) {
+  const words = key.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]/g, " ");
+  return words.charAt(0).toUpperCase() + words.slice(1);
+}
+function recordFacts(record2, fields = FIELD_TYPES, warnUnknown = true) {
+  const lines = [];
+  let unsupported = false;
+  for (const [key, value] of Object.entries(record2)) {
+    const expected = Object.hasOwn(fields, key) ? fields[key] : void 0;
+    const valid = expected === "scalar" ? typeof value === "string" || typeof value === "number" && Number.isFinite(value) : expected === "money" ? typeof value === "number" && Number.isFinite(value) || typeof value === "string" && /^[+-]?\d+(?:\.\d+)?$/.test(value) && Number.isFinite(Number(value)) : typeof value === expected && (expected !== "number" || Number.isFinite(value));
+    if (!expected || !valid) {
+      if (warnUnknown || expected) unsupported = true;
+      continue;
+    }
+    lines.push(`${label(key)}: ${typeof value === "boolean" ? String(value) : inline(value)}`);
+  }
+  if (unsupported) lines.push(UNSUPPORTED);
+  return lines.length ? lines : ["No result fields were returned."];
+}
+var TEMPLATE_WIRE_FIELDS = ["prepaidpackagetemplateid", "prepaidpackagetemplatename", "resellerid", "locationzoneid"];
+var ACCOUNT_WIRE_FIELDS = ["id", "name", "balance", "packageOnly"];
+function projectResellerAccounts(rows2) {
+  const accounts = [];
+  for (const row of rows2) {
+    const reseller = object(row);
+    if (!reseller || !Array.isArray(reseller.account)) continue;
+    for (const item of reseller.account) {
+      const account = object(item);
+      if (!account) continue;
+      const projected = {};
+      if (typeof reseller.id === "number" && Number.isFinite(reseller.id)) projected.resellerId = reseller.id;
+      for (const key of ACCOUNT_WIRE_FIELDS) {
+        if (Object.hasOwn(account, key)) projected[key] = account[key];
+      }
+      accounts.push(projected);
+    }
+  }
+  return accounts;
+}
+function projectPackageTemplates(rows2) {
+  const projected = [];
+  for (const row of rows2) {
+    const record2 = object(row);
+    if (!record2) return void 0;
+    const wire = Object.hasOwn(record2, "prepaidpackagetemplateid") || Object.hasOwn(record2, "prepaidpackagetemplatename");
+    if (!wire) return void 0;
+    const next = {};
+    for (const key of TEMPLATE_WIRE_FIELDS) {
+      if (Object.hasOwn(record2, key)) next[key] = record2[key];
+    }
+    projected.push(next);
+  }
+  return projected;
+}
+function facts(value) {
+  if (Array.isArray(value)) {
+    if (!value.length) return ["No items were returned."];
+    const lines2 = value.slice(0, MAX_ROWS).flatMap((row, i) => {
+      const record3 = object(row);
+      return record3 ? [`Item ${i + 1}: ${recordFacts(record3).join("; ")}`] : [UNSUPPORTED];
+    });
+    if (value.length > MAX_ROWS) lines2.push(`Showing ${MAX_ROWS} of ${value.length} returned rows. ${RAW_HINT}`);
+    return lines2;
+  }
+  const record2 = object(value);
+  if (!record2) return [UNSUPPORTED];
+  const outer = Object.fromEntries(Object.entries(record2).filter(([key]) => !["account", "result", "data"].includes(key)));
+  const lines = Object.keys(outer).length ? recordFacts(outer) : [];
+  for (const key of ["account", "result", "data"]) {
+    if (!Object.hasOwn(record2, key)) continue;
+    const inner = object(record2[key]);
+    if (inner) lines.push(`${label(key)}:`, ...recordFacts(inner));
+    else if (key === "account" && Array.isArray(record2[key])) {
+      const accounts = record2[key];
+      lines.push(...facts(accounts));
+    } else lines.push(UNSUPPORTED);
+  }
+  return lines.length ? lines : ["No result fields were returned."];
 }
 
 // src/cli/lib/ask.ts
@@ -863,7 +1470,7 @@ function parseRpcBody(raw) {
   return JSON.parse(dataLine.slice(5).trim());
 }
 async function callMcpTool(tool, args, opts = {}) {
-  const token = resolveCliToken() ?? await getAccessToken();
+  const token = (resolveExplicitCredential({ allowOcs: true }) ?? await resolveCredential({ allowOcs: true }))?.token;
   if (!token) {
     return {
       ok: false,
@@ -890,7 +1497,7 @@ async function callMcpTool(tool, args, opts = {}) {
   });
   const signal = controller.signal;
   try {
-    return await Promise.race([
+    const result = await Promise.race([
       (async () => {
         const initRes = await fetch(MCP_URL, {
           method: "POST",
@@ -973,6 +1580,7 @@ async function callMcpTool(tool, args, opts = {}) {
       })(),
       deadline
     ]);
+    return redactCredential(result, token);
   } catch (e) {
     if (isTimeoutish(e)) {
       const secs = Math.round(timeoutMs / 1e3);
@@ -990,7 +1598,7 @@ async function callMcpTool(tool, args, opts = {}) {
         )
       };
     }
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = redact((e instanceof Error ? e.message : String(e)).split(token).join("***"));
     return {
       ok: false,
       text: withNextStep(`Could not reach MCP: ${msg}`, [
@@ -1019,11 +1627,24 @@ function parseRouting(text3) {
     return void 0;
   }
 }
-async function carrierAsk(intent) {
+function readableAskError(result) {
+  try {
+    const body = JSON.parse(result.text);
+    const message = body.error ?? body.message;
+    if (typeof message === "string") return { ...result, text: message };
+  } catch {
+  }
+  return result;
+}
+async function carrierAsk(intent, opts = {}) {
+  const result = await routeAsk(intent, opts);
+  return opts.json ? result : { ...result, text: sanitizeAskText(result.text) };
+}
+async function routeAsk(intent, opts) {
   const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
   if (!routed.ok) return routed;
   const routing = parseRouting(routed.text);
-  if (!routing) return routed;
+  if (!routing) return opts.json ? routed : { ...routed, text: formatAskAnswer(routed.text, "carrier_ask", routed.structured, intent) };
   if (!routing.resolved_tool) {
     const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
     return {
@@ -1049,13 +1670,16 @@ async function carrierAsk(intent) {
     return {
       ok: false,
       text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
-        `Params: ${JSON.stringify(args)}`,
+        `Params: ${JSON.stringify(args, (_k, v) => typeof v === "string" ? sanitizeAskText(v) : v)}`,
         "Run the matching discrete command so every flag is explicit and reviewable",
         "carrier --help lists every domain"
       ])
     };
   }
-  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
+  const result = await callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
+  if (opts.json) return result;
+  if (!result.ok) return readableAskError(result);
+  return { ...result, text: formatAskAnswer(result.text, tool, result.structured, intent) };
 }
 
 // src/cli/lib/rest.ts
@@ -1063,9 +1687,6 @@ var DEFAULT_ERROR_HINTS2 = [
   "Re-check the arguments: carrier <domain> <command> --help",
   "Or open Claude and ask there with full tool routing"
 ];
-function resolveApiKey() {
-  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
-}
 function ocsTokenOnly() {
   return Boolean(
     process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
@@ -1114,7 +1735,7 @@ function orgNotConnected(raw) {
   }
 }
 async function callRestEndpoint(method, path, args, opts = {}) {
-  const token = resolveApiKey() ?? await getAccessToken();
+  const token = (await resolveCredential())?.token;
   if (!token) {
     return {
       ok: false,
@@ -1158,7 +1779,7 @@ async function callRestEndpoint(method, path, args, opts = {}) {
       signal: controller.signal,
       body: sendsBody ? JSON.stringify(rest) : void 0
     });
-    const raw = await res.text();
+    const raw = (await res.text()).split(token).join("***");
     if (res.status === 202) {
       let confirmToken;
       let expires;
@@ -1225,7 +1846,7 @@ async function callRestEndpoint(method, path, args, opts = {}) {
         ])
       };
     }
-    const msg = e instanceof Error ? e.message : String(e);
+    const msg = (e instanceof Error ? e.message : String(e)).split(token).join("***");
     return {
       ok: false,
       text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
@@ -1248,9 +1869,9 @@ var NAME_TO_CODE = /* @__PURE__ */ new Map();
 for (let first = 65; first <= 90; first += 1) {
   for (let second = 65; second <= 90; second += 1) {
     const code = String.fromCharCode(first, second);
-    const label = regionLabel(code);
-    if (!label) continue;
-    const key = label.toLowerCase();
+    const label2 = regionLabel(code);
+    if (!label2) continue;
+    const key = label2.toLowerCase();
     const current = NAME_TO_CODE.get(key);
     if (!current || PREFERRED.has(code)) NAME_TO_CODE.set(key, code);
   }
@@ -1382,9 +2003,9 @@ function logoMime(bytes) {
 function regionLabel(code) {
   if (!/^[A-Z]{2}$/.test(code)) return void 0;
   try {
-    const label = regionNames.of(code);
-    if (!label || label.toUpperCase() === code) return void 0;
-    return label;
+    const label2 = regionNames.of(code);
+    if (!label2 || label2.toUpperCase() === code) return void 0;
+    return label2;
   } catch {
     return void 0;
   }
@@ -1505,9 +2126,9 @@ function storefrontPlanBody(input) {
 function isStorefrontPlanError(value) {
   return value !== null && "error" in value;
 }
-function parseWholeNumber(value, label) {
+function parseWholeNumber(value, label2) {
   if (value === void 0) return { ok: true, value: void 0 };
-  if (!/^\d+$/.test(value)) return { ok: false, message: `${label} must be a whole number.` };
+  if (!/^\d+$/.test(value)) return { ok: false, message: `${label2} must be a whole number.` };
   return { ok: true, value: Number(value) };
 }
 function overlay(base, input, fields) {
@@ -1734,7 +2355,7 @@ function record(value) {
 }
 
 // src/cli/lib/resend.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 import { createServer as createServer2 } from "http";
 var RESEND_API = "https://api.resend.com";
 var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
@@ -1752,7 +2373,7 @@ function base64url2(input) {
 }
 function pkcePair2() {
   const verifier = base64url2(randomBytes2(64));
-  return { verifier, challenge: base64url2(createHash2("sha256").update(verifier).digest()) };
+  return { verifier, challenge: base64url2(createHash3("sha256").update(verifier).digest()) };
 }
 function buildAuthorizeUrl(opts) {
   const url = new URL(`${RESEND_API}/oauth/authorize`);
@@ -1900,9 +2521,9 @@ async function startLoopbackServer() {
       error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
     );
   });
-  await new Promise((resolve3, reject) => {
+  await new Promise((resolve5, reject) => {
     server.once("error", reject);
-    server.listen(0, REDIRECT_HOST, resolve3);
+    server.listen(0, REDIRECT_HOST, resolve5);
   });
   const port = server.address().port;
   const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
@@ -1910,12 +2531,12 @@ async function startLoopbackServer() {
     redirectUri,
     close: () => server.close(),
     waitForCode(state, timeoutMs) {
-      return new Promise((resolve3) => {
+      return new Promise((resolve5) => {
         const done = (r) => {
           clearTimeout(timer);
           resolveCode = null;
           server.close();
-          resolve3(r);
+          resolve5(r);
         };
         const timer = setTimeout(
           () => done({ ok: false, reason: "Timed out waiting for the browser." }),
@@ -2189,6 +2810,217 @@ function buildDashScreen(domain, payload) {
   }
 }
 
+// src/cli/lib/status.ts
+import { homedir as homedir4 } from "os";
+import { join as join8 } from "path";
+
+// src/cli/lib/mcp-url.ts
+var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
+var PRODUCTION_HOST = "mcp.carrier.llc";
+var URL_TOKEN = /https?:\/\/[^\s"'<>)]+/g;
+function pathWithoutTrailingSlash(pathname) {
+  let end = pathname.length;
+  while (end > 1 && pathname.charCodeAt(end - 1) === 47) end -= 1;
+  return pathname.slice(0, end);
+}
+function parseHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isProductionMcpUrl(value) {
+  if (value === PRODUCTION_MCP_URL) return true;
+  const parsed = parseHttpUrl(value);
+  if (!parsed || parsed.protocol !== "https:" || parsed.hostname !== PRODUCTION_HOST) return false;
+  return pathWithoutTrailingSlash(parsed.pathname) === "/mcp";
+}
+function isCarrierMcpHost(value) {
+  const parsed = parseHttpUrl(value);
+  return parsed?.protocol === "https:" && parsed.hostname === PRODUCTION_HOST;
+}
+function trimTrailingPunctuation(token) {
+  let end = token.length;
+  while (end > 0) {
+    const code = token.charCodeAt(end - 1);
+    if (code !== 46 && code !== 44 && code !== 59 && code !== 58) break;
+    end -= 1;
+  }
+  return token.slice(0, end);
+}
+function lineMentionsProductionMcp(line) {
+  const tokens = line.match(URL_TOKEN);
+  if (!tokens) return false;
+  for (const token of tokens) {
+    if (isProductionMcpUrl(trimTrailingPunctuation(token))) return true;
+  }
+  return false;
+}
+
+// src/cli/lib/status.ts
+function rankHit(name, url) {
+  let rank = 0;
+  if (name.toLowerCase() === MCP_NAME) rank += 100;
+  else if (/^carrier[-_]?/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 40;
+  else if (/carrier/i.test(name) && !/test|staging|stg|dev|local/i.test(name)) rank += 20;
+  else if (/carrier/i.test(name)) rank += 5;
+  if (isProductionMcpUrl(url)) rank += 50;
+  else if (isCarrierMcpHost(url)) rank += 25;
+  return rank;
+}
+function scanMcpServers(servers) {
+  if (!servers || typeof servers !== "object") return null;
+  let best = null;
+  for (const [name, entry] of Object.entries(servers)) {
+    if (!/carrier/i.test(name) && !(typeof entry?.url === "string" && /carrier\.llc/i.test(entry.url))) {
+      continue;
+    }
+    const url = typeof entry?.url === "string" ? entry.url : "";
+    const rank = rankHit(name, url);
+    if (rank < 20 && !isCarrierMcpHost(url)) {
+      continue;
+    }
+    const urlMatches = isProductionMcpUrl(url);
+    const hit = {
+      registered: true,
+      urlMatches,
+      detail: url ? `${name}: ${url}` : `${name}: ${entry?.command ?? "configured"}`,
+      rank
+    };
+    if (!best || hit.rank > best.rank) best = hit;
+  }
+  return best;
+}
+async function probeMcpFromConfig() {
+  const candidates = [
+    join8(homedir4(), ".claude.json"),
+    join8(claudeHome(), "settings.json"),
+    join8(claudeHome(), ".mcp.json"),
+    join8(process.cwd(), ".mcp.json")
+  ];
+  let best = null;
+  let configSeen = false;
+  for (const file of candidates) {
+    if (!await exists(file)) continue;
+    try {
+      const json = JSON.parse(await readFile(file, "utf8"));
+      configSeen = true;
+      const direct = scanMcpServers(json.mcpServers);
+      if (direct && (!best || direct.rank > best.rank)) best = direct;
+      if (json.projects) {
+        for (const proj of Object.values(json.projects)) {
+          const hit = scanMcpServers(proj?.mcpServers);
+          if (hit && (!best || hit.rank > best.rank)) best = hit;
+        }
+      }
+    } catch {
+    }
+  }
+  if (!best) return { hit: null, configSeen };
+  return {
+    hit: { registered: best.registered, urlMatches: best.urlMatches, detail: best.detail },
+    configSeen
+  };
+}
+async function probeMcpRegistration() {
+  const { hit, configSeen } = await probeMcpFromConfig();
+  if (hit) return hit;
+  if (configSeen) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "carrier not registered (no production MCP URL in Claude config)"
+    };
+  }
+  const claudeFound = await which("claude");
+  if (!claudeFound) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "claude CLI not on PATH"
+    };
+  }
+  const r = await run("claude", ["mcp", "list"], { timeoutMs: 5e3 });
+  const out = `${r.stdout}
+${r.stderr}`;
+  if (!r.ok && !out.trim()) {
+    return { registered: false, urlMatches: false, detail: "claude mcp list failed or timed out" };
+  }
+  if (/timeout after/i.test(r.stderr) && !/carrier/i.test(out)) {
+    return {
+      registered: false,
+      urlMatches: false,
+      detail: "claude mcp list timed out \u2014 run `claude mcp list` manually"
+    };
+  }
+  const lines = out.split("\n").map((l) => l.trim()).filter(Boolean);
+  const carrierLine = lines.find((l) => new RegExp(`^${MCP_NAME}\\s*:`, "i").test(l)) ?? lines.find((l) => /carrier/i.test(l) && /mcp\.carrier\.llc/i.test(l));
+  if (!carrierLine) {
+    return { registered: false, urlMatches: false, detail: "carrier not in claude mcp list" };
+  }
+  const urlMatches = lineMentionsProductionMcp(carrierLine);
+  return { registered: true, urlMatches, detail: carrierLine.slice(0, 200) };
+}
+function buildNextSteps(s) {
+  const steps = [];
+  if (!s.claudeFound) {
+    steps.push("Install Claude Code (https://claude.ai/code), then re-run: carrier plugin install");
+  } else if (!s.pluginInstalled) {
+    steps.push("Install the Carrier plugin: carrier plugin install");
+  } else if (!s.mcpRegistered) {
+    steps.push(`Register the zero-cred MCP URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
+  } else if (!s.mcpUrlMatches) {
+    steps.push(`Update MCP to production URL: claude mcp add --transport http ${MCP_NAME} ${MCP_URL}`);
+  }
+  if (s.mcpRegistered || s.pluginInstalled) {
+    steps.push(
+      "Talk to your fleet in Claude \u2014 first tool call opens Clerk OAuth (Google / GitHub / email). No API token needed."
+    );
+  } else {
+    steps.push("Create a free account (browser): carrier open signup");
+    steps.push("Or sign in: carrier open signin");
+  }
+  if (!s.tokenPresent) {
+    steps.push(
+      "Headless: carrier login, or refresh compatible Carrier OAuth in Claude. Export to a child terminal: carrier exec -- bash."
+    );
+  } else {
+    steps.push('Try a natural-language fleet query: carrier ask "show fleet health"');
+  }
+  steps.push("Scaffold a white-label storefront anytime: carrier site create");
+  return steps;
+}
+async function gatherStatus() {
+  const [plugin2, mcp, claudeFound] = await Promise.all([
+    pluginStatus(),
+    probeMcpRegistration(),
+    which("claude")
+  ]);
+  const credential = await resolveCredential({ allowOcs: true });
+  const token = { present: !!credential, kind: credential?.kind ?? "none" };
+  let authMode = "none";
+  if (token.kind === "oauth") authMode = "oauth";
+  else if (token.kind === "api-key") authMode = "api-key";
+  else if (token.kind === "ocs-token") authMode = "ocs-token";
+  else if (mcp.registered || plugin2.installed) authMode = "oauth-first-use";
+  const base = {
+    pluginInstalled: plugin2.installed,
+    pluginVersion: plugin2.version,
+    pluginDir: plugin2.dir,
+    claudeFound,
+    mcpRegistered: mcp.registered,
+    mcpUrlMatches: mcp.urlMatches,
+    mcpDetail: mcp.detail,
+    tokenPresent: token.present,
+    tokenKind: token.kind,
+    authMode
+  };
+  return { ...base, nextSteps: buildNextSteps(base) };
+}
+
 // src/cli/lib/home.ts
 import * as p from "@clack/prompts";
 import pc2 from "picocolors";
@@ -2207,19 +3039,19 @@ async function showHomeStatus() {
   printStatus(st);
   return st;
 }
-async function openAndReport(url, label) {
+async function openAndReport(url, label2) {
   const r = await openUrl(url);
   if (r.ok) p.log.success(r.hint);
   else {
     p.log.warn(r.hint);
-    p.note(url, label);
+    p.note(url, label2);
   }
 }
 async function runHome(opts) {
   let st = await showHomeStatus();
   p.note(oauthFirstUseNote(), "How auth works");
   for (; ; ) {
-    const hasToken = !!resolveCliToken();
+    const hasToken = !!await resolveCredential({ allowOcs: true });
     const choice = await p.select({
       message: "What do you want to do?",
       options: [
@@ -2255,8 +3087,8 @@ async function runHome(opts) {
         },
         {
           value: "ask",
-          label: hasToken ? "Ask the fleet (carrier ask)" : "Ask the fleet (needs CARRIER_API_KEY)",
-          hint: hasToken ? "Uses env token" : "Optional headless path"
+          label: hasToken ? "Ask the fleet (carrier ask)" : "Ask the fleet (sign-in needed)",
+          hint: hasToken ? "Uses Carrier credential" : "Run carrier login"
         },
         {
           value: "site",
@@ -2294,8 +3126,8 @@ async function runHome(opts) {
         p.log.info("Link OCS credentials (BYO) or finish managed setup, then use Claude MCP.");
         break;
       case "ask": {
-        if (!resolveCliToken()) {
-          p.log.warn("No CARRIER_API_KEY / OCS token in env.");
+        if (!await resolveCredential({ allowOcs: true })) {
+          p.log.warn("No usable Carrier credential. Run carrier login or refresh Carrier OAuth in Claude.");
           p.note(
             [
               "Interactive (recommended): install MCP, open Claude, ask in plain English.",
@@ -2317,7 +3149,7 @@ async function runHome(opts) {
         spin.start("Asking Carrier MCP\u2026");
         const result = await carrierAsk(String(intent).trim());
         spin.stop(result.ok ? "Answer" : "Could not complete ask");
-        if (result.ok) p.note(result.text.slice(0, 4e3), "carrier ask");
+        if (result.ok) p.note(result.text, "carrier ask");
         else p.log.error(result.text);
         break;
       }
@@ -2330,6 +3162,68 @@ async function runHome(opts) {
   }
 }
 
+// src/cli/lib/credential-exec.ts
+import { spawn as spawn3 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { constants as constants3 } from "os";
+import { writeSync, fstatSync } from "fs";
+async function credentialHandoff() {
+  try {
+    const stat = fstatSync(3);
+    if (!stat.isFIFO() && !stat.isSocket()) throw new Error("unsafe fd");
+    const credential = await resolveCredential();
+    if (!credential) throw new Error("no credential");
+    const fields = [credential.token, credential.origin ?? "explicit", String(credential.expiresAt ?? 0), credential.kind === "oauth" ? createHash4("sha256").update(credential.token).digest("hex") : "-", credential.binding ?? "-"];
+    if (fields.some((field) => /[\r\n\0]/.test(field))) throw new Error("unsafe field");
+    const data = Buffer.from(`${fields.join("\n")}
+`);
+    let offset = 0;
+    while (offset < data.length) offset += writeSync(3, data, offset, data.length - offset);
+    return 0;
+  } catch {
+    console.error("Carrier credential handoff unavailable; use the static shell integration with a usable owner session.");
+    return 1;
+  }
+}
+async function credentialExec(command, args) {
+  const credential = await resolveCredential();
+  if (!credential) {
+    console.error("No usable Carrier credential. Run carrier login, or refresh Carrier OAuth in Claude. See carrier exec --help.");
+    return 1;
+  }
+  const env = { ...process.env, CARRIER_API_KEY: credential.token };
+  if (credential.kind === "oauth") {
+    env.CARRIER_OAUTH_HANDOFF = createHash4("sha256").update(credential.token).digest("hex");
+    env.CARRIER_OAUTH_ORIGIN = credential.origin;
+    env.CARRIER_OAUTH_BINDING = credential.binding;
+    env.CARRIER_OAUTH_EXPIRES_AT = String(credential.expiresAt);
+  } else {
+    delete env.CARRIER_OAUTH_HANDOFF;
+    delete env.CARRIER_OAUTH_BINDING;
+    delete env.CARRIER_OAUTH_ORIGIN;
+    delete env.CARRIER_OAUTH_EXPIRES_AT;
+  }
+  return new Promise((resolve5) => {
+    const child = spawn3(command, args, { env, stdio: "inherit", shell: false });
+    const forward = (signal) => {
+      child.kill(signal);
+    };
+    const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+    const handlers = signals.map((signal) => () => forward(signal));
+    signals.forEach((signal, i) => process.on(signal, handlers[i]));
+    const cleanup = () => signals.forEach((signal, i) => process.removeListener(signal, handlers[i]));
+    child.once("error", () => {
+      cleanup();
+      console.error("Could not start the requested command.");
+      resolve5(1);
+    });
+    child.once("close", (code, signal) => {
+      cleanup();
+      resolve5(code ?? (signal ? 128 + (constants3.signals[signal] ?? 1) : 1));
+    });
+  });
+}
+
 // src/cli/lib/signup.ts
 var DEFAULT_MAX_CODE_ATTEMPTS = 3;
 function parseEnvironment(raw) {
@@ -5143,7 +6037,7 @@ function formatJsonOutput(text3) {
   }
 }
 async function runCapability(domain, cmd, opts) {
-  const label = `${domain.name} ${cmd.name}`;
+  const label2 = `${domain.name} ${cmd.name}`;
   const quiet = opts.json === true;
   const { args, errors, notes } = buildToolArgs(cmd, opts);
   if (cmd.write && opts.commit === true) delete args.dry_run;
@@ -5151,9 +6045,9 @@ async function runCapability(domain, cmd, opts) {
     errors.push(`${capabilityTarget(cmd)} has no preview mode. Pass --confirm to run it for real.`);
   }
   if (errors.length) {
-    const message = withNextStep(`Cannot run \`carrier ${label}\`.`, [
+    const message = withNextStep(`Cannot run \`carrier ${label2}\`.`, [
       ...errors,
-      `See every flag: carrier ${label} --help`
+      `See every flag: carrier ${label2} --help`
     ]);
     if (quiet) console.error(message);
     else p2.log.error(message);
@@ -5169,7 +6063,7 @@ async function runCapability(domain, cmd, opts) {
     ].join("\n");
     if (quiet) process.stdout.write(`${formatJsonOutput(preview)}
 `);
-    else p2.note(preview, `carrier ${label}`);
+    else p2.note(preview, `carrier ${label2}`);
     return;
   }
   const dryRun = cmd.write === true && args.dry_run === true;
@@ -5180,7 +6074,7 @@ async function runCapability(domain, cmd, opts) {
   }
   const target = capabilityTarget(cmd);
   const errorHints = [
-    `Check the arguments: carrier ${label} --help`,
+    `Check the arguments: carrier ${label2} --help`,
     'Or describe the task in words: carrier ask "\u2026"'
   ];
   const s = quiet ? null : p2.spinner();
@@ -5593,7 +6487,7 @@ async function interactiveSiteCreate() {
     defaultValue: "./storefront"
   });
   if (p3.isCancel(dir)) return;
-  const target = resolve2(dir);
+  const target = resolve4(dir);
   if (await exists(target)) {
     const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
     if (p3.isCancel(go) || !go) {
@@ -5605,6 +6499,20 @@ async function interactiveSiteCreate() {
   p3.outro(pc4.green(`Scaffolded. cd ${dir} && pnpm install && pnpm dev`));
 }
 var program = new Command();
+program.command("credential-handoff").description("Private FD protocol for the explicitly sourced static shell integration; never stdout.").action(async () => {
+  process.exitCode = await credentialHandoff();
+});
+program.command("shell-path").description("Print the static integration file path, without credentials or startup edits.").argument("<shell>", "bash or zsh").action((shell) => {
+  if (shell !== "bash" && shell !== "zsh") {
+    console.error("Supported shells: bash, zsh.");
+    process.exitCode = 1;
+    return;
+  }
+  console.log(resolve4(packageRoot(), "shell", `carrier.${shell}`));
+});
+program.command("exec").description("Run a command/child shell with CARRIER_API_KEY securely in its environment.").argument("<command>", "Executable to start (use -- before the command)").argument("[args...]", "Arguments passed without shell interpolation").addHelpText("after", "\nExamples: carrier exec -- bash\n          carrier exec -- your-headless-job\nOAuth snapshots expire; Carrier commands refresh their owner per call. Exit the child shell after logout. This never changes the existing parent shell or prints a token.").action(async (command, args) => {
+  process.exitCode = await credentialExec(command, args);
+});
 program.name("carrier").description(
   [
     "Carrier CLI \u2014 status, OAuth-ready MCP install, storefront scaffold, and fleet control.",
@@ -5624,7 +6532,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
   if (o.yes) {
     await doPluginInstall();
     const brand = CARRIER_BRAND;
-    const target = resolve2(o.dir);
+    const target = resolve4(o.dir);
     if (await exists(target)) {
       info(pc4.yellow(`${target} exists \u2014 writing into it (--yes).`));
     }
@@ -5649,7 +6557,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
     printStatus(st);
     await doPluginInstall();
     const brand = await promptBrand(CARRIER_BRAND);
-    const target = resolve2(o.dir);
+    const target = resolve4(o.dir);
     if (await exists(target)) {
       const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
       if (p3.isCancel(go) || !go) {
@@ -5690,7 +6598,7 @@ program.command("init").description("Interactive home: status, install plugin+MC
     onInstall: doPluginInstall,
     onSiteCreate: async () => {
       const brand = await promptBrand(CARRIER_BRAND);
-      const target = resolve2(o.dir);
+      const target = resolve4(o.dir);
       if (await exists(target)) {
         const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
         if (p3.isCancel(go) || !go) {
@@ -5765,7 +6673,7 @@ program.command("login").description("Sign in from this terminal. Opens a browse
       return;
     }
     p3.note(
-      [`Scope: ${r.scope ?? "read write"}`, "", "Try it: carrier intelligence fleet-health"].join("\n"),
+      [`Scope: ${r.scope ?? "read write"}`, "", "Try it: carrier intelligence fleet-health", 'Existing shell: source "$(carrier shell-path bash)"; carrier_auth_export', "Child terminal: carrier exec -- bash"].join("\n"),
       "Signed in"
     );
   } catch (e) {
@@ -5980,8 +6888,8 @@ program.command("examples").description("Print natural-language fleet prompts fo
 });
 program.command("ask").description(
   'Natural-language fallback for whatever the domain commands miss: carrier ask "show fleet health" (needs CARRIER_API_KEY or OCS token).'
-).argument("<intent...>", "Natural-language intent").action(async (parts) => {
-  header();
+).argument("<intent...>", "Natural-language intent").option("--json", "Print the complete raw tool result (may contain sensitive data)").action(async (parts, opts) => {
+  if (!opts.json) header();
   const intent = parts.join(" ").trim();
   if (!intent) {
     fail("Missing intent.", [
@@ -5991,12 +6899,27 @@ program.command("ask").description(
     process.exitCode = 1;
     return;
   }
-  const s = p3.spinner();
-  s.start("Asking Carrier MCP\u2026");
-  const result = await carrierAsk(intent);
-  s.stop(result.ok ? "Done" : "Failed");
+  const s = opts.json ? void 0 : p3.spinner();
+  s?.start("Asking Carrier MCP\u2026");
+  const result = await carrierAsk(intent, opts);
+  s?.stop(result.ok ? "Done" : "Failed");
+  if (opts.json) {
+    if (result.ok) {
+      let raw = result.text;
+      try {
+        JSON.parse(raw);
+      } catch {
+        raw = JSON.stringify(raw);
+      }
+      process.stdout.write(raw + "\n");
+    } else {
+      process.stderr.write(result.text + "\n");
+      process.exitCode = 1;
+    }
+    return;
+  }
   if (result.ok) {
-    p3.note(result.text.slice(0, 6e3), "Answer");
+    p3.note(result.text, "Answer");
     p3.outro("");
   } else {
     p3.log.error(result.text);
@@ -6133,7 +7056,7 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
   } else if (!o.yes) {
     brand = await promptBrand(CARRIER_BRAND);
   }
-  const target = resolve2(dir ?? "./storefront");
+  const target = resolve4(dir ?? "./storefront");
   if (await exists(target)) {
     const go = await p3.confirm({ message: `${target} exists \u2014 write into it anyway?`, initialValue: false });
     if (p3.isCancel(go) || !go) {
@@ -6158,7 +7081,7 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
 site.command("deploy [dir]").description("Build + deploy a storefront to whichever host is available on this box.").option("--name <name>", "Project/worker name (defaults from brand)").option("--force", "Deploy under the scaffold default name anyway (acknowledges the overwrite risk)").option(`--target <target>`, `Force a host: ${TARGET_IDS.join(" | ")}`).option("--no-secrets", "Skip staging runtime secrets on the host").option("--clerk", "Provision and configure Clerk before building").option("--no-verify", "Skip the post-deploy check that the site actually serves").option("--autofix-agent", "On an unrecognised failure, print an agent-ready diagnosis bundle").option("--domain", "Route the brand domain to the deployment (Cloudflare provisions DNS + cert)").action(
   async (dir, o) => {
     header();
-    const target = resolve2(dir ?? "./storefront");
+    const target = resolve4(dir ?? "./storefront");
     if (o.target && !isTargetId(o.target)) {
       fail(`Unknown target "${o.target}".`, [`Supported: ${TARGET_IDS.join(", ")}`]);
       process.exitCode = 1;
@@ -6208,7 +7131,7 @@ site.command("publish").description("Publish a Carrier-hosted storefront. Does n
 });
 site.command("targets [dir]").description("Show which deploy hosts are installed, logged in, and ready.").action(async (dir) => {
   header();
-  const storefront = resolve2(dir ?? "./storefront");
+  const storefront = resolve4(dir ?? "./storefront");
   const statuses = await probeAll(storefront);
   const ranked = rankTargets(statuses);
   const rows2 = statuses.map((s) => {
@@ -6225,7 +7148,7 @@ site.command("targets [dir]").description("Show which deploy hosts are installed
 site.command("clerk [dir]").description("Create or discover a Clerk instance and configure it for the storefront.").option("--name <name>", "Application name (defaults from brand)").option("--production", "Also create a production instance (Platform API only)").option("--no-create", "Never create a new application; only reuse existing keys").option("--url <url>", "Deployed URL to whitelist as an origin/redirect").action(
   async (dir, o) => {
     header();
-    const storefront = resolve2(dir ?? "./storefront");
+    const storefront = resolve4(dir ?? "./storefront");
     try {
       const brand = await loadStorefrontBrand(storefront, o.name ? { name: o.name } : void 0);
       const result = await provisionClerk({
@@ -6271,7 +7194,7 @@ site.command("clerk [dir]").description("Create or discover a Clerk instance and
 site.command("email [dir]").description("Connect Resend in the browser so the storefront can email QR codes.").option("--no-browser", "Never open a browser; print the manual steps instead").option("--yes", "Non-interactive: skip rather than wait for a human").option("--timeout <seconds>", "How long to wait for the browser approval", "180").action(
   async (dir, o) => {
     header();
-    const storefront = resolve2(dir ?? "./storefront");
+    const storefront = resolve4(dir ?? "./storefront");
     const interactive = process.stdin.isTTY === true && o.yes !== true;
     try {
       const brand = await loadStorefrontBrand(storefront);
@@ -6329,7 +7252,7 @@ site.command("email [dir]").description("Connect Resend in the browser so the st
 );
 site.command("logo [dir]").description("Generate a storefront logo (SVG always; PNG if an image key is on this box or Carrier).").action(async (dir) => {
   header();
-  const target = resolve2(dir ?? "./storefront");
+  const target = resolve4(dir ?? "./storefront");
   try {
     const brand = await loadStorefrontBrand(target);
     const logo = await writeStorefrontLogo(target, brand);